otto 1.6.0 → 2.0.0.pre1

data/lib/otto/security/authentication/strategies/permission_strategy.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative '../auth_strategy'
+
+class Otto
+  module Security
+    module Authentication
+      module Strategies
+        # Permission-based authentication strategy
+        class PermissionStrategy < AuthStrategy
+          def initialize(required_permissions, session_key: 'user_permissions')
+            @required_permissions = Array(required_permissions)
+            @session_key = session_key
+          end
+
+          def authenticate(env, requirement)
+            session = env['rack.session']
+            return failure('No session available') unless session
+
+            user_permissions = session[@session_key] || []
+            user_permissions = Array(user_permissions)
+
+            # Create user data from session
+            user_data = { user_permissions: user_permissions, session: session }
+
+            # Extract permission from requirement (e.g., "permission:write" -> "write")
+            required_permission = requirement.split(':', 2).last
+
+            if user_permissions.include?(required_permission)
+              success(user: user_data, user_permissions: user_permissions, required_permission: required_permission)
+            else
+              failure("Insufficient privileges - requires permission: #{required_permission}")
+            end
+          end
+
+          def user_context(env)
+            session = env['rack.session']
+            return {} unless session
+
+            user_permissions = session[@session_key] || []
+            { user_permissions: Array(user_permissions) }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/otto/security/authentication/strategies/public_strategy.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require_relative '../auth_strategy'
+require_relative '../strategy_result'
+
+class Otto
+  module Security
+    module Authentication
+      module Strategies
+        # Public access strategy - always allows access
+        class PublicStrategy < AuthStrategy
+          def authenticate(env, _requirement)
+            Otto::Security::Authentication::StrategyResult.anonymous(metadata: { ip: env['REMOTE_ADDR'] })
+          end
+        end
+      end
+    end
+  end
+end

data/lib/otto/security/authentication/strategies/role_strategy.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require_relative '../auth_strategy'
+
+class Otto
+  module Security
+    module Authentication
+      module Strategies
+        # Role-based authentication strategy
+        class RoleStrategy < AuthStrategy
+          def initialize(allowed_roles, session_key: 'user_roles')
+            @allowed_roles = Array(allowed_roles)
+            @session_key = session_key
+          end
+
+          def authenticate(env, requirement)
+            session = env['rack.session']
+            return failure('No session available') unless session
+
+            user_roles = session[@session_key] || []
+            user_roles = Array(user_roles)
+
+            # Create user data from session
+            user_data = { user_roles: user_roles, session: session }
+
+            # For requirements like "role:admin", extract the role part
+            if requirement.include?(':')
+              required_role = requirement.split(':', 2).last
+              if user_roles.include?(required_role)
+                success(user: user_data, user_roles: user_roles, required_role: required_role)
+              else
+                failure("Insufficient privileges - requires role: #{required_role}")
+              end
+            else
+              # For direct strategy matches, check if user has any of the allowed roles
+              matching_roles = user_roles & @allowed_roles
+              if matching_roles.any?
+                success(user: user_data, user_roles: user_roles, allowed_roles: @allowed_roles,
+                        matching_roles: matching_roles)
+              else
+                failure("Insufficient privileges - requires one of roles: #{@allowed_roles.join(', ')}")
+              end
+            end
+          end
+
+          def user_context(env)
+            session = env['rack.session']
+            return {} unless session
+
+            user_roles = session[@session_key] || []
+            { user_roles: Array(user_roles) }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/otto/security/authentication/strategies/session_strategy.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative '../auth_strategy'
+
+class Otto
+  module Security
+    module Authentication
+      module Strategies
+        # Session-based authentication strategy
+        class SessionStrategy < AuthStrategy
+          def initialize(session_key: 'user_id', session_store: nil)
+            @session_key = session_key
+            @session_store = session_store
+          end
+
+          def authenticate(env, _requirement)
+            session = env['rack.session']
+            return failure('No session available') unless session
+
+            user_id = session[@session_key]
+            return failure('Not authenticated') unless user_id
+
+            # Create a simple user hash for the generic strategy
+            user_data = { id: user_id, user_id: user_id }
+            success(session: session, user: user_data, auth_method: 'session')
+          end
+
+          def user_context(env)
+            session = env['rack.session']
+            return {} unless session
+
+            user_id = session[@session_key]
+            return {} unless user_id
+
+            { user_id: user_id }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/otto/security/authentication/strategy_result.rb

@@ -0,0 +1,223 @@
+# frozen_string_literal: true
+
+# lib/otto/security/authentication/strategy_result.rb
+
+# StrategyResult is an immutable data structure that holds the result of an
+# authentication strategy. It contains session, user, and metadata needed by
+# Otto Logic classes.
+#
+# @example Basic usage
+#   result = StrategyResult.new(
+#     session: { id: 'abc123', user_id: 1 },
+#     user: user_model_instance,  # Actual user model, not a hash
+#     auth_method: 'token',
+#     metadata: { ip: '127.0.0.1' }
+#   )
+#
+#   result.authenticated?  #=> true
+#   result.has_role?('admin')  #=> true
+#   result.user.name  #=> 'John' (assuming user model has name method)
+#
+class Otto
+  module Security
+    module Authentication
+      StrategyResult = Data.define(:session, :user, :auth_method, :metadata) do
+        # Create an anonymous (unauthenticated) result
+        # @return [StrategyResult] Anonymous result with empty session and nil user
+        def self.anonymous(metadata: {})
+          new(
+            session: {},
+            user: nil,  # Changed from {} to nil - clearer semantics
+            auth_method: 'anonymous',
+            metadata: metadata
+          )
+        end
+
+        # Check if the request is authenticated (has a user)
+        # @return [Boolean] True if user is present, false otherwise
+        def authenticated?
+          !user.nil?
+        end
+
+        # Check if the request is anonymous (no user)
+        # @return [Boolean] True if not authenticated
+        def anonymous?
+          user.nil?
+        end
+
+        # Success/failure methods for compatibility
+        def success?
+          true  # If we have a StrategyResult, authentication succeeded
+        end
+
+        def failure?
+          false  # Failures return nil, not a StrategyResult
+        end
+
+
+        # Check if the user has a specific role
+        # @param role [String, Symbol] Role to check
+        # @return [Boolean] True if user has the role
+        def has_role?(role)
+          return false unless authenticated?
+
+          # Try user model methods first, fall back to hash access for backward compatibility
+          if user.respond_to?(:role)
+            user.role.to_s == role.to_s
+          elsif user.respond_to?(:has_role?)
+            user.has_role?(role)
+          elsif user.is_a?(Hash)
+            user_role = user[:role] || user['role']
+            user_role.to_s == role.to_s
+          else
+            false
+          end
+        end
+
+        # Check if the user has a specific permission
+        # @param permission [String, Symbol] Permission to check
+        # @return [Boolean] True if user has the permission
+        def has_permission?(permission)
+          return false unless authenticated?
+
+          # Try user model methods first, fall back to hash access for backward compatibility
+          if user.respond_to?(:has_permission?)
+            user.has_permission?(permission)
+          elsif user.respond_to?(:permissions)
+            permissions = user.permissions || []
+            permissions = [permissions] unless permissions.is_a?(Array)
+            permissions.map(&:to_s).include?(permission.to_s)
+          elsif user.is_a?(Hash)
+            permissions = user[:permissions] || user['permissions'] || []
+            permissions = [permissions] unless permissions.is_a?(Array)
+            permissions.map(&:to_s).include?(permission.to_s)
+          else
+            false
+          end
+        end
+
+        # Check if the user has any of the specified roles
+        # @param roles [Array<String, Symbol>] Roles to check
+        # @return [Boolean] True if user has any of the roles
+        def has_any_role?(*roles)
+          roles.flatten.any? { |role| has_role?(role) }
+        end
+
+        # Check if the user has any of the specified permissions
+        # @param permissions [Array<String, Symbol>] Permissions to check
+        # @return [Boolean] True if user has any of the permissions
+        def has_any_permission?(*permissions)
+          permissions.flatten.any? { |permission| has_permission?(permission) }
+        end
+
+        # Get user ID from various possible locations
+        # @return [String, Integer, nil] User ID or nil
+        def user_id
+          return nil unless authenticated?
+
+          # Try user model methods first, fall back to hash access and session
+          if user.respond_to?(:id)
+            user.id
+          elsif user.respond_to?(:user_id)
+            user.user_id
+          elsif user.is_a?(Hash)
+            user[:id] || user['id'] || user[:user_id] || user['user_id']
+          end || session[:user_id] || session['user_id']
+        end
+
+        # Get user name from various possible locations
+        # @return [String, nil] User name or nil
+        def user_name
+          return nil unless authenticated?
+
+          # Try user model methods first, fall back to hash access
+          if user.respond_to?(:name)
+            user.name
+          elsif user.respond_to?(:username)
+            user.username
+          elsif user.is_a?(Hash)
+            user[:name] || user['name'] || user[:username] || user['username']
+          end
+        end
+
+        # Get session ID from various possible locations
+        # @return [String, nil] Session ID or nil
+        def session_id
+          session[:id] || session['id'] || session[:session_id] || session['session_id']
+        end
+
+        # Get all user roles as an array
+        # @return [Array<String>] Array of roles (empty if none)
+        def roles
+          return [] unless authenticated?
+
+          roles_data = user[:roles] || user['roles']
+          if roles_data.is_a?(Array)
+            roles_data.map(&:to_s)
+          elsif roles_data
+            [roles_data.to_s]
+          else
+            role = user[:role] || user['role']
+            role ? [role.to_s] : []
+          end
+        end
+
+        # Get all user permissions as an array
+        # @return [Array<String>] Array of permissions (empty if none)
+        def permissions
+          return [] unless authenticated?
+
+          perms = user[:permissions] || user['permissions'] || []
+          perms = [perms] unless perms.is_a?(Array)
+          perms.map(&:to_s)
+        end
+
+        # Create a string representation for debugging
+        # @return [String] Debug representation
+        def inspect
+          if authenticated?
+            "#<StrategyResult authenticated user=#{user_name || user_id} roles=#{roles} method=#{auth_method}>"
+          else
+            "#<StrategyResult anonymous method=#{auth_method}>"
+          end
+        end
+
+        # Get user context - a hash containing user-specific information and metadata
+        # @return [Hash] User context hash
+        def user_context
+          if authenticated?
+            case auth_method
+            when 'session'
+              { user_id: user_id, session: session }
+            else
+              metadata
+            end
+          else
+            case auth_method
+            when 'anonymous'
+              {}
+            else
+              metadata
+            end
+          end
+        end
+
+        # Create a hash representation
+        # @return [Hash] Hash representation of the context
+        def to_h
+          {
+            session: session,
+            user: user,
+            auth_method: auth_method,
+            metadata: metadata,
+            authenticated: authenticated?,
+            user_id: user_id,
+            user_name: user_name,
+            roles: roles,
+            permissions: permissions
+          }
+        end
+      end
+    end
+  end
+end