rabarber 4.1.1 → 4.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -0
- data/README.md +83 -67
- data/lib/rabarber/core/cache.rb +2 -5
- data/lib/rabarber/version.rb +1 -1
- data/rabarber.gemspec +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 73050af26c88e78f295c489ee5fc49c782b3950157db2ecd1dd48cdda5b10045
|
4
|
+
data.tar.gz: '08f7da98672774c2198c155be4fb6f795c23e7da72e565631ef0f08207cd2cb9'
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: d1482714aa484c800970ea77a081388a0df4b8945e8fc0931b76e8d6415ed9f88c01ad8834e873d9161a20c7a5f2208b10782fe95857024b1a6069919f83dd47
|
7
|
+
data.tar.gz: '06383d81e91f872419fb567b2ef18991abf6a32263297645725e52b70a9c383a769c72d3657fb9f61a6cc11fb30b2129d813ca63e1a352761f99795f287c86b7'
|
data/CHANGELOG.md
CHANGED
data/README.md
CHANGED
@@ -248,17 +248,19 @@ This adds `.grant_access(action: nil, roles: nil, context: nil, if: nil, unless:
|
|
248
248
|
The most basic usage of the method is as follows:
|
249
249
|
|
250
250
|
```rb
|
251
|
-
|
252
|
-
|
253
|
-
|
254
|
-
|
255
|
-
|
256
|
-
|
257
|
-
|
258
|
-
|
259
|
-
|
260
|
-
|
261
|
-
|
251
|
+
module Crm
|
252
|
+
class InvoicesController < ApplicationController
|
253
|
+
grant_access action: :index, roles: [:accountant, :admin]
|
254
|
+
def index
|
255
|
+
@invoices = Invoice.all
|
256
|
+
@invoices = @invoices.paid if current_user.has_role?(:accountant)
|
257
|
+
# ...
|
258
|
+
end
|
259
|
+
|
260
|
+
grant_access action: :destroy, roles: :admin
|
261
|
+
def destroy
|
262
|
+
# ...
|
263
|
+
end
|
262
264
|
end
|
263
265
|
end
|
264
266
|
```
|
@@ -267,23 +269,27 @@ This grants access to `index` action for users with `accountant` or `admin` role
|
|
267
269
|
You can also define controller-wide rules (without `action` argument):
|
268
270
|
|
269
271
|
```rb
|
270
|
-
|
271
|
-
|
272
|
+
module Crm
|
273
|
+
class BaseController < ApplicationController
|
274
|
+
grant_access roles: [:admin, :manager]
|
272
275
|
|
273
|
-
|
274
|
-
|
275
|
-
|
276
|
+
grant_access action: :dashboard, roles: :marketer
|
277
|
+
def dashboard
|
278
|
+
# ...
|
279
|
+
end
|
276
280
|
end
|
277
281
|
end
|
278
282
|
|
279
|
-
|
280
|
-
|
281
|
-
|
282
|
-
|
283
|
-
|
283
|
+
module Crm
|
284
|
+
class InvoicesController < Crm::BaseController
|
285
|
+
grant_access roles: :accountant
|
286
|
+
def index
|
287
|
+
# ...
|
288
|
+
end
|
284
289
|
|
285
|
-
|
286
|
-
|
290
|
+
def delete
|
291
|
+
# ...
|
292
|
+
end
|
287
293
|
end
|
288
294
|
end
|
289
295
|
```
|
@@ -311,28 +317,34 @@ If you've set `must_have_roles` setting to `true`, then only the users with at l
|
|
311
317
|
|
312
318
|
Also keep in mind that rules defined in child classes don't override parent rules but rather add to them:
|
313
319
|
```rb
|
314
|
-
|
315
|
-
|
320
|
+
module Crm
|
321
|
+
class BaseController < ApplicationController
|
322
|
+
grant_access roles: :admin
|
316
323
|
# ...
|
324
|
+
end
|
317
325
|
end
|
318
326
|
|
319
|
-
|
320
|
-
|
327
|
+
module Crm
|
328
|
+
class InvoicesController < Crm::BaseController
|
329
|
+
grant_access roles: :accountant
|
321
330
|
# ...
|
331
|
+
end
|
322
332
|
end
|
323
333
|
```
|
324
334
|
This means that `Crm::InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
|
325
335
|
|
326
336
|
This applies as well to multiple rules defined for the same controller or action:
|
327
337
|
```rb
|
328
|
-
|
329
|
-
|
330
|
-
|
338
|
+
module Crm
|
339
|
+
class OrdersController < ApplicationController
|
340
|
+
grant_access roles: :manager, context: Order
|
341
|
+
grant_access roles: :admin
|
331
342
|
|
332
|
-
|
333
|
-
|
334
|
-
|
335
|
-
|
343
|
+
grant_access action: :show, roles: :client, context: -> { Order.find(params[:id]) }
|
344
|
+
grant_access action: :show, roles: :accountant
|
345
|
+
def show
|
346
|
+
# ...
|
347
|
+
end
|
336
348
|
end
|
337
349
|
end
|
338
350
|
```
|
@@ -343,38 +355,42 @@ This will add rules for `manager` and `admin` roles for all actions in `Crm::Ord
|
|
343
355
|
For more complex cases, Rabarber provides dynamic rules:
|
344
356
|
|
345
357
|
```rb
|
346
|
-
|
347
|
-
|
358
|
+
module Crm
|
359
|
+
class OrdersController < ApplicationController
|
360
|
+
grant_access roles: :manager, if: :company_manager?, unless: :fired?
|
348
361
|
|
349
|
-
|
350
|
-
|
351
|
-
|
362
|
+
def index
|
363
|
+
# ...
|
364
|
+
end
|
352
365
|
|
353
|
-
|
366
|
+
private
|
354
367
|
|
355
|
-
|
356
|
-
|
357
|
-
|
368
|
+
def company_manager?
|
369
|
+
Company.find(params[:company_id]).manager == current_user
|
370
|
+
end
|
358
371
|
|
359
|
-
|
360
|
-
|
372
|
+
def fired?
|
373
|
+
current_user.fired?
|
374
|
+
end
|
361
375
|
end
|
362
376
|
end
|
363
377
|
|
364
|
-
|
365
|
-
|
366
|
-
|
367
|
-
|
368
|
-
|
369
|
-
|
370
|
-
|
371
|
-
|
372
|
-
|
373
|
-
|
374
|
-
|
375
|
-
|
376
|
-
|
377
|
-
|
378
|
+
module Crm
|
379
|
+
class InvoicesController < ApplicationController
|
380
|
+
grant_access roles: :senior_accountant
|
381
|
+
|
382
|
+
grant_access action: :index, roles: [:secretary, :accountant], if: -> { InvoicesPolicy.new(current_user).can_access?(:index) }
|
383
|
+
def index
|
384
|
+
@invoices = Invoice.all
|
385
|
+
@invoices = @invoices.where("total < 10000") if current_user.has_role?(:accountant)
|
386
|
+
@invoices = @invoices.unpaid if current_user.has_role?(:secretary)
|
387
|
+
# ...
|
388
|
+
end
|
389
|
+
|
390
|
+
grant_access action: :show, roles: :accountant, unless: -> { Invoice.find(params[:id]).total > 10_000 }
|
391
|
+
def show
|
392
|
+
# ...
|
393
|
+
end
|
378
394
|
end
|
379
395
|
end
|
380
396
|
```
|
@@ -408,27 +424,27 @@ Every Rabarber method can accept a context as an additional keyword argument. By
|
|
408
424
|
E.g., consider a model named `Project`, where each project has its owner and regular members. Roles can be defined like this:
|
409
425
|
|
410
426
|
```rb
|
411
|
-
|
412
|
-
|
427
|
+
user.assign_roles(:owner, context: project)
|
428
|
+
another_user.assign_roles(:member, context: project)
|
413
429
|
```
|
414
430
|
|
415
431
|
Then the roles can be verified:
|
416
432
|
|
417
433
|
```rb
|
418
|
-
|
419
|
-
|
434
|
+
user.has_role?(:owner, context: project)
|
435
|
+
another_user.has_role?(:member, context: project)
|
420
436
|
```
|
421
437
|
|
422
438
|
A role can also be added using a class as a context, e.g., for project admins who can manage all projects:
|
423
439
|
|
424
440
|
```rb
|
425
|
-
|
441
|
+
user.assign_roles(:admin, context: Project)
|
426
442
|
```
|
427
443
|
|
428
444
|
And then it can also be verified:
|
429
445
|
|
430
446
|
```rb
|
431
|
-
|
447
|
+
user.has_role?(:admin, context: Project)
|
432
448
|
```
|
433
449
|
|
434
450
|
In authorization rules, the context can be used in the same way, but it also can be a proc or a symbol (similar to dynamic rules):
|
@@ -460,13 +476,13 @@ It's important to note that role names are not unique globally but are unique wi
|
|
460
476
|
If you want to see all the roles assigned to a user within a specific context, you can use:
|
461
477
|
|
462
478
|
```rb
|
463
|
-
|
479
|
+
user.roles(context: project)
|
464
480
|
```
|
465
481
|
|
466
482
|
Or if you want to get all the roles available in a specific context, you can use:
|
467
483
|
|
468
484
|
```rb
|
469
|
-
|
485
|
+
Rabarber::Role.names(context: Project)
|
470
486
|
```
|
471
487
|
|
472
488
|
## When Unauthorized
|
data/lib/rabarber/core/cache.rb
CHANGED
data/lib/rabarber/version.rb
CHANGED
data/rabarber.gemspec
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rabarber
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 4.1.
|
4
|
+
version: 4.1.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- enjaku4
|
8
8
|
- trafium
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2025-
|
11
|
+
date: 2025-02-21 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: rails
|