rbacan 0.3.2 → 0.5.0

data/lib/rbacan/host_authorization.rb

@@ -0,0 +1,165 @@
+module Rbacan
+  class ConfigurationError < StandardError; end
+  class UnsafeLegacyApi < StandardError; end
+
+  class AuthorizationContext
+    ATTRIBUTES = %i[tenant property vertical subject at metadata].freeze
+
+    attr_reader(*ATTRIBUTES)
+
+    def initialize(tenant:, property: nil, vertical: nil, subject: nil, at: Time.now, metadata: {})
+      raise ArgumentError, 'authorization tenant must identify a tenant' unless identifying_tenant?(tenant)
+
+      @tenant = deep_copy_and_freeze(tenant, label: 'authorization tenant')
+      @property = deep_copy_and_freeze(property, label: 'authorization property')
+      @vertical = deep_copy_and_freeze(vertical, label: 'authorization vertical')
+      @subject = deep_copy_and_freeze(subject, label: 'authorization subject')
+      @at = copy_and_freeze_time(at)
+      @metadata = deep_copy_and_freeze(metadata, label: 'authorization metadata')
+      freeze
+    end
+
+    private
+
+    def deep_copy_and_freeze(value, label:)
+      copy = case value
+             when Hash
+               value.to_h do |key, item|
+                 [ deep_copy_and_freeze(key, label: label), deep_copy_and_freeze(item, label: label) ]
+               end
+             when Array
+               value.map { |item| deep_copy_and_freeze(item, label: label) }
+             when String
+               value.dup
+             when Integer
+               value
+             when Float
+               raise ArgumentError, "#{label} supports only finite JSON numbers" unless value.finite?
+
+               value
+             when NilClass, TrueClass, FalseClass, Symbol
+               value
+             else
+               raise ArgumentError,
+                     "#{label} supports only hashes, arrays, strings, numbers, booleans, nil, and symbols"
+             end
+      copy.freeze
+    end
+
+    def copy_and_freeze_time(value)
+      time = value.to_time if value.respond_to?(:to_time)
+      raise ArgumentError, 'authorization timestamp must be time-like' unless time.is_a?(Time)
+
+      time.dup.freeze
+    end
+
+    def identifying_tenant?(value)
+      case value
+      when String, Array, Hash
+        !value.empty?
+      when Integer
+        true
+      when Float
+        value.finite?
+      when Symbol
+        !value.to_s.empty?
+      else
+        false
+      end
+    end
+  end
+
+  class AuthorizationRequest
+    attr_reader :user, :permission, :role, :context
+
+    def initialize(user:, permission:, role:, context:)
+      @user = user
+      @permission = permission&.to_s&.dup&.freeze
+      @role = role&.to_s&.dup&.freeze
+      @context = context
+      freeze
+    end
+  end
+
+  class AssignmentRequest
+    attr_reader :user, :role, :context
+
+    def initialize(user:, role:, context:)
+      @user = user
+      @role = role.to_s.dup.freeze
+      @context = context
+      freeze
+    end
+  end
+
+  class << self
+    def ensure_legacy_mode!(method_name)
+      return if legacy_mode
+
+      raise UnsafeLegacyApi,
+            "#{method_name} is a legacy unscoped API; set Rbacan.legacy_mode = true to opt in"
+    end
+
+    def authorized?(user:, permission: nil, role: nil, context:)
+      validate_authorization_target!(permission, role)
+      validate_context!(context)
+      return false unless user && authorization_adapter
+
+      request = AuthorizationRequest.new(
+        user: user,
+        permission: permission&.to_s,
+        role: role&.to_s,
+        context: context
+      )
+
+      !!call_authorization_adapter(request)
+    end
+
+    def assign_role(user:, role:, context:)
+      call_assignment_adapter(:assign, user: user, role: role, context: context)
+    end
+
+    def revoke_role(user:, role:, context:)
+      call_assignment_adapter(:revoke, user: user, role: role, context: context)
+    end
+
+    private
+
+    def validate_authorization_target!(permission, role)
+      if permission.nil? ^ role.nil?
+        target = permission || role
+        raise ArgumentError, 'authorization permission or role cannot be blank' if target.to_s.empty?
+
+        return
+      end
+
+      raise ArgumentError, 'Provide exactly one permission or role'
+    end
+
+    def validate_context!(context)
+      raise ArgumentError, 'authorization context is required' unless context.is_a?(AuthorizationContext)
+    end
+
+    def call_authorization_adapter(request)
+      if authorization_adapter.respond_to?(:allowed?)
+        authorization_adapter.allowed?(request)
+      elsif authorization_adapter.respond_to?(:call)
+        authorization_adapter.call(request)
+      else
+        raise ConfigurationError, 'authorization adapter must respond to allowed? or call'
+      end
+    end
+
+    def call_assignment_adapter(action, user:, role:, context:)
+      validate_context!(context)
+      raise ArgumentError, 'assignment user is required' unless user
+      raise ArgumentError, 'assignment role is required' if role.nil? || role.to_s.empty?
+      unless assignment_adapter&.respond_to?(action)
+        raise ConfigurationError, "assignment adapter must respond to #{action}"
+      end
+
+      request = AssignmentRequest.new(user: user, role: role.to_s, context: context)
+      assignment_adapter.public_send(action, request)
+    end
+  end
+end

data/lib/rbacan/not_authorized.rb

@@ -1,10 +1,17 @@
 module Rbacan
   class NotAuthorized < StandardError
-    attr_reader :permission, :role
+    attr_reader :permission, :role, :code
 
     def initialize(message = nil, permission: nil, role: nil)
       @permission = permission
-      @role       = role
+      @role = role
+      @code = if permission
+                'rbacan.not_authorized.permission'
+              elsif role
+                'rbacan.not_authorized.role'
+              else
+                'rbacan.not_authorized'
+              end
       super(message || default_message)
     end
 
@@ -16,7 +23,7 @@ module Rbacan
       elsif role
         "Not authorized: missing role '#{role}'"
       else
-        "Not authorized"
+        'Not authorized'
       end
     end
   end

data/lib/rbacan/permittable.rb

@@ -7,72 +7,110 @@ module Rbacan
     included do
       has_many :user_roles,
                class_name: Rbacan.user_role_class,
-               dependent:  :destroy
+               dependent: :destroy
       accepts_nested_attributes_for :user_roles
       has_many :roles,
                class_name: Rbacan.role_class,
-               through:    :user_roles
+               through: :user_roles
 
       # Returns users that have the given role (by name).
-      scope :with_role, ->(role_name) {
-        joins(:roles).where(Rbacan.role_table => { name: role_name.to_s })
+    scope :with_role, lambda { |role_name|
+      Rbacan.ensure_legacy_mode!(:with_role)
+        joins(:roles).where(Rbacan.role_table => { Rbacan.role_key => role_name.to_s })
       }
 
       # Returns users that have the given permission via any of their roles.
-      scope :with_permission, ->(permission_name) {
-        joins(roles: { role_permissions: :permission })
-          .where(Rbacan.permission_table => { name: permission_name.to_s })
+    scope :with_permission, lambda { |permission_name|
+      Rbacan.ensure_legacy_mode!(:with_permission)
+      joins(roles: { role_permissions: :permission })
+          .where(Rbacan.permission_table => { Rbacan.permission_key => permission_name.to_s })
       }
 
       # Assigns a role to the user. Idempotent — safe to call multiple times.
-      # Fix: was find_or_initialize_by (never persisted); now find_or_create_by.
-      def assign_role(role_name)
-        assigned_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
+      # When tenant_scoped is enabled, pass tenant_id: to scope the assignment.
+    def assign_role(role_name, tenant_id: nil)
+      Rbacan.ensure_legacy_mode!(:assign_role)
+      assigned_role = Rbacan.role_class.constantize.find_by(Rbacan.role_key => role_name.to_s)
         raise ArgumentError, "Role '#{role_name}' not found" unless assigned_role
 
-        self.user_roles.find_or_create_by(role_id: assigned_role.id)
+        attrs = { role_id: assigned_role.id }
+        attrs[:tenant_id] = tenant_id if Rbacan.tenant_scoped
+        user_roles.find_or_create_by(attrs)
       end
 
       # Removes a role from the user.
-      # Fix: was Rbacan::UserRole.where(user_id: ...) — now uses the scoped
-      # association so it respects the configured class and any FK setup.
-      def remove_role(role_name)
-        removed_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
+      # When tenant_scoped is enabled, pass tenant_id: to remove from a specific tenant.
+    def remove_role(role_name, tenant_id: nil)
+      Rbacan.ensure_legacy_mode!(:remove_role)
+      removed_role = Rbacan.role_class.constantize.find_by(Rbacan.role_key => role_name.to_s)
         return unless removed_role
 
-        self.user_roles.where(role_id: removed_role.id).destroy_all
+        scope = user_roles.where(role_id: removed_role.id)
+        scope = scope.where(tenant_id: tenant_id) if Rbacan.tenant_scoped
+        scope.destroy_all
       end
 
       # Returns true if the user has the named permission via any of their roles.
-      # Fix: was two queries; now a single EXISTS query via association joins.
-      def can?(permission_name)
-        self.roles
-            .joins(role_permissions: :permission)
-            .where(Rbacan.permission_table => { name: permission_name.to_s })
-            .exists?
+    def can?(permission_name)
+      Rbacan.ensure_legacy_mode!(:can?)
+      roles
+          .joins(role_permissions: :permission)
+        .where(Rbacan.permission_table => { Rbacan.permission_key => permission_name.to_s })
+          .exists?
+      end
+
+      # Returns true if the user has the named permission in a specific tenant context.
+      # Checks both global role assignments (tenant_id NULL) and tenant-specific ones.
+    def can_in_tenant?(permission_name, tenant_id)
+      Rbacan.ensure_legacy_mode!(:can_in_tenant?)
+      roles
+          .joins(role_permissions: :permission)
+        .where(Rbacan.permission_table => { Rbacan.permission_key => permission_name.to_s })
+          .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
+          .exists?
       end
 
       # Returns true if the user has the named role.
-      def has_role?(role_name)
-        self.roles.where(name: role_name.to_s).exists?
+    def has_role?(role_name)
+      Rbacan.ensure_legacy_mode!(:has_role?)
+      roles.where(Rbacan.role_key => role_name.to_s).exists?
+      end
+
+      # Returns true if the user has the named role in a specific tenant context.
+      # Checks both global role assignments (tenant_id NULL) and tenant-specific ones.
+    def has_role_in_tenant?(role_name, tenant_id)
+      Rbacan.ensure_legacy_mode!(:has_role_in_tenant?)
+      user_roles
+          .joins(:role)
+        .where(Rbacan.role_table => { Rbacan.role_key => role_name.to_s })
+          .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
+          .exists?
       end
 
       # Returns true if the user has ANY of the listed roles.
-      def has_any_role?(*role_names)
-        self.roles.where(name: role_names.map(&:to_s)).exists?
+    def has_any_role?(*role_names)
+      Rbacan.ensure_legacy_mode!(:has_any_role?)
+      roles.where(Rbacan.role_key => role_names.map(&:to_s)).exists?
       end
 
       # Returns true if the user has ALL of the listed permissions.
-      # Uses a single query: counts distinct matching permissions and compares
-      # to the requested set size.
-      def can_all?(*permission_names)
-        names = permission_names.map(&:to_s)
-        self.roles
-            .joins(role_permissions: :permission)
-            .where(Rbacan.permission_table => { name: names })
-            .select("#{Rbacan.permission_table}.name")
-            .distinct
-            .count == names.uniq.size
+    def can_all?(*permission_names)
+      Rbacan.ensure_legacy_mode!(:can_all?)
+      names = permission_names.map(&:to_s)
+        roles
+          .joins(role_permissions: :permission)
+        .where(Rbacan.permission_table => { Rbacan.permission_key => names })
+        .select("#{Rbacan.permission_table}.#{Rbacan.permission_key}")
+          .distinct
+          .count == names.uniq.size
+      end
+
+      # Returns roles assigned to this user for a specific tenant.
+      # Includes global role assignments (tenant_id NULL).
+    def roles_for_tenant(tenant_id)
+      Rbacan.ensure_legacy_mode!(:roles_for_tenant)
+      roles
+          .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
       end
     end
   end

data/lib/rbacan/roles_and_permissions.rb

@@ -3,25 +3,33 @@ module Rbacan
 
     # Creates roles by name. Idempotent — skips existing ones.
     def self.create_roles(roles)
+      Rbacan.ensure_legacy_mode!(:create_roles)
+
       roles.each do |role|
-        Rbacan.role_class.constantize.find_or_create_by(name: role.to_s)
+        Rbacan.role_class.constantize.find_or_create_by(Rbacan.role_key => role.to_s)
       end
     end
 
     # Creates permissions by name. Idempotent — skips existing ones.
     def self.create_permissions(permissions)
+      Rbacan.ensure_legacy_mode!(:create_permissions)
+
       permissions.each do |permission|
-        Rbacan.permission_class.constantize.find_or_create_by(name: permission.to_s)
+        Rbacan.permission_class.constantize.find_or_create_by(Rbacan.permission_key => permission.to_s)
       end
     end
 
     # Assigns a list of permissions to a role. Idempotent — skips duplicates.
     def self.assign_permissions_to_role(role_name, permissions)
-      chosen_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
+      Rbacan.ensure_legacy_mode!(:assign_permissions_to_role)
+
+      chosen_role = Rbacan.role_class.constantize.find_by(Rbacan.role_key => role_name.to_s)
       return unless chosen_role
 
       permissions.each do |permission|
-        given_permission = Rbacan.permission_class.constantize.find_by_name(permission.to_s)
+        given_permission = Rbacan.permission_class.constantize.find_by(
+          Rbacan.permission_key => permission.to_s
+        )
         next unless given_permission
 
         Rbacan.role_permission_class.constantize.find_or_create_by(

data/lib/rbacan/route_constraint.rb

@@ -1,30 +1,22 @@
 module Rbacan
   class RouteConstraint
-    # Constrains routes to users that have a given role or permission.
-    #
-    # Usage in config/routes.rb:
-    #   constraints Rbacan::RouteConstraint.new(role: :admin) do
-    #     namespace :admin do
-    #       resources :users
-    #     end
-    #   end
-    #
-    #   constraints Rbacan::RouteConstraint.new(permission: :access_admin_panel) do
-    #     ...
-    #   end
-    def initialize(role: nil, permission: nil)
+    def initialize(role: nil, permission: nil, user_resolver: nil, context_resolver: nil)
       if role.nil? && permission.nil?
-        raise ArgumentError, "Provide exactly one of role: or permission:"
+        raise ArgumentError, 'Provide exactly one role: or permission:'
       end
       if role && permission
-        raise ArgumentError, "Provide exactly one of role: or permission:, not both"
+        raise ArgumentError, 'Provide exactly one role: or permission:, not both'
       end
 
-      @role       = role&.to_s
+      @role = role&.to_s
       @permission = permission&.to_s
+      @user_resolver = user_resolver
+      @context_resolver = context_resolver
     end
 
     def matches?(request)
+      return hardened_match?(request) unless Rbacan.legacy_mode
+
       user = current_user_from(request)
       return false unless user
 
@@ -33,12 +25,23 @@ module Rbacan
 
     private
 
+    def hardened_match?(request)
+      return false unless @user_resolver&.respond_to?(:call) && @context_resolver&.respond_to?(:call)
+
+      Rbacan.authorized?(
+        user: @user_resolver.call(request),
+        permission: @permission,
+        role: @role,
+        context: @context_resolver.call(request)
+      )
+    rescue Rbacan::ConfigurationError, ArgumentError
+      false
+    end
+
     def current_user_from(request)
-      # Warden (Devise) path — most common, no extra query needed.
       warden = request.env['warden']
       return warden.user if warden&.authenticated?
 
-      # Fallback: manual session lookup for apps not using Warden.
       user_id = request.session[:user_id] || request.session['user_id']
       return nil unless user_id
 

data/lib/rbacan/version.rb

@@ -1,3 +1,3 @@
 module Rbacan
-  VERSION = "0.3.2"
+  VERSION = '0.5.0'
 end

data/lib/rbacan/view_helpers.rb

@@ -1,13 +1,18 @@
 module Rbacan
   module ViewHelpers
-    # Renders the block only if the current user has the given permission.
-    #
-    # Usage in views:
-    #   <% authorized?(:publish_post) do %>
-    #     <%= link_to "Publish", publish_post_path(@post) %>
-    #   <% end %>
-    def authorized?(permission, &block)
-      return unless current_user&.can?(permission.to_s)
+    # Renders the block only when the host authorization adapter permits it.
+    def authorized?(permission, context: nil, &block)
+      allowed = if Rbacan.legacy_mode
+                  current_user&.can?(permission.to_s)
+                else
+                  Rbacan.authorized?(
+                    user: current_user,
+                    permission: permission,
+                    context: context || rbacan_authorization_context
+                  )
+                end
+      return unless allowed
+
       capture(&block) if block_given?
     end
   end

data/lib/rbacan.rb

@@ -1,20 +1,34 @@
-require "rbacan/version"
-require "rbacan/not_authorized"
-require "rbacan/permittable"
-require "rbacan/engine"
-require "rbacan/roles_and_permissions"
-require "rbacan/authorization"
-require "rbacan/view_helpers"
-require "rbacan/route_constraint"
+require 'rbacan/version'
+require 'rbacan/not_authorized'
+require 'rbacan/host_authorization'
+require 'rbacan/authorizable'
+require 'rbacan/permittable'
+require 'rbacan/engine'
+require 'rbacan/roles_and_permissions'
+require 'rbacan/authorization'
+require 'rbacan/view_helpers'
+require 'rbacan/route_constraint'
 
 module Rbacan
+  mattr_accessor :authorization_adapter
+  @@authorization_adapter = nil
+
+  mattr_accessor :assignment_adapter
+  @@assignment_adapter = nil
+
+  # Legacy Active Record mutation/query APIs are opt-in in the hardened API.
+  mattr_accessor :legacy_mode
+  @@legacy_mode = false
+
   mattr_accessor :permittable_class
   @@permittable_class = 'User'
 
   mattr_accessor :role_class
   mattr_accessor :role_table
+  mattr_accessor :role_key
   @@role_class = 'Rbacan::Role'
   @@role_table = 'roles'
+  @@role_key = :name
 
   mattr_accessor :user_role_class
   mattr_accessor :user_role_table
@@ -23,8 +37,10 @@ module Rbacan
 
   mattr_accessor :permission_class
   mattr_accessor :permission_table
+  mattr_accessor :permission_key
   @@permission_class = 'Rbacan::Permission'
   @@permission_table = 'permissions'
+  @@permission_key = :name
 
   mattr_accessor :role_permission_class
   mattr_accessor :role_permission_table
@@ -39,24 +55,57 @@ module Rbacan
   mattr_accessor :unauthorized_redirect_path
   @@unauthorized_redirect_path = '/'
 
+  # Primary key type for generated migrations.
+  # nil = auto-detect from Rails generator config (primary_key_type).
+  # Set to :uuid for UUID primary keys, or :bigint for standard integer keys.
+  mattr_accessor :primary_key_type
+  @@primary_key_type = nil
+
+  # When true, adds tenant_id to roles and user_roles tables,
+  # enabling tenant-scoped roles and role assignments.
+  # Permissions remain global (no tenant_id) regardless of this setting.
+  mattr_accessor :tenant_scoped
+  @@tenant_scoped = false
+
+  # The name of your tenant model class (default: "Tenant").
+  # Only used when tenant_scoped is true.
+  mattr_accessor :tenant_class
+  @@tenant_class = 'Tenant'
+
+  # Resolves the effective primary key type.
+  # Checks the explicit config first, then falls back to the Rails generator config.
+  def self.resolve_primary_key_type
+    return primary_key_type if primary_key_type.present?
+
+    Rails.configuration.generators.options.dig(:active_record, :primary_key_type)
+  rescue StandardError
+    nil
+  end
+
   def self.create_role(role_name)
-    @@role_class.constantize.create(name: role_name)
+    ensure_legacy_mode!(:create_role)
+
+    @@role_class.constantize.create(@@role_key => role_name.to_s)
   end
 
   def self.create_permission(permission_name)
-    @@permission_class.constantize.create(name: permission_name)
+    ensure_legacy_mode!(:create_permission)
+
+    @@permission_class.constantize.create(@@permission_key => permission_name.to_s)
   end
 
   def self.assign_permission_to_role(role_name, permission_name)
-    chosen_role      = @@role_class.constantize.find_by_name(role_name)
-    given_permission = @@permission_class.constantize.find_by_name(permission_name)
+    ensure_legacy_mode!(:assign_permission_to_role)
+
+    chosen_role = @@role_class.constantize.find_by(@@role_key => role_name.to_s)
+    given_permission = @@permission_class.constantize.find_by(@@permission_key => permission_name.to_s)
     @@role_permission_class.constantize.create(
-      role_id:       chosen_role.id,
+      role_id: chosen_role.id,
       permission_id: given_permission.id
     )
   end
 
-  def self.configure(&block)
+  def self.configure
     yield self
   end