pebblebed 0.0.43 → 0.0.44

data/README.md

@@ -57,6 +57,7 @@ Other helper methods provided by this extension:
     require_identity                        # Halts with 403 if there is no current user
     require_god                             # Halts with 403 if the current user is not a god
     require_access_to_path(path)            # Halts with 403 if the current user is not a member of a checkpoint access group with privileged access to that path
+    require_action_allowed(action, uid)     # Halts with 403 if the current user is not allowed by checkpoint to perform this action for that uid
     require_parameters(parameters, *keys)   # Halts with 409 if the at least one of the provided keys is not in the params-hash
 
 ### Testing Sinatra APIs

data/lib/pebblebed/sinatra.rb

@@ -93,6 +93,15 @@ module Sinatra
         halt 403, "Access denied."
       end
 
+      def require_action_allowed(action, uid)
+        require_identity
+        uid = ::Pebblebed::Uid.new(uid) if uid.is_a?(String)
+        return if current_identity.god and uid.path.split(".")[0] == current_identity.realm
+        res = pebbles.checkpoint.get("/callbacks/allowed/#{action}/#{uid}")
+        return if res['allowed']
+        halt 403, ":#{action} denied for #{uid} : #{res['reason']}"
+      end
+
       def limit_offset_collection(collection, options)
         limit = (options[:limit] || 20).to_i
         offset = (options[:offset] || 0).to_i

data/lib/pebblebed/version.rb

@@ -1,3 +1,3 @@
 module Pebblebed
-  VERSION = "0.0.43"
+  VERSION = "0.0.44"
 end

data/spec/sinatra_spec.rb

@@ -34,6 +34,11 @@ class TestApp < Sinatra::Base
     "You are most powerful"
   end
 
+  post '/create/:uid' do |uid|
+    require_action_allowed(:create, uid)
+    "You are creative"
+  end
+
   get '/nonexistant' do
     raise Pebblebed::HttpNotFoundError, "Not found /nonexistant"
   end
@@ -154,6 +159,49 @@ describe Sinatra::Pebblebed do
     end
   end
 
+  describe "with checkpoint psm2 callbacks" do
+    let(:checkpoint) {
+      checkpoint = stub
+      checkpoint.stub!(:service_url => 'http://example.com')
+      checkpoint
+    }
+    context "as a guest" do
+      specify "not allowed" do
+        guest!
+        post '/create/post.foo:testrealm'
+        last_response.status.should == 403
+      end
+    end
+    context "as a god" do
+      specify "allowed without callbacks" do
+        god!(:session => random_session)
+        post '/create/post.foo:testrealm'
+        last_response.body.should == "You are creative"
+      end
+    end
+    context "as user without permissions" do
+      specify "is disallowed" do
+        user!
+        checkpoint.should_receive(:get).with("/identities/me").and_return(DeepStruct.wrap(:identity => {:realm => 'testrealm', :id => 1, :god => false}))
+        checkpoint.should_receive(:get).with("/callbacks/allowed/create/post.foo:testrealm").and_return(DeepStruct.wrap(:allowed => false, :reason => "You are not worthy!"))
+        Pebblebed::Connector.any_instance.stub(:checkpoint => checkpoint)
+        post '/create/post.foo:testrealm'
+        last_response.status.should == 403
+        last_response.body.should == ":create denied for post.foo:testrealm : You are not worthy!"
+      end
+    end
+    context "as user with permissions" do
+      specify "is allowed" do
+        user!
+        checkpoint.should_receive(:get).with("/identities/me").and_return(DeepStruct.wrap(:identity => {:realm => 'testrealm', :id => 1, :god => false}))
+        checkpoint.should_receive(:get).with("/callbacks/allowed/create/post.foo:testrealm").and_return(DeepStruct.wrap(:allowed => true))
+        Pebblebed::Connector.any_instance.stub(:checkpoint => checkpoint)
+        post '/create/post.foo:testrealm'
+        last_response.body.should == "You are creative"
+      end
+    end
+  end
+
   describe "error handling" do
     before(:each) { guest! }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pebblebed
 version: !ruby/object:Gem::Version
-  version: 0.0.43
+  version: 0.0.44
   prerelease: 
 platform: ruby
 authors:
@@ -329,7 +329,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -4488871030272884545
+      hash: -110595815413794395
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -338,7 +338,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -4488871030272884545
+      hash: -110595815413794395
 requirements: []
 rubyforge_project: pebblebed
 rubygems_version: 1.8.25