rails_authorize 1.1.0 → 1.2.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +5 -0
- data/Gemfile.lock +34 -3
- data/README.md +145 -0
- data/lib/rails_authorize.rb +29 -0
- data/lib/rails_authorize/version.rb +1 -1
- data/rails_authorize.gemspec +0 -2
- metadata +2 -16
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 1bc7528dc0f49e6b7c2c98175fd00c9cd45f8d0cb69b17b9f223e560284415ec
|
4
|
+
data.tar.gz: 6454b3b867b16b01e46695399d82ecf9792419d98f8d9897aa486046972a724a
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 0b7dec8d13ea8a5cdbd07752d10c16a64e89d3292bd030fc67da557de10a937aca5e84c7d80d2f10209033c48630cdd43b542d22cc613b0dbac820dedbe56e8e
|
7
|
+
data.tar.gz: e3fc2ff683d0d0f9164e1cc19f24178be850286062270924bbc30b716c7c1c56ff7abbce7a8ac3ceaa696db98e473664c08ed72a4ea8915f33d9ea12d81149c3
|
data/Gemfile
CHANGED
data/Gemfile.lock
CHANGED
@@ -1,22 +1,51 @@
|
|
1
1
|
PATH
|
2
2
|
remote: .
|
3
3
|
specs:
|
4
|
-
rails_authorize (1.
|
5
|
-
activesupport (>= 3.0.0)
|
4
|
+
rails_authorize (1.2.0)
|
6
5
|
|
7
6
|
GEM
|
8
7
|
remote: https://rubygems.org/
|
9
8
|
specs:
|
9
|
+
actionpack (5.2.0)
|
10
|
+
actionview (= 5.2.0)
|
11
|
+
activesupport (= 5.2.0)
|
12
|
+
rack (~> 2.0)
|
13
|
+
rack-test (>= 0.6.3)
|
14
|
+
rails-dom-testing (~> 2.0)
|
15
|
+
rails-html-sanitizer (~> 1.0, >= 1.0.2)
|
16
|
+
actionview (5.2.0)
|
17
|
+
activesupport (= 5.2.0)
|
18
|
+
builder (~> 3.1)
|
19
|
+
erubi (~> 1.4)
|
20
|
+
rails-dom-testing (~> 2.0)
|
21
|
+
rails-html-sanitizer (~> 1.0, >= 1.0.3)
|
10
22
|
activesupport (5.2.0)
|
11
23
|
concurrent-ruby (~> 1.0, >= 1.0.2)
|
12
24
|
i18n (>= 0.7, < 2)
|
13
25
|
minitest (~> 5.1)
|
14
26
|
tzinfo (~> 1.1)
|
27
|
+
builder (3.2.3)
|
15
28
|
concurrent-ruby (1.0.5)
|
29
|
+
crass (1.0.4)
|
16
30
|
diff-lcs (1.3)
|
31
|
+
erubi (1.7.1)
|
17
32
|
i18n (1.0.0)
|
18
33
|
concurrent-ruby (~> 1.0)
|
34
|
+
loofah (2.2.2)
|
35
|
+
crass (~> 1.0.2)
|
36
|
+
nokogiri (>= 1.5.9)
|
37
|
+
mini_portile2 (2.3.0)
|
19
38
|
minitest (5.11.3)
|
39
|
+
nokogiri (1.8.4)
|
40
|
+
mini_portile2 (~> 2.3.0)
|
41
|
+
rack (2.0.5)
|
42
|
+
rack-test (1.0.0)
|
43
|
+
rack (>= 1.0, < 3)
|
44
|
+
rails-dom-testing (2.0.3)
|
45
|
+
activesupport (>= 4.2.0)
|
46
|
+
nokogiri (>= 1.6)
|
47
|
+
rails-html-sanitizer (1.0.4)
|
48
|
+
loofah (~> 2.2, >= 2.2.2)
|
20
49
|
rake (10.5.0)
|
21
50
|
rspec (3.7.0)
|
22
51
|
rspec-core (~> 3.7.0)
|
@@ -39,10 +68,12 @@ PLATFORMS
|
|
39
68
|
ruby
|
40
69
|
|
41
70
|
DEPENDENCIES
|
71
|
+
actionpack (>= 3.0.0)
|
72
|
+
activesupport (>= 3.0.0)
|
42
73
|
bundler (~> 1.15)
|
43
74
|
rails_authorize!
|
44
75
|
rake (~> 10)
|
45
76
|
rspec (~> 3.0)
|
46
77
|
|
47
78
|
BUNDLED WITH
|
48
|
-
1.16.
|
79
|
+
1.16.2
|
data/README.md
CHANGED
@@ -60,6 +60,14 @@ class PostPolicy < ApplicationPolicy
|
|
60
60
|
def scope
|
61
61
|
target.where(published: true)
|
62
62
|
end
|
63
|
+
|
64
|
+
def permitted_attributes
|
65
|
+
if user.admin?
|
66
|
+
%i[status body title]
|
67
|
+
else
|
68
|
+
%i[body title]
|
69
|
+
end
|
70
|
+
end
|
63
71
|
end
|
64
72
|
```
|
65
73
|
|
@@ -77,11 +85,148 @@ end
|
|
77
85
|
class PostController
|
78
86
|
def index
|
79
87
|
@posts = authorized_scope(Post)
|
88
|
+
...
|
89
|
+
end
|
90
|
+
|
91
|
+
def update
|
92
|
+
@post = Post.find(params[:id])
|
93
|
+
@post.update(permitted_attributes(@post))
|
94
|
+
...
|
80
95
|
end
|
81
96
|
|
82
97
|
def show
|
83
98
|
@post = Post.find(params[:id])
|
84
99
|
authorize @post
|
100
|
+
...
|
101
|
+
end
|
102
|
+
end
|
103
|
+
```
|
104
|
+
|
105
|
+
## Customize user
|
106
|
+
|
107
|
+
Rails Authorize will call the `current_user` method to retrieve the user for authorization. If you need to customize it you can pass `user` as option to method `authorize`:
|
108
|
+
|
109
|
+
```ruby
|
110
|
+
# app/controllers/posts_controller.rb
|
111
|
+
|
112
|
+
class PostController
|
113
|
+
def show
|
114
|
+
@post = Post.find(params[:id])
|
115
|
+
@user = User.find(params[:user_id])
|
116
|
+
authorize @post, user: @user
|
117
|
+
...
|
118
|
+
end
|
119
|
+
end
|
120
|
+
```
|
121
|
+
|
122
|
+
## Customize action
|
123
|
+
|
124
|
+
Rails Authorize will use the controller action name as identifier of policy method to use for authorization. If you need to customize it you can pass `action` as option to method `authorize`:
|
125
|
+
|
126
|
+
```ruby
|
127
|
+
# app/controllers/posts_controller.rb
|
128
|
+
|
129
|
+
class PostController
|
130
|
+
def show
|
131
|
+
@post = Post.find(params[:id])
|
132
|
+
authorize @post, action: :custom_action?
|
133
|
+
...
|
134
|
+
end
|
135
|
+
end
|
136
|
+
```
|
137
|
+
|
138
|
+
## Define context
|
139
|
+
|
140
|
+
Rails Authorize allow you to define the context objects that you need to authorize an action:
|
141
|
+
|
142
|
+
```ruby
|
143
|
+
# app/controllers/posts_controller.rb
|
144
|
+
|
145
|
+
class PostController
|
146
|
+
def show
|
147
|
+
@post = Post.find(params[:id])
|
148
|
+
authorize @post, context: {template: params[:template]}
|
149
|
+
...
|
150
|
+
end
|
151
|
+
end
|
152
|
+
```
|
153
|
+
|
154
|
+
```ruby
|
155
|
+
# app/policies/post_policy.rb
|
156
|
+
|
157
|
+
class PostPolicy < ApplicationPolicy
|
158
|
+
def show?
|
159
|
+
if context[:template] == 'complete' ?
|
160
|
+
user.is_admin?
|
161
|
+
else
|
162
|
+
true
|
163
|
+
end
|
164
|
+
end
|
165
|
+
end
|
166
|
+
```
|
167
|
+
|
168
|
+
## Strong parameters
|
169
|
+
|
170
|
+
Rails uses [strong_parameters](http://edgeguides.rubyonrails.org/action_controller_overview.html#strong-parameters) to handle mass-assignment protection in the controller. With this gem you can control which attributes a user has access via your policies.
|
171
|
+
|
172
|
+
You can set up a `permitted_attributes` method in your policy like this:
|
173
|
+
|
174
|
+
```ruby
|
175
|
+
# app/policies/post_policy.rb
|
176
|
+
|
177
|
+
class PostPolicy < ApplicationPolicy
|
178
|
+
def permitted_attributes
|
179
|
+
if user.admin?
|
180
|
+
%i[status body title]
|
181
|
+
else
|
182
|
+
%i[body title]
|
183
|
+
end
|
184
|
+
end
|
185
|
+
end
|
186
|
+
```
|
187
|
+
|
188
|
+
You can now retrieve these attributes from the policy:
|
189
|
+
|
190
|
+
```ruby
|
191
|
+
policy(@post).permitted_attributes
|
192
|
+
```
|
193
|
+
|
194
|
+
Rails Authorize provides `permitted_attributes` helper method to use it in your controllers:
|
195
|
+
|
196
|
+
```ruby
|
197
|
+
# app/controllers/posts_controller.rb
|
198
|
+
|
199
|
+
class PostController
|
200
|
+
def update
|
201
|
+
@post.update(permitted_attributes(@post))
|
202
|
+
end
|
203
|
+
end
|
204
|
+
```
|
205
|
+
|
206
|
+
By default `permitted_attributes` makes `params.require(:post)` if you want to personalize what attribute is required in params, your policy must define a `param_key`.
|
207
|
+
|
208
|
+
```ruby
|
209
|
+
# app/policies/post_policy.rb
|
210
|
+
|
211
|
+
class PostPolicy < ApplicationPolicy
|
212
|
+
def param_key
|
213
|
+
'custom_key'
|
214
|
+
end
|
215
|
+
end
|
216
|
+
```
|
217
|
+
|
218
|
+
If you want to permit different attributes based on the current action, you can define a `permitted_attributes_for_#{action_name}` method on your policy:
|
219
|
+
|
220
|
+
```ruby
|
221
|
+
# app/policies/post_policy.rb
|
222
|
+
|
223
|
+
class PostPolicy < ApplicationPolicy
|
224
|
+
def permitted_attributes_for_create
|
225
|
+
[:title, :body]
|
226
|
+
end
|
227
|
+
|
228
|
+
def permitted_attributes_for_update
|
229
|
+
[:body]
|
85
230
|
end
|
86
231
|
end
|
87
232
|
```
|
data/lib/rails_authorize.rb
CHANGED
@@ -71,4 +71,33 @@ module RailsAuthorize
|
|
71
71
|
|
72
72
|
policy.scope
|
73
73
|
end
|
74
|
+
|
75
|
+
# Retrieves a set of permitted attributes from the policy by instantiating
|
76
|
+
# the policy class for the given record and calling `permitted_attributes` on
|
77
|
+
# it, or `permitted_attributes_for_{action}` if `action` is defined. It then infers
|
78
|
+
# what key the record should have in the params hash and retrieves the
|
79
|
+
# permitted attributes from the params hash under that key.
|
80
|
+
#
|
81
|
+
# @param record [Object] the object we're retrieving permitted attributes for
|
82
|
+
# @param options [Hash] key/value options (action, user, policy, context)
|
83
|
+
# @param options[:action] [String] the method to check on the policy (e.g. `:show?`)
|
84
|
+
# @return [Hash{String => Object}] the permitted attributes
|
85
|
+
def permitted_attributes(target, options={})
|
86
|
+
action = options.delete(:action) || action_name
|
87
|
+
policy = policy(target, options)
|
88
|
+
|
89
|
+
method_name = if policy.respond_to?("permitted_attributes_for_#{action}")
|
90
|
+
"permitted_attributes_for_#{action}"
|
91
|
+
else
|
92
|
+
'permitted_attributes'
|
93
|
+
end
|
94
|
+
|
95
|
+
param_key = if policy.try(:param_key).present?
|
96
|
+
policy.param_key
|
97
|
+
else
|
98
|
+
target.model_name.name.underscore
|
99
|
+
end
|
100
|
+
|
101
|
+
params.require(param_key).permit(*policy.public_send(method_name))
|
102
|
+
end
|
74
103
|
end
|
data/rails_authorize.gemspec
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rails_authorize
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.2.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- rjurado01
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2018-
|
11
|
+
date: 2018-07-12 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -52,20 +52,6 @@ dependencies:
|
|
52
52
|
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
54
|
version: '3.0'
|
55
|
-
- !ruby/object:Gem::Dependency
|
56
|
-
name: activesupport
|
57
|
-
requirement: !ruby/object:Gem::Requirement
|
58
|
-
requirements:
|
59
|
-
- - ">="
|
60
|
-
- !ruby/object:Gem::Version
|
61
|
-
version: 3.0.0
|
62
|
-
type: :runtime
|
63
|
-
prerelease: false
|
64
|
-
version_requirements: !ruby/object:Gem::Requirement
|
65
|
-
requirements:
|
66
|
-
- - ">="
|
67
|
-
- !ruby/object:Gem::Version
|
68
|
-
version: 3.0.0
|
69
55
|
description: Authorization system for Rails with only few helpers and regular Ruby
|
70
56
|
classes.
|
71
57
|
email:
|