petergate 3.1.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 458fdd69a1955dde44434ec3ba661af445de0b754b09b8d61dfd7e959ba33632
-  data.tar.gz: 5b99cfc5fb9d622d9b9b47a9777b3fe3bc51bc520b45ee52a29dfdbc633b3c7d
+  metadata.gz: acd5072223d85700246df5acd1445b292a918cf85a3b51b4ee42ae03c3648630
+  data.tar.gz: d084364761c8234ac5db4cc4434e88337913f07dea42cf7d2d3fdc15b3b8261d
 SHA512:
-  metadata.gz: af0027d006aa080fe77ce5467ac3ec036d84d2ad3211caf21d267914fc18b46680ff3722dbc855801b7026bfdeeb420ffc5e53cac10611f78a82d063d2178486
-  data.tar.gz: 686f7f73c012fc240a9734599cd2106e35dbe0b0694bff964aab9114fb3f8de9ff78a7a83dfcc57a39c10cce7c124cb05a592a2a5594dbe763cc198d0cc513fb
+  metadata.gz: ffef6582b1bcd3d55d01c4655dff65a7d12ee47fbefeb32ba2339911db89827923a05e876396261c00849f966ecb36b3470247c057eb99dc60cf0822c8ee26f5
+  data.tar.gz: 9c4e7e84b9e07811651f6cd172f4b32b92540bd47a24a2ec986f028d64b7a3786d3a800aefe879f9d81f04700360a05f007d36148a22dea8b80b5456cc2d938e

data/README.md

@@ -130,6 +130,9 @@ Inside your views you can use logged_in?(:admin, :customer, :etc) to show or hid
 <%= link_to "destroy", destroy_listing_path(listing) if logged_in?(:admin, :customer, :etc) %>
 ```
 
+`logged_in?` tests roles. To ask only whether anyone is signed in, without
+caring which role they hold, use `user_logged_in?`.
+
 If you need to access available roles within your project you can by calling:
 
 ```ruby
@@ -140,7 +143,16 @@ User.first.available_roles # the same list, from an instance
 `ROLES` is a constant on the model, so it is also reachable from your own
 instance methods. A subclass shares its parent's roles.
 
-If you need to deny access you can use the forbidden! method:
+#### Denying access yourself
+
+Two helpers are available in controllers and in views:
+
+```ruby
+forbidden!     # refuse someone who is signed in
+unauthorized!  # send a visitor to authentication, via authenticate_user!
+```
+
+`forbidden!` is the one you want in your own filters:
 
 ```ruby
 before_action :check_active_user
@@ -149,12 +161,35 @@ def check_active_user
   forbidden! unless current_user.active
 end
 ```
-If you want to change the `permission denied` message you can add to the access line:
+
+Both answer a `js`, `json` or `xml` request with a bare `403` or `401` rather
+than a redirect, and do the same in an `ActionController::API` controller,
+which has no format negotiation to offer.
+
+##### The denial message
+
+`forbidden!` takes one for a single call, and `access` sets a default for the
+whole controller:
 
 ```ruby
+forbidden! "Your account is suspended"
+
 access user: [:show, :index], message: "You shall not pass"
 ```
 
+The message is resolved in this order, first match winning:
+
+| | Source |
+| --- | --- |
+| 1 | the argument passed to `forbidden!` |
+| 2 | an `msg` request header |
+| 3 | the `message:` option on `access` |
+| 4 | `"Permission Denied"` |
+
+Note the second entry: the `msg` header is read off the request, so a caller
+can replace a message you set with `message:`. It is undocumented legacy
+behaviour rather than something to rely on.
+
 #### User Admin Example Form for Multiple Roles
 
 ```slim

data/lib/petergate/action_controller/base.rb

@@ -1,3 +1,6 @@
+# Included into ActionController::Base *and* ActionController::API: Rails runs
+# the :action_controller load hook for both. See the hook at the bottom of this
+# file for why that hook rather than the Base/API-specific pair.
 module Petergate
   module ActionController
     module Base
@@ -106,15 +109,10 @@ module Petergate
         defined?(self.class.controller_message) ? self.class.controller_message : 'Permission Denied'
       end
 
-      # ActionController::API does not include ActionController::MimeResponds,
-      # so `respond_to` is unavailable there. API controllers get a bare status
-      # code instead of an HTML redirect, which is what an API caller expects.
-      def negotiates_formats?
-        respond_to?(:respond_to)
-      end
-
       def unauthorized!
-        return head(:unauthorized) unless negotiates_formats?
+        # ActionController::API has no MimeResponds, so no respond_to; a bare
+        # status is the right answer for an API caller regardless.
+        return head(:unauthorized) if is_a?(::ActionController::API)
 
         respond_to do |format|
           format.any(:js, :json, :xml) do 
@@ -127,7 +125,8 @@ module Petergate
       end
 
       def forbidden!(msg = nil)
-        return head(:forbidden) unless negotiates_formats?
+        # See unauthorized! -- API controllers cannot respond_to.
+        return head(:forbidden) if is_a?(::ActionController::API)
 
         respond_to do |format|
           format.any(:js, :json, :xml) do 

data/lib/petergate/active_record/base.rb

@@ -1,3 +1,5 @@
+# Included into ActiveRecord::Base, through the load hook at the bottom of
+# this file.
 module Petergate
   module ActiveRecord
     module Base
@@ -6,27 +8,7 @@ module Petergate
       end
 
       module ClassMethods
-        # True when a class this one inherits from has already been through
-        # petergate. Only the superclass chain is walked: an included module
-        # carrying its own ROLES is somebody else's constant, not a sign that
-        # this model is already configured.
-        def petergate_configured_by_ancestor?
-          klass = superclass
-
-          while klass && klass != ::ActiveRecord::Base && klass != ::Object
-            return true if klass.const_defined?(:ROLES, false)
-            klass = klass.superclass
-          end
-
-          false
-        end
-
         def petergate(roles: [:admin], multiple: true)
-          # A subclass shares everything its parent configured -- roles, scopes
-          # and callbacks. Running again would define scopes for roles the model
-          # can never hold and register a second after_initialize.
-          return if petergate_configured_by_ancestor?
-
           if multiple
             serialize :roles, coder: YAML
             after_initialize do
@@ -39,7 +21,9 @@ module Petergate
           end
 
           instance_eval do
-            # Configuring the same model twice keeps the first set of roles.
+            # Own constant only, so each model that calls petergate gets its own
+            # roles rather than deferring to whichever model loaded first.
+            # Configuring the same model twice keeps the first set.
             const_set('ROLES', (roles + [:user]).uniq.map(&:to_sym)) unless const_defined?(:ROLES, false)
 
             if multiple

data/lib/petergate/version.rb

@@ -1,3 +1,3 @@
 module Petergate
-  VERSION = "3.1.0"
+  VERSION = "3.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: petergate
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Isaac Sloan