rabarber 6.0.3 → 6.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7481864a3dc409501c34dc66d1f7bfe3399118285fb99cbc6979b17c1b75ff3
-  data.tar.gz: ea2c8e12a4a28be3166d4fb60db78e5c5857e838697a5b2308db2486e81d92ad
+  metadata.gz: d6a04e1ab84c89a6ab0271fb9c75021c6a5b0ecf042ae53914e58c969ed8a533
+  data.tar.gz: 4dc99eacf060c21b9a08d23a882a96ce41c3cf8675d1eae73a2dc00ee925eae5
 SHA512:
-  metadata.gz: 239a2ba8dc2541688ab09fdbf143d9246e6a725d5ac8adebd253c2ef5d2a7935a4b51d4dffadfb6f490cb6871955b1832c6f24188bfe389abbf22287627652d8
-  data.tar.gz: bdf91f9803ec0fd770a7bdb8b0267e63566078a7496b736b0cfdc8a2b7084c73be0836148e0d89e887f8753338fc9efa3a15213f3fa839229b041497349f8908
+  metadata.gz: 876ded94c228f0318c809c2d93ae4b0a7187fd85a958cd85c826b2b6659dae1550d90b665e63b1221866e72fdd133f39811aa458de2e6755676b4f9590e0062b
+  data.tar.gz: 43e014c4ce4f3e57f7c3bb9668b40d00a355d0f5c9129a8e36d130d01568377dbfa2f7a1a27a8e3224b77b13d276a820966c7c765ea52dcf0b628e5cfa037452

data/CHANGELOG.md

@@ -1,3 +1,26 @@
+## v6.1.0
+
+### Features:
+
+- Added `Rabarber.create_roles` and `Rabarber.delete_roles` to create and delete several roles at once
+- Added support for binary UUID primary keys in MySQL
+
+### Bugs:
+
+- Fixed a race condition where assigning several roles at once could assign none of them
+- Fixed context migration helpers raising when no roles exist in the context
+- Fixed the generated migration creating a broken foreign key when the user table's primary key is not `id`
+- Fixed roles assigned or revoked inside a rolled back transaction staying cached
+- Fixed concurrent role creation or renaming discarding the surrounding transaction
+- Fixed the generated migration not working with UUID primary keys on some databases
+- Fixed roles assigned during `revoke_all_roles` staying cached after being revoked
+
+### Misc:
+
+- Deprecated calling `assign_roles`, `revoke_roles`, or `revoke_all_roles` on an unsaved record
+- Deprecated `Rabarber.create_role` and `Rabarber.delete_role`
+- The generator now takes the primary key type from the existing user table, making `--uuid` unnecessary
+
 ## v6.0.3
 
 ### Bugs:
@@ -49,7 +72,7 @@ On databases without partial index support, such as MySQL, uniqueness of global
 - Optimized cache key generation
 - Dropped some unnecessary dependencies
 
-To upgrade to v6.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/101)
+To upgrade to v6.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/101)
 
 ## v5.2.5
 
@@ -135,7 +158,7 @@ To upgrade to v6.0.0, please refer to the [migration guide](https://github.com/e
 - Added `with_authorization` method for more granular authorization control
 - `Rabarber::Role.rename` and `Rabarber::Role.remove` now require the role to exist
 
-To upgrade to v5.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/77)
+To upgrade to v5.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/77)
 
 ### Features:
 
@@ -240,7 +263,7 @@ To upgrade to v5.0.0, please refer to the [migration guide](https://github.com/e
 
 - Changed Rabarber roles table structure
 
-To upgrade to v3.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/58)
+To upgrade to v3.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/58)
 
 ### Features:
 
@@ -264,7 +287,7 @@ To upgrade to v3.0.0, please refer to the [migration guide](https://github.com/e
 - Replaced `when_unauthorized` configuration option with an overridable controller method
 - Renamed `Rabarber::Role.assignees_for` method to `Rabarber::Role.assignees`
 
-To upgrade to v2.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/52)
+To upgrade to v2.0.0, please refer to the [migration guide](https://github.com/brownboxdev/rabarber-authorization/discussions/52)
 
 ### Features:
 

data/README.md

@@ -2,8 +2,8 @@
 
 [![Gem Version](https://badge.fury.io/rb/rabarber.svg)](http://badge.fury.io/rb/rabarber)
 [![Downloads](https://img.shields.io/gem/dt/rabarber.svg)](https://rubygems.org/gems/rabarber)
-[![Github Actions badge](https://github.com/enjaku4/rabarber/actions/workflows/ci.yml/badge.svg)](https://github.com/enjaku4/rabarber/actions/workflows/ci.yml)
-[![License](https://img.shields.io/github/license/enjaku4/rabarber.svg)](LICENSE)
+[![Github Actions badge](https://github.com/brownboxdev/rabarber-authorization/actions/workflows/ci.yml/badge.svg)](https://github.com/brownboxdev/rabarber-authorization/actions/workflows/ci.yml)
+[![License](https://img.shields.io/github/license/brownboxdev/rabarber-authorization.svg)](LICENSE)
 
 Rabarber is a role-based authorization library for Ruby on Rails. It provides a set of tools for managing user roles and defining access rules, with support for multi-tenancy through context.
 
@@ -62,11 +62,16 @@ bundle install
 Generate the migration to store roles (replace `users` with your table name if different):
 
 ```shell
-# For standard integer IDs
 rails generate rabarber:roles users
+```
+
+Rabarber's tables use the same primary key type as your users table, so the table must exist before you run the generator. With binary UUIDs in MySQL, apply your UUID handling to Rabarber's models too, for example:
 
-# For UUID primary keys
-rails generate rabarber:roles users --uuid
+```rb
+Rails.application.config.to_prepare do
+  Rabarber::Role.attribute :context_id, YourBinaryUuidType.new
+  Rabarber::RoleAssignment.attribute :roleable_id, YourBinaryUuidType.new
+end
 ```
 
 Run the migration:
@@ -139,7 +144,10 @@ User.with_role(:admin, :manager)
 You can also directly manage roles available in the application:
 
 ```rb
-# Create a new role
+# Create roles, leaving the ones that already exist as they are
+Rabarber.create_roles(:admin, :manager)
+
+# Create a new role (deprecated, use create_roles instead)
 Rabarber.create_role(:admin)
 # => true if created, false if already exists
 
@@ -150,11 +158,17 @@ Rabarber.rename_role(:admin, :administrator)
 # Force rename even if role is assigned
 Rabarber.rename_role(:admin, :administrator, force: true)
 
-# Remove a role
+# Delete roles, keeping the ones that are assigned to users
+Rabarber.delete_roles(:admin, :manager)
+
+# Force deletion even if roles are assigned
+Rabarber.delete_roles(:admin, :manager, force: true)
+
+# Remove a role (deprecated, use delete_roles instead)
 Rabarber.delete_role(:admin)
 # => true if deleted, false if role is assigned
 
-# Force deletion even if role is assigned
+# Force deletion even if role is assigned (deprecated, use delete_roles instead)
 Rabarber.delete_role(:admin, force: true)
 
 # List available roles in the global context
@@ -364,13 +378,19 @@ User.with_role(:member, context: project)
 ### Contextual Role Management
 
 ```rb
-# Create a new role within a context
+# Create roles within a context
+Rabarber.create_roles(:admin, :member, context: Project)
+
+# Create a new role within a context (deprecated, use create_roles instead)
 Rabarber.create_role(:admin, context: Project)
 
 # Rename a role within a context
 Rabarber.rename_role(:admin, :owner, context: project)
 
-# Remove a contextual role
+# Delete contextual roles
+Rabarber.delete_roles(:admin, :member, context: project)
+
+# Remove a contextual role (deprecated, use delete_roles instead)
 Rabarber.delete_role(:admin, context: project)
 
 # List available roles within a specific context
@@ -409,7 +429,16 @@ end
 
 When a context object is deleted from your database, its associated roles become orphaned and ignored by Rabarber.
 
-Ideally, the application should be designed so that this doesn't happen: whenever a context object is deleted, its roles are revoked and deleted as part of the same operation. However, if that wasn't done, you can clean up the orphaned roles as a fallback:
+Ideally, the application should be designed so that this doesn't happen: whenever a context object is deleted, its roles are revoked and deleted as part of the same operation:
+
+```rb
+Project.transaction do
+  Rabarber.delete_roles(*Rabarber.roles(context: project), context: project, force: true)
+  project.destroy!
+end
+```
+
+However, if that wasn't done, you can clean up the orphaned roles as a fallback:
 
 ```rb
 Rabarber.prune
@@ -465,7 +494,7 @@ Like authorization, these helpers require an authenticated user. In views that c
 
 ### Getting Help
 
-Have a question or need assistance? Open a discussion in the [discussions section](https://github.com/enjaku4/rabarber/discussions) for:
+Have a question or need assistance? Open a discussion in the [discussions section](https://github.com/brownboxdev/rabarber-authorization/discussions) for:
 
 - Usage questions
 - Implementation guidance
@@ -473,7 +502,7 @@ Have a question or need assistance? Open a discussion in the [discussions sectio
 
 ### Issues
 
-[Issues](https://github.com/enjaku4/rabarber/issues) track bugs, planned features, and other work. When reporting a bug, please include:
+[Issues](https://github.com/brownboxdev/rabarber-authorization/issues) track bugs, planned features, and other work. When reporting a bug, please include:
 
 - A clear description of the problem
 - Steps to reproduce the issue
@@ -481,21 +510,21 @@ Have a question or need assistance? Open a discussion in the [discussions sectio
 
 ### Contributing Code
 
-Any open issue is free to pick up or discuss. Check the [project board](https://github.com/users/enjaku4/projects/10) or [issues tab](https://github.com/enjaku4/rabarber/issues).
+Any open issue is free to pick up or discuss. Check the [issues tab](https://github.com/brownboxdev/rabarber-authorization/issues).
 
-Before contributing, please read the [contributing guidelines](https://github.com/enjaku4/rabarber/blob/main/CONTRIBUTING.md).
+Before contributing, please read the [contributing guidelines](https://github.com/brownboxdev/rabarber-authorization/blob/main/CONTRIBUTING.md).
 
 ## License
 
-The gem is available as open source under the terms of the [MIT License](https://github.com/enjaku4/rabarber/blob/main/LICENSE.txt).
+The gem is available as open source under the terms of the [MIT License](https://github.com/brownboxdev/rabarber-authorization/blob/main/LICENSE.txt).
 
 ## Code of Conduct
 
-Everyone interacting in the Rabarber project is expected to follow the [code of conduct](https://github.com/enjaku4/rabarber/blob/main/CODE_OF_CONDUCT.md).
+Everyone interacting in the Rabarber project is expected to follow the [code of conduct](https://github.com/brownboxdev/rabarber-authorization/blob/main/CODE_OF_CONDUCT.md).
 
 ## Old Versions
 
 Only the latest major version is actively maintained. READMEs for older versions are available here for reference:
 
-[v5.x.x](https://github.com/enjaku4/rabarber/blob/12a23858e974f5cc0a4ebddfc18bdf84171dd554/README.md) | [v4.x.x](https://github.com/enjaku4/rabarber/blob/9353e70281971154d5acd70693620197a132c543/README.md) | [v3.x.x](https://github.com/enjaku4/rabarber/blob/3bb273de7e342004abc7ef07fa4d0a9a3ce3e249/README.md)
- | [v2.x.x](https://github.com/enjaku4/rabarber/blob/875b357ea949404ddc3645ad66eddea7ed4e2ee4/README.md) | [v1.x.x](https://github.com/enjaku4/rabarber/blob/b81428429404e197d70317b763e7b2a21e02c296/README.md)
+[v5.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/12a23858e974f5cc0a4ebddfc18bdf84171dd554/README.md) | [v4.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/9353e70281971154d5acd70693620197a132c543/README.md) | [v3.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/3bb273de7e342004abc7ef07fa4d0a9a3ce3e249/README.md)
+ | [v2.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/875b357ea949404ddc3645ad66eddea7ed4e2ee4/README.md) | [v1.x.x](https://github.com/brownboxdev/rabarber-authorization/blob/b81428429404e197d70317b763e7b2a21e02c296/README.md)

data/app/models/rabarber/role.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+module Rabarber
+  class Role < ActiveRecord::Base
+    self.table_name = "rabarber_roles"
+
+    belongs_to :context, polymorphic: true, optional: true
+
+    has_many :role_assignments, class_name: "Rabarber::RoleAssignment", inverse_of: :role, dependent: :delete_all
+
+    class << self
+      def list(context: nil)
+        names_in(Rabarber::Inputs::Context.new(context).resolve)
+      end
+
+      def list_all
+        roles = where(context_id: nil).to_a + where.not(context_id: nil).includes(:context).to_a
+
+        roles.each_with_object({}) do |role, hash|
+          (hash[role.context] ||= []) << role.name.to_sym
+        rescue ActiveRecord::RecordNotFound
+          next
+        end
+      end
+
+      def register(names, context: nil)
+        processed_names = Rabarber::Inputs::Roles.new(names).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+
+        register_missing(processed_names, processed_context)
+
+        names_in(processed_context)
+      end
+
+      def amend(old_name, new_name, context: nil, force: false)
+        processed_force = Rabarber::Inputs::Boolean.new(force).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+        processed_old_name = Rabarber::Inputs::Role.new(old_name).process
+        name = Rabarber::Inputs::Role.new(new_name).process
+
+        transaction(requires_new: true) do
+          role = lock.find_by(name: processed_old_name, **processed_context)
+
+          raise Rabarber::NotFoundError, "Role not found" unless role
+
+          next false if exists?(name:, **processed_context) || !processed_force && role.role_assignments.lock.exists?
+
+          role.update!(name:)
+
+          delete_roleables_cache(role.role_assignments.lock.pluck(:roleable_id), context: processed_context)
+
+          true
+        end
+      rescue ActiveRecord::RecordNotUnique
+        false
+      end
+
+      def drop(names, context: nil, force: false)
+        processed_names = Rabarber::Inputs::Roles.new(names).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+        processed_force = Rabarber::Inputs::Boolean.new(force).process
+
+        transaction do
+          role_ids = where(name: processed_names, **processed_context).lock.ids
+          role_ids.reject! { Rabarber::RoleAssignment.where(role_id: _1).lock.exists? } unless processed_force
+          roleable_ids = Rabarber::RoleAssignment.where(role_id: role_ids).lock.pluck(:roleable_id).uniq
+
+          delete_with_assignments(where(id: role_ids))
+
+          delete_roleables_cache(roleable_ids, context: processed_context)
+        end
+
+        names_in(processed_context)
+      end
+
+      def prune
+        where.not(context_id: nil).distinct.pluck(:context_type).each do |context_type|
+          context_class = context_type.constantize
+
+          delete_with_assignments(where(context_type:).where.not(context_id: context_class.select(context_class.primary_key)))
+        end
+      end
+
+      def deprecated_register(name, context: nil)
+        name = Rabarber::Inputs::Role.new(name).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+
+        return false if exists?(name:, **processed_context)
+
+        !!transaction(requires_new: true) { create!(name:, **processed_context) }
+      rescue ActiveRecord::RecordNotUnique
+        false
+      end
+
+      def deprecated_drop(name, context: nil, force: false)
+        processed_force = Rabarber::Inputs::Boolean.new(force).process
+        processed_context = Rabarber::Inputs::Context.new(context).resolve
+        processed_name = Rabarber::Inputs::Role.new(name).process
+
+        transaction do
+          role = lock.find_by(name: processed_name, **processed_context)
+
+          raise Rabarber::NotFoundError, "Role not found" unless role
+
+          next false if !processed_force && role.role_assignments.lock.exists?
+
+          roleable_ids = role.role_assignments.lock.pluck(:roleable_id)
+
+          role.destroy!
+
+          delete_roleables_cache(roleable_ids, context: processed_context)
+
+          true
+        end
+      end
+
+      def names_in(processed_context)
+        where(processed_context).pluck(:name).map(&:to_sym)
+      end
+
+      def register_missing(names, processed_context)
+        (names.uniq - names_in(processed_context)).each do |name|
+          transaction(requires_new: true) { create!(name:, **processed_context) }
+        rescue ActiveRecord::RecordNotUnique
+          next
+        end
+      end
+
+      def delete_with_assignments(roles)
+        transaction do
+          Rabarber::RoleAssignment.where(role: roles).delete_all
+          roles.delete_all
+        end
+      end
+
+      private
+
+      def delete_roleables_cache(roleable_ids, context:)
+        Rabarber::Core::Cache.delete(*roleable_ids.flat_map { [[_1, context], [_1, :all]] })
+      end
+    end
+
+    def context
+      return context_type.constantize if context_type.present? && context_id.blank?
+
+      record = super
+
+      raise ActiveRecord::RecordNotFound.new(nil, context_type, nil, context_id) if context_id.present? && !record
+
+      record
+    end
+  end
+end

data/app/models/rabarber/role_assignment.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Rabarber
+  class RoleAssignment < ActiveRecord::Base
+    self.table_name = "rabarber_roles_roleables"
+
+    belongs_to :role, class_name: "Rabarber::Role"
+    belongs_to :roleable, class_name: Rabarber::Configuration.user_model_name
+  end
+end

data/lib/generators/rabarber/roles_generator.rb

@@ -10,9 +10,13 @@ module Rabarber
 
     argument :table_name, type: :string, required: true
 
-    class_option :uuid, type: :boolean, default: false, desc: "Use UUIDs as primary keys"
-
     def create_migrations
+      @id_type = ActiveRecord::Base.with_connection do |connection|
+        raise Thor::Error, "Table `#{table_name}` does not exist, run its migration first" unless connection.table_exists?(table_name)
+
+        connection.columns(table_name).find { |column| column.name == connection.primary_key(table_name) }.sql_type
+      end
+
       migration_template "create_rabarber_roles.rb.erb", "db/migrate/create_rabarber_roles.rb"
     end
 

data/lib/generators/rabarber/templates/create_rabarber_roles.rb.erb

@@ -2,9 +2,9 @@
 
 class CreateRabarberRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version.to_s %>]
   def change
-    create_table :rabarber_roles<%= ", id: :uuid" if options[:uuid] %> do |t|
+    create_table :rabarber_roles do |t|
       t.string :name, null: false
-      t.belongs_to :context, polymorphic: true, index: true<%= ", type: :uuid" if options[:uuid] %>
+      t.belongs_to :context, polymorphic: true, index: true, type: <%= @id_type.inspect %>
       t.timestamps
     end
 
@@ -16,8 +16,8 @@ class CreateRabarberRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.
     end
 
     create_table :rabarber_roles_roleables, id: false do |t|
-      t.belongs_to :role, null: false, index: true, foreign_key: { to_table: :rabarber_roles }<%= ", type: :uuid" if options[:uuid] %>
-      t.belongs_to :roleable, null: false, index: true, foreign_key: { to_table: <%= table_name.to_sym.inspect %> }<%= ", type: :uuid" if options[:uuid] %>
+      t.belongs_to :role, null: false, index: true, foreign_key: { to_table: :rabarber_roles }
+      t.belongs_to :roleable, null: false, index: true, foreign_key: { to_table: <%= table_name.to_sym.inspect %>, primary_key: primary_key(<%= table_name.to_sym.inspect %>) }, type: <%= @id_type.inspect %>
     end
 
     add_index :rabarber_roles_roleables, [:role_id, :roleable_id], unique: true

data/lib/rabarber/configuration.rb

@@ -16,7 +16,7 @@ module Rabarber
       @cache_enabled = Rabarber::Inputs::Boolean.new(
         value,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `cache_enabled`, expected a boolean, got #{value.inspect}"
+        message: "Invalid configuration `cache_enabled`, expected a boolean, got `#{value.inspect}`"
       ).process
     end
 
@@ -24,7 +24,7 @@ module Rabarber
       @current_user_method = Rabarber::Inputs::NonEmptySymbol.new(
         value,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `current_user_method`, expected a symbol or a string, got #{value.inspect}"
+        message: "Invalid configuration `current_user_method`, expected a symbol or a string, got `#{value.inspect}`"
       ).process
     end
 
@@ -32,7 +32,7 @@ module Rabarber
       @user_model_name = Rabarber::Inputs::NonEmptyString.new(
         value,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got #{value.inspect}"
+        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got `#{value.inspect}`"
       ).process
     end
 
@@ -46,7 +46,7 @@ module Rabarber
       Rabarber::Inputs::Model.new(
         user_model_name,
         error: Rabarber::ConfigurationError,
-        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got #{user_model_name.inspect}"
+        message: "Invalid configuration `user_model_name`, expected an ActiveRecord model name, got `#{user_model_name.inspect}`"
       ).process
     end
 

data/lib/rabarber/controllers/concerns/authorization.rb

@@ -24,30 +24,11 @@ module Rabarber
 
         Rabarber::Core::Permissions.add(
           self,
-          Rabarber::Inputs::NonEmptySymbol.new(
-            action,
-            optional: true,
-            message: "Expected a symbol or a string, got #{action.inspect}"
-          ).process,
-          Rabarber::Inputs::Roles.new(
-            roles,
-            message: "Expected an array of symbols or strings containing only lowercase letters, numbers, and underscores, got #{roles.inspect}"
-          ).process,
-          Rabarber::Inputs::Contexts::Authorizational.new(
-            context,
-            error: Rabarber::InvalidContextError,
-            message: "Expected a Class, an instance of ActiveRecord model, a symbol, a string, or a proc, got #{context.inspect}"
-          ).resolve,
-          Rabarber::Inputs::DynamicRule.new(
-            if_rule,
-            optional: true,
-            message: "Expected a symbol, a string, or a proc, got #{if_rule.inspect}"
-          ).process,
-          Rabarber::Inputs::DynamicRule.new(
-            unless_rule,
-            optional: true,
-            message: "Expected a symbol, a string, or a proc, got #{unless_rule.inspect}"
-          ).process
+          Rabarber::Inputs::NonEmptySymbol.new(action, optional: true).process,
+          Rabarber::Inputs::Roles.new(roles).process,
+          Rabarber::Inputs::Contexts::Authorizational.new(context).process,
+          Rabarber::Inputs::DynamicRule.new(if_rule, optional: true).process,
+          Rabarber::Inputs::DynamicRule.new(unless_rule, optional: true).process
         )
       end
     end

data/lib/rabarber/core/cache.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "digest/md5"
+require "json"
 require "securerandom"
 
 module Rabarber
@@ -9,22 +10,22 @@ module Rabarber
       extend self
 
       def fetch(roleable_id, scope, &)
-        return yield unless enabled?
+        return yield if !enabled? || ActiveRecord::Base.current_transaction.open?
 
-        Rails.cache.fetch(prepare_key(roleable_id, scope), expires_in: 1.hour, race_condition_ttl: 5.seconds, &)
+        Rails.cache.fetch(prepare_key(current_version, roleable_id, scope), expires_in: 1.hour, race_condition_ttl: 5.seconds, &)
       end
 
       def delete(*pairs)
         return unless enabled? && pairs.any?
 
-        keys = pairs.map { |roleable_id, scope| prepare_key(roleable_id, scope) }
+        delete_keys(pairs)
 
-        Rails.cache.delete_multi(keys)
-        ActiveRecord.after_all_transactions_commit { Rails.cache.delete_multi(keys) } if ActiveRecord::Base.connection.transaction_open?
+        transaction = ActiveRecord::Base.current_transaction
+        transaction.after_commit { delete_keys(pairs) } if transaction.open?
       end
 
       def clear
-        Rails.cache.write(VERSION_KEY, SecureRandom.alphanumeric(8))
+        ActiveRecord::Base.current_transaction.after_commit { rotate_version }
       end
 
       private
@@ -33,8 +34,13 @@ module Rabarber
         Rabarber::Configuration.cache_enabled
       end
 
-      def prepare_key(roleable_id, scope)
-        Digest::MD5.base64digest(Marshal.dump([current_version, roleable_id, scope]))
+      def delete_keys(pairs)
+        version = current_version
+        Rails.cache.delete_multi(pairs.map { |roleable_id, scope| prepare_key(version, roleable_id, scope) })
+      end
+
+      def prepare_key(version, roleable_id, scope)
+        Digest::MD5.base64digest(JSON.generate([version, roleable_id, scope]))
       end
 
       def current_version
@@ -42,11 +48,15 @@ module Rabarber
 
         return version if version
 
-        clear
+        rotate_version
 
         Rails.cache.read(VERSION_KEY)
       end
 
+      def rotate_version
+        Rails.cache.write(VERSION_KEY, SecureRandom.alphanumeric(8))
+      end
+
       VERSION_KEY = "rabarber"
       private_constant :VERSION_KEY
     end

data/lib/rabarber/core/roleable.rb

@@ -11,7 +11,7 @@ module Rabarber
         unless current_roleable.is_a?(Rabarber::Configuration.user_model)
           raise(
             Rabarber::Error,
-            "Expected `#{Rabarber::Configuration.current_user_method}` to return an instance of #{Rabarber::Configuration.user_model_name}, got #{current_roleable.inspect}"
+            "Expected `#{Rabarber::Configuration.current_user_method}` to return an instance of #{Rabarber::Configuration.user_model_name}, got `#{current_roleable.inspect}`"
           )
         end
 

data/lib/rabarber/core/rule.rb

@@ -19,7 +19,7 @@ module Rabarber
       end
 
       def roles_permitted?(roleable, controller_instance)
-        @roles.empty? || roleable.has_role?(*@roles, context: resolve_context(controller_instance))
+        @roles.empty? || roleable.has_role?(*@roles, context: context_for(controller_instance))
       end
 
       def dynamic_rules_followed?(controller_instance)
@@ -32,18 +32,12 @@ module Rabarber
         !!(rule.is_a?(Proc) ? controller_instance.instance_exec(&rule) : controller_instance.send(rule))
       end
 
-      def resolve_context(controller_instance)
-        context = case @context
-                  when Proc then controller_instance.instance_exec(&@context)
-                  when Symbol then controller_instance.send(@context)
-                  else @context
-                  end
-
-        Rabarber::Inputs::Context.new(
-          context,
-          error: Rabarber::InvalidContextError,
-          message: "Expected an instance of ActiveRecord model, a Class, or nil, got #{context.inspect}"
-        ).resolve
+      def context_for(controller_instance)
+        case @context
+        when Proc then controller_instance.instance_exec(&@context)
+        when Symbol then controller_instance.send(@context)
+        else @context
+        end
       end
     end
   end

data/lib/rabarber/{railtie.rb → engine.rb}

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require "rails/railtie"
+require "rails/engine"
 
 module Rabarber
-  class Railtie < Rails::Railtie
+  class Engine < Rails::Engine
     initializer "rabarber.include_roleable" do
       Rails.autoloaders.each do |autoloader|
         autoloader.on_load do |cpath, klass, _abspath|
@@ -15,14 +15,13 @@ module Rabarber
     initializer "rabarber.to_prepare" do |app|
       app.config.to_prepare do
         Rabarber::Core::Permissions.reset! unless app.config.eager_load
-
-        Rabarber::Role.send(:remove_const, :HABTM_Roleables) if Rabarber::Role.const_defined?(:HABTM_Roleables, false)
-        Rabarber::Role.has_and_belongs_to_many :roleables, class_name: Rabarber::Configuration.user_model_name,
-                                                           association_foreign_key: "roleable_id",
-                                                           join_table: "rabarber_roles_roleables"
       end
     end
 
+    initializer "rabarber.deprecator" do |app|
+      app.deprecators[:rabarber] = Rabarber.deprecator
+    end
+
     initializer "rabarber.extend_migration_helpers" do
       ActiveSupport.on_load :active_record do
         ActiveRecord::Migration.include Rabarber::MigrationHelpers

data/lib/rabarber/helpers/migration_helpers.rb

@@ -3,27 +3,16 @@
 module Rabarber
   module MigrationHelpers
     def migrate_authorization_context!(old_context, new_context)
-      roles = Rabarber::Role.where(context_type: old_context.to_s)
+      old_context_type = Rabarber::Inputs::NonEmptyString.new(old_context).process
+      new_context_type = Rabarber::Inputs::NonEmptyString.new(new_context).process
 
-      raise Rabarber::InvalidArgumentError, "No roles exist in context #{old_context.inspect}" unless roles.exists?
-      raise Rabarber::InvalidArgumentError, "Cannot migrate context to #{new_context.inspect}: class does not exist" unless new_context.to_s.safe_constantize
-
-      roles.update_all(context_type: new_context.to_s)
+      Rabarber::Role.where(context_type: old_context_type).update_all(context_type: new_context_type)
     end
 
     def delete_authorization_context!(context)
-      roles = Rabarber::Role.where(context_type: context.to_s)
-
-      raise Rabarber::InvalidArgumentError, "No roles exist in context #{context.inspect}" unless roles.exists?
+      context_type = Rabarber::Inputs::NonEmptyString.new(context).process
 
-      ActiveRecord::Base.transaction do
-        ActiveRecord::Base.connection.execute(
-          ActiveRecord::Base.sanitize_sql(
-            ["DELETE FROM rabarber_roles_roleables WHERE role_id IN (?)", roles.pluck(:id)]
-          )
-        )
-        roles.delete_all
-      end
+      Rabarber::Role.delete_with_assignments(Rabarber::Role.where(context_type:))
     end
   end
 end

data/lib/rabarber/inputs/base.rb

@@ -3,7 +3,7 @@
 module Rabarber
   module Inputs
     class Base
-      def initialize(value, optional: false, error: Rabarber::InvalidArgumentError, message: nil)
+      def initialize(value, optional: false, error: nil, message: nil)
         @value = value
         @optional = optional
         @error = error
@@ -22,8 +22,11 @@ module Rabarber
         raise NotImplementedError
       end
 
+      def default_error = Rabarber::InvalidArgumentError
+      def default_message = nil
+
       def raise_error
-        raise @error, @message
+        raise @error || default_error, @message || default_message
       end
     end
   end

data/lib/rabarber/inputs/boolean.rb

@@ -5,7 +5,9 @@ module Rabarber
     class Boolean < Rabarber::Inputs::Base
       private
 
-      def validate_and_normalize = @value == true || @value == false ? @value : raise_error
+      def default_message = "Expected a boolean, got `#{@value.inspect}`"
+
+      def validate_and_normalize = @value.equal?(true) || @value.equal?(false) ? @value : raise_error
     end
   end
 end

data/lib/rabarber/inputs/context.rb

@@ -10,20 +10,19 @@ module Rabarber
         when Class
           { context_type: context.to_s, context_id: nil }
         when ActiveRecord::Base
-          raise_error unless context.persisted?
-          { context_type: context.class.to_s, context_id: context.public_send(context.class.primary_key) }
-        else
-          context
+          { context_type: context.class.to_s, context_id: context.id }
         end
       end
 
       private
 
+      def default_error = Rabarber::InvalidContextError
+      def default_message = "Expected an instance of ActiveRecord model, a Class, or nil, got `#{@value.inspect}`"
+
       def validate_and_normalize
         return @value if @value.nil?
         return @value if @value.is_a?(Class)
-        return @value if @value.is_a?(ActiveRecord::Base)
-        return @value if @value in { context_type: String | nil, context_id: String | Integer | nil }
+        return @value if @value.is_a?(ActiveRecord::Base) && @value.persisted?
 
         raise_error
       end

data/lib/rabarber/inputs/contexts/authorizational.rb

@@ -4,15 +4,10 @@ module Rabarber
   module Inputs
     module Contexts
       class Authorizational < Rabarber::Inputs::Context
-        def resolve
-          result = process
-          return result if result.is_a?(Symbol) || result.is_a?(Proc)
-
-          super
-        end
-
         private
 
+        def default_message = "Expected a Class, an instance of ActiveRecord model, a symbol, a string, or a proc, got `#{@value.inspect}`"
+
         def validate_and_normalize
           return @value if @value.is_a?(Proc)
           return @value.to_sym if (@value.is_a?(String) || @value.is_a?(Symbol)) && @value.present?

data/lib/rabarber/inputs/dynamic_rule.rb

@@ -5,10 +5,12 @@ module Rabarber
     class DynamicRule < Rabarber::Inputs::Base
       private
 
+      def default_message = "Expected a symbol, a string, or a proc, got `#{@value.inspect}`"
+
       def validate_and_normalize
         return @value if @value.is_a?(Proc)
 
-        Rabarber::Inputs::NonEmptySymbol.new(@value, error: @error, message: @message).process
+        Rabarber::Inputs::NonEmptySymbol.new(@value, error: @error || default_error, message: @message || default_message).process
       end
     end
   end

data/lib/rabarber/inputs/non_empty_string.rb

@@ -5,6 +5,8 @@ module Rabarber
     class NonEmptyString < Rabarber::Inputs::Base
       private
 
+      def default_message = "Expected a non-empty string, got `#{@value.inspect}`"
+
       def validate_and_normalize
         @value.is_a?(String) && @value.present? ? @value : raise_error
       end

data/lib/rabarber/inputs/non_empty_symbol.rb

@@ -5,6 +5,8 @@ module Rabarber
     class NonEmptySymbol < Rabarber::Inputs::Base
       private
 
+      def default_message = "Expected a symbol or a string, got `#{@value.inspect}`"
+
       def validate_and_normalize
         raise_error unless (@value.is_a?(String) || @value.is_a?(Symbol)) && @value.present?
 

data/lib/rabarber/inputs/role.rb

@@ -5,6 +5,8 @@ module Rabarber
     class Role < Rabarber::Inputs::Base
       private
 
+      def default_message = "Expected a symbol or a string containing only lowercase letters, numbers, and underscores, got `#{@value.inspect}`"
+
       def validate_and_normalize
         raise_error unless (@value.is_a?(String) || @value.is_a?(Symbol)) && @value.to_s.match?(/\A[a-z0-9_]+\z/)
 

data/lib/rabarber/inputs/roles.rb

@@ -5,9 +5,11 @@ module Rabarber
     class Roles < Rabarber::Inputs::Base
       private
 
+      def default_message = "Expected an array of symbols or strings containing only lowercase letters, numbers, and underscores, got `#{@value.inspect}`"
+
       def validate_and_normalize
         Array(@value).map do |role|
-          Rabarber::Inputs::Role.new(role, error: @error, message: @message).process
+          Rabarber::Inputs::Role.new(role, error: @error || default_error, message: @message || default_message).process
         end
       end
     end

data/lib/rabarber/models/concerns/roleable.rb

@@ -9,113 +9,105 @@ module Rabarber
 
       @@included = name
 
-      has_and_belongs_to_many :rabarber_roles, class_name: "Rabarber::Role",
-                                               foreign_key: "roleable_id",
-                                               join_table: "rabarber_roles_roleables"
+      has_many :rabarber_role_assignments, class_name: "Rabarber::RoleAssignment", foreign_key: "roleable_id", inverse_of: :roleable, dependent: :delete_all
+      has_many :rabarber_roles, through: :rabarber_role_assignments, source: :role
 
       scope :with_role, -> (*role_names, context: nil) {
         joins(:rabarber_roles).where(
-          rabarber_roles: { name: process_role_names(role_names), **process_context(context) }
+          rabarber_roles: { name: Rabarber::Inputs::Roles.new(role_names).process, **Rabarber::Inputs::Context.new(context).resolve }
         ).distinct
       }
-
-      class << self
-        def process_role_names(role_names)
-          Rabarber::Inputs::Roles.new(
-            role_names,
-            message: "Expected an array of symbols or strings containing only lowercase letters, numbers, and underscores, got #{role_names.inspect}"
-          ).process
-        end
-
-        def process_context(context)
-          Rabarber::Inputs::Context.new(
-            context,
-            error: Rabarber::InvalidContextError,
-            message: "Expected an instance of ActiveRecord model, a Class, or nil, got #{context.inspect}"
-          ).resolve
-        end
-      end
-      delegate :process_role_names, :process_context, to: :class, private: true
     end
 
     def roles(context: nil)
-      processed_context = process_context(context)
-      Rabarber::Core::Cache.fetch(roleable_id, processed_context) { rabarber_roles.list(context: processed_context) }
+      cached_roles(Rabarber::Inputs::Context.new(context).resolve)
     end
 
     def all_roles
-      Rabarber::Core::Cache.fetch(roleable_id, :all) { rabarber_roles.list_all }
+      Rabarber::Core::Cache.fetch(id, :all) { assigned_roles.list_all }
     end
 
     def has_role?(*role_names, context: nil)
-      processed_context = process_context(context)
-      processed_roles = process_role_names(role_names)
-      roles(context: processed_context).intersect?(processed_roles)
+      processed_context = Rabarber::Inputs::Context.new(context).resolve
+      processed_roles = Rabarber::Inputs::Roles.new(role_names).process
+      cached_roles(processed_context).intersect?(processed_roles)
     end
 
     def assign_roles(*role_names, context: nil, create_new: true)
-      processed_role_names = process_role_names(role_names)
-      processed_context = process_context(context)
+      processed_create_new = Rabarber::Inputs::Boolean.new(create_new).process
+      warn_if_unsaved_roleable(:assign_roles)
 
-      create_new_roles(processed_role_names, context: processed_context) if create_new
+      processed_role_names = Rabarber::Inputs::Roles.new(role_names).process
+      processed_context = Rabarber::Inputs::Context.new(context).resolve
 
-      roles_to_assign = Rabarber::Role.where(
-        name: (processed_role_names - rabarber_roles.list(context: processed_context)), **processed_context
-      )
+      Rabarber::Role.register_missing(processed_role_names, processed_context) if processed_create_new
+
+      role_ids = Rabarber::Role.where(
+        name: (processed_role_names - assigned_roles.names_in(processed_context)), **processed_context
+      ).ids
 
-      if roles_to_assign.any?
-        begin
-          rabarber_roles << roles_to_assign
-        rescue ActiveRecord::RecordNotUnique
+      if role_ids.any?
+        if persisted?
+          rabarber_role_assignments.insert_all(role_ids.map { { role_id: _1 } })
           rabarber_roles.reset
+        else
+          rabarber_roles << Rabarber::Role.where(id: role_ids)
         end
         delete_roleable_cache(contexts: [processed_context])
       end
 
-      roles(context: processed_context)
+      cached_roles(processed_context)
     end
 
     def revoke_roles(*role_names, context: nil)
-      processed_role_names = process_role_names(role_names)
-      processed_context = process_context(context)
+      warn_if_unsaved_roleable(:revoke_roles)
 
-      roles_to_revoke = Rabarber::Role.where(
-        name: processed_role_names.intersection(rabarber_roles.list(context: processed_context)), **processed_context
-      )
+      processed_role_names = Rabarber::Inputs::Roles.new(role_names).process
+      processed_context = Rabarber::Inputs::Context.new(context).resolve
 
-      if roles_to_revoke.any?
-        self.rabarber_roles -= roles_to_revoke
+      if rabarber_role_assignments.where(role: Rabarber::Role.where(name: processed_role_names, **processed_context)).delete_all.positive?
+        rabarber_roles.reset
         delete_roleable_cache(contexts: [processed_context])
       end
 
-      roles(context: processed_context)
+      cached_roles(processed_context)
     end
 
     def revoke_all_roles
-      return [] if rabarber_roles.none?
+      warn_if_unsaved_roleable(:revoke_all_roles)
 
-      contexts = all_roles.keys.map { process_context(_1) }
+      roles = assigned_roles.pluck(:id, :context_type, :context_id)
 
-      rabarber_roles.clear
+      rabarber_role_assignments.where(role_id: roles.map(&:first)).delete_all
+      rabarber_role_assignments.reset
+      rabarber_roles.reset
 
-      delete_roleable_cache(contexts:)
+      delete_roleable_cache(contexts: roles.map { |_, context_type, context_id| { context_type:, context_id: } }.uniq) if roles.any?
 
       []
     end
 
     private
 
-    def create_new_roles(role_names, context:)
-      new_roles = role_names - Rabarber.roles(context:)
-      new_roles.each { |role_name| Rabarber::Role.register(role_name, context:) }
+    def warn_if_unsaved_roleable(method_name)
+      return unless new_record?
+
+      Rabarber.deprecator.warn(
+        "Calling ##{method_name} on an unsaved record is deprecated. Save the record before managing roles.",
+        caller_locations(2)
+      )
     end
 
-    def delete_roleable_cache(contexts:)
-      Rabarber::Core::Cache.delete(*contexts.map { [roleable_id, _1] }, [roleable_id, :all])
+    def assigned_roles
+      Rabarber::Role.where(id: rabarber_role_assignments.select(:role_id))
     end
 
-    def roleable_id
-      public_send(self.class.primary_key)
+    def cached_roles(processed_context)
+      Rabarber::Core::Cache.fetch(id, processed_context) { assigned_roles.names_in(processed_context) }
+    end
+
+    def delete_roleable_cache(contexts:)
+      Rabarber::Core::Cache.delete(*contexts.map { [id, _1] }, [id, :all])
     end
   end
 end

data/lib/rabarber/models/role_management.rb

@@ -1,12 +1,18 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/module/deprecation"
+
 module Rabarber
   module RoleManagement
     def roles(context: nil) = Rabarber::Role.list(context:)
     def all_roles = Rabarber::Role.list_all
-    def create_role(name, context: nil) = Rabarber::Role.register(name, context:)
+    def create_role(name, context: nil) = Rabarber::Role.deprecated_register(name, context:)
+    def create_roles(*names, context: nil) = Rabarber::Role.register(names, context:)
     def rename_role(old_name, new_name, context: nil, force: false) = Rabarber::Role.amend(old_name, new_name, context:, force:)
-    def delete_role(name, context: nil, force: false) = Rabarber::Role.drop(name, context:, force:)
+    def delete_role(name, context: nil, force: false) = Rabarber::Role.deprecated_drop(name, context:, force:)
+    def delete_roles(*names, context: nil, force: false) = Rabarber::Role.drop(names, context:, force:)
     def prune = Rabarber::Role.prune # rubocop:disable Rails/Delegate
+
+    deprecate create_role: :create_roles, delete_role: :delete_roles, deprecator: Rabarber.deprecator
   end
 end

data/lib/rabarber/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rabarber
-  VERSION = "6.0.3"
+  VERSION = "6.1.0"
 end

data/lib/rabarber.rb

@@ -25,6 +25,12 @@ module Rabarber
   class InvalidContextError < Rabarber::InvalidArgumentError; end
   class NotFoundError < Rabarber::Error; end
 
+  DEPRECATOR = ActiveSupport::Deprecation.new("7.0", "Rabarber")
+
+  def self.deprecator
+    DEPRECATOR
+  end
+
   delegate :configure, to: Rabarber::Configuration
   module_function :configure
 end
@@ -37,11 +43,10 @@ require_relative "rabarber/controllers/concerns/authorization"
 require_relative "rabarber/helpers/helpers"
 require_relative "rabarber/helpers/migration_helpers"
 require_relative "rabarber/models/concerns/roleable"
-require_relative "rabarber/models/role"
 require_relative "rabarber/models/role_management"
 
 Rabarber.extend Rabarber::RoleManagement
 
 require_relative "rabarber/core/permissions"
 
-require_relative "rabarber/railtie"
+require_relative "rabarber/engine"

data/rabarber.gemspec

@@ -7,14 +7,13 @@ Gem::Specification.new do |spec|
   spec.version = Rabarber::VERSION
   spec.authors = ["enjaku4", "trafium"]
   spec.email = ["contact@brownbox.dev"]
-  spec.homepage = "https://github.com/enjaku4/rabarber"
+  spec.homepage = "https://github.com/brownboxdev/rabarber-authorization"
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
   spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
   spec.metadata["documentation_uri"] = "#{spec.homepage}/blob/main/README.md"
   spec.metadata["mailing_list_uri"] = "#{spec.homepage}/discussions"
-  spec.metadata["funding_uri"] = "https://github.com/sponsors/enjaku4"
   spec.metadata["rubygems_mfa_required"] = "true"
   spec.summary = "Simple role-based authorization library for Ruby on Rails"
   spec.description = "Simple role-based authorization for Rails applications with multi-tenancy support"
@@ -23,7 +22,7 @@ Gem::Specification.new do |spec|
 
   spec.files = [
     "rabarber.gemspec", "README.md", "CHANGELOG.md", "LICENSE.txt"
-  ] + Dir.glob("lib/**/*")
+  ] + Dir.glob("{app,lib}/**/*")
 
   spec.require_paths = ["lib"]
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rabarber
 version: !ruby/object:Gem::Version
-  version: 6.0.3
+  version: 6.1.0
 platform: ruby
 authors:
 - enjaku4
@@ -41,6 +41,8 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
+- app/models/rabarber/role.rb
+- app/models/rabarber/role_assignment.rb
 - lib/generators/rabarber/roles_generator.rb
 - lib/generators/rabarber/templates/create_rabarber_roles.rb.erb
 - lib/rabarber.rb
@@ -51,6 +53,7 @@ files:
 - lib/rabarber/core/permissions.rb
 - lib/rabarber/core/roleable.rb
 - lib/rabarber/core/rule.rb
+- lib/rabarber/engine.rb
 - lib/rabarber/helpers/helpers.rb
 - lib/rabarber/helpers/migration_helpers.rb
 - lib/rabarber/inputs/base.rb
@@ -64,22 +67,19 @@ files:
 - lib/rabarber/inputs/role.rb
 - lib/rabarber/inputs/roles.rb
 - lib/rabarber/models/concerns/roleable.rb
-- lib/rabarber/models/role.rb
 - lib/rabarber/models/role_management.rb
-- lib/rabarber/railtie.rb
 - lib/rabarber/version.rb
 - rabarber.gemspec
-homepage: https://github.com/enjaku4/rabarber
+homepage: https://github.com/brownboxdev/rabarber-authorization
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/enjaku4/rabarber
-  source_code_uri: https://github.com/enjaku4/rabarber
-  changelog_uri: https://github.com/enjaku4/rabarber/blob/main/CHANGELOG.md
-  bug_tracker_uri: https://github.com/enjaku4/rabarber/issues
-  documentation_uri: https://github.com/enjaku4/rabarber/blob/main/README.md
-  mailing_list_uri: https://github.com/enjaku4/rabarber/discussions
-  funding_uri: https://github.com/sponsors/enjaku4
+  homepage_uri: https://github.com/brownboxdev/rabarber-authorization
+  source_code_uri: https://github.com/brownboxdev/rabarber-authorization
+  changelog_uri: https://github.com/brownboxdev/rabarber-authorization/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/brownboxdev/rabarber-authorization/issues
+  documentation_uri: https://github.com/brownboxdev/rabarber-authorization/blob/main/README.md
+  mailing_list_uri: https://github.com/brownboxdev/rabarber-authorization/discussions
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:

data/lib/rabarber/models/role.rb

@@ -1,126 +0,0 @@
-# frozen_string_literal: true
-
-module Rabarber
-  class Role < ActiveRecord::Base
-    self.table_name = "rabarber_roles"
-
-    belongs_to :context, polymorphic: true, optional: true
-
-    class << self
-      def list(context: nil)
-        where(process_context(context)).pluck(:name).map(&:to_sym)
-      end
-
-      def list_all
-        roles = where(context_id: nil).to_a + where.not(context_id: nil).includes(:context).to_a
-
-        roles.each_with_object({}) do |role, hash|
-          (hash[role.context] ||= []) << role.name.to_sym
-        rescue ActiveRecord::RecordNotFound
-          next
-        end
-      rescue NameError => e
-        raise Rabarber::NotFoundError, "Context not found: class #{e.name} may have been renamed or deleted"
-      end
-
-      def register(name, context: nil)
-        name = process_role_name(name)
-        processed_context = process_context(context)
-
-        return false if exists?(name:, **processed_context)
-
-        !!create!(name:, **processed_context)
-      rescue ActiveRecord::RecordNotUnique
-        false
-      end
-
-      def amend(old_name, new_name, context: nil, force: false)
-        processed_context = process_context(context)
-        role = find_by(name: process_role_name(old_name), **processed_context)
-
-        raise Rabarber::NotFoundError, "Role not found" unless role
-
-        name = process_role_name(new_name)
-
-        return false if exists?(name:, **processed_context) || role.roleables.exists? && !force
-
-        role.update!(name:)
-
-        delete_roleables_cache(role.roleables.pluck(:id), context: processed_context)
-
-        true
-      rescue ActiveRecord::RecordNotUnique
-        false
-      end
-
-      def drop(name, context: nil, force: false)
-        processed_context = process_context(context)
-        role = find_by(name: process_role_name(name), **processed_context)
-
-        raise Rabarber::NotFoundError, "Role not found" unless role
-
-        return false if role.roleables.exists? && !force
-
-        roleable_ids = role.roleables.pluck(:id)
-
-        role.destroy!
-
-        delete_roleables_cache(roleable_ids, context: processed_context)
-
-        true
-      end
-
-      def prune
-        orphaned_roles = where.not(context_id: nil).includes(:context).filter_map do |role|
-          !role.context
-        rescue ActiveRecord::RecordNotFound
-          role.id
-        end
-
-        return if orphaned_roles.empty?
-
-        ActiveRecord::Base.transaction do
-          ActiveRecord::Base.connection.execute(
-            ActiveRecord::Base.sanitize_sql(
-              ["DELETE FROM rabarber_roles_roleables WHERE role_id IN (?)", orphaned_roles]
-            )
-          )
-          where(id: orphaned_roles).delete_all
-        end
-
-        Rabarber::Core::Cache.clear
-      end
-
-      private
-
-      def delete_roleables_cache(roleable_ids, context:)
-        Rabarber::Core::Cache.delete(*roleable_ids.flat_map { [[_1, context], [_1, :all]] })
-      end
-
-      def process_role_name(name)
-        Rabarber::Inputs::Role.new(
-          name,
-          message: "Expected a symbol or a string containing only lowercase letters, numbers, and underscores, got #{name.inspect}"
-        ).process
-      end
-
-      def process_context(context)
-        Rabarber::Inputs::Context.new(
-          context,
-          error: Rabarber::InvalidContextError,
-          message: "Expected an instance of ActiveRecord model, a Class, or nil, got #{context.inspect}"
-        ).resolve
-      end
-    end
-
-    def context
-      return context_type.constantize if context_type.present? && context_id.blank?
-
-      record = super
-
-      raise ActiveRecord::RecordNotFound.new(nil, context_type, nil, context_id) if context_id.present? && !record
-
-      record
-    end
-  end
-end