rails_iam 0.1.0

data/app/services/rails_iam/authentication/logout.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    class Logout < RailsIam::RailsIamService
+      def initialize(refresh_token: nil)
+        super()
+
+        @refresh_token = refresh_token
+      end
+
+      def call
+        invalidate_refresh_token
+      end
+
+      private
+
+      attr_reader :refresh_token
+
+      def invalidate_refresh_token
+        return unless refresh_token
+
+        case session_strategy
+        when :single
+          refresh_token.user.refresh_tokens.delete_all
+        when :multi
+          refresh_token.destroy
+
+        else
+          raise RailsIam::Authentication::Exceptions::AuthenticationError, session_strategy_error
+        end
+      end
+    end
+  end
+end

data/app/services/rails_iam/authentication/refresh_token_encoder.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    class RefreshTokenEncoder
+      def self.call
+        SecureRandom.hex(64)
+      end
+    end
+  end
+end

data/app/services/rails_iam/authentication/skip_authentication_rule.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    SkipAuthenticationRule = Data.define(
+      :only,
+      :except,
+    ) do
+      def matches?(action)
+        action = action.to_sym
+
+        return Array(only).map(&:to_sym).include?(action) if only.present?
+
+        return Array(except).map(&:to_sym).exclude?(action) if except.present?
+
+        true
+      end
+    end
+  end
+end

data/app/services/rails_iam/authentication/token_extractor.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authentication
+    class CookieExtractor < RailsIam::RailsIamService
+      def initialize(request)
+        super()
+        @request = request
+      end
+
+      def call
+        request.cookie_jar.encrypted[access_token_key]
+      end
+
+      private
+
+      attr_reader :request
+    end
+
+    class BearerExtractor < RailsIam::RailsIamService
+      def initialize(request)
+        super()
+        @request = request
+      end
+
+      def call
+        authorization = request.headers["Authorization"]
+        return if authorization.blank?
+
+        scheme, token = authorization.split(" ", 2)
+
+        scheme == "Bearer" ? token : nil
+      end
+
+      private
+
+      attr_reader :request
+    end
+
+    class TokenExtractor < RailsIam::RailsIamService
+      def initialize(request)
+        super()
+        @request = request
+      end
+
+      def call
+        extractor.call(request)
+      end
+
+      private
+
+      def extractor
+        # Explicitly pick the extractor based on the incoming request signature
+        if authentication_strategies.include?(:bearer) && request.headers["Authorization"]&.start_with?("Bearer ")
+          BearerExtractor
+        else
+          CookieExtractor
+        end
+      end
+
+      attr_reader :request
+    end
+  end
+end

data/app/services/rails_iam/authorization/authorization_context.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    class AuthorizationContext
+      attr_reader :user,
+                  :resolved_permissions,
+                  :roles,
+                  :required_roles,
+                  :required_permissions,
+                  :inferred_permission,
+                  :role_match,
+                  :permission_match
+
+      def initialize(
+        user:,
+        required_roles: [],
+        required_permissions: [],
+        inferred_permission: nil,
+        role_match: :any,
+        permission_match: :all
+      )
+        @user = user
+        @roles = RoleResolver.call(user)
+        @resolved_permissions = PermissionResolver.call(user)
+        @required_roles = required_roles.map(&:to_s)
+        @required_permissions = required_permissions.map(&:to_s)
+        @inferred_permission = inferred_permission
+        @role_match = role_match
+        @permission_match = permission_match
+      end
+
+      def permissions_for_check
+        return required_permissions if required_permissions.any?
+        return [inferred_permission] if inferred_permission.present?
+
+        []
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/authorization_rule.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    AuthorizationRule = Data.define(
+      :roles,
+      :permissions,
+      :role_match,
+      :permission_match,
+      :only,
+      :except,
+    ) do
+      def matches?(action)
+        action = action.to_sym
+
+        return Array(only).map(&:to_sym).include?(action) if only.present?
+
+        return Array(except).map(&:to_sym).exclude?(action) if except.present?
+
+        true
+      end
+
+      def authorizer_arguments(inferred_permission: nil)
+        {
+          required_roles: roles,
+          required_permissions: permissions,
+          inferred_permission: inferred_permission,
+          role_match: role_match,
+          permission_match: permission_match,
+        }
+      end
+
+      def valid?
+        roles.any? || permissions.any?
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/authorizer.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    class Authorizer < RailsIam::RailsIamService
+      def initialize(
+        user:,
+        required_roles: [],
+        required_permissions: [],
+        inferred_permission: nil,
+        role_match: :any,
+        permission_match: :all
+      )
+        super()
+        @context =
+          AuthorizationContext.new(
+            user: user,
+            required_roles: required_roles,
+            required_permissions: required_permissions,
+            inferred_permission: inferred_permission,
+            role_match: role_match,
+            permission_match: permission_match,
+          )
+      end
+
+      def call
+        DeniedPermissionChecker.call(@context)
+        RoleChecker.call(@context)
+        PermissionChecker.call(@context)
+
+        true # success is the absence of an exception
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/cache.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    class Cache
+      ROLES = :roles
+      PERMISSIONS = :permissions
+
+      class << self
+        def read_or_write(namespace, user_id, &block)
+          cache.fetch(
+            cache_key(namespace, user_id),
+            expires_in: RailsIam.configuration.authorization.cache_ttl,
+            &block
+          )
+        end
+
+        def delete(namespace, user_id)
+          cache.delete(cache_key(namespace, user_id))
+        end
+
+        def delete_all(user_id)
+          delete(Cache::ROLES, user_id)
+          delete(Cache::PERMISSIONS, user_id)
+        end
+
+        private
+
+        def cache
+          RailsIam.configuration.authorization.cache_store || Rails.cache
+        end
+
+        def cache_key(namespace, user_id)
+          "rails_iam:#{namespace}:#{user_id}"
+        end
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/denied_permission_checker.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    class DeniedPermissionChecker < RailsIam::RailsIamService
+      def initialize(context)
+        super()
+        @context = context
+      end
+
+      def call
+        return true if denied_permissions.empty?
+
+        raise RailsIam::Authorization::Exceptions::MissingPermissionError.new(
+          required: denied_permissions,
+        )
+      end
+
+      private
+
+      def denied_permissions
+        permissions = @context.permissions_for_check
+
+        denied =
+          @context.resolved_permissions.denied_codes
+
+        permissions.select do |permission|
+          denied.include?(permission)
+        end
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/exceptions/authorization_error.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    module Exceptions
+      class AuthorizationError < StandardError
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/exceptions/missing_permission_error.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    module Exceptions
+      class MissingPermissionError < AuthorizationError
+        include RailsIam::ConfigLoader
+
+        def initialize(required:)
+          formatter = missing_permission_error
+
+          message = case formatter
+                    # 1. If the user configured a plain String, use it directly
+                    when String
+                      formatter
+                    # 2. If it's a Proc/Lambda, inspect its argument requirements
+                    when Proc
+                      if formatter.arity.zero?
+                        # The user defined a lambda with no parameters: e.g., -> { "Access Denied" }
+                        formatter.call
+                      else
+                        # The user defined a parameterized lambda: e.g., ->(required:, actual:) { ... }
+                        formatter.call(required: required)
+                      end
+                    # 3. Fallback safeguard if config is empty or invalid type
+                    else
+                      "Missing permission(s): #{required.join(', ')}"
+                    end
+
+          super(message)
+        end
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/exceptions/missing_role_error.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    module Exceptions
+      class MissingRoleError < AuthorizationError
+        include RailsIam::ConfigLoader
+
+        def initialize(required:, actual:)
+          formatter = missing_role_error
+
+          message = case formatter
+                    # 1. If the user configured a plain String, use it directly
+                    when String
+                      formatter
+                    # 2. If it's a Proc/Lambda, inspect its argument requirements
+                    when Proc
+                      if formatter.arity.zero?
+                        # The user defined a lambda with no parameters: e.g., -> { "Access Denied" }
+                        formatter.call
+                      else
+                        # The user defined a parameterized lambda: e.g., ->(required:, actual:) { ... }
+                        formatter.call(required: required, actual: actual)
+                      end
+                    # 3. Fallback safeguard if config is empty or invalid type
+                    else
+                      "Required role: #{required.join(', ')}, actual: #{actual.join(', ')}"
+                    end
+
+          super(message)
+        end
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/permission_checker.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    class PermissionChecker < RailsIam::RailsIamService
+      def initialize(context)
+        super()
+        @context = context
+      end
+
+      def call
+        return true if permissions.empty?
+
+        success =
+          case @context.permission_match
+          when :any
+            permissions.any? do |permission|
+              @context.resolved_permissions.include?(permission)
+            end
+
+          when :all
+            permissions.all? do |permission|
+              @context.resolved_permissions.include?(permission)
+            end
+
+          else
+            raise ArgumentError, "Unknown permission_match #{@context.permission_match}"
+          end
+
+        return true if success
+
+        raise RailsIam::Authorization::Exceptions::MissingPermissionError.new(
+          required: permissions,
+        )
+      end
+
+      def permissions
+        @context.permissions_for_check
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/permission_resolver.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    PermissionMetadata = Data.define(
+      :source,
+      :role,
+    )
+
+    class PermissionResolver < RailsIam::RailsIamService
+      ALLOW_SOURCES = [
+        Authorization::PermissionSources::RolePermissionSource,
+        Authorization::PermissionSources::UserPermissionSource,
+      ].freeze
+
+      DENY_SOURCES = [
+        Authorization::PermissionSources::UserDeniedPermissionSource,
+      ].freeze
+
+      def initialize(user)
+        super()
+
+        @user = user
+      end
+
+      def call
+        Cache.read_or_write(:permissions, user.id) do
+          resolve
+        end
+      end
+
+      private
+
+      attr_reader :user
+
+      def resolve
+        allowed_codes = Set.new
+        denied_codes = Set.new
+        metadata = {}
+
+        # Resolve allowed permissions
+        ALLOW_SOURCES.each do |source|
+          source.call(@user).each do |row|
+            allowed_codes << row[:code]
+
+            metadata[row[:code]] ||= []
+
+            metadata[row[:code]] << PermissionMetadata.new(
+              source: row[:source],
+              role: row[:role],
+            )
+          end
+        end
+
+        # Resolve denied permissions
+        DENY_SOURCES.each do |source|
+          source.call(@user).each do |row|
+            denied_codes << row[:code]
+          end
+        end
+
+        ResolvedPermissions.new(
+          allowed_codes: allowed_codes,
+          denied_codes: denied_codes,
+          metadata: metadata,
+        )
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/permission_sources/role_permission_source.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    module PermissionSources
+      class RolePermissionSource < RailsIam::RailsIamService
+        def initialize(user)
+          super()
+          @user = user
+        end
+
+        def call
+          rows = []
+
+          user
+            .roles
+            .includes(:permissions)
+            .find_each do |role|
+            role.permissions.each do |permission|
+              rows << {
+                code: permission.code,
+                source: :role,
+                role: role.name,
+              }
+            end
+          end
+
+          rows
+        end
+
+        private
+
+        attr_reader :user
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/permission_sources/user_denied_permission_source.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    module PermissionSources
+      class UserDeniedPermissionSource < RailsIam::RailsIamService
+        def initialize(user)
+          super()
+
+          @user = user
+        end
+
+        def call
+          user.user_denied_permissions.includes(:permission).map do |record|
+            {
+              code: record.permission.code,
+              source: :user_denied,
+              role: nil,
+            }
+          end
+        end
+
+        private
+
+        attr_reader :user
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/permission_sources/user_permission_source.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    module PermissionSources
+      class UserPermissionSource < RailsIam::RailsIamService
+        def initialize(user)
+          super()
+
+          @user = user
+        end
+
+        def call
+          user.user_permissions.includes(:permission).map do |record|
+            {
+              code: record.permission.code,
+              source: :user,
+            }
+          end
+        end
+
+        private
+
+        attr_reader :user
+      end
+    end
+  end
+end

data/app/services/rails_iam/authorization/resolved_permissions.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module RailsIam
+  module Authorization
+    class ResolvedPermissions
+      attr_reader :allowed_codes,
+                  :denied_codes,
+                  :metadata
+
+      def initialize(
+        allowed_codes:,
+        denied_codes:,
+        metadata:
+      )
+        @allowed_codes = allowed_codes.to_set.freeze
+        @denied_codes = denied_codes.to_set.freeze
+        @metadata = metadata.freeze
+      end
+
+      def include?(permission)
+        permission = permission.to_s
+
+        return false if denied?(permission)
+
+        allowed?(permission)
+      end
+
+      def codes
+        allowed_codes
+      end
+
+      def effective_codes
+        @allowed_codes - @denied_codes
+      end
+
+      def explain(permission)
+        metadata.fetch(permission.to_s, [])
+      end
+
+      private
+
+      def allowed?(permission)
+        match?(allowed_codes, permission)
+      end
+
+      def denied?(permission)
+        match?(denied_codes, permission)
+      end
+
+      def match?(set, permission)
+        return true if set.include?(permission)
+
+        namespace = permission.split(":").first
+
+        return true if set.include?("#{namespace}:*")
+
+        return true if set.include?("*")
+
+        false
+      end
+    end
+  end
+end