rabarber 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f719eb670170521e94a58a1c75d30110699ab941da6d5dae151fbf53e0eb9880
-  data.tar.gz: bd06646e15ab2eb5ff7b49d2a18316c4b539b95aa98bd2ec1b4de5c6b5fb921a
+  metadata.gz: 2cf7603eb6340263f349ffd661101f6428d210982b2a4dfb0d121f19814db3b7
+  data.tar.gz: e31584352b9ea5565bfbc4e9a9f53084c6b9123643eb6919557ef52b9dfb3efb
 SHA512:
-  metadata.gz: 0db86c7d46337decbe9972ea3b0c1ad30e1c66f2b76b3ef27a494ef8c2ecc9bcf35ce3f135360e74045b7f20beb38149f5ca308af0cb3d3a0db829ff9dc7147b
-  data.tar.gz: d1a20c732318d12ccfe49338df7338dcf09bd1222fd574e8581d035cb38b55295e501bfa45ef63ea0a556a8c21a28abdad7d06ca765c3f14eed6e6cd98db93be
+  metadata.gz: 757631f95940e95d1640d16101b1fafe049808178ade0d0d97aac3163d0c31c581043bbeeab5b94da9ba4ed28e9edf890aba9adc845e80e9ab1b39ae22c6d66b
+  data.tar.gz: 0eb8500deced87bea565d146de0dcd236ffeacac86e025bd6c5cd484fad94cb8594158575c88e31c69fec1f9d0a83f5328029ee261a343603505f847cad5e989

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v2.1.0
+
+### Features:
+
+- Added `Rabarber::Authorization.skip_authorization` method to skip authorization checks
+
 ## v2.0.0
 
 ### Breaking:
@@ -14,7 +20,7 @@ To upgrade to v2.0.0, please refer to the [migration guide](https://github.com/e
 
 ### Bugs:
 
-- Fixed the issue where an error would occur if the user was not authenticated
+- Fixed the issue where an error would occur when using view helpers if the user was not authenticated
 
 ### Misc:
 

data/README.md

@@ -40,6 +40,7 @@ This means that `admin` users can access everything in `TicketsController`, whil
   - [Authorization Rules](#authorization-rules)
   - [Dynamic Authorization Rules](#dynamic-authorization-rules)
   - [When Unauthorized](#when-unauthorized)
+  - [Skip Authorization](#skip-authorization)
   - [View Helpers](#view-helpers)
   - [Audit Trail](#audit-trail)
 
@@ -246,8 +247,6 @@ end
 ```
 This grants access to `index` action for users with `accountant` or `admin` role, and access to `destroy` action for `admin` users only.
 
-Please note that Rabarber does not provide any built-in data scoping mechanism as it is not a part of the authorization layer and is not necessarily role specific or has anything to do with the current user. The business logic can vary drastically depending on the application, so you're encouraged to limit the data visibility yourself, for example, in the same way as in the example above, where `accountant` role can only see paid invoices.
-
 You can also define controller-wide rules (without `action` argument):
 
 ```rb
@@ -289,11 +288,9 @@ class InvoicesController < ApplicationController
 end
 ```
 
-This allows everyone to access `OrdersController` and its children and also `index` action in `InvoicesController`. This extends to scenarios where there is no user present, i.e. when the method responsible for returning the currently authenticated user in your application returns `nil`.
-
-If the user is not authenticated (the method responsible for returning the currently authenticated user in your application returns `nil`), Rabarber will handle this situation as if the user has no roles.
+This allows everyone to access `OrdersController` and its children and also `index` action in `InvoicesController`.
 
-If you've set `must_have_roles` setting to `true`, then only the users with at least one role can gain access. This setting can be useful if your requirements are such that users without roles (or unauthenticated users) are not allowed to access anything.
+If you've set `must_have_roles` setting to `true`, then only the users with at least one role can gain access. This setting can be useful if your requirements are such that users without roles are not allowed to access anything.
 
 Also keep in mind that rules defined in child classes don't override parent rules but rather add to them:
 ```rb
@@ -349,7 +346,7 @@ class Crm::InvoicesController < ApplicationController
   end
 end
 ```
-You can pass a dynamic rule as `if` or `unless` argument. It can be a symbol, in which case the method with that name will be called. Alternatively, it can be a proc, which will be executed within the context of the controller's instance.
+You can pass a dynamic rule as `if` or `unless` argument. It can be a symbol, in which case the method with that name will be called, or alternatively it can be a proc that will be executed within the context of the controller instance at request time.
 
 You can use only dynamic rules without specifying roles if that suits your needs:
 ```rb
@@ -392,6 +389,19 @@ end
 
 The method can be overridden in different controllers, providing flexibility in handling unauthorized access attempts.
 
+## Skip Authorization
+
+To skip authorization, use `.skip_authorization(options = {})` method:
+
+```rb
+class TicketsController < ApplicationController
+  skip_authorization only: :index
+  # ...
+end
+```
+
+This method accepts the same options as `skip_before_action` method in Rails.
+
 ## View Helpers
 
 Rabarber also provides a couple of helpers that can be used in views: `visible_to(*roles, &block)` and `hidden_from(*roles, &block)`. To use them, simply include `Rabarber::Helpers` in the desired helper. Usually it is `ApplicationHelper`, but it can be any helper of your choice.

data/lib/rabarber/controllers/concerns/authorization.rb

@@ -11,6 +11,10 @@ module Rabarber
     end
 
     class_methods do
+      def skip_authorization(options = {})
+        skip_before_action :verify_access, **options
+      end
+
       def grant_access(action: nil, roles: nil, if: nil, unless: nil)
         dynamic_rule, negated_dynamic_rule = binding.local_variable_get(:if), binding.local_variable_get(:unless)
 

data/lib/rabarber/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rabarber
-  VERSION = "2.0.0"
+  VERSION = "2.1.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rabarber
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - enjaku4
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-04-25 00:00:00.000000000 Z
+date: 2024-05-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails