protector 0.7.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6b6f32b7d79bf2d7f9780574d4dbb40c561713ea
-  data.tar.gz: 9bbcc88df9a26dddaed4703eba2b07ae314cff05
+  metadata.gz: 8046a17b4ab071f2e5af6511c48a213eb46a8c8a
+  data.tar.gz: 789efaa941d0b0fa7590b2d91e6a7cbfac879975
 SHA512:
-  metadata.gz: 4bc5bcb7599dfaa7befa6340290d9aa329e98cb967cfbcfa6e122c6c7ca24ed944d3ca4fc42293d67ccb135be0210f0707f39c84463b2e37f4b54ccf5042d396
-  data.tar.gz: 3229c4cb23b9eaf637247d83297b1f6bddd515dd15ea2f30e3db9e747dac6e35d629eb40e69a188d9667d2f150710db8656d453ec16de36bfb4e0d4be928de13
+  metadata.gz: bc9c1a541de4183af641b8b1d5f498d27eb3804e284d0682f83bba43653ba86475165468f9099dd48a1ccbff266d33724dae82a1737a9c57df5cdc839b3a923b
+  data.tar.gz: c863b7e9044aa4e0b46776280be869df766a2e631746efb048c5ed62ecbd71ccdad82987f0abadeafeb3a5cdd700f45c8a479cde2c73e5d31b1990cfb2e95b01

data/.gitignore

@@ -4,7 +4,7 @@
 .config
 .yardoc
 Gemfile.lock
-gemfiles/
+gemfiles/*.lock
 InstalledFiles
 _yardoc
 coverage

data/.travis.yml

@@ -2,3 +2,13 @@ rvm:
   - 1.9.3
   - jruby-19mode
   - 2.0.0
+
+gemfile:
+  - gemfiles/AR_3.2.gemfile
+  - gemfiles/AR_4.gemfile
+  - gemfiles/AR_edge.gemfile
+  - gemfiles/Rails_3.2.gemfile
+  - gemfiles/Rails_4.gemfile
+  - gemfiles/Sequel.gemfile
+
+script: bundle exec rspec

data/Appraisals

@@ -4,7 +4,15 @@ appraise "AR_3.2" do
 end
 
 appraise "AR_4" do
-  gem "activerecord", "4.0.0", require: "active_record"
+  gem "activerecord", "4.0", require: "active_record"
+  gem "activerecord-jdbcsqlite3-adapter", platform: :jruby, github: "jruby/activerecord-jdbc-adapter"
+end
+
+appraise "AR_edge" do
+  gem "activerecord", require: "active_record", github: "rails/rails"
+  gem "activemodel", github: "rails/rails"
+  gem "activesupport", github: "rails/rails"
+  gem "arel", github: "rails/arel"
   gem "activerecord-jdbcsqlite3-adapter", platform: :jruby, github: "jruby/activerecord-jdbc-adapter"
 end
 

data/Gemfile

@@ -8,9 +8,9 @@ gem 'rspec'
 gem 'simplecov', require: false
 gem 'simplecov-summary'
 
-gem 'appraisal'
+gem 'appraisal', github: 'thoughtbot/appraisal'
 
 gem 'sqlite3', platform: :ruby
 gem 'jdbc-sqlite3', platform: :jruby, require: 'jdbc/sqlite3'
 
-gem 'ruby-prof', platform: :ruby
+gem 'ruby-prof', platform: :ruby

data/Rakefile

@@ -8,8 +8,8 @@ RSpec::Core::RakeTask.new(:spec)
 task :default => :all
 
 desc 'Test the plugin under all supported Rails versions.'
-task :all => ["appraisal:install"] do |t|
-  exec('rake appraisal spec')
+task :all do |t|
+  exec('bundle exec appraisal install; bundle exec appraisal rspec')
 end
 
 task :perf do
@@ -23,4 +23,4 @@ task :perf do
       Perf.load a.underscore
     end
   end
-end
+end

data/gemfiles/AR_3.2.gemfile

@@ -0,0 +1,18 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "simplecov", :require=>false
+gem "simplecov-summary"
+gem "appraisal", :github=>"thoughtbot/appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "ruby-prof", :platform=>:ruby
+gem "activerecord", "3.2.9", :require=>"active_record"
+gem "activerecord-jdbcsqlite3-adapter", :platform=>:jruby, :github=>"jruby/activerecord-jdbc-adapter"
+
+gemspec :path=>".././"

data/gemfiles/AR_4.gemfile

@@ -0,0 +1,18 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "simplecov", :require=>false
+gem "simplecov-summary"
+gem "appraisal", :github=>"thoughtbot/appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "ruby-prof", :platform=>:ruby
+gem "activerecord", "4.0", :require=>"active_record"
+gem "activerecord-jdbcsqlite3-adapter", :platform=>:jruby, :github=>"jruby/activerecord-jdbc-adapter"
+
+gemspec :path=>".././"

data/gemfiles/AR_edge.gemfile

@@ -0,0 +1,21 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "simplecov", :require=>false
+gem "simplecov-summary"
+gem "appraisal", :github=>"thoughtbot/appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "ruby-prof", :platform=>:ruby
+gem "activerecord", :require=>"active_record", :github=>"rails/rails"
+gem "activemodel", :github=>"rails/rails"
+gem "activesupport", :github=>"rails/rails"
+gem "arel", :github=>"rails/arel"
+gem "activerecord-jdbcsqlite3-adapter", :platform=>:jruby, :github=>"jruby/activerecord-jdbc-adapter"
+
+gemspec :path=>".././"

data/gemfiles/Rails_3.2.gemfile

@@ -0,0 +1,20 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "simplecov", :require=>false
+gem "simplecov-summary"
+gem "appraisal", :github=>"thoughtbot/appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "ruby-prof", :platform=>:ruby
+gem "combustion", :github=>"pat/combustion", :ref=>"50a946b5a7ab3d9249f0e5fcebbb73488a91b1e5"
+gem "rails", "3.2.13"
+gem "strong_parameters"
+gem "activerecord-jdbcsqlite3-adapter", :platform=>:jruby, :github=>"jruby/activerecord-jdbc-adapter"
+
+gemspec :path=>".././"

data/gemfiles/Rails_4.gemfile

@@ -0,0 +1,19 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "simplecov", :require=>false
+gem "simplecov-summary"
+gem "appraisal", :github=>"thoughtbot/appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "ruby-prof", :platform=>:ruby
+gem "combustion", :github=>"pat/combustion", :ref=>"50a946b5a7ab3d9249f0e5fcebbb73488a91b1e5"
+gem "rails", "4.0.0"
+gem "activerecord-jdbcsqlite3-adapter", :platform=>:jruby, :github=>"jruby/activerecord-jdbc-adapter"
+
+gemspec :path=>".././"

data/gemfiles/Sequel.gemfile

@@ -0,0 +1,17 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rake"
+gem "colored"
+gem "pry"
+gem "rspec"
+gem "simplecov", :require=>false
+gem "simplecov-summary"
+gem "appraisal", :github=>"thoughtbot/appraisal"
+gem "sqlite3", :platform=>:ruby
+gem "jdbc-sqlite3", :platform=>:jruby, :require=>"jdbc/sqlite3"
+gem "ruby-prof", :platform=>:ruby
+gem "sequel", "3.30.0"
+
+gemspec :path=>".././"

data/lib/protector/adapters/active_record/association.rb

@@ -13,6 +13,8 @@ module Protector
             alias_method 'scope_without_protector', 'scoped'
             alias_method 'scoped', 'scope_with_protector'
           end
+
+          alias_method_chain :build, :protector
         end
 
         # Wraps every association with current subject
@@ -21,6 +23,12 @@ module Protector
           scope = scope.restrict!(owner.protector_subject) if owner.protector_subject?
           scope
         end
+
+        # Forwards protection subject to the new instance
+        def build_with_protector(*args, &block)
+          return build_without_protector(*args, &block) unless owner.protector_subject?
+          build_without_protector(*args, &block).restrict!(owner.protector_subject)
+        end
       end
     end
   end

data/lib/protector/adapters/active_record/base.rb

@@ -17,12 +17,12 @@ module Protector
           end
 
           validate do
-            return unless protector_subject?
+            if protector_subject?
+              method = new_record? ? :first_uncreatable_field : :first_unupdatable_field
+              field  = protector_meta.send(method, protector_changed)
 
-            method = new_record? ? :first_uncreatable_field : :first_unupdatable_field
-            field  = protector_meta.send(method, protector_changed)
-
-            errors[:base] << I18n.t('protector.invalid', field: field) if field
+              errors[:base] << I18n.t('protector.invalid', field: field) if field
+            end
           end
 
           before_destroy do

data/lib/protector/adapters/active_record/relation.rb

@@ -42,7 +42,9 @@ module Protector
         end
 
         def protector_relation
-          protector_meta.relation ? merge(protector_meta.relation) : clone
+          result = self.clone
+          result = protector_meta.eval_scope_procs(result) if protector_meta.relation
+          result
         end
 
         # @note Unscoped relation drops properties and therefore should be re-restricted
@@ -92,7 +94,13 @@ module Protector
             Protector::ActiveRecord::StrongParameters.sanitize! args, true, protector_meta
           end
 
-          new_without_protector(*args, &block).restrict!(protector_subject)
+          unless block_given?
+            new_without_protector(*args).restrict!(protector_subject)
+          else
+            new_without_protector(*args) do |instance|
+              block.call instance.restrict!(protector_subject)
+            end
+          end
         end
 
         def create_with_protector(*args, &block)
@@ -136,7 +144,11 @@ module Protector
 
           # Now we have @records restricted properly so let's preload associations!
           associations.each do |association|
-            ::ActiveRecord::Associations::Preloader.new(@records, association).run
+            if ::ActiveRecord::Associations::Preloader.method_defined? :preload
+              ::ActiveRecord::Associations::Preloader.new.preload(@records, association)
+            else
+              ::ActiveRecord::Associations::Preloader.new(@records, association).run
+            end
           end
 
           @loaded = true

data/lib/protector/adapters/active_record/strong_parameters.rb

@@ -2,6 +2,7 @@ module Protector
   module ActiveRecord
     module StrongParameters
       def self.sanitize!(args, is_new, meta)
+        return if args[0].permitted?
         if is_new
           args[0] = args[0].permit(*meta.access[:create].keys) if meta.access.include? :create
         else

data/lib/protector/dsl.rb

@@ -215,7 +215,7 @@ module Protector
             when Range
               return k unless x.include?(v)
             when Proc
-              return k unless x.call(v)
+              return k unless Protector.insecurely{ x.call(v) }
             else
               return k if !x.nil? && x != v
             end

data/lib/protector/version.rb

@@ -1,4 +1,4 @@
 module Protector
   # Gem version
-  VERSION = '0.7.0'
+  VERSION = '0.7.1'
 end

data/spec/lib/protector/adapters/active_record_spec.rb

@@ -57,6 +57,7 @@ if defined?(ActiveRecord)
     describe Protector::Adapters::ActiveRecord::Base do
       let(:dummy) do
         Class.new(ActiveRecord::Base) do
+          def self.name; 'Dummy'; end
           def self.model_name; ActiveModel::Name.new(self, nil, "dummy"); end
           self.table_name = "dummies"
           scope :none, where('1 = 0') unless respond_to?(:none)
@@ -92,6 +93,29 @@ if defined?(ActiveRecord)
 
         expect { dummy.restrict!('!').create!(string: 'test').delete }.to raise_error
       end
+
+      it "validates on new{}" do
+        dummy.instance_eval do
+          protect do; end
+        end
+
+        result = dummy.restrict!('!').new do |instance|
+          instance.protector_subject.should == '!'
+        end
+
+        result.protector_subject.should == '!'
+      end
+
+      it "finds with scope on id column" do
+        dummy.instance_eval do
+          protect do
+            scope { where(id: 1) }
+          end
+        end
+
+        expect { dummy.restrict!('!').find(1) }.to_not raise_error
+        expect { dummy.restrict!('!').find(2) }.to raise_error
+      end
     end
 
     #
@@ -112,6 +136,7 @@ if defined?(ActiveRecord)
         Dummy.restrict!('!').where(number: 999).first.protector_subject.should == '!'
         Dummy.restrict!('!').where(number: 999).to_a.first.protector_subject.should == '!'
         Dummy.restrict!('!').new.protector_subject.should == '!'
+        Dummy.restrict!('!').first.fluffies.new.protector_subject.should == '!'
       end
 
       it "checks creatability" do

data/spec/lib/protector/dsl_spec.rb

@@ -80,7 +80,7 @@ describe Protector::DSL do
 
   describe Protector::DSL::Meta do
     context "basic methods" do
-      l = lambda {|x| x > 4 }
+      l = lambda {|x| x > 4}
 
       before :each do
         @meta = Protector::DSL::Meta.new(nil, nil){%w(field1 field2 field3 field4 field5)}
@@ -129,55 +129,59 @@ describe Protector::DSL do
         end
       end
 
-      it "sets relation" do
-        data = @meta.evaluate('user', 'entry')
-        data.relation.should == 'relation'
-      end
+      context "evaluated" do
+        let(:data) { @meta.evaluate('user', 'entry') }
+
+        it "sets relation" do
+          data.relation.should == 'relation'
+        end
 
-      it "sets access" do
-        data = @meta.evaluate('user', 'entry')
-        data.access.should == {
-          update: {
-            "field1" => nil,
-            "field2" => nil,
-            "field3" => 1,
-            "field4" => 0..5,
-            "field5" => l
-          },
-          read: {
-            "field1" => nil,
-            "field2" => nil,
-            "field3" => nil
+        it "sets access" do
+          data.access.should == {
+            update: {
+              "field1" => nil,
+              "field2" => nil,
+              "field3" => 1,
+              "field4" => 0..5,
+              "field5" => l
+            },
+            read: {
+              "field1" => nil,
+              "field2" => nil,
+              "field3" => nil
+            }
           }
-        }
-      end
+        end
 
-      it "marks destroyable" do
-        data = @meta.evaluate('user', 'entry')
-        data.destroyable?.should == true
-        data.can?(:destroy).should == true
-      end
+        it "marks destroyable" do
+          data.destroyable?.should == true
+          data.can?(:destroy).should == true
+        end
 
-      it "marks updatable" do
-        data = @meta.evaluate('user', 'entry')
-        data.updatable?.should == true
-        data.can?(:update).should == true
-      end
+        context "marks updatable" do
+          it "with defaults" do
+            data.updatable?.should == true
+            data.can?(:update).should == true
+          end
 
-      it "gets first unupdatable field" do
-        data = @meta.evaluate('user', 'entry')
-        data.first_unupdatable_field('field1' => 1, 'field6' => 2, 'field7' => 3).should == 'field6'
-      end
+          it "respecting lambda", dev: true do
+            data.updatable?('field5' => 5).should == true
+            data.updatable?('field5' => 3).should == false
+          end
+        end
 
-      it "marks creatable" do
-        data = @meta.evaluate('user', 'entry')
-        data.creatable?.should == false
-        data.can?(:create).should == false
-      end
+        it "gets first unupdatable field" do
+          data.first_unupdatable_field('field1' => 1, 'field6' => 2, 'field7' => 3).should == 'field6'
+        end
+
+        it "marks creatable" do
+          data.creatable?.should == false
+          data.can?(:create).should == false
+        end
 
-      it "gets first uncreatable field" do
-        data = @meta.evaluate('user', 'entry')
-        data.first_uncreatable_field('field1' => 1, 'field6' => 2).should == 'field1'
+        it "gets first uncreatable field" do
+          data.first_uncreatable_field('field1' => 1, 'field6' => 2).should == 'field1'
+        end
       end
     end
 
@@ -222,5 +226,17 @@ describe Protector::DSL do
         box.can?(:eat).should == true
       end
     end
+
+    it "avoids lambdas recursion" do
+      base = Class.new{ include Protector::DSL::Base }
+      meta = Protector::DSL::Meta.new(nil, nil){%w(field1)}
+
+      meta << lambda {
+        can :create, field1: lambda {|x| x.protector_subject?.should == false}
+      }
+
+      box = meta.evaluate('context', 'instance')
+      box.creatable?('field1' => base.new.restrict!(nil))
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: protector
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.1
 platform: ruby
 authors:
 - Boris Staal
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-20 00:00:00.000000000 Z
+date: 2013-12-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -56,6 +56,12 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- gemfiles/AR_3.2.gemfile
+- gemfiles/AR_4.gemfile
+- gemfiles/AR_edge.gemfile
+- gemfiles/Rails_3.2.gemfile
+- gemfiles/Rails_4.gemfile
+- gemfiles/Sequel.gemfile
 - lib/protector.rb
 - lib/protector/adapters/active_record.rb
 - lib/protector/adapters/active_record/association.rb