rabarber 1.4.1 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23a3e2a6c83a827ad3cd468761de12d2124cdd2f1b022e18661fdf97f21302e7
-  data.tar.gz: 1b56b41289ce816796856832f07e76453ecfa0c290f1cd8f37f4a83690227abc
+  metadata.gz: f719eb670170521e94a58a1c75d30110699ab941da6d5dae151fbf53e0eb9880
+  data.tar.gz: bd06646e15ab2eb5ff7b49d2a18316c4b539b95aa98bd2ec1b4de5c6b5fb921a
 SHA512:
-  metadata.gz: ac4af855dc20a41b78633fa4c4e946d1c54fad1df93e5f8505954bc4ff2cd43307fc94789718e1f9a563b44a57d3266660b84057f9de1d61afdab1111eb5b506
-  data.tar.gz: 17408ae706718e23ac594cd7c3144413c78aa69ce1ae0d0a230e5f62400917e1d5a82a22bd727df19391c7cbf235510cbaea8bbf6edc7aba47b8bcab06e6de81
+  metadata.gz: 0db86c7d46337decbe9972ea3b0c1ad30e1c66f2b76b3ef27a494ef8c2ecc9bcf35ce3f135360e74045b7f20beb38149f5ca308af0cb3d3a0db829ff9dc7147b
+  data.tar.gz: d1a20c732318d12ccfe49338df7338dcf09bd1222fd574e8581d035cb38b55295e501bfa45ef63ea0a556a8c21a28abdad7d06ca765c3f14eed6e6cd98db93be

data/CHANGELOG.md

@@ -1,3 +1,25 @@
+## v2.0.0
+
+### Breaking:
+
+- Removed `when_actions_missing` and `when_roles_missing` configuration options
+- Replaced `when_unauthorized` configuration option with an overridable controller method
+- Renamed `Rabarber::Role.assignees_for` method to `Rabarber::Role.assignees`
+
+To upgrade to v2.0.0, please refer to the [migration guide](https://github.com/enjaku4/rabarber/discussions/52).
+
+### Features:
+
+- Added support for UUID primary keys
+
+### Bugs:
+
+- Fixed the issue where an error would occur if the user was not authenticated
+
+### Misc:
+
+- Significant refactoring and code improvements
+
 ## v1.4.1
 
 - Fix an issue where an error could be raised when using controller-wide dynamic rules

data/README.md

@@ -9,7 +9,7 @@ Rabarber is a role-based authorization library for Ruby on Rails, primarily desi
 
 **Example of Usage**:
 
-Consider a CRM where users with different roles have distinct access levels. For instance, the role `accountant` can interact with invoices but cannot access marketing information, while the role `marketer` has access to marketing-related data. Such authorization rules can be easily defined with Rabarber.
+Consider a CRM system where users with different roles have distinct access levels. For instance, the role `accountant` can interact with invoices but cannot access marketing information, while the role `marketer` has access to marketing-related data. Such authorization rules can be easily defined with Rabarber.
 
 ---
 
@@ -21,39 +21,65 @@ class TicketsController < ApplicationController
 
   grant_access action: :index, roles: :manager
   def index
-    ...
+    # ...
   end
 
   def delete
-    ...
+    # ...
   end
 end
 ```
 This means that `admin` users can access everything in `TicketsController`, while `manager` role can access only `index` action.
 
+## Table of Contents
+
+**Gem usage:**
+  - [Installation](#installation)
+  - [Configuration](#configuration)
+  - [Roles](#roles)
+  - [Authorization Rules](#authorization-rules)
+  - [Dynamic Authorization Rules](#dynamic-authorization-rules)
+  - [When Unauthorized](#when-unauthorized)
+  - [View Helpers](#view-helpers)
+  - [Audit Trail](#audit-trail)
+
+**Community Resources:**
+  - [Problems?](#problems)
+  - [Contributing](#contributing)
+  - [Code of Conduct](#code-of-conduct)
+
+**Legal:**
+  - [License](#license)
+
 ## Installation
 
 Add the Rabarber gem to your Gemfile:
 
-```
+```rb
 gem "rabarber"
 ```
 
 Install the gem:
 
-```
+```shell
 bundle install
 ```
 
 Next, generate a migration to create tables for storing roles in the database. Make sure to specify the table name of the model representing users in your application as an argument. For instance, if the table name is `users`, run:
 
-```
+```shell
 rails g rabarber:roles users
 ```
 
-Finally, run the migration to apply the changes to the database:
+Rabarber supports UUIDs as primary keys. If your application uses UUIDs, add `--uuid` option to the generator:
 
+```shell
+rails g rabarber:roles users --uuid
 ```
+
+Finally, run the migration to apply the changes to the database:
+
+```shell
 rails db:migrate
 ```
 
@@ -67,28 +93,13 @@ Rabarber.configure do |config|
   config.cache_enabled = true
   config.current_user_method = :current_user
   config.must_have_roles = false
-  config.when_unauthorized = -> (controller) {
-    if controller.request.format.html?
-      controller.redirect_back fallback_location: controller.root_path
-    else
-      controller.head :unauthorized
-    end
-  }
 end
 ```
 
-- `audit_trail_enabled` must be a boolean determining whether the audit trail functionality is enabled. _The audit trail is enabled by default._
-- `cache_enabled` must be a boolean determining whether roles are cached. _Roles are cached by default to avoid unnecessary database queries._ If you want to disable caching, set this option to `false`. If caching is enabled and you need to clear the cache, use `Rabarber::Cache.clear` method.
-- `current_user_method` must be a symbol representing the method that returns the currently authenticated user. _The default value is `:current_user`._
-- `must_have_roles` must be a boolean determining whether a user with no roles can access endpoints permitted to everyone. _The default value is `false` (allowing users without roles to access endpoints permitted to everyone)._
-- `when_unauthorized` must be a proc where you can define the behaviour when access is not authorized. Lambda argument `controller` is an instance of the controller where the code is executed. _By default, the user is redirected back if the request format is HTML; otherwise, a 401 Unauthorized response is sent._
-
-### Deprecated Configuration Options
-
-The following configuration options are deprecated and will be removed in the next major version (see [the discussion](https://github.com/enjaku4/rabarber/discussions/48)):
-
-- `when_actions_missing` must be a proc where you can define the behaviour when the action specified in `grant_access` method cannot be found in the controller. Lambda argument `missing_actions` is an array of symbols, e.g., `[:index]`, while `context` argument is a hash that looks like this: `{ controller: "InvoicesController" }`. This check is performed when the application is initialized if `eager_load` configuration is enabled in Rails and also on every request. _By default, an error is raised when action is missing._
-- `when_roles_missing` must be a proc where you can define the behaviour when the roles specified in `grant_access` method cannot be found in the database. Lambda argument `missing_roles` is an array of symbols, e.g., `[:admin]`, while `context` argument is a hash that looks like this: `{ controller: "InvoicesController", action: "index" }`. This check is performed when the application is initialized if `eager_load` configuration is enabled in Rails and also on every request. _By default, a warning is logged when roles are missing._
+- `audit_trail_enabled` determines whether the audit trail functionality is enabled. The audit trail is enabled by default.
+- `cache_enabled` determines whether roles are cached to avoid unnecessary database queries. Roles are cached by default. If you need to clear the cache, use `Rabarber::Cache.clear` method.
+- `current_user_method` represents the method that returns the currently authenticated user. The default value is `:current_user`.
+- `must_have_roles` determines whether a user with no roles can access endpoints permitted to everyone. The default value is `false` (allowing users without roles to access such endpoints).
 
 ## Roles
 
@@ -97,7 +108,7 @@ Include `Rabarber::HasRoles` module in your model representing users in your app
 ```rb
 class User < ApplicationRecord
   include Rabarber::HasRoles
-  ...
+  # ...
 end
 ```
 
@@ -123,7 +134,7 @@ To revoke roles, use:
 ```rb
 user.revoke_roles(:accountant, :marketer)
 ```
-If any of the specified roles doesn't exist or the user doesn't have the role you want to revoke, it will be ignored.
+If the user doesn't have the role you want to revoke, it will be ignored.
 
 The method returns an array of roles assigned to the user.
 
@@ -139,7 +150,7 @@ It returns `true` if the user has at least one role and `false` otherwise.
 
 **`#roles`**
 
-To view all the roles assigned to the user, use:
+To get all the roles assigned to the user, use:
 
 ```rb
 user.roles
@@ -149,7 +160,7 @@ user.roles
 
 To manipulate roles directly, you can use `Rabarber::Role` methods:
 
-**`.add(role)`**
+**`.add(role_name)`**
 
 To add a new role, use:
 
@@ -166,14 +177,14 @@ To rename a role, use:
 ```rb
 Rabarber::Role.rename(:admin, :administrator)
 ```
-The first argument is the old name, and the second argument is the new name. This will rename the role and return `true`. If a role with the new name already exists, it will return `false`.
+The first argument is the old name, and the second argument is the new name. This will rename the role and return `true`. If the role with a new name already exists, it will return `false`.
 
 The method won't rename the role and will return `false` if it is assigned to any user. To force the rename, use the method with `force: true` argument:
 ```rb
 Rabarber::Role.rename(:admin, :administrator, force: true)
 ```
 
-**`.remove(role, force: false)`**
+**`.remove(role_name, force: false)`**
 
 To remove a role, use:
 
@@ -196,12 +207,12 @@ If you need to list all the role names available in your application, use:
 Rabarber::Role.names
 ```
 
-**`.assignees_for(role)`**
+**`.assignees(role_name)`**
 
 To get all the users to whom the role is assigned, use:
 
 ```rb
-Rabarber::Role.assignees_for(:admin)
+Rabarber::Role.assignees(:admin)
 ```
 
 ## Authorization Rules
@@ -211,7 +222,7 @@ Include `Rabarber::Authorization` module into the controller that needs authoriz
 ```rb
 class ApplicationController < ActionController::Base
   include Rabarber::Authorization
-  ...
+  # ...
 end
 ```
 This adds `.grant_access(action: nil, roles: nil, if: nil, unless: nil)` method which allows you to define the authorization rules.
@@ -219,22 +230,24 @@ This adds `.grant_access(action: nil, roles: nil, if: nil, unless: nil)` method
 The most basic usage of the method is as follows:
 
 ```rb
-class InvoicesController < ApplicationController
+class Crm::InvoicesController < ApplicationController
   grant_access action: :index, roles: [:accountant, :admin]
   def index
     @invoices = Invoice.all
     @invoices = @invoices.paid if current_user.has_role?(:accountant)
-    ...
+    # ...
   end
 
   grant_access action: :destroy, roles: :admin
   def destroy
-    ...
+    # ...
   end
 end
 ```
 This grants access to `index` action for users with `accountant` or `admin` role, and access to `destroy` action for `admin` users only.
 
+Please note that Rabarber does not provide any built-in data scoping mechanism as it is not a part of the authorization layer and is not necessarily role specific or has anything to do with the current user. The business logic can vary drastically depending on the application, so you're encouraged to limit the data visibility yourself, for example, in the same way as in the example above, where `accountant` role can only see paid invoices.
+
 You can also define controller-wide rules (without `action` argument):
 
 ```rb
@@ -243,18 +256,18 @@ class Crm::BaseController < ApplicationController
 
   grant_access action: :dashboard, roles: :marketer
   def dashboard
-    ...
+    # ...
   end
 end
 
 class Crm::InvoicesController < Crm::BaseController
   grant_access roles: :accountant
   def index
-    ...
+    # ...
   end
 
   def delete
-    ...
+    # ...
   end
 end
 ```
@@ -265,31 +278,47 @@ Roles can also be omitted:
 ```rb
 class OrdersController < ApplicationController
   grant_access
-  ...
+  # ...
 end
 
 class InvoicesController < ApplicationController
   grant_access action: :index
   def index
-    ...
+    # ...
   end
 end
 ```
 
 This allows everyone to access `OrdersController` and its children and also `index` action in `InvoicesController`. This extends to scenarios where there is no user present, i.e. when the method responsible for returning the currently authenticated user in your application returns `nil`.
 
-_Be aware that if the user is not authenticated (the method responsible for returning the currently authenticated user in your application returns `nil`), Rabarber will treat this situation as if the user with no roles assigned was authenticated._
+If the user is not authenticated (the method responsible for returning the currently authenticated user in your application returns `nil`), Rabarber will handle this situation as if the user has no roles.
+
+If you've set `must_have_roles` setting to `true`, then only the users with at least one role can gain access. This setting can be useful if your requirements are such that users without roles (or unauthenticated users) are not allowed to access anything.
+
+Also keep in mind that rules defined in child classes don't override parent rules but rather add to them:
+```rb
+class Crm::BaseController < ApplicationController
+  grant_access roles: :admin
+  # ...
+end
+
+class Crm::InvoicesController < Crm::BaseController
+  grant_access roles: :accountant
+  # ...
+end
+```
+This means that `Crm::InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
 
-If you've set `must_have_roles` setting to `true`, then, only the users with at least one role can have access. This setting can be useful if your requirements are such that users without roles are not allowed to access anything.
+## Dynamic Authorization Rules
 
 For more complex cases, Rabarber provides dynamic rules:
 
 ```rb
-class OrdersController < ApplicationController
+class Crm::OrdersController < ApplicationController
   grant_access roles: :manager, if: :company_manager?, unless: :fired?
 
   def index
-    ...
+    # ...
   end
 
   private
@@ -303,7 +332,7 @@ class OrdersController < ApplicationController
   end
 end
 
-class InvoicesController < ApplicationController
+class Crm::InvoicesController < ApplicationController
   grant_access roles: :senior_accountant
 
   grant_access action: :index, roles: [:secretary, :accountant], if: -> { InvoicesPolicy.new(current_user).can_access?(:index) }
@@ -311,30 +340,57 @@ class InvoicesController < ApplicationController
     @invoices = Invoice.all
     @invoices = @invoices.where("total < 10000") if current_user.has_role?(:accountant)
     @invoices = @invoices.unpaid if current_user.has_role?(:secretary)
-    ...
+    # ...
   end
 
   grant_access action: :show, roles: :accountant, unless: -> { Invoice.find(params[:id]).total > 10_000 }
   def show
-    ...
+    # ...
   end
 end
 ```
-You can pass a dynamic rule as `if` or `unless` argument. It can be a symbol, in which case the method with the same name will be called. Alternatively, it can be a proc, which will be executed within the context of the controller's instance.
+You can pass a dynamic rule as `if` or `unless` argument. It can be a symbol, in which case the method with that name will be called. Alternatively, it can be a proc, which will be executed within the context of the controller's instance.
 
-Rules defined in child classes don't override parent rules but rather add to them:
+You can use only dynamic rules without specifying roles if that suits your needs:
 ```rb
-class Crm::BaseController < ApplicationController
-  grant_access roles: :admin
-  ...
+class InvoicesController < ApplicationController
+  grant_access action: :index, if: -> { current_user.company == Company.find(params[:company_id]) }
+  def index
+    # ...
+  end
+end
+```
+This basically allows you to use Rabarber as a policy-based authorization library by calling your own custom policy within a dynamic rule:
+```rb
+class InvoicesController < ApplicationController
+  grant_access action: :index, if: -> { InvoicesPolicy.new(current_user).can_access?(:index) }
+  def index
+    # ...
+  end
 end
+```
 
-class Crm::InvoicesController < Crm::BaseController
-  grant_access roles: :accountant
-  ...
+## When Unauthorized
+
+By default, in the event of an unauthorized attempt, Rabarber redirects the user back if the request format is HTML (with fallback to the root path), and returns a 401 (Unauthorized) status code otherwise.
+
+This behavior can be customized by overriding private `when_unauthorized` method:
+
+```rb
+class ApplicationController < ActionController::Base
+  include Rabarber::Authorization
+
+  # ...
+
+  private
+
+  def when_unauthorized
+    head :not_found # pretend the page doesn't exist
+  end
 end
 ```
-This means that `Crm::InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
+
+The method can be overridden in different controllers, providing flexibility in handling unauthorized access attempts.
 
 ## View Helpers
 
@@ -343,7 +399,7 @@ Rabarber also provides a couple of helpers that can be used in views: `visible_t
 ```rb
 module ApplicationHelper
   include Rabarber::Helpers
-  ...
+  # ...
 end
 ```
 
@@ -375,7 +431,7 @@ The logs are written to the file `log/rabarber_audit.log` unless the `audit_trai
 
 Facing a problem or want to suggest an enhancement?
 
-- **Open a Discussion**: If you have a question, experience difficulties using the gem, or have an improvement suggestion, feel free to use the Discussions section.
+- **Open a Discussion**: If you have a question, experience difficulties using the gem, or have a suggestion for improvements, feel free to use the Discussions section.
 
 Encountered a bug?
 
@@ -384,12 +440,12 @@ Encountered a bug?
 
 ## Contributing
 
-Before opening an issue or creating a pull request, please read the [contributing guidelines](https://github.com/enjaku4/rabarber/blob/main/CONTRIBUTING.md).
-
-## License
-
-The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+Before creating an issue or a pull request, please read the [contributing guidelines](https://github.com/enjaku4/rabarber/blob/main/CONTRIBUTING.md).
 
 ## Code of Conduct
 
 Everyone interacting in the Rabarber project is expected to follow the [code of conduct](https://github.com/enjaku4/rabarber/blob/main/CODE_OF_CONDUCT.md).
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://github.com/enjaku4/rabarber/blob/main/LICENSE.txt).

data/lib/generators/rabarber/roles_generator.rb

@@ -10,6 +10,8 @@ module Rabarber
 
     argument :table_name, type: :string, required: true
 
+    class_option :uuid, type: :boolean, default: false, desc: "Use UUIDs as primary keys"
+
     def create_migrations
       migration_template "create_rabarber_roles.rb.erb", "db/migrate/create_rabarber_roles.rb"
     end

data/lib/generators/rabarber/templates/create_rabarber_roles.rb.erb

@@ -2,14 +2,14 @@
 
 class CreateRabarberRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version.to_s %>]
   def change
-    create_table :rabarber_roles do |t|
+    create_table :rabarber_roles<%= ", id: :uuid" if options[:uuid] %> do |t|
       t.string :name, null: false, index: { unique: true }
       t.timestamps
     end
 
     create_table :rabarber_roles_roleables, id: false do |t|
-      t.belongs_to :role, null: false, index: true, foreign_key: { to_table: :rabarber_roles }
-      t.belongs_to :roleable, null: false, index: true, foreign_key: { to_table: <%= table_name.to_sym.inspect %> }
+      t.belongs_to :role, null: false, index: true, foreign_key: { to_table: :rabarber_roles }<%= ", type: :uuid" if options[:uuid] %>
+      t.belongs_to :roleable, null: false, index: true, foreign_key: { to_table: <%= table_name.to_sym.inspect %> }<%= ", type: :uuid" if options[:uuid] %>
     end
 
     add_index :rabarber_roles_roleables, [:role_id, :roleable_id], unique: true

data/lib/rabarber/audit/events/base.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require_relative "../logger"
+
+module Rabarber
+  module Audit
+    module Events
+      class Base
+        attr_reader :roleable, :specifics
+
+        def self.trigger(roleable, specifics)
+          new(roleable, specifics).send(:log)
+        end
+
+        private
+
+        def initialize(roleable, specifics)
+          raise ArgumentError, "Roleable is required for #{self.class} event" if roleable.nil? && !nil_roleable_allowed?
+
+          @roleable = roleable
+          @specifics = specifics
+        end
+
+        def nil_roleable_allowed?
+          raise NotImplementedError
+        end
+
+        def log
+          Rabarber::Audit::Logger.log(log_level, message)
+        end
+
+        def log_level
+          raise NotImplementedError
+        end
+
+        def message
+          raise NotImplementedError
+        end
+
+        def identity
+          roleable_identity(with_roles: identity_with_roles?)
+        end
+
+        def identity_with_roles?
+          raise NotImplementedError
+        end
+
+        def roleable_identity(with_roles:)
+          if roleable
+            model_name = roleable.model_name.human
+            primary_key = roleable.class.primary_key
+            roleable_id = roleable.public_send(primary_key)
+
+            roles = with_roles ? ", roles: #{roleable.roles}" : ""
+
+            "#{model_name} with #{primary_key}: '#{roleable_id}'#{roles}"
+          else
+            "Unauthenticated #{Rabarber::HasRoles.roleable_class.model_name.human.downcase}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rabarber/audit/events/roles_assigned.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Rabarber
+  module Audit
+    module Events
+      class RolesAssigned < Base
+        private
+
+        def nil_roleable_allowed?
+          false
+        end
+
+        def log_level
+          :info
+        end
+
+        def message
+          "[Role Assignment] #{identity} has been assigned the following roles: #{roles_to_assign}, current roles: #{current_roles}"
+        end
+
+        def identity_with_roles?
+          false
+        end
+
+        def roles_to_assign
+          specifics.fetch(:roles_to_assign)
+        end
+
+        def current_roles
+          specifics.fetch(:current_roles)
+        end
+      end
+    end
+  end
+end

data/lib/rabarber/audit/events/roles_revoked.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Rabarber
+  module Audit
+    module Events
+      class RolesRevoked < Base
+        private
+
+        def nil_roleable_allowed?
+          false
+        end
+
+        def log_level
+          :info
+        end
+
+        def message
+          "[Role Revocation] #{identity} has been revoked from the following roles: #{roles_to_revoke}, current roles: #{current_roles}"
+        end
+
+        def identity_with_roles?
+          false
+        end
+
+        def roles_to_revoke
+          specifics.fetch(:roles_to_revoke)
+        end
+
+        def current_roles
+          specifics.fetch(:current_roles)
+        end
+      end
+    end
+  end
+end

data/lib/rabarber/audit/events/unauthorized_attempt.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Rabarber
+  module Audit
+    module Events
+      class UnauthorizedAttempt < Base
+        private
+
+        def nil_roleable_allowed?
+          true
+        end
+
+        def log_level
+          :warn
+        end
+
+        def message
+          "[Unauthorized Attempt] #{identity} attempted to access '#{path}'"
+        end
+
+        def identity_with_roles?
+          true
+        end
+
+        def path
+          specifics.fetch(:path)
+        end
+      end
+    end
+  end
+end

data/lib/rabarber/audit/logger.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "singleton"
+
+module Rabarber
+  module Audit
+    class Logger
+      include Singleton
+
+      attr_reader :logger
+
+      def initialize
+        @logger = ::Logger.new(Rails.root.join("log/rabarber_audit.log"))
+      end
+
+      def self.log(log_level, message)
+        return unless Rabarber::Configuration.instance.audit_trail_enabled
+
+        instance.logger.public_send(log_level, message)
+      end
+    end
+  end
+end