proxes 0.1.0

data/lib/proxes/models/role.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+require 'sequel'
+
+module ProxES
+  class Role < Sequel::Model
+    many_to_many :users
+    one_to_many :permissions
+
+    def validate
+      validates_presence [:name]
+      validates_unique [:name]
+    end
+  end
+end

data/lib/proxes/models/user.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+require 'sequel'
+require 'bcrypt'
+require 'digest/md5'
+require 'active_support'
+require 'active_support/core_ext/object/blank'
+
+# Why not store this in Elasticsearch?
+module ProxES
+  class User < Sequel::Model
+    one_to_many :identity
+    many_to_many :roles
+    one_to_many :audit_logs
+
+    def role?(check)
+      !roles_dataset.first(name: check).nil?
+    end
+
+    def method_missing(method_sym, *arguments, &block)
+      if method_sym.to_s[-1] == '?'
+        role?(method_sym[0..-2])
+      else
+        super
+      end
+    end
+
+    def respond_to_missing?(name, _include_private = false)
+      name[-1] == '?'
+    end
+
+    def gravatar
+      hash = Digest::MD5.hexdigest(email.downcase)
+      "https://www.gravatar.com/avatar/#{hash}"
+    end
+
+    def validate
+      validates_presence :email
+      return if email.blank?
+      validates_unique :email
+      validates_format(/\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i, :email)
+    end
+
+    # Add the basic roles and identity
+    def after_create
+      check_roles
+    end
+
+    def check_roles
+      add_role Role.find_or_create(name: 'user') unless role?('user')
+      add_role Role.find_or_create(name: 'super_admin') if id == 1 && ENV['RACK_ENV'] != 'test' && !role?('super_admin')
+    end
+
+    def index_prefix
+      email
+    end
+  end
+end

data/lib/proxes/policies/application_policy.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+module ProxES
+  class ApplicationPolicy
+    attr_reader :user, :record
+
+    def initialize(user, record)
+      @user = user
+      @record = record
+    end
+
+    class Scope
+      attr_reader :user, :scope
+
+      def initialize(user, scope)
+        @user = user
+        @scope = scope
+      end
+    end
+  end
+end

data/lib/proxes/policies/audit_log_policy.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+require 'proxes/policies/application_policy'
+
+module ProxES
+  class AuditLogPolicy < ApplicationPolicy
+    def create?
+      user && user.super_admin?
+    end
+
+    def list?
+      create?
+    end
+
+    def read?
+      create?
+    end
+
+    def update?
+      read?
+    end
+
+    def delete?
+      create?
+    end
+
+    def permitted_attributes
+      [:action]
+    end
+
+    class Scope < ApplicationPolicy::Scope
+      def resolve
+        if user && user.super_admin?
+          scope
+        else
+          scope.where(id: -1)
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/identity_policy.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+require_relative 'application_policy'
+
+module ProxES
+  class IdentityPolicy < ApplicationPolicy
+    def register?
+      true
+    end
+
+    def permitted_attributes
+      [:username, :password, :password_confirmation]
+    end
+
+    class Scope < ApplicationPolicy::Scope
+      def resolve
+        if user.super_admin?
+          scope.all
+        else
+          []
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/permission_policy.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+require 'proxes/policies/application_policy'
+
+module ProxES
+  class PermissionPolicy < ApplicationPolicy
+    def create?
+      user && user.super_admin?
+    end
+
+    def list?
+      create?
+    end
+
+    def read?
+      create?
+    end
+
+    def update?
+      read?
+    end
+
+    def delete?
+      create?
+    end
+
+    def permitted_attributes
+      [:verb, :pattern, :role_id]
+    end
+
+    class Scope < ApplicationPolicy::Scope
+      def resolve
+        if user && user.super_admin?
+          scope
+        else
+          scope.where(id: -1)
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/request/root_policy.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+module ProxES
+  class Request
+    class RootPolicy < ProxES::RequestPolicy
+      class Scope < ProxES::RequestPolicy::Scope
+        def resolve
+          scope
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/request/search_policy.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+module ProxES
+  class Request
+    class SearchPolicy < ProxES::RequestPolicy
+      class Scope < ProxES::RequestPolicy::Scope
+        def resolve
+          patterns = ProxES::Permission.where(verb: 'INDEX', role: user.roles).map do |permission|
+            permission.pattern.gsub(/\{user.(.*)\}/) { |match| user.send(Regexp.last_match[1].to_sym) }
+          end
+          filter scope.index, patterns
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/request/snapshot_policy.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+module ProxES
+  class Request
+    class SnapshotPolicy < ProxES::RequestPolicy
+      class Scope < ProxES::RequestPolicy::Scope
+        def resolve
+          scope
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/request/stats_policy.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+module ProxES
+  class Request
+    class StatsPolicy < ProxES::RequestPolicy
+      class Scope < ProxES::RequestPolicy::Scope
+        def resolve
+          patterns = ProxES::Permission.where(verb: 'INDEX', role: user.roles).map do |permission|
+            permission.pattern.gsub(/\{user.(.*)\}/) { |match| user.send(Regexp.last_match[1].to_sym) }
+          end
+          filter scope.index, patterns
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/request_policy.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+require 'proxes/db'
+require 'proxes/models/permission'
+require 'proxes/services/logger'
+require 'proxes/helpers/indices'
+
+module ProxES
+  class RequestPolicy
+    include Helpers::Indices
+
+    attr_reader :user, :record
+
+    def initialize(user, record)
+      @user = user
+      @record = record
+    end
+
+    def method_missing(method_sym, *arguments, &block)
+      if method_sym.to_s[-1] == '?'
+        return false if user.nil?
+        require 'pry'
+        # binding.pry
+
+        if record.indices?
+          patterns = ProxES::Permission.where(verb: 'INDEX', role: user.roles).map do |permission|
+            permission.pattern.gsub(/\{user.(.*)\}/) { |match| user.send(Regexp.last_match[1].to_sym) }
+          end
+          return filter(record.index, patterns).count.positive?
+        else
+          # Give me all the user's permissions that match the verb
+          ProxES::Permission.where(verb: method_sym[0..-2].upcase, role: user.roles).each do |permission|
+            return true if record.path =~ %r{#{permission.pattern}}
+          end
+        end
+        false
+      else
+        super
+      end
+    end
+
+    def respond_to_missing?(name, _include_private = false)
+      name[-1] == '?'
+    end
+
+    def logger
+      @logger ||= ProxES::Services::Logger.instance
+    end
+
+    class Scope
+      include Helpers::Indices
+
+      attr_reader :user, :scope
+
+      def initialize(user, scope)
+        @user = user
+        @scope = scope
+      end
+
+      def logger
+        @logger ||= ProxES::Services::Logger.instance
+      end
+    end
+  end
+end
+
+require 'proxes/policies/request/root_policy'
+require 'proxes/policies/request/stats_policy'
+require 'proxes/policies/request/search_policy'
+require 'proxes/policies/request/snapshot_policy'

data/lib/proxes/policies/role_policy.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+require 'proxes/policies/application_policy'
+
+module ProxES
+  class RolePolicy < ApplicationPolicy
+    def create?
+      user && user.super_admin?
+    end
+
+    def list?
+      create?
+    end
+
+    def read?
+      create?
+    end
+
+    def update?
+      read?
+    end
+
+    def delete?
+      create?
+    end
+
+    def permitted_attributes
+      [:name]
+    end
+
+    class Scope < ApplicationPolicy::Scope
+      def resolve
+        if user && user.super_admin?
+          scope
+        else
+          scope.where(id: -1)
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/token_policy.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+require_relative 'application_policy'
+
+module ProxES
+  class TokenPolicy < ApplicationPolicy
+    def create?
+      user.super_admin?
+    end
+
+    def list?
+      create?
+    end
+
+    def read?
+      record.id == user.id || user.super_admin?
+    end
+
+    def update?
+      read?
+    end
+
+    def delete?
+      create?
+    end
+
+    def register?
+      true
+    end
+
+    def permitted_attributes
+      attribs = [:email, :name, :surname]
+      attribs << :role if user.super_admin?
+      attribs
+    end
+
+    class Scope < ApplicationPolicy::Scope
+      def resolve
+        if user.super_admin?
+          scope.all
+        else
+          []
+        end
+      end
+    end
+  end
+end

data/lib/proxes/policies/user_policy.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+require 'proxes/policies/application_policy'
+
+module ProxES
+  class UserPolicy < ApplicationPolicy
+    def create?
+      user && user.super_admin?
+    end
+
+    def list?
+      create?
+    end
+
+    def read?
+      user && (record.id == user.id || user.super_admin?)
+    end
+
+    def update?
+      read?
+    end
+
+    def delete?
+      create?
+    end
+
+    def register?
+      true
+    end
+
+    def permitted_attributes
+      attribs = [:email, :name, :surname]
+      attribs << :role_id if user.super_admin?
+      attribs
+    end
+
+    class Scope < ApplicationPolicy::Scope
+      def resolve
+        if user && user.super_admin?
+          scope
+        else
+          scope.where(id: -1)
+        end
+      end
+    end
+  end
+end