rabarber 4.1.0 → 4.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5450b60dd272da8e0b78af00e44a3e82b29c7b9a9e8b510c68efccbba30ba150
-  data.tar.gz: 7bbdd6de4ed8f2e33be07363c9c9d4e099170099ca7cb32a50df217373503284
+  metadata.gz: 73050af26c88e78f295c489ee5fc49c782b3950157db2ecd1dd48cdda5b10045
+  data.tar.gz: '08f7da98672774c2198c155be4fb6f795c23e7da72e565631ef0f08207cd2cb9'
 SHA512:
-  metadata.gz: 8c9aa4a196f99dbb5250dd1b625fed829418843f5de8f35a4b2cde5f933f8780be0865f8c23e90c57490a3358f004fd1168dc28bcc9be9f66f0bb56b9ebcfddf
-  data.tar.gz: 3ddc04e91777a31631d4e9db9a54d6d1e23f588935e09c9d9691f8c607fffbabe18a49553cc9bad22ed8944dbec8b6cb58ecaf6a432c7ac7da59c1aca27a334f
+  metadata.gz: d1482714aa484c800970ea77a081388a0df4b8945e8fc0931b76e8d6415ed9f88c01ad8834e873d9161a20c7a5f2208b10782fe95857024b1a6069919f83dd47
+  data.tar.gz: '06383d81e91f872419fb567b2ef18991abf6a32263297645725e52b70a9c383a769c72d3657fb9f61a6cc11fb30b2129d813ca63e1a352761f99795f287c86b7'

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+## v4.1.2
+
+### Misc:
+
+- Replaced `git ls-files` with `Dir.glob` in gemspec for improved portability and compatibility
+
+## v4.1.1
+
+### Bugs:
+
+- Fixed an issue where controller-wide `grant_access` calls would overwrite each other instead of being additive, causing inconsistent access control based on statement order
+
+### Misc:
+
+- Minor performance improvement for authorization checks
+
 ## v4.1.0
 
 ### Features:

data/README.md

@@ -248,17 +248,19 @@ This adds `.grant_access(action: nil, roles: nil, context: nil, if: nil, unless:
 The most basic usage of the method is as follows:
 
 ```rb
-class Crm::InvoicesController < ApplicationController
-  grant_access action: :index, roles: [:accountant, :admin]
-  def index
-    @invoices = Invoice.all
-    @invoices = @invoices.paid if current_user.has_role?(:accountant)
-    # ...
-  end
-
-  grant_access action: :destroy, roles: :admin
-  def destroy
-    # ...
+module Crm
+  class InvoicesController < ApplicationController
+    grant_access action: :index, roles: [:accountant, :admin]
+    def index
+      @invoices = Invoice.all
+      @invoices = @invoices.paid if current_user.has_role?(:accountant)
+      # ...
+    end
+
+    grant_access action: :destroy, roles: :admin
+    def destroy
+      # ...
+    end
   end
 end
 ```
@@ -267,23 +269,27 @@ This grants access to `index` action for users with `accountant` or `admin` role
 You can also define controller-wide rules (without `action` argument):
 
 ```rb
-class Crm::BaseController < ApplicationController
-  grant_access roles: [:admin, :manager]
+module Crm
+  class BaseController < ApplicationController
+    grant_access roles: [:admin, :manager]
 
-  grant_access action: :dashboard, roles: :marketer
-  def dashboard
-    # ...
+    grant_access action: :dashboard, roles: :marketer
+    def dashboard
+      # ...
+    end
   end
 end
 
-class Crm::InvoicesController < Crm::BaseController
-  grant_access roles: :accountant
-  def index
-    # ...
-  end
+module Crm
+  class InvoicesController < Crm::BaseController
+    grant_access roles: :accountant
+    def index
+      # ...
+    end
 
-  def delete
-    # ...
+    def delete
+      # ...
+    end
   end
 end
 ```
@@ -311,55 +317,80 @@ If you've set `must_have_roles` setting to `true`, then only the users with at l
 
 Also keep in mind that rules defined in child classes don't override parent rules but rather add to them:
 ```rb
-class Crm::BaseController < ApplicationController
-  grant_access roles: :admin
+module Crm
+  class BaseController < ApplicationController
+    grant_access roles: :admin
   # ...
+  end
 end
 
-class Crm::InvoicesController < Crm::BaseController
-  grant_access roles: :accountant
+module Crm
+  class InvoicesController < Crm::BaseController
+    grant_access roles: :accountant
   # ...
+  end
 end
 ```
 This means that `Crm::InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
 
+This applies as well to multiple rules defined for the same controller or action:
+```rb
+module Crm
+  class OrdersController < ApplicationController
+    grant_access roles: :manager, context: Order
+    grant_access roles: :admin
+
+    grant_access action: :show, roles: :client, context: -> { Order.find(params[:id]) }
+    grant_access action: :show, roles: :accountant
+    def show
+      # ...
+    end
+  end
+end
+```
+This will add rules for `manager` and `admin` roles for all actions in `Crm::OrdersController`, and for `client` and `accountant` roles for the `show` action.
+
 ## Dynamic Authorization Rules
 
 For more complex cases, Rabarber provides dynamic rules:
 
 ```rb
-class Crm::OrdersController < ApplicationController
-  grant_access roles: :manager, if: :company_manager?, unless: :fired?
+module Crm
+  class OrdersController < ApplicationController
+    grant_access roles: :manager, if: :company_manager?, unless: :fired?
 
-  def index
-    # ...
-  end
+    def index
+      # ...
+    end
 
-  private
+    private
 
-  def company_manager?
-    Company.find(params[:company_id]).manager == current_user
-  end
+    def company_manager?
+      Company.find(params[:company_id]).manager == current_user
+    end
 
-  def fired?
-    current_user.fired?
+    def fired?
+      current_user.fired?
+    end
   end
 end
 
-class Crm::InvoicesController < ApplicationController
-  grant_access roles: :senior_accountant
-
-  grant_access action: :index, roles: [:secretary, :accountant], if: -> { InvoicesPolicy.new(current_user).can_access?(:index) }
-  def index
-    @invoices = Invoice.all
-    @invoices = @invoices.where("total < 10000") if current_user.has_role?(:accountant)
-    @invoices = @invoices.unpaid if current_user.has_role?(:secretary)
-    # ...
-  end
-
-  grant_access action: :show, roles: :accountant, unless: -> { Invoice.find(params[:id]).total > 10_000 }
-  def show
-    # ...
+module Crm
+  class InvoicesController < ApplicationController
+    grant_access roles: :senior_accountant
+
+    grant_access action: :index, roles: [:secretary, :accountant], if: -> { InvoicesPolicy.new(current_user).can_access?(:index) }
+    def index
+      @invoices = Invoice.all
+      @invoices = @invoices.where("total < 10000") if current_user.has_role?(:accountant)
+      @invoices = @invoices.unpaid if current_user.has_role?(:secretary)
+      # ...
+    end
+
+    grant_access action: :show, roles: :accountant, unless: -> { Invoice.find(params[:id]).total > 10_000 }
+    def show
+      # ...
+    end
   end
 end
 ```
@@ -393,27 +424,27 @@ Every Rabarber method can accept a context as an additional keyword argument. By
 E.g., consider a model named `Project`, where each project has its owner and regular members. Roles can be defined like this:
 
 ```rb
-  user.assign_roles(:owner, context: project)
-  another_user.assign_roles(:member, context: project)
+user.assign_roles(:owner, context: project)
+another_user.assign_roles(:member, context: project)
 ```
 
 Then the roles can be verified:
 
 ```rb
-  user.has_role?(:owner, context: project)
-  another_user.has_role?(:member, context: project)
+user.has_role?(:owner, context: project)
+another_user.has_role?(:member, context: project)
 ```
 
 A role can also be added using a class as a context, e.g., for project admins who can manage all projects:
 
 ```rb
-  user.assign_roles(:admin, context: Project)
+user.assign_roles(:admin, context: Project)
 ```
 
 And then it can also be verified:
 
 ```rb
-  user.has_role?(:admin, context: Project)
+user.has_role?(:admin, context: Project)
 ```
 
 In authorization rules, the context can be used in the same way, but it also can be a proc or a symbol (similar to dynamic rules):
@@ -445,13 +476,13 @@ It's important to note that role names are not unique globally but are unique wi
 If you want to see all the roles assigned to a user within a specific context, you can use:
 
 ```rb
-  user.roles(context: project)
+user.roles(context: project)
 ```
 
 Or if you want to get all the roles available in a specific context, you can use:
 
 ```rb
-  Rabarber::Role.names(context: Project)
+Rabarber::Role.names(context: Project)
 ```
 
 ## When Unauthorized

data/lib/rabarber/core/access.rb

@@ -8,15 +8,13 @@ module Rabarber
       end
 
       def controller_accessible?(roleable, controller_instance)
-        controller_rules.any? do |rule_controller, rule|
-          controller_instance.is_a?(rule_controller) && rule.verify_access(roleable, controller_instance)
+        controller_rules.any? do |controller, rules|
+          controller_instance.is_a?(controller) && rules.any? { _1.verify_access(roleable, controller_instance) }
         end
       end
 
       def action_accessible?(roleable, action, controller_instance)
-        action_rules[controller_instance.class].any? do |rule|
-          rule.action == action && rule.verify_access(roleable, controller_instance)
-        end
+        action_rules[controller_instance.class][action].any? { _1.verify_access(roleable, controller_instance) }
       end
     end
   end

data/lib/rabarber/core/cache.rb

@@ -38,10 +38,7 @@ module Rabarber
   end
 
   module Cache
-    module_function
-
-    def clear
-      Rabarber::Core::Cache.clear
-    end
+    delegate :clear, to: :"Rabarber::Core::Cache"
+    module_function :clear
   end
 end

data/lib/rabarber/core/permissions.rb

@@ -13,13 +13,16 @@ module Rabarber
       attr_reader :storage
 
       def initialize
-        @storage = { controller_rules: Hash.new({}), action_rules: Hash.new([]) }
+        @storage = {
+          controller_rules: Hash.new { |h, k| h[k] = [] },
+          action_rules: Hash.new { |h1, k1| h1[k1] = Hash.new { |h2, k2| h2[k2] = [] } }
+        }
       end
 
       class << self
         def add(controller, action, roles, context, dynamic_rule, negated_dynamic_rule)
-          rule = Rabarber::Core::Rule.new(action, roles, context, dynamic_rule, negated_dynamic_rule)
-          action ? action_rules[controller] += [rule] : controller_rules[controller] = rule
+          rule = Rabarber::Core::Rule.new(roles, context, dynamic_rule, negated_dynamic_rule)
+          action ? action_rules[controller][action] += [rule] : controller_rules[controller] += [rule]
         end
 
         def controller_rules

data/lib/rabarber/core/permissions_integrity_checker.rb

@@ -21,8 +21,8 @@ module Rabarber
       private
 
       def missing_list
-        @missing_list ||= action_rules.each_with_object([]) do |(controller, rules), arr|
-          missing_actions = rules.map(&:action) - controller.action_methods.map(&:to_sym)
+        @missing_list ||= action_rules.each_with_object([]) do |(controller, hash), arr|
+          missing_actions = hash.keys - controller.action_methods.map(&:to_sym)
           arr << { controller => missing_actions } if missing_actions.any?
         end
       end

data/lib/rabarber/core/rule.rb

@@ -3,10 +3,9 @@
 module Rabarber
   module Core
     class Rule
-      attr_reader :action, :roles, :context, :dynamic_rule, :negated_dynamic_rule
+      attr_reader :roles, :context, :dynamic_rule, :negated_dynamic_rule
 
-      def initialize(action, roles, context, dynamic_rule, negated_dynamic_rule)
-        @action = action
+      def initialize(roles, context, dynamic_rule, negated_dynamic_rule)
         @roles = Array(roles)
         @context = context
         @dynamic_rule = dynamic_rule || -> { true }

data/lib/rabarber/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rabarber
-  VERSION = "4.1.0"
+  VERSION = "4.1.2"
 end

data/rabarber.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
 
   spec.files = [
     "rabarber.gemspec", "README.md", "CHANGELOG.md", "LICENSE.txt"
-  ] + `git ls-files | grep -E '^(lib)'`.split("\n")
+  ] + Dir.glob("lib/**/*")
 
   spec.require_paths = ["lib"]
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rabarber
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 4.1.2
 platform: ruby
 authors:
 - enjaku4
 - trafium
 bindir: bin
 cert_chain: []
-date: 2024-12-29 00:00:00.000000000 Z
+date: 2025-02-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails