rabarber 6.0.2 → 6.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9b600e0f228b103c91be66a391b115f5478785e25cb590b6377a55584db33e5
-  data.tar.gz: b4d93e408b7e6b6b9cba4b56ea9d4b5e60ddb6299b43f90b4ccc0d40f9db0b4e
+  metadata.gz: d6a04e1ab84c89a6ab0271fb9c75021c6a5b0ecf042ae53914e58c969ed8a533
+  data.tar.gz: 4dc99eacf060c21b9a08d23a882a96ce41c3cf8675d1eae73a2dc00ee925eae5
 SHA512:
-  metadata.gz: b85dc2c9c0d9ed86e1de5811e2b62254816632b98cba73d7a2da351db093281329b39ef34891d02cffae23c613ef48f2a10d79a9241d677c51a68199ff7aed21
-  data.tar.gz: c9fbf1d765b960b43f335078e9e4b6714f8a21eb33db85ed7c7c74ac8f6a1c943f293e630981e3c60e800e333ea94db260266a5de0e85ce72fc6702dbd015d3b
+  metadata.gz: 876ded94c228f0318c809c2d93ae4b0a7187fd85a958cd85c826b2b6659dae1550d90b665e63b1221866e72fdd133f39811aa458de2e6755676b4f9590e0062b
+  data.tar.gz: 43e014c4ce4f3e57f7c3bb9668b40d00a355d0f5c9129a8e36d130d01568377dbfa2f7a1a27a8e3224b77b13d276a820966c7c765ea52dcf0b628e5cfa037452

data/CHANGELOG.md

@@ -1,3 +1,32 @@
+## v6.1.0
+
+### Features:
+
+- Added `Rabarber.create_roles` and `Rabarber.delete_roles` to create and delete several roles at once
+- Added support for binary UUID primary keys in MySQL
+
+### Bugs:
+
+- Fixed a race condition where assigning several roles at once could assign none of them
+- Fixed context migration helpers raising when no roles exist in the context
+- Fixed the generated migration creating a broken foreign key when the user table's primary key is not `id`
+- Fixed roles assigned or revoked inside a rolled back transaction staying cached
+- Fixed concurrent role creation or renaming discarding the surrounding transaction
+- Fixed the generated migration not working with UUID primary keys on some databases
+- Fixed roles assigned during `revoke_all_roles` staying cached after being revoked
+
+### Misc:
+
+- Deprecated calling `assign_roles`, `revoke_roles`, or `revoke_all_roles` on an unsaved record
+- Deprecated `Rabarber.create_role` and `Rabarber.delete_role`
+- The generator now takes the primary key type from the existing user table, making `--uuid` unnecessary
+
+## v6.0.3
+
+### Bugs:
+
+- Fixed `Rabarber.all_roles` raising `Rabarber::NotFoundError` when a role's context is a class that is not an ActiveRecord model
+
 ## v6.0.2
 
 ### Bugs:
@@ -43,7 +72,7 @@ On databases without partial index support, such as MySQL, uniqueness of global
 - Optimized cache key generation
 - Dropped some unnecessary dependencies
 
-To upgrade to v6.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/101)
+To upgrade to v6.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/101)
 
 ## v5.2.5
 
@@ -129,7 +158,7 @@ To upgrade to v6.0.0, please refer to the [migration guide](https://github.com/e
 - Added `with_authorization` method for more granular authorization control
 - `Rabarber::Role.rename` and `Rabarber::Role.remove` now require the role to exist
 
-To upgrade to v5.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/77)
+To upgrade to v5.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/77)
 
 ### Features:
 
@@ -234,7 +263,7 @@ To upgrade to v5.0.0, please refer to the [migration guide](https://github.com/e
 
 - Changed Rabarber roles table structure
 
-To upgrade to v3.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/58)
+To upgrade to v3.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/58)
 
 ### Features:
 
@@ -258,7 +287,7 @@ To upgrade to v3.0.0, please refer to the [migration guide](https://github.com/e
 - Replaced `when_unauthorized` configuration option with an overridable controller method
 - Renamed `Rabarber::Role.assignees_for` method to `Rabarber::Role.assignees`
 
-To upgrade to v2.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/52)
+To upgrade to v2.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/52)
 
 ### Features:
 

data/README.md

@@ -1,9 +1,9 @@
-# Rabarber: Simple Role-Based Authorization for Rails
+# Rabarber: Simple Authorization for Rails
 
 [![Gem Version](https://badge.fury.io/rb/rabarber.svg)](http://badge.fury.io/rb/rabarber)
 [![Downloads](https://img.shields.io/gem/dt/rabarber.svg)](https://rubygems.org/gems/rabarber)
-[![Github Actions badge](https://github.com/enjaku4/rabarber/actions/workflows/ci.yml/badge.svg)](https://github.com/enjaku4/rabarber/actions/workflows/ci.yml)
-[![License](https://img.shields.io/github/license/enjaku4/rabarber.svg)](LICENSE)
+[![Github Actions badge](https://github.com/brownboxdev/rabarber-authorization/actions/workflows/ci.yml/badge.svg)](https://github.com/brownboxdev/rabarber-authorization/actions/workflows/ci.yml)
+[![License](https://img.shields.io/github/license/brownboxdev/rabarber-authorization.svg)](LICENSE)
 
 Rabarber is a role-based authorization library for Ruby on Rails. It provides a set of tools for managing user roles and defining access rules, with support for multi-tenancy through context.
 
@@ -62,11 +62,16 @@ bundle install
 Generate the migration to store roles (replace `users` with your table name if different):
 
 ```shell
-# For standard integer IDs
 rails generate rabarber:roles users
+```
+
+Rabarber's tables use the same primary key type as your users table, so the table must exist before you run the generator. With binary UUIDs in MySQL, apply your UUID handling to Rabarber's models too, for example:
 
-# For UUID primary keys
-rails generate rabarber:roles users --uuid
+```rb
+Rails.application.config.to_prepare do
+  Rabarber::Role.attribute :context_id, YourBinaryUuidType.new
+  Rabarber::RoleAssignment.attribute :roleable_id, YourBinaryUuidType.new
+end
 ```
 
 Run the migration:
@@ -139,7 +144,10 @@ User.with_role(:admin, :manager)
 You can also directly manage roles available in the application:
 
 ```rb
-# Create a new role
+# Create roles, leaving the ones that already exist as they are
+Rabarber.create_roles(:admin, :manager)
+
+# Create a new role (deprecated, use create_roles instead)
 Rabarber.create_role(:admin)
 # => true if created, false if already exists
 
@@ -150,11 +158,17 @@ Rabarber.rename_role(:admin, :administrator)
 # Force rename even if role is assigned
 Rabarber.rename_role(:admin, :administrator, force: true)
 
-# Remove a role
+# Delete roles, keeping the ones that are assigned to users
+Rabarber.delete_roles(:admin, :manager)
+
+# Force deletion even if roles are assigned
+Rabarber.delete_roles(:admin, :manager, force: true)
+
+# Remove a role (deprecated, use delete_roles instead)
 Rabarber.delete_role(:admin)
 # => true if deleted, false if role is assigned
 
-# Force deletion even if role is assigned
+# Force deletion even if role is assigned (deprecated, use delete_roles instead)
 Rabarber.delete_role(:admin, force: true)
 
 # List available roles in the global context
@@ -364,13 +378,19 @@ User.with_role(:member, context: project)
 ### Contextual Role Management
 
 ```rb
-# Create a new role within a context
+# Create roles within a context
+Rabarber.create_roles(:admin, :member, context: Project)
+
+# Create a new role within a context (deprecated, use create_roles instead)
 Rabarber.create_role(:admin, context: Project)
 
 # Rename a role within a context
 Rabarber.rename_role(:admin, :owner, context: project)
 
-# Remove a contextual role
+# Delete contextual roles
+Rabarber.delete_roles(:admin, :member, context: project)
+
+# Remove a contextual role (deprecated, use delete_roles instead)
 Rabarber.delete_role(:admin, context: project)
 
 # List available roles within a specific context
@@ -409,7 +429,16 @@ end
 
 When a context object is deleted from your database, its associated roles become orphaned and ignored by Rabarber.
 
-To clean up orphaned roles, use:
+Ideally, the application should be designed so that this doesn't happen: whenever a context object is deleted, its roles are revoked and deleted as part of the same operation:
+
+```rb
+Project.transaction do
+  Rabarber.delete_roles(*Rabarber.roles(context: project), context: project, force: true)
+  project.destroy!
+end
+```
+
+However, if that wasn't done, you can clean up the orphaned roles as a fallback:
 
 ```rb
 Rabarber.prune
@@ -465,7 +494,7 @@ Like authorization, these helpers require an authenticated user. In views that c
 
 ### Getting Help
 
-Have a question or need assistance? Open a discussion in the [discussions section](https://github.com/enjaku4/rabarber/discussions) for:
+Have a question or need assistance? Open a discussion in the [discussions section](https://github.com/brownboxdev/rabarber-authorization/discussions) for:
 
 - Usage questions
 - Implementation guidance
@@ -473,7 +502,7 @@ Have a question or need assistance? Open a discussion in the [discussions sectio
 
 ### Issues
 
-[Issues](https://github.com/enjaku4/rabarber/issues) track bugs, planned features, and other work. When reporting a bug, please include:
+[Issues](https://github.com/brownboxdev/rabarber-authorization/issues) track bugs, planned features, and other work. When reporting a bug, please include:
 
 - A clear description of the problem
 - Steps to reproduce the issue
@@ -481,21 +510,21 @@ Have a question or need assistance? Open a discussion in the [discussions sectio
 
 ### Contributing Code
 
-Any open issue is free to pick up or discuss. Check the [project board](https://github.com/users/enjaku4/projects/10) or [issues tab](https://github.com/enjaku4/rabarber/issues).
+Any open issue is free to pick up or discuss. Check the [issues tab](https://github.com/brownboxdev/rabarber-authorization/issues).
 
-Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/rabarber/blob/main/CONTRIBUTING.md).
+Before contributing, please read the [contributing guidelines](https://github.com/brownboxdev/rabarber-authorization/blob/main/CONTRIBUTING.md).
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://github.com/enjaku4/rabarber/blob/main/LICENSE.txt).
+The gem is available as open source under the terms of the [MIT License](https://github.com/brownboxdev/rabarber-authorization/blob/main/LICENSE.txt).
 
 ## Code of Conduct
 
-Everyone interacting in the Rabarber project is expected to follow the [code of conduct](https://github.com/enjaku4/rabarber/blob/main/CODE_OF_CONDUCT.md).
+Everyone interacting in the Rabarber project is expected to follow the [code of conduct](https://github.com/brownboxdev/rabarber-authorization/blob/main/CODE_OF_CONDUCT.md).
 
 ## Old Versions
 
 Only the latest major version is actively maintained. READMEs for older versions are available here for reference:
 
-[v5.x.x](https://github.com/enjaku4/rabarber/blob/12a23858e974f5cc0a4ebddfc18bdf84171dd554/README.md) | [v4.x.x](https://github.com/enjaku4/rabarber/blob/9353e70281971154d5acd70693620197a132c543/README.md) | [v3.x.x](https://github.com/enjaku4/rabarber/blob/3bb273de7e342004abc7ef07fa4d0a9a3ce3e249/README.md)
- | [v2.x.x](https://github.com/enjaku4/rabarber/blob/875b357ea949404ddc3645ad66eddea7ed4e2ee4/README.md) | [v1.x.x](https://github.com/enjaku4/rabarber/blob/b81428429404e197d70317b763e7b2a21e02c296/README.md)
+[v5.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/12a23858e974f5cc0a4ebddfc18bdf84171dd554/README.md) | [v4.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/9353e70281971154d5acd70693620197a132c543/README.md) | [v3.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/3bb273de7e342004abc7ef07fa4d0a9a3ce3e249/README.md)
+ | [v2.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/875b357ea949404ddc3645ad66eddea7ed4e2ee4/README.md) | [v1.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/b81428429404e197d70317b763e7b2a21e02c296/README.md)

data/app/models/rabarber/role.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+module Rabarber
+  class Role < ActiveRecord::Base
+    self.table_name = "rabarber_roles"
+
+    belongs_to :context, polymorphic: true, optional: true
+
+    has_many :role_assignments, class_name: "Rabarber::RoleAssignment", inverse_of: :role, dependent: :delete_all
+
+    class << self
+      def list(context: nil)
+        names_in(Rabarber::Inputs::Context.new(context).resolve)
+      end
+
+      def list_all
+        roles = where(context_id: nil).to_a + where.not(context_id: nil).includes(:context).to_a
+
+        roles.each_with_object({}) do |role, hash|
+          (hash[role.context] ||= []) << role.name.to_sym
+        rescue ActiveRecord::RecordNotFound
+          next
+        end
+      end
+
+      def register(names, context: nil)
+        processed_names = Rabarber::Inputs::Roles.new(names).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+
+        register_missing(processed_names, processed_context)
+
+        names_in(processed_context)
+      end
+
+      def amend(old_name, new_name, context: nil, force: false)
+        processed_force = Rabarber::Inputs::Boolean.new(force).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+        processed_old_name = Rabarber::Inputs::Role.new(old_name).process
+        name = Rabarber::Inputs::Role.new(new_name).process
+
+        transaction(requires_new: true) do
+          role = lock.find_by(name: processed_old_name, **processed_context)
+
+          raise Rabarber::NotFoundError, "Role not found" unless role
+
+          next false if exists?(name:, **processed_context) || !processed_force && role.role_assignments.lock.exists?
+
+          role.update!(name:)
+
+          delete_roleables_cache(role.role_assignments.lock.pluck(:roleable_id), context: processed_context)
+
+          true
+        end
+      rescue ActiveRecord::RecordNotUnique
+        false
+      end
+
+      def drop(names, context: nil, force: false)
+        processed_names = Rabarber::Inputs::Roles.new(names).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+        processed_force = Rabarber::Inputs::Boolean.new(force).process
+
+        transaction do
+          role_ids = where(name: processed_names, **processed_context).lock.ids
+          role_ids.reject! { Rabarber::RoleAssignment.where(role_id: _1).lock.exists? } unless processed_force
+          roleable_ids = Rabarber::RoleAssignment.where(role_id: role_ids).lock.pluck(:roleable_id).uniq
+
+          delete_with_assignments(where(id: role_ids))
+
+          delete_roleables_cache(roleable_ids, context: processed_context)
+        end
+
+        names_in(processed_context)
+      end
+
+      def prune
+        where.not(context_id: nil).distinct.pluck(:context_type).each do |context_type|
+          context_class = context_type.constantize
+
+          delete_with_assignments(where(context_type:).where.not(context_id: context_class.select(context_class.primary_key)))
+        end
+      end
+
+      def deprecated_register(name, context: nil)
+        name = Rabarber::Inputs::Role.new(name).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+
+        return false if exists?(name:, **processed_context)
+
+        !!transaction(requires_new: true) { create!(name:, **processed_context) }
+      rescue ActiveRecord::RecordNotUnique
+        false
+      end
+
+      def deprecated_drop(name, context: nil, force: false)
+        processed_force = Rabarber::Inputs::Boolean.new(force).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+        processed_name = Rabarber::Inputs::Role.new(name).process
+
+        transaction do
+          role = lock.find_by(name: processed_name, **processed_context)
+
+          raise Rabarber::NotFoundError, "Role not found" unless role
+
+          next false if !processed_force && role.role_assignments.lock.exists?
+
+          roleable_ids = role.role_assignments.lock.pluck(:roleable_id)
+
+          role.destroy!
+
+          delete_roleables_cache(roleable_ids, context: processed_context)
+
+          true
+        end
+      end
+
+      def names_in(processed_context)
+        where(processed_context).pluck(:name).map(&:to_sym)
+      end
+
+      def register_missing(names, processed_context)
+        (names.uniq - names_in(processed_context)).each do |name|
+          transaction(requires_new: true) { create!(name:, **processed_context) }
+        rescue ActiveRecord::RecordNotUnique
+          next
+        end
+      end
+
+      def delete_with_assignments(roles)
+        transaction do
+          Rabarber::RoleAssignment.where(role: roles).delete_all
+          roles.delete_all
+        end
+      end
+
+      private
+
+      def delete_roleables_cache(roleable_ids, context:)
+        Rabarber::Core::Cache.delete(*roleable_ids.flat_map { [[_1, context], [_1, :all]] })
+      end
+    end
+
+    def context
+      return context_type.constantize if context_type.present? && context_id.blank?
+
+      record = super
+
+      raise ActiveRecord::RecordNotFound.new(nil, context_type, nil, context_id) if context_id.present? && !record
+
+      record
+    end
+  end
+end

data/app/models/rabarber/role_assignment.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Rabarber
+  class RoleAssignment < ActiveRecord::Base
+    self.table_name = "rabarber_roles_roleables"
+
+    belongs_to :role, class_name: "Rabarber::Role"
+    belongs_to :roleable, class_name: Rabarber::Configuration.user_model_name
+  end
+end

data/lib/generators/rabarber/roles_generator.rb

@@ -10,9 +10,13 @@ module Rabarber
 
     argument :table_name, type: :string, required: true
 
-    class_option :uuid, type: :boolean, default: false, desc: "Use UUIDs as primary keys"
-
     def create_migrations
+      @id_type = ActiveRecord::Base.with_connection do |connection|
+        raise Thor::Error, "Table `#{table_name}` does not exist, run its migration first" unless connection.table_exists?(table_name)
+
+        connection.columns(table_name).find { |column| column.name == connection.primary_key(table_name) }.sql_type
+      end
+
       migration_template "create_rabarber_roles.rb.erb", "db/migrate/create_rabarber_roles.rb"
     end
 

data/lib/generators/rabarber/templates/create_rabarber_roles.rb.erb

@@ -2,9 +2,9 @@
 
 class CreateRabarberRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version.to_s %>]
   def change
-    create_table :rabarber_roles<%= ", id: :uuid" if options[:uuid] %> do |t|
+    create_table :rabarber_roles do |t|
       t.string :name, null: false
-      t.belongs_to :context, polymorphic: true, index: true<%= ", type: :uuid" if options[:uuid] %>
+      t.belongs_to :context, polymorphic: true, index: true, type: <%= @id_type.inspect %>
       t.timestamps
     end
 
@@ -16,8 +16,8 @@ class CreateRabarberRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.
     end
 
     create_table :rabarber_roles_roleables, id: false do |t|
-      t.belongs_to :role, null: false, index: true, foreign_key: { to_table: :rabarber_roles }<%= ", type: :uuid" if options[:uuid] %>
-      t.belongs_to :roleable, null: false, index: true, foreign_key: { to_table: <%= table_name.to_sym.inspect %> }<%= ", type: :uuid" if options[:uuid] %>
+      t.belongs_to :role, null: false, index: true, foreign_key: { to_table: :rabarber_roles }
+      t.belongs_to :roleable, null: false, index: true, foreign_key: { to_table: <%= table_name.to_sym.inspect %>, primary_key: primary_key(<%= table_name.to_sym.inspect %>) }, type: <%= @id_type.inspect %>
     end
 
     add_index :rabarber_roles_roleables, [:role_id, :roleable_id], unique: true

data/lib/rabarber/configuration.rb

@@ -16,7 +16,7 @@ module Rabarber
       @cache_enabled = Rabarber::Inputs::Boolean.new(
         value,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `cache_enabled`, expected a boolean, got #{value.inspect}"
+        message: "Invalid configuration `cache_enabled`, expected a boolean, got `#{value.inspect}`"
       ).process
     end
 
@@ -24,7 +24,7 @@ module Rabarber
       @current_user_method = Rabarber::Inputs::NonEmptySymbol.new(
         value,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `current_user_method`, expected a symbol or a string, got #{value.inspect}"
+        message: "Invalid configuration `current_user_method`, expected a symbol or a string, got `#{value.inspect}`"
       ).process
     end
 
@@ -32,7 +32,7 @@ module Rabarber
       @user_model_name = Rabarber::Inputs::NonEmptyString.new(
         value,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got #{value.inspect}"
+        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got `#{value.inspect}`"
       ).process
     end
 
@@ -46,7 +46,7 @@ module Rabarber
       Rabarber::Inputs::Model.new(
         user_model_name,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got #{user_model_name.inspect}"
+        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got `#{user_model_name.inspect}`"
       ).process
     end
 

data/lib/rabarber/controllers/concerns/authorization.rb

@@ -24,30 +24,11 @@ module Rabarber
 
         Rabarber::Core::Permissions.add(
           self,
-          Rabarber::Inputs::NonEmptySymbol.new(
-            action,
-            optional: true,
-            message: "Expected a symbol or a string, got #{action.inspect}"
-          ).process,
-          Rabarber::Inputs::Roles.new(
-            roles,
-            message: "Expected an array of symbols or strings containing only lowercase letters, numbers, and underscores, got #{roles.inspect}"
-          ).process,
-          Rabarber::Inputs::Contexts::Authorizational.new(
-            context,
-            error: Rabarber::InvalidContextError,
-            message: "Expected a Class, an instance of ActiveRecord model, a symbol, a string, or a proc, got #{context.inspect}"
-          ).resolve,
-          Rabarber::Inputs::DynamicRule.new(
-            if_rule,
-            optional: true,
-            message: "Expected a symbol, a string, or a proc, got #{if_rule.inspect}"
-          ).process,
-          Rabarber::Inputs::DynamicRule.new(
-            unless_rule,
-            optional: true,
-            message: "Expected a symbol, a string, or a proc, got #{unless_rule.inspect}"
-          ).process
+          Rabarber::Inputs::NonEmptySymbol.new(action, optional: true).process,
+          Rabarber::Inputs::Roles.new(roles).process,
+          Rabarber::Inputs::Contexts::Authorizational.new(context).process,
+          Rabarber::Inputs::DynamicRule.new(if_rule, optional: true).process,
+          Rabarber::Inputs::DynamicRule.new(unless_rule, optional: true).process
         )
       end
     end

data/lib/rabarber/core/cache.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "digest/md5"
+require "json"
 require "securerandom"
 
 module Rabarber
@@ -9,22 +10,22 @@ module Rabarber
       extend self
 
       def fetch(roleable_id, scope, &)
-        return yield unless enabled?
+        return yield if !enabled? || ActiveRecord::Base.current_transaction.open?
 
-        Rails.cache.fetch(prepare_key(roleable_id, scope), expires_in: 1.hour, race_condition_ttl: 5.seconds, &)
+        Rails.cache.fetch(prepare_key(current_version, roleable_id, scope), expires_in: 1.hour, race_condition_ttl: 5.seconds, &)
       end
 
       def delete(*pairs)
         return unless enabled? && pairs.any?
 
-        keys = pairs.map { |roleable_id, scope| prepare_key(roleable_id, scope) }
+        delete_keys(pairs)
 
-        Rails.cache.delete_multi(keys)
-        ActiveRecord.after_all_transactions_commit { Rails.cache.delete_multi(keys) } if ActiveRecord::Base.connection.transaction_open?
+        transaction = ActiveRecord::Base.current_transaction
+        transaction.after_commit { delete_keys(pairs) } if transaction.open?
       end
 
       def clear
-        Rails.cache.write(VERSION_KEY, SecureRandom.alphanumeric(8))
+        ActiveRecord::Base.current_transaction.after_commit { rotate_version }
       end
 
       private
@@ -33,8 +34,13 @@ module Rabarber
         Rabarber::Configuration.cache_enabled
       end
 
-      def prepare_key(roleable_id, scope)
-        Digest::MD5.base64digest(Marshal.dump([current_version, roleable_id, scope]))
+      def delete_keys(pairs)
+        version = current_version
+        Rails.cache.delete_multi(pairs.map { |roleable_id, scope| prepare_key(version, roleable_id, scope) })
+      end
+
+      def prepare_key(version, roleable_id, scope)
+        Digest::MD5.base64digest(JSON.generate([version, roleable_id, scope]))
       end
 
       def current_version
@@ -42,11 +48,15 @@ module Rabarber
 
         return version if version
 
-        clear
+        rotate_version
 
         Rails.cache.read(VERSION_KEY)
       end
 
+      def rotate_version
+        Rails.cache.write(VERSION_KEY, SecureRandom.alphanumeric(8))
+      end
+
       VERSION_KEY = "rabarber"
       private_constant :VERSION_KEY
     end

data/lib/rabarber/core/roleable.rb

@@ -3,22 +3,20 @@
 module Rabarber
   module Core
     module Roleable
+      private
+
       def roleable
         current_roleable = send(Rabarber::Configuration.current_user_method)
 
         unless current_roleable.is_a?(Rabarber::Configuration.user_model)
           raise(
             Rabarber::Error,
-            "Expected `#{Rabarber::Configuration.current_user_method}` to return an instance of #{Rabarber::Configuration.user_model_name}, got #{current_roleable.inspect}"
+            "Expected `#{Rabarber::Configuration.current_user_method}` to return an instance of #{Rabarber::Configuration.user_model_name}, got `#{current_roleable.inspect}`"
           )
         end
 
         current_roleable
       end
-
-      def roleable_roles(context: nil)
-        roleable.roles(context:)
-      end
     end
   end
 end

data/lib/rabarber/core/rule.rb

@@ -19,7 +19,7 @@ module Rabarber
       end
 
       def roles_permitted?(roleable, controller_instance)
-        @roles.empty? || roleable.has_role?(*@roles, context: resolve_context(controller_instance))
+        @roles.empty? || roleable.has_role?(*@roles, context: context_for(controller_instance))
       end
 
       def dynamic_rules_followed?(controller_instance)
@@ -32,18 +32,12 @@ module Rabarber
         !!(rule.is_a?(Proc) ? controller_instance.instance_exec(&rule) : controller_instance.send(rule))
       end
 
-      def resolve_context(controller_instance)
-        context = case @context
-                  when Proc then controller_instance.instance_exec(&@context)
-                  when Symbol then controller_instance.send(@context)
-                  else @context
-                  end
-
-        Rabarber::Inputs::Context.new(
-          context,
-          error: Rabarber::InvalidContextError,
-          message: "Expected an instance of ActiveRecord model, a Class, or nil, got #{context.inspect}"
-        ).resolve
+      def context_for(controller_instance)
+        case @context
+        when Proc then controller_instance.instance_exec(&@context)
+        when Symbol then controller_instance.send(@context)
+        else @context
+        end
       end
     end
   end