permission_policy 0.0.6 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d197b0a408448eb634f15c4229434f643229daca
-  data.tar.gz: a3861829e10f0738d884080167e91f76cb802736
+  metadata.gz: cf58d8db5cb145457f2477e95784d7083d1ae3a9
+  data.tar.gz: 6186f34bf9b8171db1b061123e37d78c975c25b2
 SHA512:
-  metadata.gz: aa90267b5878dbdad8f3140a0ac8f5e08a2db1e8aa06e8d6e742eb36d07491a4fc91989d23a7b6844e7bf9fb42f73a4019ba1e620c105fff55624bb69405ca88
-  data.tar.gz: 12974cc8b86fabea2530d79872816bcd1bc94810d9fcbc1270f2fe193921b0b7f92ba93d6bae8938cd2b126b3befa36cc8b0468769522c062402169c774a6cd7
+  metadata.gz: a01d8c7b01188ab26ad30d5ee23ea8e7c7f4c25c71f88a2bd5310849d09c6a3c2da8f30b12d091cd6fd0ca62f0133c435ad019c30dc58df931314ae339f481fe
+  data.tar.gz: 14fdc5e33244dd581c6f48cf940b24e1bec4f1297e526246c7a81457570c1b2b5625098256d3d2c58d76b24ee8b9ad0810313485f5921beb0debaff7d8d59f9d

data/CHANGELOG.md

@@ -1,4 +1,8 @@
 
+# 0.1.0
+
+  * [REFACTORING] change the way *configuration* is handled (breaking changes)
+
 # 0.0.6
 
   * [ENHANCEMENT] moar convenience with `skip_verify_authorization`

data/README.md

@@ -6,6 +6,21 @@
 * dependencies
 
 
+## Authorization is hard
+
+There are plenty of diferent solutions to this problem.
+Because the requirements can be very difficult and as the system grows the problems become even worse. Exspecially when you need to support change.
+The hardest part may be thight coupling and issues with encapsulation through the whole application.
+To avoid repetitive and grwoing if/else branches you want a single responsible system.
+
+In general, the permission policy defines and controls whether a current **object** (usually the user) can perform a specific **action** on a given **subject**. This decision is commonly based on one or more
+factors:
+
+* role
+* type (or a set of attributes)
+* enabled features / areas of the application
+
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -122,6 +137,13 @@ You can extend the permission policy by:
  - implement new permission strategies, which help the policy to find the 'decider'
 
 
+## possible ideas/improvements:
+
+- support skip_verify_authorization only:/except: [:actions]
+- register features and roles in the policy
+- raise NoSuchFeature
+- get available "permissions" for role/subject/feature
+
 ## Contributing
 
 1. Fork it ( https://github.com/[my-github-username]/permission_policy/fork )

data/lib/permission_policy/authorization.rb

@@ -4,8 +4,9 @@ module PermissionPolicy
 
     def initialize(context)
       @preconditions = []
+      @context = context
 
-      PermissionPolicy.preconditions.each do |precondition|
+      context.authorization_preconditions.each do |precondition|
         set! precondition, context.public_send(precondition)
         @preconditions << precondition
       end
@@ -40,7 +41,9 @@ module PermissionPolicy
 
     # Finds the matching strategy which can decide if the action is allowed by lazy checking
     def strategy_for(*args)
-      PermissionPolicy.strategies.lazy.map { |klass| Strategies.const_get(klass).new(self, *args) }.find(&:match?)
+      @context.authorization_strategies.lazy.map do |klass|
+        Strategies.const_get(klass).new(self, *args)
+      end.find(&:match?)
     end
 
     def set!(var, value)

data/lib/permission_policy/configuration.rb

@@ -1,38 +1,4 @@
 module PermissionPolicy
-  class Configuration < OpenStruct
-    def preconditions
-      precondition_attributes || [:current_user]
-    end
-
-    def strategies
-      strategy_order || [:UnknownStrategy]
-    end
-
-    def verification
-      verify_authorization || false
-    end
-  end
-
-  class << self
-    attr_accessor :configuration
-
-    extend Forwardable
-    delegate [:preconditions, :strategies, :verification] => :config
-
-    def configure
-      yield(config)
-    end
-
-    def config
-      self.configuration ||= Configuration.new
-    end
-
-    def authorize_with(*args)
-      configure { |c| c.precondition_attributes = *args }
-    end
-
-    def verify_authorization!(setting)
-      configure { |c| c.verify_authorization = setting }
-    end
+  class Configuration
   end
 end

data/lib/permission_policy/controller_additions.rb

@@ -3,16 +3,20 @@ require 'active_support/concern'
 module PermissionPolicy
   module ControllerAdditions
     module ClassMethods
-      def authorize_with(*args)
-        PermissionPolicy.authorize_with(*args)
+      def authorize_with(*preconditions)
+        define_method('authorization_preconditions') { preconditions }
       end
 
       def verify_authorization!
-        PermissionPolicy.verify_authorization!(true)
+        define_method('authorization_verification?') { true }
       end
 
       def skip_verify_authorization
-        PermissionPolicy.verify_authorization!(false)
+        define_method('authorization_verification?') { false }
+      end
+
+      def authorization_strategies(*strategies)
+        define_method('authorization_strategies') { strategies }
       end
     end
 
@@ -23,7 +27,7 @@ module PermissionPolicy
         helper_method :allowed?
         delegate :allowed?, to: :permission_policy
         delegate :authorize!, to: :permission_policy
-        after_action -> { verify_authorization if PermissionPolicy.verification }
+        after_action -> { verify_authorization if authorization_verification? }
       end
 
       def permission_policy

data/lib/permission_policy/version.rb

@@ -1,3 +1,3 @@
 module PermissionPolicy
-  VERSION = '0.0.6'
+  VERSION = '0.1.0'
 end

data/spec/permission_policy/authorization_spec.rb

@@ -1,13 +1,9 @@
 module PermissionPolicy
   RSpec.describe 'Authorization' do
-    before do
-      PermissionPolicy.authorize_with :my_user, :my_account
-    end
-
-    subject { PermissionPolicy::Authorization.new(context) }
+    subject { PermissionPolicy::Authorization.new(controller_context) }
 
     context 'valid' do
-      let(:context) { double('context', my_user: 'foo', my_account: 'bar') }
+      let(:controller_context) { double('context', authorization_preconditions: [:my_user, :my_account], my_user: 'foo', my_account: 'bar') }
 
       it 'sets attribute readers for each precondition' do
         expect(subject.my_user).to eq('foo')
@@ -20,7 +16,7 @@ module PermissionPolicy
     end
 
     context 'invalid' do
-      let(:context) { double('context', my_user: nil, my_account: nil) }
+      let(:controller_context) { double('context', authorization_preconditions: [:my_user, :my_account], my_user: nil, my_account: nil) }
 
       it 'raises missing precondition error' do
         expect { subject }.to raise_error('missing precondition: my_user')

data/spec/permission_policy/configuration_spec.rb

@@ -1,13 +1,4 @@
 module PermissionPolicy
   RSpec.describe Configuration do
-    before { PermissionPolicy.configuration = nil }
-
-    it 'has a default precondition' do
-      expect(subject.preconditions).to eq([:current_user])
-    end
-
-    it 'has a default strategy' do
-      expect(subject.strategies).to eq([:UnknownStrategy])
-    end
   end
 end

data/spec/permission_policy/controller_additions_spec.rb

@@ -6,38 +6,118 @@ class MetalTestController < ActionController::Metal
   include PermissionPolicy::ControllerAdditions::InstanceMethods
   extend PermissionPolicy::ControllerAdditions::ClassMethods
 
+  authorize_with :foo, :bar
+  verify_authorization!
+  authorization_strategies :TestStrategy, :UnknownStrategy
+
   def foo
+    'foo'
   end
 
   def bar
+    'bar'
+  end
+
+  def baz
+    'baz'
+  end
+end
+
+class TestController < MetalTestController
+  def not_authorized_action
+    'you will never see me'
+  end
+
+  def not_allowed_action
+    authorize! :something
+    'you also wont see me, but get a different error'
+  end
+
+  def allowed_action
+    authorize! :view, subject: 'some_subject'
+    'ok go ahead'
+  end
+end
+
+class TestStrategy < PermissionPolicy::Strategies::BaseStrategy
+  def match?
+    options[:subject] == 'some_subject'
+  end
+
+  def allowed?
+    { view: true, manage: false }[action]
+  end
+end
+
+class SkipTestController < MetalTestController
+  authorize_with :baz
+  skip_verify_authorization
+
+  def skipped_authorization
+    'ohai'
   end
 end
 
 
 module PermissionPolicy
   RSpec.describe 'ControllerAdditions' do
-    subject { MetalTestController.new }
 
-    context 'authorization' do
-      before do
-        MetalTestController.authorize_with :foo, :bar
-        is_expected.to receive(:foo) { 'foo' }
-        is_expected.to receive(:bar) { 'bar' }
+    context 'instance_methods' do
+      subject { MetalTestController.new }
+
+      describe 'authorization' do
+        it 'is available through #permission_policy' do
+          expect(subject.permission_policy).to be_kind_of(PermissionPolicy::Authorization)
+        end
+
+        it 'is initialized with precondition foo' do
+          expect(subject.permission_policy.foo).to eq('foo')
+        end
+
+        it 'is initialized with precondition bar' do
+          expect(subject.permission_policy.bar).to eq('bar')
+        end
       end
 
-      it 'is available throuth #permission_policy' do
-        expect(subject.permission_policy).to be_kind_of(PermissionPolicy::Authorization)
+      describe 'helpers' do
+        it { is_expected.to respond_to :authorize! }
+        it { is_expected.to respond_to :allowed? }
       end
+    end
+
+    context 'class_methods' do
+      subject { TestController.new }
+
+      describe '#verify_authorization!' do
+        context 'no call to #authorize!' do
+          it 'is not verified' do
+            expect { subject.process_action :not_authorized_action }.to raise_error PermissionPolicy::NotVerified
+          end
+        end
+
+        context 'with #authorize! but not allowed' do
+          it 'is still not allowed' do
+            expect { subject.process_action :not_allowed_action }.to raise_error PermissionPolicy::NotAllowed
+          end
+        end
 
-      it 'is initialized with preconditions' do
-        expect(subject.permission_policy.foo).to eq('foo')
-        expect(subject.permission_policy.bar).to eq('bar')
+        context '#authorized! and allowed' do
+          it 'is allowed' do
+            expect(subject.process_action :allowed_action).to eq('ok go ahead')
+          end
+        end
       end
     end
 
-    context 'helpers' do
-      it { is_expected.to respond_to :authorize! }
-      it { is_expected.to respond_to :allowed? }
+    describe '#skip_verify_authorization' do
+      subject { SkipTestController.new }
+
+      context 'with :only option' do
+        it 'skips this action' do
+          expect(subject.process_action :skipped_authorization).to eq('ohai')
+        end
+      end
     end
+
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: permission_policy
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.1.0
 platform: ruby
 authors:
 - Marco Schaden
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-30 00:00:00.000000000 Z
+date: 2015-02-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport