protector 0.1.1 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4d35910dd47bbaec6c4fa77c49edb1643b7ab614
-  data.tar.gz: 6d7e0b11f3c750004281dc432372d8e6e9b01cad
+  metadata.gz: 75c42dc51baa287fb4d302415f78e383687b88b0
+  data.tar.gz: e11a06fc1a46d40deeb04c36295e5efce4795bbf
 SHA512:
-  metadata.gz: 41f684019bb41d363579165474abfc9b280bd9bbaad66bd034b4735fe1a1acb8404941dd9d3f269969e44945fa42b612bb393b508f3be2ed147b8a9878830e58
-  data.tar.gz: 2cbf62c1a0da1f6ae6e15d97677cd5594641bcda24987460648625fdad83a163fdf5f0c6e7c35b2041bbdef65ea3ec040a49fd01f4cc4ddfc1b9e7acd56e24c9
+  metadata.gz: c5c613251c76af90245f55031a26711a193f84474e86d68f352b2afb1d9afb3fd9c77a92faaa396816f00dcf0a579a548fc242766920e600318dd73a1d0e87f0
+  data.tar.gz: 14f326b243705cdfd75bf132b42c04a8d9e06db85ee6ffa69d9e955251cabe936da2d99a4ecafdd7fe6beb99e01512a84b4e705e7b80e49f1dc242a0017633e8

data/Appraisals

@@ -7,3 +7,11 @@ appraise "AR_4" do
   gem "activerecord", "4.0.0.rc1", require: "active_record"
   gem "activerecord-jdbcsqlite3-adapter", platform: :jruby, github: "jruby/activerecord-jdbc-adapter"
 end
+
+appraise "Sequel" do
+  gem "sequel", "3.30.0"
+end
+
+# appraise "Mongoid" do
+#   gem "mongoid", ">= 3.1.4"
+# end

data/Gemfile

@@ -11,4 +11,8 @@ gem 'guard-rspec'
 gem 'appraisal'
 
 gem 'sqlite3', platform: :ruby
-gem 'jdbc-sqlite3', platform: :jruby
+gem 'jdbc-sqlite3', platform: :jruby, require: 'jdbc/sqlite3'
+
+gem 'coveralls', require: false
+
+gem 'ruby-prof', platform: :ruby

data/README.md

@@ -1,19 +1,22 @@
 # Protector
 
+[![Gem Version](https://badge.fury.io/rb/protector.png)](http://badge.fury.io/rb/protector)
 [![Build Status](https://travis-ci.org/inossidabile/protector.png?branch=master)](https://travis-ci.org/inossidabile/protector)
 [![Code Climate](https://codeclimate.com/github/inossidabile/protector.png)](https://codeclimate.com/github/inossidabile/protector)
+<!-- [![Coverage Status](https://coveralls.io/repos/inossidabile/protector/badge.png?branch=master)](https://coveralls.io/r/inossidabile/protector?branch=master) -->
 
 Protector is a Ruby ORM extension for managing security restrictions on a field level. The gem favors white-listing over black-listing (everything is disallowed by default), convention over configuration and is duck-type compatible with most of existing code.
 
 Currently Protector supports the following ORM adapters:
 
   * [ActiveRecord](http://guides.rubyonrails.org/active_record_querying.html) (>= 3.2.9)
+  * [Sequel](http://sequel.rubyforge.org/) (>= 3.30.0)
 
 We are working hard to extend the list with:
 
-  * [Sequel](http://sequel.rubyforge.org/)
-  * [DataMapper](http://datamapper.org/)
   * [Mongoid](http://mongoid.org/en/mongoid/index.html)
+  * [ROM](https://github.com/rom-rb/rom)
+  * [DataMapper](http://datamapper.org/) (its undead so it might be skipped)
 
 ## Basics
 
@@ -115,7 +118,7 @@ Remember however that auto-restriction is only enabled for reading. Passing a mo
 
 ## Eager Loading
 
-To take a long story short: it works and you are very likely to never notice changes it introduces to the process.
+To take a long story short: it works and you are very likely to never notice changes it introduces to the process. But it might behave unexpected (yet mathematically correct) in complex cases.
 
 Eager Loading has 2 possible strategies: JOINs and additional requests. Whenever you mark an association to preload and at the same time use this relation among `where` clause – ORMs prefer JOIN. Otherwise it goes with additional requests.
 
@@ -124,15 +127,21 @@ Foo.includes(:bars)                                  # This will make 2 queries
 Foo.includes(:bars).where(bars: {absolute: true})    # This will make 1 big JOINfull query
 ```
 
-The problem here is that JOIN strategy is impossible for scoped restrictions. I.e. for the following code:
+The problem here is that JOIN strategy makes restriction scopes overlap. With the following query:
 
 ```ruby
-Foo.restrict(current_user).includes(:bars).where(bars: {absolute: true})
+Foo.restrict!(current_user).includes(:bars).where(bars: {absolute: true})
 ```
 
-we can appear in the situation where `foos` and `bars` relations are having different restrictions scopes. In this case JOIN would filter by an intersection of scopes which is wrong.
+we can appear in the situation where `foos` and `bars` relations are having different restrictions scopes. In this case JOIN will filter by an intersection of scopes which is important to understand. You might not get all `Foo` entries you expect with such where clause since they might appear filtered out by the restriction scope of `Bar`.
 
-To solve the issue Protector forces additional requests strategy and intelligently adds proper JOINs to the general query to make your conditions work. That's why unlike unrestricted query from the first sample, the code from the second sample will result into 2 queries.
+If you don't want `Bar` scope to affect `Foo` selection, you can modify the query as follows:
+
+```ruby
+Foo.restrict!(current_user).preload(:bars).join(:bars).where(bars: {absolute: true})
+```
+
+Such chain will force the usage of an additional request so the first query will not be scoped with `Bar` restriction.
 
 ## Ideology
 

data/gemfiles/AR_3.2.gemfile

@@ -10,7 +10,9 @@ gem "guard"
 gem "guard-rspec"
 gem "appraisal"
 gem "sqlite3", :platform=>:ruby
-gem "jdbc-sqlite3", :platform=>:jruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "coveralls", :require=>false
+gem "ruby-prof", :platform=>:ruby
 gem "activerecord", "3.2.9", :require=>"active_record"
 gem "activerecord-jdbcsqlite3-adapter", :platform=>:jruby, :github=>"jruby/activerecord-jdbc-adapter"
 

data/gemfiles/AR_3.2.gemfile.lock

@@ -1,12 +1,16 @@
 GIT
   remote: git://github.com/jruby/activerecord-jdbc-adapter.git
-  revision: 180dd863d30d6048c914622e4e77f018cf77026a
+  revision: a77ac76d2adda35d01aa9d66cafa324b2953e5ea
   specs:
+    activerecord-jdbc-adapter (1.3.0.beta2)
+    activerecord-jdbcsqlite3-adapter (1.3.0.beta2)
+      activerecord-jdbc-adapter (~> 1.3.0.beta2)
+      jdbc-sqlite3 (~> 3.7.2)
 
 PATH
   remote: /Users/inossidabile/Repos/protector
   specs:
-    protector (0.1.0)
+    protector (0.2.1)
       activesupport
       i18n
 
@@ -31,8 +35,16 @@ GEM
     builder (3.0.4)
     coderay (1.0.9)
     colored (1.2)
+    colorize (0.5.8)
+    coveralls (0.6.7)
+      colorize
+      multi_json (~> 1.3)
+      rest-client
+      simplecov (>= 0.7)
+      thor
     diff-lcs (1.2.4)
     ffi (1.8.1)
+    ffi (1.8.1-java)
     formatador (0.2.4)
     guard (1.8.0)
       formatador (>= 0.2.4)
@@ -44,23 +56,32 @@ GEM
       guard (>= 1.8)
       rspec (~> 2.13)
     i18n (0.6.4)
+    jdbc-sqlite3 (3.7.2)
     listen (1.1.3)
       rb-fsevent (>= 0.9.3)
       rb-inotify (>= 0.9)
       rb-kqueue (>= 0.2)
     lumberjack (1.0.3)
     method_source (0.8.1)
+    mime-types (1.23)
     multi_json (1.7.4)
     pry (0.9.12.2)
       coderay (~> 1.0.5)
       method_source (~> 0.8)
       slop (~> 3.4)
+    pry (0.9.12.2-java)
+      coderay (~> 1.0.5)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+      spoon (~> 0.0)
     rake (10.0.4)
     rb-fsevent (0.9.3)
     rb-inotify (0.9.0)
       ffi (>= 0.5.0)
     rb-kqueue (0.2.0)
       ffi (>= 0.5.0)
+    rest-client (1.6.7)
+      mime-types (>= 1.16)
     rspec (2.13.0)
       rspec-core (~> 2.13.0)
       rspec-expectations (~> 2.13.0)
@@ -69,12 +90,20 @@ GEM
     rspec-expectations (2.13.0)
       diff-lcs (>= 1.1.3, < 2.0)
     rspec-mocks (2.13.1)
+    ruby-prof (0.13.0)
+    simplecov (0.7.1)
+      multi_json (~> 1.0)
+      simplecov-html (~> 0.7.1)
+    simplecov-html (0.7.1)
     slop (3.4.5)
+    spoon (0.0.4)
+      ffi
     sqlite3 (1.3.7)
     thor (0.18.1)
     tzinfo (0.3.37)
 
 PLATFORMS
+  java
   ruby
 
 DEPENDENCIES
@@ -82,6 +111,7 @@ DEPENDENCIES
   activerecord-jdbcsqlite3-adapter!
   appraisal
   colored
+  coveralls
   guard
   guard-rspec
   jdbc-sqlite3
@@ -89,4 +119,5 @@ DEPENDENCIES
   pry
   rake
   rspec
+  ruby-prof
   sqlite3

data/gemfiles/AR_4.gemfile

@@ -10,7 +10,9 @@ gem "guard"
 gem "guard-rspec"
 gem "appraisal"
 gem "sqlite3", :platform=>:ruby
-gem "jdbc-sqlite3", :platform=>:jruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "coveralls", :require=>false
+gem "ruby-prof", :platform=>:ruby
 gem "activerecord", "4.0.0.rc1", :require=>"active_record"
 gem "activerecord-jdbcsqlite3-adapter", :platform=>:jruby, :github=>"jruby/activerecord-jdbc-adapter"
 

data/gemfiles/AR_4.gemfile.lock

@@ -9,7 +9,7 @@ GIT
 PATH
   remote: /Users/inossidabile/Repos/protector
   specs:
-    protector (0.1.0)
+    protector (0.2.1)
       activesupport
       i18n
 
@@ -41,6 +41,13 @@ GEM
     builder (3.1.4)
     coderay (1.0.9)
     colored (1.2)
+    colorize (0.5.8)
+    coveralls (0.6.7)
+      colorize
+      multi_json (~> 1.3)
+      rest-client
+      simplecov (>= 0.7)
+      thor
     diff-lcs (1.2.4)
     ffi (1.8.1)
     ffi (1.8.1-java)
@@ -62,6 +69,7 @@ GEM
       rb-kqueue (>= 0.2)
     lumberjack (1.0.3)
     method_source (0.8.1)
+    mime-types (1.23)
     minitest (4.7.4)
     multi_json (1.7.3)
     pry (0.9.12.2)
@@ -79,6 +87,8 @@ GEM
       ffi (>= 0.5.0)
     rb-kqueue (0.2.0)
       ffi (>= 0.5.0)
+    rest-client (1.6.7)
+      mime-types (>= 1.16)
     rspec (2.13.0)
       rspec-core (~> 2.13.0)
       rspec-expectations (~> 2.13.0)
@@ -87,6 +97,11 @@ GEM
     rspec-expectations (2.13.0)
       diff-lcs (>= 1.1.3, < 2.0)
     rspec-mocks (2.13.1)
+    ruby-prof (0.13.0)
+    simplecov (0.7.1)
+      multi_json (~> 1.0)
+      simplecov-html (~> 0.7.1)
+    simplecov-html (0.7.1)
     slop (3.4.5)
     spoon (0.0.4)
       ffi
@@ -105,6 +120,7 @@ DEPENDENCIES
   activerecord-jdbcsqlite3-adapter!
   appraisal
   colored
+  coveralls
   guard
   guard-rspec
   jdbc-sqlite3
@@ -112,4 +128,5 @@ DEPENDENCIES
   pry
   rake
   rspec
+  ruby-prof
   sqlite3

data/gemfiles/Mongoid.gemfile

@@ -0,0 +1,17 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "guard"
+gem "guard-rspec"
+gem "appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby
+gem "coveralls", :require=>false
+gem "mongoid", ">= 3.1.4"
+
+gemspec :path=>"../"

data/gemfiles/Mongoid.gemfile.lock

@@ -0,0 +1,112 @@
+PATH
+  remote: /Users/inossidabile/Repos/protector
+  specs:
+    protector (0.1.1)
+      activesupport
+      i18n
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activemodel (3.2.13)
+      activesupport (= 3.2.13)
+      builder (~> 3.0.0)
+    activesupport (3.2.13)
+      i18n (= 0.6.1)
+      multi_json (~> 1.0)
+    appraisal (0.5.2)
+      bundler
+      rake
+    builder (3.0.4)
+    coderay (1.0.9)
+    colored (1.2)
+    colorize (0.5.8)
+    coveralls (0.6.7)
+      colorize
+      multi_json (~> 1.3)
+      rest-client
+      simplecov (>= 0.7)
+      thor
+    diff-lcs (1.2.4)
+    ffi (1.8.1)
+    ffi (1.8.1-java)
+    formatador (0.2.4)
+    guard (1.8.0)
+      formatador (>= 0.2.4)
+      listen (>= 1.0.0)
+      lumberjack (>= 1.0.2)
+      pry (>= 0.9.10)
+      thor (>= 0.14.6)
+    guard-rspec (3.0.1)
+      guard (>= 1.8)
+      rspec (~> 2.13)
+    i18n (0.6.1)
+    jdbc-sqlite3 (3.7.2.1)
+    listen (1.1.4)
+      rb-fsevent (>= 0.9.3)
+      rb-inotify (>= 0.9)
+      rb-kqueue (>= 0.2)
+    lumberjack (1.0.3)
+    method_source (0.8.1)
+    mime-types (1.23)
+    mongoid (3.1.4)
+      activemodel (~> 3.2)
+      moped (~> 1.4)
+      origin (~> 1.0)
+      tzinfo (~> 0.3.22)
+    moped (1.5.0)
+    multi_json (1.7.5)
+    origin (1.1.0)
+    pry (0.9.12.2)
+      coderay (~> 1.0.5)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+    pry (0.9.12.2-java)
+      coderay (~> 1.0.5)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+      spoon (~> 0.0)
+    rake (10.0.4)
+    rb-fsevent (0.9.3)
+    rb-inotify (0.9.0)
+      ffi (>= 0.5.0)
+    rb-kqueue (0.2.0)
+      ffi (>= 0.5.0)
+    rest-client (1.6.7)
+      mime-types (>= 1.16)
+    rspec (2.13.0)
+      rspec-core (~> 2.13.0)
+      rspec-expectations (~> 2.13.0)
+      rspec-mocks (~> 2.13.0)
+    rspec-core (2.13.1)
+    rspec-expectations (2.13.0)
+      diff-lcs (>= 1.1.3, < 2.0)
+    rspec-mocks (2.13.1)
+    simplecov (0.7.1)
+      multi_json (~> 1.0)
+      simplecov-html (~> 0.7.1)
+    simplecov-html (0.7.1)
+    slop (3.4.5)
+    spoon (0.0.4)
+      ffi
+    sqlite3 (1.3.7)
+    thor (0.18.1)
+    tzinfo (0.3.37)
+
+PLATFORMS
+  java
+  ruby
+
+DEPENDENCIES
+  appraisal
+  colored
+  coveralls
+  guard
+  guard-rspec
+  jdbc-sqlite3
+  mongoid (>= 3.1.4)
+  protector!
+  pry
+  rake
+  rspec
+  sqlite3

data/gemfiles/Sequel.gemfile

@@ -0,0 +1,18 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "guard"
+gem "guard-rspec"
+gem "appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "coveralls", :require=>false
+gem "ruby-prof", :platform=>:ruby
+gem "sequel", "3.30.0"
+
+gemspec :path=>"../"

data/gemfiles/Sequel.gemfile.lock

@@ -0,0 +1,103 @@
+PATH
+  remote: /Users/inossidabile/Repos/protector
+  specs:
+    protector (0.2.1)
+      activesupport
+      i18n
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    activesupport (3.2.12)
+      i18n (~> 0.6)
+      multi_json (~> 1.0)
+    appraisal (0.5.2)
+      bundler
+      rake
+    coderay (1.0.9)
+    colored (1.2)
+    colorize (0.5.8)
+    coveralls (0.6.7)
+      colorize
+      multi_json (~> 1.3)
+      rest-client
+      simplecov (>= 0.7)
+      thor
+    diff-lcs (1.2.4)
+    ffi (1.8.1)
+    ffi (1.8.1-java)
+    formatador (0.2.4)
+    guard (1.8.0)
+      formatador (>= 0.2.4)
+      listen (>= 1.0.0)
+      lumberjack (>= 1.0.2)
+      pry (>= 0.9.10)
+      thor (>= 0.14.6)
+    guard-rspec (3.0.1)
+      guard (>= 1.8)
+      rspec (~> 2.13)
+    i18n (0.6.4)
+    jdbc-sqlite3 (3.7.2.1)
+    listen (1.1.4)
+      rb-fsevent (>= 0.9.3)
+      rb-inotify (>= 0.9)
+      rb-kqueue (>= 0.2)
+    lumberjack (1.0.3)
+    method_source (0.8.1)
+    mime-types (1.23)
+    multi_json (1.7.5)
+    pry (0.9.12.2)
+      coderay (~> 1.0.5)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+    pry (0.9.12.2-java)
+      coderay (~> 1.0.5)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+      spoon (~> 0.0)
+    rake (10.0.4)
+    rb-fsevent (0.9.3)
+    rb-inotify (0.9.0)
+      ffi (>= 0.5.0)
+    rb-kqueue (0.2.0)
+      ffi (>= 0.5.0)
+    rest-client (1.6.7)
+      mime-types (>= 1.16)
+    rspec (2.13.0)
+      rspec-core (~> 2.13.0)
+      rspec-expectations (~> 2.13.0)
+      rspec-mocks (~> 2.13.0)
+    rspec-core (2.13.1)
+    rspec-expectations (2.13.0)
+      diff-lcs (>= 1.1.3, < 2.0)
+    rspec-mocks (2.13.1)
+    ruby-prof (0.13.0)
+    sequel (3.30.0)
+    simplecov (0.7.1)
+      multi_json (~> 1.0)
+      simplecov-html (~> 0.7.1)
+    simplecov-html (0.7.1)
+    slop (3.4.5)
+    spoon (0.0.4)
+      ffi
+    sqlite3 (1.3.7)
+    thor (0.18.1)
+
+PLATFORMS
+  java
+  ruby
+
+DEPENDENCIES
+  appraisal
+  colored
+  coveralls
+  guard
+  guard-rspec
+  jdbc-sqlite3
+  protector!
+  pry
+  rake
+  rspec
+  ruby-prof
+  sequel (= 3.30.0)
+  sqlite3

data/lib/protector/adapters/active_record/base.rb

@@ -1,7 +1,7 @@
 module Protector
   module Adapters
     module ActiveRecord
-      # Pathces `ActiveRecord::Base`
+      # Patches `ActiveRecord::Base`
       module Base
         extend ActiveSupport::Concern
 
@@ -9,18 +9,15 @@ module Protector
           include Protector::DSL::Base
           include Protector::DSL::Entry
 
-          ObjectSpace.each_object(Class).each do |c|
-            c.undefine_attribute_methods if c < self
+          ObjectSpace.each_object(Class).each do |klass|
+            klass.undefine_attribute_methods if klass < self
           end
 
-          validate(on: :create) do
+          validate do
             return unless @protector_subject
-            errors[:base] << I18n.t('protector.invalid') unless creatable?
-          end
-
-          validate(on: :update) do
-            return unless @protector_subject
-            errors[:base] << I18n.t('protector.invalid') unless updatable?
+            if (new_record? && !creatable?) || (!new_record? && !updatable?)
+              errors[:base] << I18n.t('protector.invalid')
+            end
           end
 
           before_destroy do
@@ -45,7 +42,12 @@ module Protector
           end
 
           def [](name)
-            if !@protector_subject || name == self.class.primary_key || protector_meta.readable?(name)
+            if (
+              !@protector_subject || 
+              name == self.class.primary_key ||
+              (self.class.primary_key.is_a?(Array) && self.class.primary_key.include?(name)) ||
+              protector_meta.readable?(name)
+            )
               read_attribute(name)
             else
               nil
@@ -77,10 +79,6 @@ module Protector
 
         # Storage for {Protector::DSL::Meta::Box}
         def protector_meta
-          unless @protector_subject
-            raise "Unprotected entity detected: use `restrict` method to protect it."
-          end
-
           @protector_meta ||= self.class.protector_meta.evaluate(
             self.class,
             @protector_subject,
@@ -98,13 +96,13 @@ module Protector
 
         # Checks if current model can be created in the context of current subject
         def creatable?
-          fields = HashWithIndifferentAccess[changed.map{|x| [x, read_attribute(x)]}]
+          fields = HashWithIndifferentAccess[changed.map{|field| [field, read_attribute(field)]}]
           protector_meta.creatable?(fields)
         end
 
         # Checks if current model can be updated in the context of current subject
         def updatable?
-          fields = HashWithIndifferentAccess[changed.map{|x| [x, read_attribute(x)]}]
+          fields = HashWithIndifferentAccess[changed.map{|field| [field, read_attribute(field)]}]
           protector_meta.updatable?(fields)
         end