rabarber 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 1af249a1b8bffcd7db310f4a5a187caebb692127d628a852c61004d63b43165d
+  data.tar.gz: ffa8eae28eaf5267d4b93dfe4a2d253b83ec113118b5ca6ff5ec66188e589537
+SHA512:
+  metadata.gz: 55a56413aac6b5bc2a2f9fe7f07374bf05c96c9ed231ef2c04958405d7bdac40160731524f50311127593821054bdb46cb6abfbbe25a5a329d4937dc1164ede1
+  data.tar.gz: ab5e0f475366072ba485db587eea73d080e98e702ed45e1866a688c0f28fa3fb0246aaeddad9a911c09a70cac5aacd57eb039ed084cef6d38a67297143d81f5c

data/.rspec

@@ -0,0 +1,4 @@
+--format documentation
+--color
+--require spec_helper
+--order rand

data/.rubocop.yml

@@ -0,0 +1,65 @@
+require:
+  - rubocop-rails
+  - rubocop-rspec
+
+AllCops:
+  TargetRubyVersion: 2.7
+
+Layout/LineLength:
+  Max: 120
+
+Metrics/BlockLength:
+  Enabled: false
+
+Rails/ApplicationController:
+  Exclude:
+    - spec/support/controllers.rb
+
+Rails/ApplicationRecord:
+  Exclude:
+    - lib/rabarber/models/role.rb
+    - spec/support/models.rb
+
+RSpec/ContextWording:
+  Enabled: false
+
+RSpec/ExampleLength:
+  Enabled: false
+
+RSpec/FilePath:
+  Enabled: false
+
+RSpec/MultipleExpectations:
+  Enabled: false
+
+RSpec/NamedSubject:
+  Enabled: false
+
+RSpec/NestedGroups:
+  Enabled: false
+
+Style/ClassVars:
+  Enabled: false
+
+Style/Documentation:
+  Enabled: false
+
+Style/Lambda:
+  Enabled: true
+  EnforcedStyle: literal
+
+Style/StringLiterals:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Style/SymbolArray:
+  Enabled: true
+  EnforcedStyle: brackets
+
+Style/WordArray:
+  Enabled: true
+  EnforcedStyle: brackets

data/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 0.1.1
+
+- Initial release

data/Gemfile

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+gemspec
+
+ENV["RAILS_VERSION"] ? gem("rails", ENV["RAILS_VERSION"]) : gem("rails", ">= 6.1")
+
+gem "database_cleaner-active_record", "~> 2.1"
+gem "rake", "~> 13.1"
+gem "rspec", "~> 3.12"
+gem "rspec-rails", "~> 6.1"
+gem "rubocop", "~> 1.57"
+gem "rubocop-rails", "~> 2.22"
+gem "rubocop-rspec", "~> 2.25"
+gem "sqlite3", "~> 1.6"

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2023 enjaku4
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,254 @@
+# Rabarber: Simplified Authorization for Rails
+
+Rabarber is an authorization library primarily designed for use in the web layer of your application, specifically in controllers and views.
+
+Rabarber takes a slightly different approach compared to some popular libraries. Instead of answering, "Who can perform actions on this record?" it focuses on a question: "Who can access this endpoint?" In Rabarber, authorization is expressed not as "A user with role 'editor' can edit a post," but rather as "A user with the role 'editor' can access a post editing endpoint."
+
+#### Example Usage:
+
+Consider a CRM application where users in different roles have distinct access levels. For instance, an accountant role can interact with invoices and orders but cannot access marketing information, while the marketer role has access to marketing-related data.
+
+## Installation
+
+Add the Rabarber gem to your Gemfile:
+
+```
+gem "rabarber"
+```
+
+Install the gem: 
+
+```
+bundle install
+```
+
+Next, generate a migration to create tables for storing roles in the database: 
+
+```
+rails g rabarber:roles
+```
+
+Finally, run the migration to apply the changes to the database:
+
+```
+rails db:migrate
+```
+
+## Configuration
+
+Seamlessly include Rabarber in your application by adding the following initializer:
+
+```rb
+Rabarber.configure do |config|
+  config.current_user_method = :authenticated_user
+  config.must_have_roles = true
+  config.when_unauthorized = ->(controller) {
+    controller.head 418
+  }
+end
+```
+- `current_user_method` must be a symbol representing the method that returns the currently authenticated user. The default value is `:current_user`.
+- `must_have_roles` must be a boolean, determining whether a user with no roles can access endpoints permitted to everyone. The default value is `false` (allowing users without roles to access endpoints permitted for everyone).
+- `when_unauthorized` must be a lambda where you can define your actions when access is not authorized (`controller` is the instance of the controller where the code is executed). By default, the user is redirected back for HTML requests; otherwise, a 401 Unauthorized response is sent.
+
+## Usage
+
+Include the `Rabarber::HasRoles` module in your model representing application users:
+
+```rb
+class User < ApplicationRecord
+  include Rabarber::HasRoles
+  ...
+end
+```
+
+### This adds the following methods:
+
+#### `#assign_roles`
+
+To assign roles to the user, use:
+
+```rb
+user.assign_roles(:accountant, :marketer)
+```
+By default, the `#assign_roles` method will automatically create any roles that don't exist. If you want to assign only existing roles and prevent the creation of new ones, use the method with the `create_new: false` argument:
+```rb
+user.assign_roles(:accountant, :marketer, create_new: false)
+```
+
+#### `#revoke_roles`
+
+To revoke roles from the user, use:
+
+```rb
+user.revoke_roles(:accountant, :marketer)
+```
+If any of the specified roles doesn't exist or the user doesn't have such a role, it will be ignored.
+
+#### `#has_role?`
+
+To check whether the user has a role, use:
+
+```rb
+user.has_role?(:accountant, :marketer)
+```
+
+It returns `true` if the user has at least one role and `false` otherwise.
+
+#### `#roles`
+
+View all roles assigned to the user:
+
+```rb
+user.roles
+```
+
+Utilize these methods to manipulate user roles. For example, create a custom UI for managing roles or assign necessary roles during migration or runtime (e.g., when the user is created). Adapt them to fit the requirements of your app.
+
+If you need to list all the role names, use:
+
+```rb
+Rabarber::Role.names
+```
+
+---
+
+### Authorization Rules
+
+Include the `Rabarber::Authorization` module in the controller to which (specifically to it and its children) you want authorization rules to be applied. Typically, it is `ApplicationController`, but it can be any controller.
+
+```rb
+class ApplicationController < ActionController::Base
+  include Rabarber::Authorization
+  ...
+end
+```
+This adds the `.grant_access` method to the controller and its children. This method allows you to define the access rules.
+
+The most basic usage of the method is as follows:
+
+```rb
+class InvoicesController < ApplicationController
+  grant_access action: :index, roles: [:accountant, :admin]
+  def index
+    ...
+  end
+
+  grant_access action: :delete, roles: :admin
+  def delete
+    ...
+  end
+end
+```
+This grants access to the `index` action for users with the `accountant` or `admin` role, and access to the `delete` action for only `admin` users.
+
+You can also define controller-wide rules (without the `action` argument):
+
+```rb
+class Crm::BaseController < ApplicationController
+  grant_access roles: :admin, :manager
+
+  grant_access action: :dashboard, roles: :marketer
+  def dashboard
+    ...
+  end
+end
+
+class InvoicesController < Crm::BaseControlle
+  grant_access roles: :accountant
+  def index
+    ...
+  end
+
+  def delete
+    ...
+  end
+end
+```
+This means that `admin` and `manager` have access to all actions inside `Crm::BaseController` and its children, while the `accountant` role has access only to actions in `InvoicesController` and its possible children. Users with the `marketer` role can see only the dashboard in this example.
+
+Roles (as well as actions) can be omitted:
+
+```rb
+class OrdersController < ApplicationController
+  grant_access
+  ...
+end
+
+class InvoicesController < ApplicationController
+  grant_access action: :index
+  def index
+    ...
+  end
+end
+```
+
+This allows everyone to access `OrdersController` and its children and the `index` action in `InvoicesController`.
+
+If you've set the `must_have_roles` setting to `true`, then only the users with at least one role can have access. This setting can be useful if your requirements are so that users without roles are not allowed to see anything.
+
+For more complex rules, Rabarber provides the following:
+
+```rb
+class OrdersController < ApplicationController
+  grant_access if: :user_has_access?
+  ...
+
+  private
+
+  def user_has_access?
+    ...
+  end
+end
+
+class InvoicesController < ApplicationController
+  grant_access action: :index, roles: :accountant, if: -> { current_user.passed_probationary_period? }
+  def index
+    ...
+  end
+end
+```
+You can pass a custom rule as an `if` argument. It can be a symbol (the method with the same name will be called) or a lambda.
+
+Rules defined in children don't override parent rules but rather add to them:
+```rb
+class Crm::BaseController < ApplicationController
+  grant_access roles: :admin
+  ...
+end
+
+class InvoicesController < Crm::BaseControlle
+  grant_access roles: :accountant
+  ...
+end
+```
+This means that `InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
+
+---
+
+### View Helpers
+
+Rabarber also provides a couple of helpers that can be used in views: `visible_to` and `hidden_from`. The usage is straightforward:
+
+```erb
+<%= visible_to(:admin, :manager) do %>
+  <p>Visible only to admins and managers</p>
+<% end %>
+```
+
+```erb
+<%= hidden_from(:accountant) do %>
+  <p>Accountant cannot see this</p>
+<% end %>
+```
+
+## Problems?
+
+Encountered a bug or facing a problem? 
+
+- **Create an Issue**: If you've identified a problem or have a feature request, please create an issue on the gem's GitHub repository. Be sure to provide detailed information about the problem, including steps to reproduce it.
+- **Contribute a Solution**: Found a fix for the issue or want to contribute to the project? Feel free to create a pull request with your changes.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+require "rubocop/rake_task"
+
+RuboCop::RakeTask.new
+
+task default: [:spec, :rubocop]

data/lib/generators/rabarber/roles_generator.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "rails/generators/migration"
+
+module Rabarber
+  class RolesGenerator < Rails::Generators::Base
+    include Rails::Generators::Migration
+
+    source_root File.expand_path("templates", __dir__)
+
+    def create_migrations
+      migration_template "create_rabarber_roles.rb.erb", "db/migrate/create_rabarber_roles.rb"
+    end
+
+    def self.next_migration_number(_path)
+      Time.now.utc.strftime("%Y%m%d%H%M%S")
+    end
+  end
+end

data/lib/generators/rabarber/templates/create_rabarber_roles.rb.erb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class CreateRabarberRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version.to_s %>]
+  def change
+    create_table :rabarber_roles do |t|
+      t.string :name, null: false, index: { unique: true }
+      t.timestamps
+    end
+
+    create_table :rabarber_roles_roleables, id: false do |t|
+      t.belongs_to :role, index: true
+      t.belongs_to :roleable, index: true
+    end
+
+    add_index :rabarber_roles_roleables, %i[role_id roleable_id], unique: true
+  end
+end

data/lib/rabarber/access.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Rabarber
+  module Access
+    def access_granted?(roles, controller, action, custom_rule_receiver)
+      controller_accessible?(roles, controller, custom_rule_receiver) ||
+        action_accessible?(roles, controller, action, custom_rule_receiver)
+    end
+
+    def controller_accessible?(roles, controller, custom_rule_receiver)
+      accessible_controllers(roles, custom_rule_receiver).any? do |accessible_controller|
+        controller <= accessible_controller
+      end
+    end
+
+    def action_accessible?(roles, controller, action, custom_rule_receiver)
+      action_rules[controller].any? { |rule| rule.verify_access(roles, custom_rule_receiver, action) }
+    end
+
+    private
+
+    def accessible_controllers(roles, custom_rule_receiver)
+      controller_rules.select { |_, rule| rule.verify_access(roles, custom_rule_receiver) }.keys
+    end
+  end
+end

data/lib/rabarber/configuration.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "singleton"
+
+module Rabarber
+  class Configuration
+    include Singleton
+
+    attr_reader :current_user_method, :must_have_roles, :when_unauthorized
+
+    def initialize
+      @current_user_method = :current_user
+      @must_have_roles = false
+      @when_unauthorized = ->(controller) do
+        if controller.request.format.html?
+          controller.redirect_back fallback_location: controller.main_app.root_path
+        else
+          controller.head(:unauthorized)
+        end
+      end
+    end
+
+    def current_user_method=(method_name)
+      unless method_name.is_a?(Symbol) || method_name.is_a?(String)
+        raise ArgumentError, "Method name must be a symbol or a string"
+      end
+
+      @current_user_method = method_name.to_sym
+    end
+
+    def must_have_roles=(value)
+      raise ArgumentError, "Value must be a boolean" unless [true, false].include?(value)
+
+      @must_have_roles = value
+    end
+
+    def when_unauthorized=(callable)
+      raise ArgumentError, "Proc is expected" unless callable.is_a?(Proc)
+
+      @when_unauthorized = callable
+    end
+  end
+end

data/lib/rabarber/controllers/concerns/authorization.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Rabarber
+  module Authorization
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :check_permissions
+    end
+
+    class_methods do
+      def grant_access(action: nil, roles: nil, if: nil)
+        Permissions.write(self, action, roles, binding.local_variable_get(:if))
+      end
+    end
+
+    private
+
+    def check_permissions
+      return if Permissions.access_granted?(
+        send(::Rabarber::Configuration.instance.current_user_method).roles.names, self.class, action_name.to_sym, self
+      )
+
+      ::Rabarber::Configuration.instance.when_unauthorized.call(self)
+    end
+  end
+end

data/lib/rabarber/helpers/helpers.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Rabarber
+  module Helpers
+    def visible_to(*roles, &block)
+      return unless send(::Rabarber::Configuration.instance.current_user_method).has_role?(*roles)
+
+      capture(&block)
+    end
+
+    def hidden_from(*roles, &block)
+      return if send(::Rabarber::Configuration.instance.current_user_method).has_role?(*roles)
+
+      capture(&block)
+    end
+  end
+end

data/lib/rabarber/models/concerns/has_roles.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Rabarber
+  module HasRoles
+    extend ActiveSupport::Concern
+
+    included do
+      raise Error, "Rabarber::HasRoles can only be included once" if defined?(@@included) && @@included
+
+      @@included = true
+
+      has_and_belongs_to_many :roles, class_name: "Rabarber::Role",
+                                      foreign_key: "roleable_id",
+                                      join_table: "rabarber_roles_roleables"
+
+      alias_method :has_role?, :role?
+    end
+
+    def role?(*role_names)
+      unless role_names.all? { |arg| arg.is_a?(Symbol) || arg.is_a?(String) }
+        raise(ArgumentError, "Role names must be symbols or strings")
+      end
+
+      roles.exists?(name: role_names)
+    end
+
+    def assign_roles(*role_names, create_new: true)
+      unless role_names.all? { |arg| arg.is_a?(Symbol) || arg.is_a?(String) }
+        raise(ArgumentError, "Role names must be symbols or strings")
+      end
+
+      if create_new && (new_roles = role_names - Role.names).any?
+        new_roles.each { |role| Role.create!(name: role) }
+      end
+
+      roles << Role.where(name: role_names) - roles
+    end
+
+    def revoke_roles(*role_names)
+      unless role_names.all? { |arg| arg.is_a?(Symbol) || arg.is_a?(String) }
+        raise(ArgumentError, "Role names must be symbols or strings")
+      end
+
+      self.roles = roles - Role.where(name: role_names)
+    end
+  end
+end

data/lib/rabarber/models/role.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Rabarber
+  class Role < ActiveRecord::Base
+    self.table_name = "rabarber_roles"
+
+    validates :name, presence: true, uniqueness: true
+
+    def self.names
+      pluck(:name).map(&:to_sym)
+    end
+  end
+end

data/lib/rabarber/permissions.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require_relative "access"
+require_relative "rule"
+
+module Rabarber
+  class Permissions
+    include Singleton
+
+    extend Access
+
+    attr_reader :storage
+
+    def initialize
+      @storage = { controller_rules: Hash.new({}), action_rules: Hash.new([]) }
+    end
+
+    def self.write(controller, action, roles, custom_rule)
+      rule = Rule.new(action, roles, custom_rule)
+
+      if action
+        instance.storage[:action_rules][controller] += [rule]
+      else
+        instance.storage[:controller_rules][controller] = rule
+      end
+    end
+
+    def self.controller_rules
+      instance.storage[:controller_rules]
+    end
+
+    def self.action_rules
+      instance.storage[:action_rules]
+    end
+  end
+end

data/lib/rabarber/rule.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Rabarber
+  class Rule
+    attr_reader :action, :roles, :custom
+
+    def initialize(action, roles, custom)
+      @action = action
+      @roles = Array(roles)
+      @custom = custom
+    end
+
+    def verify_access(user_roles, custom_rule_receiver, action_name = nil)
+      action_accessible?(action_name) && roles_permitted?(user_roles) && custom_rule_followed?(custom_rule_receiver)
+    end
+
+    def action_accessible?(action_name)
+      action_name.nil? || action_name == action
+    end
+
+    def roles_permitted?(user_roles)
+      return false if ::Rabarber::Configuration.instance.must_have_roles && user_roles.empty?
+
+      roles.empty? || (roles & user_roles).any?
+    end
+
+    def custom_rule_followed?(custom_rule_receiver)
+      custom.nil? || execute_custom_rule(custom_rule_receiver)
+    end
+
+    private
+
+    def execute_custom_rule(custom_rule_receiver)
+      if custom.is_a?(Proc)
+        custom_rule_receiver.instance_exec(&custom)
+      else
+        custom_rule_receiver.send(custom)
+      end
+    end
+  end
+end

data/lib/rabarber/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Rabarber
+  VERSION = "0.1.1"
+end

data/lib/rabarber.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative "rabarber/version"
+require_relative "rabarber/configuration"
+
+require "active_record"
+require "active_support"
+
+require_relative "rabarber/controllers/concerns/authorization"
+
+require_relative "rabarber/helpers/helpers"
+
+require_relative "rabarber/models/role"
+require_relative "rabarber/models/concerns/has_roles"
+
+require_relative "rabarber/permissions"
+
+module Rabarber
+  module_function
+
+  def configure
+    yield(Configuration.instance)
+  end
+
+  class Error < StandardError; end
+end

metadata

@@ -0,0 +1,76 @@
+--- !ruby/object:Gem::Specification
+name: rabarber
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: ruby
+authors:
+- enjaku4
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2023-12-16 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.1'
+description:
+email:
+- enjaku4@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".rspec"
+- ".rubocop.yml"
+- CHANGELOG.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- lib/generators/rabarber/roles_generator.rb
+- lib/generators/rabarber/templates/create_rabarber_roles.rb.erb
+- lib/rabarber.rb
+- lib/rabarber/access.rb
+- lib/rabarber/configuration.rb
+- lib/rabarber/controllers/concerns/authorization.rb
+- lib/rabarber/helpers/helpers.rb
+- lib/rabarber/models/concerns/has_roles.rb
+- lib/rabarber/models/role.rb
+- lib/rabarber/permissions.rb
+- lib/rabarber/rule.rb
+- lib/rabarber/version.rb
+homepage: https://github.com/enjaku4/rabarber
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.7'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.6
+signing_key:
+specification_version: 4
+summary: Simple authorization library for Ruby on Rails.
+test_files: []