protector 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d63379ae173d9c7829a3e9548f3485eb3e3368f2
-  data.tar.gz: 200d5b81d2798dd500daec9437ebb552485f9d2d
+  metadata.gz: b0adb740ad6dcc0053fd159bf424ce0dac2092cf
+  data.tar.gz: 07969057659e1baa91b16806d25efc324389e7c8
 SHA512:
-  metadata.gz: eea5ac34d35862cd89bf724bea5824c4ad17cf45e70fee381f0d156fc1319caf1d9853541ea912395f5b4801f73bd72c41864f3e806a3a1aaae65d1a7a6f88ea
-  data.tar.gz: 6c889caf27a3cb6a22a4685bf9db971fdb9eab8d191580dca569112fec48627c38e53511d32448d990cb021b18a276cddb61968dac795a21552e03904afe494b
+  metadata.gz: 5d40755015122eef231bbe2b755db8440e6e6a38fdf51c82fc1a5d81e629012ff876c3e921b90d4c4a13b6667ad95050b63d3b79cf5207bb1e6767f24f4ef87c
+  data.tar.gz: abef904c2b38cbc1a40b5de0c6bb28e56c14db83cd3fd8e631b9a94d0ececa78356abd93f3e1e4b2651cb019a6f8bac1257e5415324a118d97dd8c323a122b2e

data/lib/protector/adapters/active_record/relation.rb

@@ -10,6 +10,8 @@ module Protector
 
           alias_method_chain :exec_queries, :protector
           alias_method_chain :new, :protector
+          alias_method_chain :create, :protector
+          alias_method_chain :create!, :protector
 
           # AR 3.2 workaround. Come on, guys... SQL parsing :(
           unless method_defined?(:references_values)
@@ -81,6 +83,24 @@ module Protector
           new_without_protector(*args, &block).restrict!(protector_subject)
         end
 
+        def create_with_protector(*args, &block)
+          return create_without_protector(*args, &block) unless protector_subject?
+
+          create_without_protector(*args) do |instance|
+            instance.restrict!(protector_subject)
+            block.call(instance) if block
+          end
+        end
+
+        def create_with_protector!(*args, &block)
+          return create_without_protector!(*args, &block) unless protector_subject?
+
+          create_without_protector!(*args) do |instance|
+            instance.restrict!(protector_subject)
+            block.call(instance) if block
+          end
+        end
+
         # Patches current relation to fulfill restriction and call real `exec_queries`
         #
         # Patching includes:
@@ -114,8 +134,8 @@ module Protector
         # Swaps `includes` with `preload` if it's not referenced or merges
         # security scope of proper class otherwise
         def protector_substitute_includes(subject, relation)
-          if eager_loading?
-            protector_expand_inclusion(includes_values + eager_load_values).each do |klass, path|
+          if relation.eager_loading?
+            protector_expand_inclusion(relation.includes_values + relation.eager_load_values).each do |klass, path|
               # AR drops default_scope for eagerly loadable associations
               # https://github.com/inossidabile/protector/issues/3
               # and so should we

data/lib/protector/version.rb

@@ -1,4 +1,4 @@
 module Protector
   # Gem version
-  VERSION = "0.6.0"
+  VERSION = "0.6.1"
 end

data/spec/lib/adapters/active_record_spec.rb

@@ -76,6 +76,24 @@ if defined?(ActiveRecord)
       end
 
       it_behaves_like "a model"
+
+      it "validates on create" do
+        dummy.instance_eval do
+          protect do; end
+        end
+
+        instance = dummy.restrict!('!').create(string: 'test')
+        instance.errors[:base].should == ["Access denied to 'string'"]
+        instance.delete
+      end
+
+      it "validates on create!" do
+        dummy.instance_eval do
+          protect do; end
+        end
+
+        expect { dummy.restrict!('!').create!(string: 'test').delete }.to raise_error
+      end
     end
 
     #
@@ -229,6 +247,25 @@ if defined?(ActiveRecord)
           end
         end
       end
+
+      context "complicated features" do
+        # https://github.com/inossidabile/protector/commit/7ce072aa2074e0f3b48e293b952810f720bc143d
+        it "handles scopes with includes" do
+          fluffy = Class.new(ActiveRecord::Base) do
+            def self.name; 'Fluffy'; end
+            def self.model_name; ActiveModel::Name.new(self, nil, "fluffy"); end
+            self.table_name = "fluffies"
+            scope :none, where('1 = 0') unless respond_to?(:none)
+            belongs_to :dummy, class_name: 'Dummy'
+
+            protect do
+              scope { includes(:dummy).where(dummies: {id: 1}) }
+            end
+          end
+
+          expect { fluffy.restrict!('!').to_a }.to_not raise_error
+        end
+      end
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: protector
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Boris Staal
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-26 00:00:00.000000000 Z
+date: 2013-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport