rabarber 4.0.2 → 4.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29fa00f5acb5a72e9dd96fa5b397408ceb4bed4c92e16ff75cb51e9277647515
-  data.tar.gz: 41ce652a994f632f7c891d7d5ad41821b8443cfcbbe3e41ad261aa2104b57672
+  metadata.gz: feb905214f327d8aef99517ba1364252b6722430fe6ab1b4839055e1ae5b18fc
+  data.tar.gz: ed0cacc2d6ad0ec5fd436ba24e96c3c26489264c3f00c73822b24f4593b2fa01
 SHA512:
-  metadata.gz: 428123e289ec77e79669a47f875e0aa7b34d0596260d534fbba95f2d997201a1fc3c1903efd6b224838fe0cee54beb8e37f8d0f1d4ea5e1d765aaa8b988dfb3b
-  data.tar.gz: 42638202030b3311b0e0501447f6e5da492fb4f79d9675d7da7529bd45e37a964de2f836069a4ec94f322ea7092e696abb9924a0141c34596e1c53d0cb1b4f70
+  metadata.gz: 6f88384ea24337c233f9183fde8bda61ba2939c3947b9eff07c2b5a47ff44372ba0287258565c3a5e085c4dc80b5026206d7b126e23c58b541b6490778946123
+  data.tar.gz: 9d7d4243f90fdc36cf8c27c391154449b38407a42995791240b72571e2dff14fa3836e62ce43ca92d5d0c65a5835a1e14119a077eda59ebedbe4c6b2a5aa8bac

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## v4.1.1
+
+### Bugs:
+
+- Fixed an issue where controller-wide `grant_access` calls would overwrite each other instead of being additive, causing inconsistent access control based on statement order
+
+### Misc:
+
+- Minor performance improvement for authorization checks
+
+## v4.1.0
+
+### Features:
+
+- Added `Rabarber::Role.all_names` method to retrieve all roles available in the application, grouped by context
+- Added `Rabarber::HasRoles#all_roles` method to retrieve all roles assigned to a user, grouped by context
+
+### Bugs:
+
+- Fixed potential bug in role revocation caused by checking for the presence of a role in the cache instead of the database
+
 ## v4.0.2
 
 ### Misc:

data/README.md

@@ -158,6 +158,14 @@ To get the list of roles assigned to the user, use:
 user.roles
 ```
 
+**`#all_roles`**
+
+To get all roles assigned to the user, grouped by context, use:
+
+```rb
+user.all_roles
+```
+
 ---
 
 To manipulate roles directly, you can use `Rabarber::Role` methods:
@@ -203,12 +211,20 @@ Rabarber::Role.remove(:admin, force: true)
 
 **`.names(context: nil)`**
 
-If you need to list the role names available in your application, use:
+If you need to list the roles available in your application, use:
 
 ```rb
 Rabarber::Role.names
 ```
 
+**`.all_names`**
+
+If you need list all roles available in your application, grouped by context, use:
+
+```rb
+Rabarber::Role.all_names
+```
+
 **`.assignees(role_name, context: nil)`**
 
 To get all the users to whom the role is assigned, use:
@@ -307,6 +323,21 @@ end
 ```
 This means that `Crm::InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
 
+This applies as well to multiple rules defined for the same controller or action:
+```rb
+class Crm::OrdersController < ApplicationController
+  grant_access roles: :manager, context: Order
+  grant_access roles: :admin
+
+  grant_access action: :show, roles: :client, context: -> { Order.find(params[:id]) }
+  grant_access action: :show, roles: :accountant
+  def show
+    # ...
+  end
+end
+```
+This will add rules for `manager` and `admin` roles for all actions in `Crm::OrdersController`, and for `client` and `accountant` roles for the `show` action.
+
 ## Dynamic Authorization Rules
 
 For more complex cases, Rabarber provides dynamic rules:

data/lib/rabarber/core/access.rb

@@ -8,15 +8,13 @@ module Rabarber
       end
 
       def controller_accessible?(roleable, controller_instance)
-        controller_rules.any? do |rule_controller, rule|
-          controller_instance.is_a?(rule_controller) && rule.verify_access(roleable, controller_instance)
+        controller_rules.any? do |controller, rules|
+          controller_instance.is_a?(controller) && rules.any? { _1.verify_access(roleable, controller_instance) }
         end
       end
 
       def action_accessible?(roleable, action, controller_instance)
-        action_rules[controller_instance.class].any? do |rule|
-          rule.action == action && rule.verify_access(roleable, controller_instance)
-        end
+        action_rules[controller_instance.class][action].any? { _1.verify_access(roleable, controller_instance) }
       end
     end
   end

data/lib/rabarber/core/permissions.rb

@@ -13,13 +13,16 @@ module Rabarber
       attr_reader :storage
 
       def initialize
-        @storage = { controller_rules: Hash.new({}), action_rules: Hash.new([]) }
+        @storage = {
+          controller_rules: Hash.new { |h, k| h[k] = [] },
+          action_rules: Hash.new { |h1, k1| h1[k1] = Hash.new { |h2, k2| h2[k2] = [] } }
+        }
       end
 
       class << self
         def add(controller, action, roles, context, dynamic_rule, negated_dynamic_rule)
-          rule = Rabarber::Core::Rule.new(action, roles, context, dynamic_rule, negated_dynamic_rule)
-          action ? action_rules[controller] += [rule] : controller_rules[controller] = rule
+          rule = Rabarber::Core::Rule.new(roles, context, dynamic_rule, negated_dynamic_rule)
+          action ? action_rules[controller][action] += [rule] : controller_rules[controller] += [rule]
         end
 
         def controller_rules

data/lib/rabarber/core/permissions_integrity_checker.rb

@@ -21,8 +21,8 @@ module Rabarber
       private
 
       def missing_list
-        @missing_list ||= action_rules.each_with_object([]) do |(controller, rules), arr|
-          missing_actions = rules.map(&:action) - controller.action_methods.map(&:to_sym)
+        @missing_list ||= action_rules.each_with_object([]) do |(controller, hash), arr|
+          missing_actions = hash.keys - controller.action_methods.map(&:to_sym)
           arr << { controller => missing_actions } if missing_actions.any?
         end
       end

data/lib/rabarber/core/rule.rb

@@ -3,10 +3,9 @@
 module Rabarber
   module Core
     class Rule
-      attr_reader :action, :roles, :context, :dynamic_rule, :negated_dynamic_rule
+      attr_reader :roles, :context, :dynamic_rule, :negated_dynamic_rule
 
-      def initialize(action, roles, context, dynamic_rule, negated_dynamic_rule)
-        @action = action
+      def initialize(roles, context, dynamic_rule, negated_dynamic_rule)
         @roles = Array(roles)
         @context = context
         @dynamic_rule = dynamic_rule || -> { true }

data/lib/rabarber/models/concerns/has_roles.rb

@@ -19,6 +19,10 @@ module Rabarber
       Rabarber::Core::Cache.fetch(roleable_id, context: processed_context) { rabarber_roles.names(context: processed_context) }
     end
 
+    def all_roles
+      rabarber_roles.all_names
+    end
+
     def has_role?(*role_names, context: nil)
       processed_context = process_context(context)
       processed_roles = process_role_names(role_names)
@@ -55,7 +59,7 @@ module Rabarber
       processed_context = process_context(context)
 
       roles_to_revoke = Rabarber::Role.where(
-        name: processed_role_names.intersection(roles(context: processed_context)), **processed_context
+        name: processed_role_names.intersection(rabarber_roles.names(context: processed_context)), **processed_context
       )
 
       if roles_to_revoke.any?

data/lib/rabarber/models/role.rb

@@ -9,6 +9,8 @@ module Rabarber
                      format: { with: Rabarber::Input::Role::REGEX },
                      strict: true
 
+    belongs_to :context, polymorphic: true, optional: true
+
     before_destroy :delete_assignments
 
     class << self
@@ -16,6 +18,14 @@ module Rabarber
         where(process_context(context)).pluck(:name).map(&:to_sym)
       end
 
+      def all_names
+        includes(:context).group_by(&:context).transform_values { |roles| roles.map { _1.name.to_sym } }
+      rescue ActiveRecord::RecordNotFound => e
+        raise Rabarber::Error, "Context not found: #{e.model}##{e.id}"
+      rescue NameError => e
+        raise Rabarber::Error, "Context not found: #{e.name}"
+      end
+
       def add(name, context: nil)
         name = process_role_name(name)
         processed_context = process_context(context)
@@ -77,6 +87,16 @@ module Rabarber
       end
     end
 
+    def context
+      return context_type.constantize if context_type.present? && context_id.blank?
+
+      record = super
+
+      raise ActiveRecord::RecordNotFound.new(nil, context_type, nil, context_id) if context_id.present? && !record
+
+      record
+    end
+
     private
 
     def delete_assignments

data/lib/rabarber/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rabarber
-  VERSION = "4.0.2"
+  VERSION = "4.1.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rabarber
 version: !ruby/object:Gem::Version
-  version: 4.0.2
+  version: 4.1.1
 platform: ruby
 authors:
 - enjaku4
 - trafium
 bindir: bin
 cert_chain: []
-date: 2024-12-26 00:00:00.000000000 Z
+date: 2025-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails