rabarber 4.1.0 → 4.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5450b60dd272da8e0b78af00e44a3e82b29c7b9a9e8b510c68efccbba30ba150
-  data.tar.gz: 7bbdd6de4ed8f2e33be07363c9c9d4e099170099ca7cb32a50df217373503284
+  metadata.gz: feb905214f327d8aef99517ba1364252b6722430fe6ab1b4839055e1ae5b18fc
+  data.tar.gz: ed0cacc2d6ad0ec5fd436ba24e96c3c26489264c3f00c73822b24f4593b2fa01
 SHA512:
-  metadata.gz: 8c9aa4a196f99dbb5250dd1b625fed829418843f5de8f35a4b2cde5f933f8780be0865f8c23e90c57490a3358f004fd1168dc28bcc9be9f66f0bb56b9ebcfddf
-  data.tar.gz: 3ddc04e91777a31631d4e9db9a54d6d1e23f588935e09c9d9691f8c607fffbabe18a49553cc9bad22ed8944dbec8b6cb58ecaf6a432c7ac7da59c1aca27a334f
+  metadata.gz: 6f88384ea24337c233f9183fde8bda61ba2939c3947b9eff07c2b5a47ff44372ba0287258565c3a5e085c4dc80b5026206d7b126e23c58b541b6490778946123
+  data.tar.gz: 9d7d4243f90fdc36cf8c27c391154449b38407a42995791240b72571e2dff14fa3836e62ce43ca92d5d0c65a5835a1e14119a077eda59ebedbe4c6b2a5aa8bac

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## v4.1.1
+
+### Bugs:
+
+- Fixed an issue where controller-wide `grant_access` calls would overwrite each other instead of being additive, causing inconsistent access control based on statement order
+
+### Misc:
+
+- Minor performance improvement for authorization checks
+
 ## v4.1.0
 
 ### Features:

data/README.md

@@ -323,6 +323,21 @@ end
 ```
 This means that `Crm::InvoicesController` is still accessible to `admin` but is also accessible to `accountant`.
 
+This applies as well to multiple rules defined for the same controller or action:
+```rb
+class Crm::OrdersController < ApplicationController
+  grant_access roles: :manager, context: Order
+  grant_access roles: :admin
+
+  grant_access action: :show, roles: :client, context: -> { Order.find(params[:id]) }
+  grant_access action: :show, roles: :accountant
+  def show
+    # ...
+  end
+end
+```
+This will add rules for `manager` and `admin` roles for all actions in `Crm::OrdersController`, and for `client` and `accountant` roles for the `show` action.
+
 ## Dynamic Authorization Rules
 
 For more complex cases, Rabarber provides dynamic rules:

data/lib/rabarber/core/access.rb

@@ -8,15 +8,13 @@ module Rabarber
       end
 
       def controller_accessible?(roleable, controller_instance)
-        controller_rules.any? do |rule_controller, rule|
-          controller_instance.is_a?(rule_controller) && rule.verify_access(roleable, controller_instance)
+        controller_rules.any? do |controller, rules|
+          controller_instance.is_a?(controller) && rules.any? { _1.verify_access(roleable, controller_instance) }
         end
       end
 
       def action_accessible?(roleable, action, controller_instance)
-        action_rules[controller_instance.class].any? do |rule|
-          rule.action == action && rule.verify_access(roleable, controller_instance)
-        end
+        action_rules[controller_instance.class][action].any? { _1.verify_access(roleable, controller_instance) }
       end
     end
   end

data/lib/rabarber/core/permissions.rb

@@ -13,13 +13,16 @@ module Rabarber
       attr_reader :storage
 
       def initialize
-        @storage = { controller_rules: Hash.new({}), action_rules: Hash.new([]) }
+        @storage = {
+          controller_rules: Hash.new { |h, k| h[k] = [] },
+          action_rules: Hash.new { |h1, k1| h1[k1] = Hash.new { |h2, k2| h2[k2] = [] } }
+        }
       end
 
       class << self
         def add(controller, action, roles, context, dynamic_rule, negated_dynamic_rule)
-          rule = Rabarber::Core::Rule.new(action, roles, context, dynamic_rule, negated_dynamic_rule)
-          action ? action_rules[controller] += [rule] : controller_rules[controller] = rule
+          rule = Rabarber::Core::Rule.new(roles, context, dynamic_rule, negated_dynamic_rule)
+          action ? action_rules[controller][action] += [rule] : controller_rules[controller] += [rule]
         end
 
         def controller_rules

data/lib/rabarber/core/permissions_integrity_checker.rb

@@ -21,8 +21,8 @@ module Rabarber
       private
 
       def missing_list
-        @missing_list ||= action_rules.each_with_object([]) do |(controller, rules), arr|
-          missing_actions = rules.map(&:action) - controller.action_methods.map(&:to_sym)
+        @missing_list ||= action_rules.each_with_object([]) do |(controller, hash), arr|
+          missing_actions = hash.keys - controller.action_methods.map(&:to_sym)
           arr << { controller => missing_actions } if missing_actions.any?
         end
       end

data/lib/rabarber/core/rule.rb

@@ -3,10 +3,9 @@
 module Rabarber
   module Core
     class Rule
-      attr_reader :action, :roles, :context, :dynamic_rule, :negated_dynamic_rule
+      attr_reader :roles, :context, :dynamic_rule, :negated_dynamic_rule
 
-      def initialize(action, roles, context, dynamic_rule, negated_dynamic_rule)
-        @action = action
+      def initialize(roles, context, dynamic_rule, negated_dynamic_rule)
         @roles = Array(roles)
         @context = context
         @dynamic_rule = dynamic_rule || -> { true }

data/lib/rabarber/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rabarber
-  VERSION = "4.1.0"
+  VERSION = "4.1.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rabarber
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 4.1.1
 platform: ruby
 authors:
 - enjaku4
 - trafium
 bindir: bin
 cert_chain: []
-date: 2024-12-29 00:00:00.000000000 Z
+date: 2025-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails