pastore 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44d3e6e0a841c09767bef483f9c53a6c1e11f8a1603671865635a50eb139d0cd
-  data.tar.gz: 246bba109256e0bb1e67c0c5cc518640e99ddd2a0ca01a403a4008fd04c53298
+  metadata.gz: 410e528dd9b199e672139ce5bca88f06a25a3c68d0d81955f1ffedf2d57f8d8e
+  data.tar.gz: 0e9e886326196f6f115b5827906310d75896a08cec53ec34fbb62a0627ee8107
 SHA512:
-  metadata.gz: bc3fb06cbbc9ae2321a486dea657f2e6645ca3e3ceea3e72d36e5cb6733ef16741097fb29e669d4fbc0e64ef072b5f6ac3edc530a3b5abf0048ad93934d5c926
-  data.tar.gz: 8f4d326809b4ed7495a964da19de29a75818a70882c447cef7f202526c764b720bb396f931d879b505fcf49bd7cf85b4d17eee8f3970a915b60d92098c60d8fb
+  metadata.gz: 2e8eae1e20fdc6429b8094f0f17c974f156d8394af38f62b3a8fc22406208a43ab278704d887f26243cbed4f6e53da972bc0ae7d2474bb7c90895fc52d724836
+  data.tar.gz: 83140c5b356109e2340bdfe1b161d8d77522463861d71da8deb299d2fb2742892f9b4abad5d96c24c777c485de802aaeae87d0dc329bde3f31d91a18dbc1e3ea

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    pastore (0.0.1)
+    pastore (0.0.2)
       rails (>= 4.0)
 
 GEM

data/README.md

@@ -222,8 +222,8 @@ your Rails Controller.
 | `detect_role(&block)` | Allows to specify the logic for user role detection. This block will be automatically called to get current user's role information. |
 | `permit_role(*roles)` | Specifies the roles that are allowed to access the action that follows. |
 | `deny_role(*roles)` | Specifies the roles that are not allowed to access the action that follows. |
-| `authorize_with(Symbol|&block)` | Allows to specify a custom authorization logic to use for action access check. Accepts a method name or a block. |
-| `skip_guards(*Symbol|*String, except: *Symbol|*String)` | Allows to disable guards for specific actions. Accepts a list of actions for which to disable guards (e.g. `skip_guards :index, 'show'`), but can be also used to disable guards for all the actions except specified (e.g. `skip_guards except: :index`). |
+| <code>authorize_with(Symbol\|&block)</code> | Allows to specify a custom authorization logic to use for action access check. Accepts a method name or a block. |
+| <code>skip_guards(*Symbol\|*String, except: *Symbol\|*String)</code> | Allows to disable guards for specific actions. Accepts a list of actions for which to disable guards (e.g. `skip_guards :index, 'show'`), but can be also used to disable guards for all the actions except specified (e.g. `skip_guards except: :index`). |
 
 ## Contributing
 

data/lib/pastore/guards/settings.rb

@@ -0,0 +1,175 @@
+# frozen_string_literal: true
+
+module Pastore
+  module Guards
+    # Implements a structure where to store the settings for the guards.
+    class Settings # rubocop:disable Metrics/ClassLength
+      attr_accessor :role_detector, :forbidden_cbk
+      attr_reader :strategy
+
+      def initialize
+        reset!
+      end
+
+      def reset!
+        @strategy = :deny
+        @role_detector = nil
+        @forbidden_cbk = nil
+        @actions = {}
+        @buffer = {}
+        @skipped_guards = []
+        @forced_guards = []
+      end
+
+      def use_allow_strategy!
+        @strategy = :allow
+      end
+
+      def use_deny_strategy!
+        @strategy = :deny
+      end
+
+      def permit_role(*roles)
+        new_roles = [roles].flatten.compact.uniq.map(&:to_s)
+        conflicts = @buffer.fetch(:denied_roles, []) & new_roles
+
+        unless conflicts.empty?
+          raise Pastore::Guards::RoleConflictError, "Roles conflict: #{conflicts} roles already specified with #deny_role"
+        end
+
+        if @buffer[:authorization_lambda].present?
+          raise Pastore::Guards::RoleConflictError, 'An #authorize_with has already been specified'
+        end
+
+        @buffer[:permitted_roles] = new_roles
+      end
+
+      def deny_role(*roles)
+        new_roles = [roles].flatten.compact.uniq.map(&:to_s)
+        conflicts = @buffer.fetch(:permitted_roles, []) & new_roles
+
+        unless conflicts.empty?
+          raise Pastore::Guards::RoleConflictError, "Roles conflict: #{conflicts} roles already specified with #permit_role"
+        end
+
+        if @buffer[:authorization_lambda].present?
+          raise Pastore::Guards::RoleConflictError, 'An #authorize_with has already been specified'
+        end
+
+        @buffer[:denied_roles] = new_roles
+      end
+
+      def authorize_with(method_name = nil, &block)
+        if @buffer[:permitted_roles].present? || @buffer[:denied_roles].present?
+          raise Pastore::Guards::RoleConflictError, 'A role has already been specified with #permit_role or #deny_role'
+        end
+
+        custom_lambda = method_name.to_sym if method_name.is_a?(Symbol) || method_name.is_a?(String)
+        custom_lambda = block if block_given?
+
+        if custom_lambda.present?
+          @buffer[:authorization_lambda] = custom_lambda
+        else
+          raise ArgumentError, 'A block or a method name must be provided'
+        end
+      end
+
+      def save_guards_for(action_name)
+        return if @buffer.empty?
+
+        name = action_name.to_sym
+        @actions[name] ||= {}
+
+        save_permitted_roles!(name)
+        save_denied_roles!(name)
+        save_authorization_lambda!(name)
+
+        reset_buffer!
+      end
+
+      def reset_buffer!
+        @buffer = {}
+      end
+
+      def skip_guards_for(*actions)
+        @skipped_guards = [actions].flatten.compact.map(&:to_sym)
+      end
+
+      def force_guards_for(*actions)
+        @forced_guards = [actions].flatten.compact.map(&:to_sym)
+      end
+
+      # Returns the current role for the controller.
+      def current_role(controller)
+        return nil if @role_detector.blank?
+
+        controller.instance_exec(&@role_detector)&.to_s
+      end
+
+      def access_granted?(controller, action_name) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        # Get setting for the current action.
+        action = @actions[action_name.to_sym]
+
+        return true if skip_guards?(action_name)
+
+        result = authorize_with_lambda(controller, action)
+        return result unless result.nil?
+
+        role = current_role(controller)
+
+        return false if action&.dig(:denied_roles)&.include?(role)
+
+        @strategy == :allow || (@strategy == :deny && action&.dig(:permitted_roles)&.include?(role)) || false
+      end
+
+      private
+
+      def save_permitted_roles!(action_name)
+        return if @buffer[:permitted_roles].blank?
+
+        @actions[action_name][:permitted_roles] = @buffer[:permitted_roles]
+      end
+
+      def save_denied_roles!(action_name)
+        return if @buffer[:denied_roles].blank?
+
+        @actions[action_name][:denied_roles] = @buffer[:denied_roles]
+      end
+
+      def save_authorization_lambda!(action_name)
+        return if @buffer[:authorization_lambda].blank?
+
+        @actions[action_name][:authorization_lambda] = @buffer[:authorization_lambda]
+      end
+
+      def skip_guards?(action_name)
+        # If current action is listed in `:except` field of `skip_guards`, then we have to run guards (return false).
+        return false if @forced_guards&.include?(action_name.to_sym)
+
+        # If `skip_guards` has specified an `:except` field, then we can skip guards, because current action has
+        # implicitely been marked as "to skip guards".
+        return true if @forced_guards.present?
+
+        # If `skip_guards` don't have the any `except` field, just check if current actions is listed in
+        # `skip_guards`.
+        return true if @skipped_guards&.include?(action_name.to_sym)
+
+        # Current action isn't listed in `skip_guards`, so we have to run guards (return false).
+        false
+      end
+
+      def authorize_with_lambda(controller, action)
+        # When an authorization lambda is defined, it has the priority over the other guards.
+        authorization_lambda = action&.dig(:authorization_lambda)
+        if authorization_lambda.present?
+          result = controller.instance_eval(&authorization_lambda) if authorization_lambda.is_a?(Proc)
+          result = controller.instance_eval(authorization_lambda.to_s) if authorization_lambda.is_a?(Symbol)
+
+          return result
+        end
+
+        nil
+      end
+    end
+  end
+end

data/lib/pastore/guards.rb

@@ -1,182 +1,81 @@
 # frozen_string_literal: true
 
 require 'active_support/concern'
+require_relative 'guards/settings'
 
 module Pastore
   # Implements the features for Rails controller access guards.
-  module Guards # rubocop:disable Metrics/ModuleLength
+  module Guards
     extend ActiveSupport::Concern
 
+    class RoleConflictError < StandardError; end
+
     included do
-      before_action :pastore_check_access
+      before_action do
+        guards = self.class.pastore_guards
+        next if guards.access_granted?(self, action_name)
+
+        if guards.forbidden_cbk.present?
+          instance_eval(&guards.forbidden_cbk)
+          response.status = :forbidden
+        else
+          render json: { message: 'Forbidden' }, status: :forbidden
+        end
+      end
     end
 
     class_methods do # rubocop:disable Metrics/BlockLength
-      attr_accessor :_role_detector, :_default_strategy, :_action_permitted_roles, :_controller_allowed_roles,
-                    :_forbidden_callback, :_action_authorization_lambda, :_controller_authorization_lambdas,
-                    :_action_denied_roles, :_controller_denied_roles, :_actions_with_skipped_guards,
-                    :_actions_with_active_guards
+      attr_accessor :_pastore_guards
+
+      def pastore_guards
+        self._pastore_guards ||= Pastore::Guards::Settings.new
+      end
 
       # Sets the logic to use for current role detection.
       def detect_role(&block)
-        self._role_detector = block
+        pastore_guards.role_detector = block
       end
 
       # Specifies a custom callback to be called when access is forbidden.
       def forbidden(&block)
-        self._forbidden_callback = block
+        pastore_guards.forbidden_cbk = block
       end
 
       # Sets the default strategy to "deny".
       def use_deny_strategy!
-        self._default_strategy = :deny
+        pastore_guards.use_deny_strategy!
       end
 
       # Sets the default strategy to "allow".
       def use_allow_strategy!
-        self._default_strategy = :allow
-      end
-
-      # Returns the default strategy.
-      def pastore_default_strategy
-        _default_strategy || :deny
+        pastore_guards.use_allow_strategy!
       end
 
       def skip_guards(*actions, except: [])
-        self._actions_with_active_guards = [except].flatten.compact.map(&:to_sym)
-        self._actions_with_skipped_guards = actions.flatten.compact.map(&:to_sym)
-      end
-
-      def actions_with_active_guards
-        _actions_with_active_guards || []
-      end
-
-      def actions_with_skipped_guards
-        _actions_with_skipped_guards || []
+        pastore_guards.skip_guards_for(*actions)
+        pastore_guards.force_guards_for(*except)
       end
 
       # Specify the list of roles allowed to access the action.
       def permit_role(*roles)
-        self._action_permitted_roles = [roles].flatten.compact.uniq.map(&:to_s)
+        pastore_guards.permit_role(*roles)
       end
 
       # Specify the list of roles denied to access the action.
       def deny_role(*roles)
-        self._action_denied_roles = [roles].flatten.compact.uniq.map(&:to_s)
+        pastore_guards.deny_role(*roles)
       end
 
       # Specify a custom lambda to be called to authorize the action.
       def authorize_with(method_name = nil, &block)
-        custom_lambda = method_name.to_sym if method_name.is_a?(Symbol) || method_name.is_a?(String)
-        custom_lambda = block if block_given?
-
-        if custom_lambda.present?
-          self._action_authorization_lambda = custom_lambda
-        else
-          raise ArgumentError, 'A block or a method name must be provided'
-        end
+        pastore_guards.authorize_with(method_name, &block)
       end
 
       # Save the configurations of the action when the action is defined.
-      def method_added(name, *args) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
-        unless _action_permitted_roles.blank?
-          self._controller_allowed_roles ||= {}
-          self._controller_allowed_roles[name] = _action_permitted_roles
-          self._action_permitted_roles = nil
-        end
-
-        unless _action_denied_roles.blank?
-          self._controller_denied_roles ||= {}
-          self._controller_denied_roles[name] = _action_denied_roles
-          self._action_denied_roles = nil
-        end
-
-        unless _action_authorization_lambda.blank?
-          self._controller_authorization_lambdas ||= {}
-          self._controller_authorization_lambdas[name] = _action_authorization_lambda
-          self._action_authorization_lambda = nil
-        end
-
+      def method_added(name, *args)
+        pastore_guards.save_guards_for(name)
         super
       end
     end
-
-    protected
-
-    # Returns the current role detected by the role detector logic.
-    def pastore_current_role
-      self.class._role_detector&.call&.to_s
-    end
-
-    # Returns the list of roles allowed to access current action.
-    def pastore_allowed_roles
-      self.class._controller_allowed_roles&.dig(action_name.to_sym) || []
-    end
-
-    # Returns the list of roles denied to access current action.
-    def pastore_denied_roles
-      self.class._controller_denied_roles&.dig(action_name.to_sym) || []
-    end
-
-    # Returns the custom lambda to be called to authorize the action.
-    def pastore_authorization_lambda
-      self.class._controller_authorization_lambdas&.dig(action_name.to_sym)
-    end
-
-    def skip_pastore_guards?
-      active_guards = self.class._actions_with_active_guards
-
-      # If current action is listed in `:except` field of `skip_guards`, then we have to run guards (return false).
-      return false if active_guards&.include?(action_name.to_sym)
-
-      # If `skip_guards` has specified an `:except` field, then we can skip guards, because current action has
-      # implicitely been marked as "to skip guards".
-      return true if active_guards.present?
-
-      # If `skip_guards` don't have the any `except` field, just check if current actions is listed in
-      # `skip_guards`.
-      return true if self.class._actions_with_skipped_guards&.include?(action_name.to_sym)
-
-      # Current action isn't listed in `skip_guards`, so we have to run guards (return false).
-      false
-    end
-
-    # Performs the access check for current action.
-    def pastore_check_access # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity
-      return if skip_pastore_guards?
-
-      if pastore_authorization_lambda.present?
-        authorized = instance_eval(&pastore_authorization_lambda) if pastore_authorization_lambda.is_a?(Proc)
-        authorized = send(pastore_authorization_lambda) if pastore_authorization_lambda.is_a?(Symbol)
-
-        return if authorized
-
-        return pastore_deny_access!
-      end
-
-      case self.class.pastore_default_strategy
-      when :deny then check_access_with_deny_strategy
-      when :allow then check_access_with_allow_strategy
-      end
-    end
-
-    def check_access_with_deny_strategy
-      return pastore_deny_access! unless pastore_allowed_roles.include?(pastore_current_role)
-    end
-
-    def check_access_with_allow_strategy
-      return pastore_deny_access! if pastore_denied_roles.include?(pastore_current_role)
-    end
-
-    def pastore_deny_access!
-      callback = self.class._forbidden_callback
-
-      if callback
-        instance_eval(&callback)
-        response.status = :forbidden
-      else
-        render json: { message: 'Forbidden' }, status: :forbidden
-      end
-    end
   end
 end

data/lib/pastore/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pastore
-  VERSION = '0.0.1'
+  VERSION = '0.0.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pastore
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Groza Sergiu
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-01-31 00:00:00.000000000 Z
+date: 2023-02-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -51,6 +51,7 @@ files:
 - Rakefile
 - lib/pastore.rb
 - lib/pastore/guards.rb
+- lib/pastore/guards/settings.rb
 - lib/pastore/params_validators.rb
 - lib/pastore/version.rb
 homepage: https://github.com/demetra-it/pastore