piko-pro-gem 0.0.1

data/pundit-2.5.2/lib/pundit/context.rb

@@ -0,0 +1,190 @@
+# frozen_string_literal: true
+
+module Pundit
+  # {Pundit::Context} is intended to be created once per request and user, and
+  # it is then used to perform authorization checks throughout the request.
+  #
+  # @example Using Sinatra
+  #   helpers do
+  #     def current_user = ...
+  #
+  #     def pundit
+  #       @pundit ||= Pundit::Context.new(user: current_user)
+  #     end
+  #   end
+  #
+  #   get "/posts/:id" do |id|
+  #     pundit.authorize(Post.find(id), query: :show?)
+  #   end
+  #
+  # @example Using [Roda](https://roda.jeremyevans.net/index.html)
+  #   route do |r|
+  #     context = Pundit::Context.new(user:)
+  #
+  #     r.get "posts", Integer do |id|
+  #       context.authorize(Post.find(id), query: :show?)
+  #     end
+  #   end
+  #
+  # @since v2.3.2
+  class Context
+    # @see Pundit::Authorization#pundit
+    # @param user later passed to policies and scopes
+    # @param policy_cache [#fetch] cache store for policies (see e.g. {CacheStore::NullStore})
+    # @since v2.3.2
+    def initialize(user:, policy_cache: CacheStore::NullStore.instance)
+      @user = user
+      @policy_cache = policy_cache
+    end
+
+    # @api public
+    # @see #initialize
+    # @since v2.3.2
+    attr_reader :user
+
+    # @api private
+    # @see #initialize
+    # @since v2.3.2
+    attr_reader :policy_cache
+
+    # @!group Policies
+
+    # Retrieves the policy for the given record, initializing it with the
+    # record and user and finally throwing an error if the user is not
+    # authorized to perform the given action.
+    #
+    # @param possibly_namespaced_record [Object, Array] the object we're checking permissions of
+    # @param query [Symbol, String] the predicate method to check on the policy (e.g. `:show?`)
+    # @param policy_class [Class] the policy class we want to force use of
+    # @raise [NotAuthorizedError] if the given query method returned false
+    # @return [Object] Always returns the passed object record
+    # @since v2.3.2
+    def authorize(possibly_namespaced_record, query:, policy_class:)
+      record = pundit_model(possibly_namespaced_record)
+      policy = if policy_class
+        policy_class.new(user, record)
+      else
+        policy!(possibly_namespaced_record)
+      end
+
+      raise NotAuthorizedError, query: query, record: record, policy: policy unless policy.public_send(query)
+
+      record
+    end
+
+    # Retrieves the policy for the given record.
+    #
+    # @see https://github.com/varvet/pundit#policies
+    # @param record [Object] the object we're retrieving the policy for
+    # @raise [InvalidConstructorError] if the policy constructor called incorrectly
+    # @return [Object, nil] instance of policy class with query methods
+    # @since v2.3.2
+    def policy(record)
+      cached_find(record, &:policy)
+    end
+
+    # Retrieves the policy for the given record, or raises if not found.
+    #
+    # @see https://github.com/varvet/pundit#policies
+    # @param record [Object] the object we're retrieving the policy for
+    # @raise [NotDefinedError] if the policy cannot be found
+    # @raise [InvalidConstructorError] if the policy constructor called incorrectly
+    # @return [Object] instance of policy class with query methods
+    # @since v2.3.2
+    def policy!(record)
+      cached_find(record, &:policy!)
+    end
+
+    # @!endgroup
+
+    # @!group Scopes
+
+    # Retrieves the policy scope for the given record.
+    #
+    # @see https://github.com/varvet/pundit#scopes
+    # @param scope [Object] the object we're retrieving the policy scope for
+    # @raise [InvalidConstructorError] if the policy constructor called incorrectly
+    # @return [Scope{#resolve}, nil] instance of scope class which can resolve to a scope
+    # @since v2.3.2
+    def policy_scope(scope)
+      policy_scope_class = policy_finder(scope).scope
+      return unless policy_scope_class
+
+      begin
+        policy_scope = policy_scope_class.new(user, pundit_model(scope))
+      rescue ArgumentError
+        raise InvalidConstructorError, "Invalid #<#{policy_scope_class}> constructor is called"
+      end
+
+      policy_scope.resolve
+    end
+
+    # Retrieves the policy scope for the given record. Raises if not found.
+    #
+    # @see https://github.com/varvet/pundit#scopes
+    # @param scope [Object] the object we're retrieving the policy scope for
+    # @raise [NotDefinedError] if the policy scope cannot be found
+    # @raise [InvalidConstructorError] if the policy constructor called incorrectly
+    # @return [Scope{#resolve}] instance of scope class which can resolve to a scope
+    # @since v2.3.2
+    def policy_scope!(scope)
+      policy_scope_class = policy_finder(scope).scope!
+
+      begin
+        policy_scope = policy_scope_class.new(user, pundit_model(scope))
+      rescue ArgumentError
+        raise InvalidConstructorError, "Invalid #<#{policy_scope_class}> constructor is called"
+      end
+
+      policy_scope.resolve
+    end
+
+    # @!endgroup
+
+    private
+
+    # @!group Private Helpers
+
+    # Finds a cached policy for the given record, or yields to find one.
+    #
+    # @api private
+    # @param record [Object] the object we're retrieving the policy for
+    # @yield a policy finder if no policy was cached
+    # @yieldparam [PolicyFinder] policy_finder
+    # @yieldreturn [#new(user, model)]
+    # @return [Policy, nil] an instantiated policy
+    # @raise [InvalidConstructorError] if policy can't be instantated
+    # @since v2.3.2
+    def cached_find(record)
+      policy_cache.fetch(user: user, record: record) do
+        klass = yield policy_finder(record)
+        next unless klass
+
+        model = pundit_model(record)
+
+        begin
+          klass.new(user, model)
+        rescue ArgumentError
+          raise InvalidConstructorError, "Invalid #<#{klass}> constructor is called"
+        end
+      end
+    end
+
+    # Return a policy finder for the given record.
+    #
+    # @api private
+    # @return [PolicyFinder]
+    # @since v2.3.2
+    def policy_finder(record)
+      PolicyFinder.new(record)
+    end
+
+    # Given a possibly namespaced record, return the actual record.
+    #
+    # @api private
+    # @since v2.3.2
+    def pundit_model(record)
+      record.is_a?(Array) ? record.last : record
+    end
+  end
+end

data/pundit-2.5.2/lib/pundit/error.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Pundit
+  # @api private
+  # @since v1.0.0
+  # To avoid name clashes with common Error naming when mixing in Pundit,
+  # keep it here with compact class style definition.
+  class Error < StandardError; end
+
+  # Error that will be raised when authorization has failed
+  # @since v0.1.0
+  class NotAuthorizedError < Error
+    # @see #initialize
+    # @since v0.2.3
+    attr_reader :query
+    # @see #initialize
+    # @since v0.2.3
+    attr_reader :record
+    # @see #initialize
+    # @since v0.2.3
+    attr_reader :policy
+
+    # @since v1.0.0
+    #
+    # @overload initialize(message)
+    #   Create an error with a simple error message.
+    #   @param [String] message A simple error message string.
+    #
+    # @overload initialize(options)
+    #   Create an error with the specified attributes.
+    #   @param [Hash] options The error options.
+    #   @option options [String] :message Optional custom error message. Will default to a generalized message.
+    #   @option options [Symbol] :query The name of the policy method that was checked.
+    #   @option options [Object] :record The object that was being checked with the policy.
+    #   @option options [Class] :policy The class of policy that was used for the check.
+    def initialize(options = {})
+      if options.is_a? String
+        message = options
+      else
+        @query  = options[:query]
+        @record = options[:record]
+        @policy = options[:policy]
+
+        message = options.fetch(:message) do
+          record_name = record.is_a?(Class) ? record.to_s : "this #{record.class}"
+          "not allowed to #{policy.class}##{query} #{record_name}"
+        end
+      end
+
+      super(message)
+    end
+  end
+
+  # Error that will be raised if a policy or policy scope constructor is not called correctly.
+  # @since v2.0.0
+  class InvalidConstructorError < Error; end
+
+  # Error that will be raised if a controller action has not called the
+  # `authorize` or `skip_authorization` methods.
+  # @since v0.2.3
+  class AuthorizationNotPerformedError < Error; end
+
+  # Error that will be raised if a controller action has not called the
+  # `policy_scope` or `skip_policy_scope` methods.
+  # @since v0.3.0
+  class PolicyScopingNotPerformedError < AuthorizationNotPerformedError; end
+
+  # Error that will be raised if a policy or policy scope is not defined.
+  # @since v0.1.0
+  class NotDefinedError < Error; end
+end

data/pundit-2.5.2/lib/pundit/helper.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Pundit
+  # Rails view helpers, to allow a slightly different view-specific
+  # implementation of the methods in {Pundit::Authorization}.
+  #
+  # @api private
+  # @since v1.0.0
+  module Helper
+    # @see Pundit::Authorization#pundit_policy_scope
+    # @since v1.0.0
+    def policy_scope(scope)
+      pundit_policy_scope(scope)
+    end
+  end
+end

data/pundit-2.5.2/lib/pundit/policy_finder.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+# String#safe_constantize, String#demodulize, String#underscore, String#camelize
+require "active_support/core_ext/string/inflections"
+
+module Pundit
+  # Finds policy and scope classes for given object.
+  # @since v0.1.0
+  # @api public
+  # @example
+  #   user = User.find(params[:id])
+  #   finder = PolicyFinder.new(user)
+  #   finder.policy #=> UserPolicy
+  #   finder.scope #=> UserPolicy::Scope
+  #
+  class PolicyFinder
+    # A constant applied to the end of the class name to find the policy class.
+    #
+    # @api private
+    # @since v2.5.0
+    SUFFIX = "Policy"
+
+    # @see #initialize
+    # @since v0.1.0
+    attr_reader :object
+
+    # @param object [any] the object to find policy and scope classes for
+    # @since v0.1.0
+    def initialize(object)
+      @object = object
+    end
+
+    # @return [nil, Scope{#resolve}] scope class which can resolve to a scope
+    # @see https://github.com/varvet/pundit#scopes
+    # @example
+    #   scope = finder.scope #=> UserPolicy::Scope
+    #   scope.resolve #=> <#ActiveRecord::Relation ...>
+    #
+    # @since v0.1.0
+    def scope
+      "#{policy}::Scope".safe_constantize
+    end
+
+    # @return [nil, Class] policy class with query methods
+    # @see https://github.com/varvet/pundit#policies
+    # @example
+    #   policy = finder.policy #=> UserPolicy
+    #   policy.show? #=> true
+    #   policy.update? #=> false
+    #
+    # @since v0.1.0
+    def policy
+      klass = find(object)
+      klass.is_a?(String) ? klass.safe_constantize : klass
+    end
+
+    # @return [Scope{#resolve}] scope class which can resolve to a scope
+    # @raise [NotDefinedError] if scope could not be determined
+    #
+    # @since v0.1.0
+    def scope!
+      scope or raise NotDefinedError, "unable to find scope `#{find(object)}::Scope` for `#{object.inspect}`"
+    end
+
+    # @return [Class] policy class with query methods
+    # @raise [NotDefinedError] if policy could not be determined
+    #
+    # @since v0.1.0
+    def policy!
+      policy or raise NotDefinedError, "unable to find policy `#{find(object)}` for `#{object.inspect}`"
+    end
+
+    # @return [String] the name of the key this object would have in a params hash
+    #
+    # @since v1.1.0
+    def param_key # rubocop:disable Metrics/AbcSize
+      model = object.is_a?(Array) ? object.last : object
+
+      if model.respond_to?(:model_name)
+        model.model_name.param_key.to_s
+      elsif model.is_a?(Class)
+        model.to_s.demodulize.underscore
+      else
+        model.class.to_s.demodulize.underscore
+      end
+    end
+
+    private
+
+    # Given an object, find the policy class name.
+    #
+    # Uses recursion to handle namespaces.
+    #
+    # @return [String, Class] the policy class, or its name.
+    # @since v0.2.0
+    def find(subject)
+      if subject.is_a?(Array)
+        modules = subject.dup
+        last = modules.pop
+        context = modules.map { |x| find_class_name(x) }.join("::")
+        [context, find(last)].join("::")
+      elsif subject.respond_to?(:policy_class)
+        subject.policy_class
+      elsif subject.class.respond_to?(:policy_class)
+        subject.class.policy_class
+      else
+        klass = find_class_name(subject)
+        "#{klass}#{SUFFIX}"
+      end
+    end
+
+    # Given an object, find its' class name.
+    #
+    # - Supports ActiveModel.
+    # - Supports regular classes.
+    # - Supports symbols.
+    # - Supports object instances.
+    #
+    # @return [String, Class] the class, or its name.
+    # @since v1.1.0
+    def find_class_name(subject)
+      if subject.respond_to?(:model_name)
+        subject.model_name
+      elsif subject.class.respond_to?(:model_name)
+        subject.class.model_name
+      elsif subject.is_a?(Class)
+        subject
+      elsif subject.is_a?(Symbol)
+        subject.to_s.camelize
+      else
+        subject.class
+      end
+    end
+  end
+end

data/pundit-2.5.2/lib/pundit/railtie.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Pundit
+  # @since v2.5.0
+  class Railtie < Rails::Railtie
+    if Rails.version.to_f >= 8.0
+      initializer "pundit.stats_directories" do
+        require "rails/code_statistics"
+
+        if Rails.root.join("app/policies").directory?
+          Rails::CodeStatistics.register_directory("Policies", "app/policies")
+        end
+
+        if Rails.root.join("test/policies").directory?
+          Rails::CodeStatistics.register_directory("Policy tests", "test/policies", test_directory: true)
+        end
+      end
+    end
+  end
+end

data/pundit-2.5.2/lib/pundit/rspec.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "pundit"
+# Array#to_sentence
+require "active_support/core_ext/array/conversions"
+
+module Pundit
+  # Namespace for Pundit's RSpec integration.
+  # @since v0.1.0
+  module RSpec
+    # Namespace for Pundit's RSpec matchers.
+    module Matchers
+      extend ::RSpec::Matchers::DSL
+
+      # @!method description=(description)
+      class << self
+        # Used to build a suitable description for the Pundit `permit` matcher.
+        # @api public
+        # @param value [String, Proc]
+        # @example
+        #   Pundit::RSpec::Matchers.description = ->(user, record) do
+        #     "permit user with role #{user.role} to access record with ID #{record.id}"
+        #   end
+        attr_writer :description
+
+        # Used to retrieve a suitable description for the Pundit `permit` matcher.
+        # @api private
+        # @private
+        def description(user, record)
+          return @description.call(user, record) if defined?(@description) && @description.respond_to?(:call)
+
+          @description
+        end
+      end
+
+      # rubocop:disable Metrics/BlockLength
+      matcher :permit do |user, record|
+        match_proc = lambda do |policy|
+          @violating_permissions = permissions.find_all do |permission|
+            !policy.new(user, record).public_send(permission)
+          end
+          @violating_permissions.empty?
+        end
+
+        match_when_negated_proc = lambda do |policy|
+          @violating_permissions = permissions.find_all do |permission|
+            policy.new(user, record).public_send(permission)
+          end
+          @violating_permissions.empty?
+        end
+
+        failure_message_proc = lambda do |policy|
+          "Expected #{policy} to grant #{permissions.to_sentence} on " \
+          "#{record} but #{@violating_permissions.to_sentence} #{was_or_were} not granted"
+        end
+
+        failure_message_when_negated_proc = lambda do |policy|
+          "Expected #{policy} not to grant #{permissions.to_sentence} on " \
+          "#{record} but #{@violating_permissions.to_sentence} #{was_or_were} granted"
+        end
+
+        def was_or_were
+          if @violating_permissions.count > 1
+            "were"
+          else
+            "was"
+          end
+        end
+
+        description do
+          Pundit::RSpec::Matchers.description(user, record) || super()
+        end
+
+        if respond_to?(:match_when_negated)
+          match(&match_proc)
+          match_when_negated(&match_when_negated_proc)
+          failure_message(&failure_message_proc)
+          failure_message_when_negated(&failure_message_when_negated_proc)
+        else
+          # :nocov:
+          # Compatibility with RSpec < 3.0, released 2014-06-01.
+          match_for_should(&match_proc)
+          match_for_should_not(&match_when_negated_proc)
+          failure_message_for_should(&failure_message_proc)
+          failure_message_for_should_not(&failure_message_when_negated_proc)
+          # :nocov:
+        end
+
+        if ::RSpec.respond_to?(:current_example)
+          def current_example
+            ::RSpec.current_example
+          end
+        else
+          # :nocov:
+          # Compatibility with RSpec < 3.0, released 2014-06-01.
+          def current_example
+            example
+          end
+          # :nocov:
+        end
+
+        def permissions
+          current_example.metadata.fetch(:permissions) do
+            raise KeyError, <<~ERROR.strip
+              No permissions in example metadata, did you forget to wrap with `permissions :show?, ...`?
+            ERROR
+          end
+        end
+      end
+      # rubocop:enable Metrics/BlockLength
+    end
+
+    # Mixed in to all policy example groups to provide a DSL.
+    module DSL
+      # @example
+      #   describe PostPolicy do
+      #     permissions :show?, :update? do
+      #       it { is_expected.to permit(user, own_post) }
+      #     end
+      #   end
+      #
+      # @example focused example group
+      #   describe PostPolicy do
+      #     permissions :show?, :update?, :focus do
+      #       it { is_expected.to permit(user, own_post) }
+      #     end
+      #   end
+      #
+      # @param list [Symbol, Array<Symbol>] a permission to describe
+      # @return [void]
+      def permissions(*list, &block)
+        metadata = { permissions: list, caller: caller }
+
+        if list.last == :focus
+          list.pop
+          metadata[:focus] = true
+        end
+
+        description = list.to_sentence
+        describe(description, metadata) { instance_eval(&block) }
+      end
+    end
+
+    # Mixed in to all policy example groups.
+    #
+    # @private not useful
+    module PolicyExampleGroup
+      include Pundit::RSpec::Matchers
+
+      def self.included(base)
+        base.metadata[:type] = :policy
+        base.extend Pundit::RSpec::DSL
+        super
+      end
+    end
+  end
+end
+
+RSpec.configure do |config|
+  config.include(
+    Pundit::RSpec::PolicyExampleGroup,
+    type: :policy,
+    file_path: %r{spec/policies}
+  )
+end

data/pundit-2.5.2/lib/pundit/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module Pundit
+  # The current version of Pundit.
+  VERSION = "2.5.2"
+end

data/pundit-2.5.2/lib/pundit.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "active_support"
+
+require "pundit/version"
+require "pundit/error"
+require "pundit/policy_finder"
+require "pundit/context"
+require "pundit/authorization"
+require "pundit/helper"
+require "pundit/cache_store"
+require "pundit/cache_store/null_store"
+require "pundit/cache_store/legacy_store"
+require "pundit/railtie" if defined?(Rails)
+
+# Hello? Yes, this is Pundit.
+#
+# @api public
+module Pundit
+  # @api private
+  # @since v1.0.0
+  # @deprecated See {Pundit::PolicyFinder}
+  SUFFIX = Pundit::PolicyFinder::SUFFIX
+
+  # @api private
+  # @private
+  # @since v0.1.0
+  module Generators; end
+
+  def self.included(base)
+    location = caller_locations(1, 1).first
+    warn <<~WARNING
+      'include Pundit' is deprecated. Please use 'include Pundit::Authorization' instead.
+       (called from #{location.label} at #{location.path}:#{location.lineno})
+    WARNING
+    base.include Authorization
+  end
+
+  class << self
+    # @see Pundit::Context#authorize
+    # @since v1.0.0
+    def authorize(user, record, query, policy_class: nil, cache: nil)
+      context = if cache
+        policy_cache = CacheStore::LegacyStore.new(cache)
+        Context.new(user: user, policy_cache: policy_cache)
+      else
+        Context.new(user: user)
+      end
+
+      context.authorize(record, query: query, policy_class: policy_class)
+    end
+
+    # @see Pundit::Context#policy_scope
+    # @since v0.1.0
+    def policy_scope(user, *args, **kwargs, &block)
+      Context.new(user: user).policy_scope(*args, **kwargs, &block)
+    end
+
+    # @see Pundit::Context#policy_scope!
+    # @since v0.1.0
+    def policy_scope!(user, *args, **kwargs, &block)
+      Context.new(user: user).policy_scope!(*args, **kwargs, &block)
+    end
+
+    # @see Pundit::Context#policy
+    # @since v0.1.0
+    def policy(user, *args, **kwargs, &block)
+      Context.new(user: user).policy(*args, **kwargs, &block)
+    end
+
+    # @see Pundit::Context#policy!
+    # @since v0.1.0
+    def policy!(user, *args, **kwargs, &block)
+      Context.new(user: user).policy!(*args, **kwargs, &block)
+    end
+  end
+end