rabarber 4.1.1 → 4.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: feb905214f327d8aef99517ba1364252b6722430fe6ab1b4839055e1ae5b18fc
-  data.tar.gz: ed0cacc2d6ad0ec5fd436ba24e96c3c26489264c3f00c73822b24f4593b2fa01
+  metadata.gz: ed0e1d5cc00bc6f410b2a677afb591fa4bb1acd21a7674729edc91e7c5b72cc1
+  data.tar.gz: 7dd9ded3179f7aef89f36a0983f28fe6f4695cd7e535cdeeba4d208053f8d53f
 SHA512:
-  metadata.gz: 6f88384ea24337c233f9183fde8bda61ba2939c3947b9eff07c2b5a47ff44372ba0287258565c3a5e085c4dc80b5026206d7b126e23c58b541b6490778946123
-  data.tar.gz: 9d7d4243f90fdc36cf8c27c391154449b38407a42995791240b72571e2dff14fa3836e62ce43ca92d5d0c65a5835a1e14119a077eda59ebedbe4c6b2a5aa8bac
+  metadata.gz: 99920a8e65cd953f2ddac63083628680b92f89195a65759b64e25d5619099517ad332b8821d2c681a2c0503286617aff0a26f41d5f5f99623fc678a33a028c93
+  data.tar.gz: ce9ddfa4d718ac7d2b2533c3c87ad9cc5d3658cb1b23aa4ae1f0e75fe544186a37fb30bbea97b14c0fc9623cdb94ef9bb41c75ae0ea6b27d5a6a72dd62250d17

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+## v4.1.3
+
+### Bugs:
+
+- Fixed an issue where role presence checking did not work correctly if `must_have_roles` configuration option was enabled
+
+### Misc:
+
+- Added caching for `Rabarber::HasRoles#all_roles` method to improve performance
+
+## v4.1.2
+
+### Misc:
+
+- Replaced `git ls-files` with `Dir.glob` in gemspec for improved portability and compatibility
+
 ## v4.1.1
 
 ### Bugs:

data/README.md

@@ -248,17 +248,19 @@ This adds `.grant_access(action: nil, roles: nil, context: nil, if: nil, unless:
 The most basic usage of the method is as follows:
 
 ```rb
-class Crm::InvoicesController < ApplicationController
-  grant_access action: :index, roles: [:accountant, :admin]
-  def index
-    @invoices = Invoice.all
-    @invoices = @invoices.paid if current_user.has_role?(:accountant)
-    # ...
-  end
-
-  grant_access action: :destroy, roles: :admin
-  def destroy
-    # ...
+module Crm
+  class InvoicesController < ApplicationController
+    grant_access action: :index, roles: [:accountant, :admin]
+    def index
+      @invoices = Invoice.all
+      @invoices = @invoices.paid if current_user.has_role?(:accountant)
+      # ...
+    end
+
+    grant_access action: :destroy, roles: :admin
+    def destroy
+      # ...
+    end
   end
 end
 ```
@@ -267,23 +269,27 @@ This grants access to `index` action for users with `accountant` or `admin` role
 You can also define controller-wide rules (without `action` argument):
 
 ```rb
-class Crm::BaseController < ApplicationController
-  grant_access roles: [:admin, :manager]
+module Crm
+  class BaseController < ApplicationController
+    grant_access roles: [:admin, :manager]
 
-  grant_access action: :dashboard, roles: :marketer
-  def dashboard
-    # ...
+    grant_access action: :dashboard, roles: :marketer
+    def dashboard
+      # ...
+    end
   end
 end
 
-class Crm::InvoicesController < Crm::BaseController
-  grant_access roles: :accountant
-  def index
-    # ...
-  end
+module Crm
+  class InvoicesController < Crm::BaseController
+    grant_access roles: :accountant
+    def index
+      # ...
+    end
 
-  def delete
-    # ...
+    def delete
+      # ...
+    end
   end
 end
 ```
@@ -311,28 +317,34 @@ If you've set `must_have_roles` setting to `true`, then only the users with at l
 
 Also keep in mind that rules defined in child classes don't override parent rules but rather add to them:
 ```rb
-class Crm::BaseController < ApplicationController
-  grant_access roles: :admin
+module Crm
+  class BaseController < ApplicationController
+    grant_access roles: :admin
   # ...
+  end
 end
 
-class Crm::InvoicesController < Crm::BaseController
-  grant_access roles: :accountant
+module Crm
+  class InvoicesController < Crm::BaseController
+    grant_access roles: :accountant
   # ...
+  end
 end
 ```
 This means that `Crm::InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
 
 This applies as well to multiple rules defined for the same controller or action:
 ```rb
-class Crm::OrdersController < ApplicationController
-  grant_access roles: :manager, context: Order
-  grant_access roles: :admin
+module Crm
+  class OrdersController < ApplicationController
+    grant_access roles: :manager, context: Order
+    grant_access roles: :admin
 
-  grant_access action: :show, roles: :client, context: -> { Order.find(params[:id]) }
-  grant_access action: :show, roles: :accountant
-  def show
-    # ...
+    grant_access action: :show, roles: :client, context: -> { Order.find(params[:id]) }
+    grant_access action: :show, roles: :accountant
+    def show
+      # ...
+    end
   end
 end
 ```
@@ -343,38 +355,42 @@ This will add rules for `manager` and `admin` roles for all actions in `Crm::Ord
 For more complex cases, Rabarber provides dynamic rules:
 
 ```rb
-class Crm::OrdersController < ApplicationController
-  grant_access roles: :manager, if: :company_manager?, unless: :fired?
+module Crm
+  class OrdersController < ApplicationController
+    grant_access roles: :manager, if: :company_manager?, unless: :fired?
 
-  def index
-    # ...
-  end
+    def index
+      # ...
+    end
 
-  private
+    private
 
-  def company_manager?
-    Company.find(params[:company_id]).manager == current_user
-  end
+    def company_manager?
+      Company.find(params[:company_id]).manager == current_user
+    end
 
-  def fired?
-    current_user.fired?
+    def fired?
+      current_user.fired?
+    end
   end
 end
 
-class Crm::InvoicesController < ApplicationController
-  grant_access roles: :senior_accountant
-
-  grant_access action: :index, roles: [:secretary, :accountant], if: -> { InvoicesPolicy.new(current_user).can_access?(:index) }
-  def index
-    @invoices = Invoice.all
-    @invoices = @invoices.where("total < 10000") if current_user.has_role?(:accountant)
-    @invoices = @invoices.unpaid if current_user.has_role?(:secretary)
-    # ...
-  end
-
-  grant_access action: :show, roles: :accountant, unless: -> { Invoice.find(params[:id]).total > 10_000 }
-  def show
-    # ...
+module Crm
+  class InvoicesController < ApplicationController
+    grant_access roles: :senior_accountant
+
+    grant_access action: :index, roles: [:secretary, :accountant], if: -> { InvoicesPolicy.new(current_user).can_access?(:index) }
+    def index
+      @invoices = Invoice.all
+      @invoices = @invoices.where("total < 10000") if current_user.has_role?(:accountant)
+      @invoices = @invoices.unpaid if current_user.has_role?(:secretary)
+      # ...
+    end
+
+    grant_access action: :show, roles: :accountant, unless: -> { Invoice.find(params[:id]).total > 10_000 }
+    def show
+      # ...
+    end
   end
 end
 ```
@@ -408,27 +424,27 @@ Every Rabarber method can accept a context as an additional keyword argument. By
 E.g., consider a model named `Project`, where each project has its owner and regular members. Roles can be defined like this:
 
 ```rb
-  user.assign_roles(:owner, context: project)
-  another_user.assign_roles(:member, context: project)
+user.assign_roles(:owner, context: project)
+another_user.assign_roles(:member, context: project)
 ```
 
 Then the roles can be verified:
 
 ```rb
-  user.has_role?(:owner, context: project)
-  another_user.has_role?(:member, context: project)
+user.has_role?(:owner, context: project)
+another_user.has_role?(:member, context: project)
 ```
 
 A role can also be added using a class as a context, e.g., for project admins who can manage all projects:
 
 ```rb
-  user.assign_roles(:admin, context: Project)
+user.assign_roles(:admin, context: Project)
 ```
 
 And then it can also be verified:
 
 ```rb
-  user.has_role?(:admin, context: Project)
+user.has_role?(:admin, context: Project)
 ```
 
 In authorization rules, the context can be used in the same way, but it also can be a proc or a symbol (similar to dynamic rules):
@@ -460,13 +476,13 @@ It's important to note that role names are not unique globally but are unique wi
 If you want to see all the roles assigned to a user within a specific context, you can use:
 
 ```rb
-  user.roles(context: project)
+user.roles(context: project)
 ```
 
 Or if you want to get all the roles available in a specific context, you can use:
 
 ```rb
-  Rabarber::Role.names(context: Project)
+Rabarber::Role.names(context: Project)
 ```
 
 ## When Unauthorized

data/lib/rabarber/core/cache.rb

@@ -5,22 +5,18 @@ require "digest/sha2"
 module Rabarber
   module Core
     module Cache
-      CACHE_PREFIX = "rabarber"
-      private_constant :CACHE_PREFIX
-
       module_function
 
-      def fetch(roleable_id, context:, &block)
+      def fetch(key, &)
         return yield unless enabled?
 
-        Rails.cache.fetch(key_for(roleable_id, context), expires_in: 1.hour, race_condition_ttl: 5.seconds, &block)
+        Rails.cache.fetch(prepare_key(key), expires_in: 1.hour, race_condition_ttl: 5.seconds, &)
       end
 
-      def delete(*roleable_ids, context:)
+      def delete(*keys)
         return unless enabled?
 
-        keys = roleable_ids.map { |roleable_id| key_for(roleable_id, context) }
-        Rails.cache.delete_multi(keys) if keys.any?
+        Rails.cache.delete_multi(keys.map { prepare_key(_1) }) if keys.any?
       end
 
       def enabled?
@@ -31,17 +27,17 @@ module Rabarber
         Rails.cache.delete_matched(/^#{CACHE_PREFIX}/o)
       end
 
-      def key_for(id, context)
-        "#{CACHE_PREFIX}:#{Digest::SHA2.hexdigest("#{id}#{context.fetch(:context_type)}#{context.fetch(:context_id)}")}"
+      def prepare_key(key)
+        "#{CACHE_PREFIX}:#{Digest::SHA2.hexdigest(Marshal.dump(key))}"
       end
+
+      CACHE_PREFIX = "rabarber"
+      private_constant :CACHE_PREFIX
     end
   end
 
   module Cache
-    module_function
-
-    def clear
-      Rabarber::Core::Cache.clear
-    end
+    delegate :clear, to: :"Rabarber::Core::Cache"
+    module_function :clear
   end
 end

data/lib/rabarber/core/null_roleable.rb

@@ -7,6 +7,10 @@ module Rabarber
         []
       end
 
+      def all_roles
+        {}
+      end
+
       def has_role?(*role_names, context: nil) # rubocop:disable Lint/UnusedMethodArgument
         false
       end

data/lib/rabarber/core/rule.rb

@@ -17,10 +17,9 @@ module Rabarber
       end
 
       def roles_permitted?(roleable, controller_instance)
-        resolved_context = resolve_context(controller_instance)
-        return false if Rabarber::Configuration.instance.must_have_roles && roleable.roles(context: resolved_context).empty?
+        return false if Rabarber::Configuration.instance.must_have_roles && roleable.all_roles.empty?
 
-        roles.empty? || roleable.has_role?(*roles, context: resolved_context)
+        roles.empty? || roleable.has_role?(*roles, context: resolve_context(controller_instance))
       end
 
       def dynamic_rules_followed?(controller_instance)

data/lib/rabarber/models/concerns/has_roles.rb

@@ -16,11 +16,11 @@ module Rabarber
 
     def roles(context: nil)
       processed_context = process_context(context)
-      Rabarber::Core::Cache.fetch(roleable_id, context: processed_context) { rabarber_roles.names(context: processed_context) }
+      Rabarber::Core::Cache.fetch([roleable_id, processed_context]) { rabarber_roles.names(context: processed_context) }
     end
 
     def all_roles
-      rabarber_roles.all_names
+      Rabarber::Core::Cache.fetch([roleable_id, :all]) { rabarber_roles.all_names }
     end
 
     def has_role?(*role_names, context: nil)
@@ -102,7 +102,7 @@ module Rabarber
     end
 
     def delete_roleable_cache(context:)
-      Rabarber::Core::Cache.delete(roleable_id, context:)
+      Rabarber::Core::Cache.delete([roleable_id, context], [roleable_id, :all])
     end
 
     def roleable_id

data/lib/rabarber/models/role.rb

@@ -67,7 +67,7 @@ module Rabarber
       private
 
       def delete_roleables_cache(role, context:)
-        Rabarber::Core::Cache.delete(*assigned_to_roleables(role), context:)
+        Rabarber::Core::Cache.delete(*assigned_to_roleables(role).flat_map { [[_1, context], [_1, :all]] })
       end
 
       def assigned_to_roleables(role)

data/lib/rabarber/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rabarber
-  VERSION = "4.1.1"
+  VERSION = "4.1.3"
 end

data/rabarber.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
 
   spec.files = [
     "rabarber.gemspec", "README.md", "CHANGELOG.md", "LICENSE.txt"
-  ] + `git ls-files | grep -E '^(lib)'`.split("\n")
+  ] + Dir.glob("lib/**/*")
 
   spec.require_paths = ["lib"]
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rabarber
 version: !ruby/object:Gem::Version
-  version: 4.1.1
+  version: 4.1.3
 platform: ruby
 authors:
 - enjaku4
 - trafium
 bindir: bin
 cert_chain: []
-date: 2025-01-22 00:00:00.000000000 Z
+date: 2025-03-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails