rbacan 0.4.0 → 0.5.0

data/lib/rbacan/permittable.rb

@@ -14,20 +14,23 @@ module Rbacan
                through: :user_roles
 
       # Returns users that have the given role (by name).
-      scope :with_role, lambda { |role_name|
-        joins(:roles).where(Rbacan.role_table => { name: role_name.to_s })
+    scope :with_role, lambda { |role_name|
+      Rbacan.ensure_legacy_mode!(:with_role)
+        joins(:roles).where(Rbacan.role_table => { Rbacan.role_key => role_name.to_s })
       }
 
       # Returns users that have the given permission via any of their roles.
-      scope :with_permission, lambda { |permission_name|
-        joins(roles: { role_permissions: :permission })
-          .where(Rbacan.permission_table => { name: permission_name.to_s })
+    scope :with_permission, lambda { |permission_name|
+      Rbacan.ensure_legacy_mode!(:with_permission)
+      joins(roles: { role_permissions: :permission })
+          .where(Rbacan.permission_table => { Rbacan.permission_key => permission_name.to_s })
       }
 
       # Assigns a role to the user. Idempotent — safe to call multiple times.
       # When tenant_scoped is enabled, pass tenant_id: to scope the assignment.
-      def assign_role(role_name, tenant_id: nil)
-        assigned_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
+    def assign_role(role_name, tenant_id: nil)
+      Rbacan.ensure_legacy_mode!(:assign_role)
+      assigned_role = Rbacan.role_class.constantize.find_by(Rbacan.role_key => role_name.to_s)
         raise ArgumentError, "Role '#{role_name}' not found" unless assigned_role
 
         attrs = { role_id: assigned_role.id }
@@ -37,8 +40,9 @@ module Rbacan
 
       # Removes a role from the user.
       # When tenant_scoped is enabled, pass tenant_id: to remove from a specific tenant.
-      def remove_role(role_name, tenant_id: nil)
-        removed_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
+    def remove_role(role_name, tenant_id: nil)
+      Rbacan.ensure_legacy_mode!(:remove_role)
+      removed_role = Rbacan.role_class.constantize.find_by(Rbacan.role_key => role_name.to_s)
         return unless removed_role
 
         scope = user_roles.where(role_id: removed_role.id)
@@ -47,58 +51,65 @@ module Rbacan
       end
 
       # Returns true if the user has the named permission via any of their roles.
-      def can?(permission_name)
-        roles
+    def can?(permission_name)
+      Rbacan.ensure_legacy_mode!(:can?)
+      roles
           .joins(role_permissions: :permission)
-          .where(Rbacan.permission_table => { name: permission_name.to_s })
+        .where(Rbacan.permission_table => { Rbacan.permission_key => permission_name.to_s })
           .exists?
       end
 
       # Returns true if the user has the named permission in a specific tenant context.
       # Checks both global role assignments (tenant_id NULL) and tenant-specific ones.
-      def can_in_tenant?(permission_name, tenant_id)
-        roles
+    def can_in_tenant?(permission_name, tenant_id)
+      Rbacan.ensure_legacy_mode!(:can_in_tenant?)
+      roles
           .joins(role_permissions: :permission)
-          .where(Rbacan.permission_table => { name: permission_name.to_s })
+        .where(Rbacan.permission_table => { Rbacan.permission_key => permission_name.to_s })
           .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
           .exists?
       end
 
       # Returns true if the user has the named role.
-      def has_role?(role_name)
-        roles.where(name: role_name.to_s).exists?
+    def has_role?(role_name)
+      Rbacan.ensure_legacy_mode!(:has_role?)
+      roles.where(Rbacan.role_key => role_name.to_s).exists?
       end
 
       # Returns true if the user has the named role in a specific tenant context.
       # Checks both global role assignments (tenant_id NULL) and tenant-specific ones.
-      def has_role_in_tenant?(role_name, tenant_id)
-        user_roles
+    def has_role_in_tenant?(role_name, tenant_id)
+      Rbacan.ensure_legacy_mode!(:has_role_in_tenant?)
+      user_roles
           .joins(:role)
-          .where(Rbacan.role_table => { name: role_name.to_s })
+        .where(Rbacan.role_table => { Rbacan.role_key => role_name.to_s })
           .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
           .exists?
       end
 
       # Returns true if the user has ANY of the listed roles.
-      def has_any_role?(*role_names)
-        roles.where(name: role_names.map(&:to_s)).exists?
+    def has_any_role?(*role_names)
+      Rbacan.ensure_legacy_mode!(:has_any_role?)
+      roles.where(Rbacan.role_key => role_names.map(&:to_s)).exists?
       end
 
       # Returns true if the user has ALL of the listed permissions.
-      def can_all?(*permission_names)
-        names = permission_names.map(&:to_s)
+    def can_all?(*permission_names)
+      Rbacan.ensure_legacy_mode!(:can_all?)
+      names = permission_names.map(&:to_s)
         roles
           .joins(role_permissions: :permission)
-          .where(Rbacan.permission_table => { name: names })
-          .select("#{Rbacan.permission_table}.name")
+        .where(Rbacan.permission_table => { Rbacan.permission_key => names })
+        .select("#{Rbacan.permission_table}.#{Rbacan.permission_key}")
           .distinct
           .count == names.uniq.size
       end
 
       # Returns roles assigned to this user for a specific tenant.
       # Includes global role assignments (tenant_id NULL).
-      def roles_for_tenant(tenant_id)
-        roles
+    def roles_for_tenant(tenant_id)
+      Rbacan.ensure_legacy_mode!(:roles_for_tenant)
+      roles
           .where(Rbacan.user_role_table => { tenant_id: [tenant_id, nil] })
       end
     end

data/lib/rbacan/roles_and_permissions.rb

@@ -3,25 +3,33 @@ module Rbacan
 
     # Creates roles by name. Idempotent — skips existing ones.
     def self.create_roles(roles)
+      Rbacan.ensure_legacy_mode!(:create_roles)
+
       roles.each do |role|
-        Rbacan.role_class.constantize.find_or_create_by(name: role.to_s)
+        Rbacan.role_class.constantize.find_or_create_by(Rbacan.role_key => role.to_s)
       end
     end
 
     # Creates permissions by name. Idempotent — skips existing ones.
     def self.create_permissions(permissions)
+      Rbacan.ensure_legacy_mode!(:create_permissions)
+
       permissions.each do |permission|
-        Rbacan.permission_class.constantize.find_or_create_by(name: permission.to_s)
+        Rbacan.permission_class.constantize.find_or_create_by(Rbacan.permission_key => permission.to_s)
       end
     end
 
     # Assigns a list of permissions to a role. Idempotent — skips duplicates.
     def self.assign_permissions_to_role(role_name, permissions)
-      chosen_role = Rbacan.role_class.constantize.find_by_name(role_name.to_s)
+      Rbacan.ensure_legacy_mode!(:assign_permissions_to_role)
+
+      chosen_role = Rbacan.role_class.constantize.find_by(Rbacan.role_key => role_name.to_s)
       return unless chosen_role
 
       permissions.each do |permission|
-        given_permission = Rbacan.permission_class.constantize.find_by_name(permission.to_s)
+        given_permission = Rbacan.permission_class.constantize.find_by(
+          Rbacan.permission_key => permission.to_s
+        )
         next unless given_permission
 
         Rbacan.role_permission_class.constantize.find_or_create_by(

data/lib/rbacan/route_constraint.rb

@@ -1,30 +1,22 @@
 module Rbacan
   class RouteConstraint
-    # Constrains routes to users that have a given role or permission.
-    #
-    # Usage in config/routes.rb:
-    #   constraints Rbacan::RouteConstraint.new(role: :admin) do
-    #     namespace :admin do
-    #       resources :users
-    #     end
-    #   end
-    #
-    #   constraints Rbacan::RouteConstraint.new(permission: :access_admin_panel) do
-    #     ...
-    #   end
-    def initialize(role: nil, permission: nil)
+    def initialize(role: nil, permission: nil, user_resolver: nil, context_resolver: nil)
       if role.nil? && permission.nil?
-        raise ArgumentError, "Provide exactly one of role: or permission:"
+        raise ArgumentError, 'Provide exactly one role: or permission:'
       end
       if role && permission
-        raise ArgumentError, "Provide exactly one of role: or permission:, not both"
+        raise ArgumentError, 'Provide exactly one role: or permission:, not both'
       end
 
-      @role       = role&.to_s
+      @role = role&.to_s
       @permission = permission&.to_s
+      @user_resolver = user_resolver
+      @context_resolver = context_resolver
     end
 
     def matches?(request)
+      return hardened_match?(request) unless Rbacan.legacy_mode
+
       user = current_user_from(request)
       return false unless user
 
@@ -33,12 +25,23 @@ module Rbacan
 
     private
 
+    def hardened_match?(request)
+      return false unless @user_resolver&.respond_to?(:call) && @context_resolver&.respond_to?(:call)
+
+      Rbacan.authorized?(
+        user: @user_resolver.call(request),
+        permission: @permission,
+        role: @role,
+        context: @context_resolver.call(request)
+      )
+    rescue Rbacan::ConfigurationError, ArgumentError
+      false
+    end
+
     def current_user_from(request)
-      # Warden (Devise) path — most common, no extra query needed.
       warden = request.env['warden']
       return warden.user if warden&.authenticated?
 
-      # Fallback: manual session lookup for apps not using Warden.
       user_id = request.session[:user_id] || request.session['user_id']
       return nil unless user_id
 

data/lib/rbacan/version.rb

@@ -1,3 +1,3 @@
 module Rbacan
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

data/lib/rbacan/view_helpers.rb

@@ -1,13 +1,18 @@
 module Rbacan
   module ViewHelpers
-    # Renders the block only if the current user has the given permission.
-    #
-    # Usage in views:
-    #   <% authorized?(:publish_post) do %>
-    #     <%= link_to "Publish", publish_post_path(@post) %>
-    #   <% end %>
-    def authorized?(permission, &block)
-      return unless current_user&.can?(permission.to_s)
+    # Renders the block only when the host authorization adapter permits it.
+    def authorized?(permission, context: nil, &block)
+      allowed = if Rbacan.legacy_mode
+                  current_user&.can?(permission.to_s)
+                else
+                  Rbacan.authorized?(
+                    user: current_user,
+                    permission: permission,
+                    context: context || rbacan_authorization_context
+                  )
+                end
+      return unless allowed
+
       capture(&block) if block_given?
     end
   end

data/lib/rbacan.rb

@@ -1,5 +1,7 @@
 require 'rbacan/version'
 require 'rbacan/not_authorized'
+require 'rbacan/host_authorization'
+require 'rbacan/authorizable'
 require 'rbacan/permittable'
 require 'rbacan/engine'
 require 'rbacan/roles_and_permissions'
@@ -8,13 +10,25 @@ require 'rbacan/view_helpers'
 require 'rbacan/route_constraint'
 
 module Rbacan
+  mattr_accessor :authorization_adapter
+  @@authorization_adapter = nil
+
+  mattr_accessor :assignment_adapter
+  @@assignment_adapter = nil
+
+  # Legacy Active Record mutation/query APIs are opt-in in the hardened API.
+  mattr_accessor :legacy_mode
+  @@legacy_mode = false
+
   mattr_accessor :permittable_class
   @@permittable_class = 'User'
 
   mattr_accessor :role_class
   mattr_accessor :role_table
+  mattr_accessor :role_key
   @@role_class = 'Rbacan::Role'
   @@role_table = 'roles'
+  @@role_key = :name
 
   mattr_accessor :user_role_class
   mattr_accessor :user_role_table
@@ -23,8 +37,10 @@ module Rbacan
 
   mattr_accessor :permission_class
   mattr_accessor :permission_table
+  mattr_accessor :permission_key
   @@permission_class = 'Rbacan::Permission'
   @@permission_table = 'permissions'
+  @@permission_key = :name
 
   mattr_accessor :role_permission_class
   mattr_accessor :role_permission_table
@@ -67,16 +83,22 @@ module Rbacan
   end
 
   def self.create_role(role_name)
-    @@role_class.constantize.create(name: role_name)
+    ensure_legacy_mode!(:create_role)
+
+    @@role_class.constantize.create(@@role_key => role_name.to_s)
   end
 
   def self.create_permission(permission_name)
-    @@permission_class.constantize.create(name: permission_name)
+    ensure_legacy_mode!(:create_permission)
+
+    @@permission_class.constantize.create(@@permission_key => permission_name.to_s)
   end
 
   def self.assign_permission_to_role(role_name, permission_name)
-    chosen_role      = @@role_class.constantize.find_by_name(role_name)
-    given_permission = @@permission_class.constantize.find_by_name(permission_name)
+    ensure_legacy_mode!(:assign_permission_to_role)
+
+    chosen_role = @@role_class.constantize.find_by(@@role_key => role_name.to_s)
+    given_permission = @@permission_class.constantize.find_by(@@permission_key => permission_name.to_s)
     @@role_permission_class.constantize.create(
       role_id: chosen_role.id,
       permission_id: given_permission.id

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rbacan
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - hamdi
@@ -147,24 +147,15 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".rspec"
-- ".travis.yml"
 - CHANGELOG.md
-- CLAUDE.md
 - CODE_OF_CONDUCT.md
-- Gemfile
-- Gemfile.lock
 - LICENSE.txt
 - README.md
-- Rakefile
 - app/models/rbacan/application_record.rb
 - app/models/rbacan/permission.rb
 - app/models/rbacan/role.rb
 - app/models/rbacan/role_permission.rb
 - app/models/rbacan/user_role.rb
-- bin/console
-- bin/setup
 - lib/generators/install/templates/copy_to_seeds.rb
 - lib/generators/install/templates/create_permissions.rb
 - lib/generators/install/templates/create_role_permissions.rb
@@ -173,15 +164,16 @@ files:
 - lib/generators/install/templates/rbacan.rb
 - lib/generators/rbacan/install_generator.rb
 - lib/rbacan.rb
+- lib/rbacan/authorizable.rb
 - lib/rbacan/authorization.rb
 - lib/rbacan/engine.rb
+- lib/rbacan/host_authorization.rb
 - lib/rbacan/not_authorized.rb
 - lib/rbacan/permittable.rb
 - lib/rbacan/roles_and_permissions.rb
 - lib/rbacan/route_constraint.rb
 - lib/rbacan/version.rb
 - lib/rbacan/view_helpers.rb
-- rbacan.gemspec
 homepage: https://github.com/hamdi777/RBACan
 licenses:
 - MIT
@@ -203,7 +195,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A gem to give permission access to users based on their roles
 test_files: []

data/.gitignore

@@ -1,14 +0,0 @@
-/.bundle/
-/.yardoc
-/_yardoc/
-/coverage/
-/doc/
-/pkg/
-/spec/reports/
-/tmp/
-
-# rspec failure tracking
-.rspec_status
-
-# Built gem files
-*.gem

data/.rspec

@@ -1,3 +0,0 @@
---format documentation
---color
---require spec_helper

data/.travis.yml

@@ -1,7 +0,0 @@
----
-sudo: false
-language: ruby
-cache: bundler
-rvm:
-  - 2.4.2
-before_install: gem install bundler -v 2.0.1

data/CLAUDE.md

@@ -1,51 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Commands
-
-```bash
-bin/setup          # install dependencies
-rake spec          # run all tests
-bundle exec rspec spec/rbacan_spec.rb   # run a single spec file
-bundle exec rake install   # install gem locally
-bundle exec rake release   # tag, push commits/tags, push .gem to RubyGems
-gem build rbacan.gemspec   # build .gem file manually
-gem push rbacan-<version>.gem           # push to RubyGems manually
-```
-
-## Architecture
-
-This is a Rails engine gem that provides Role-Based Access Control (RBAC).
-
-**Data model** — four tables managed by the gem's migrations:
-- `roles` / `permissions` — named entities
-- `role_permissions` — join table linking roles to permissions
-- `user_roles` — join table linking the host app's user model to roles
-
-**Entry points:**
-- `lib/rbacan.rb` — main module; holds `mattr_accessor` config accessors and a `configure` block. All class names and table names are configurable here (defaults to `User`, `Rbacan::Role`, etc.).
-- `lib/rbacan/permittable.rb` — `ActiveSupport::Concern` included in the host app's user model via `include Rbacan::Permittable`. Adds `assign_role`, `remove_role`, and `can?` instance methods.
-- `lib/rbacan/roles_and_permissions.rb` — utility module (`RolesAndPermissions`) used in seeds to bulk-create roles/permissions and assign permissions to roles.
-- `lib/rbacan/engine.rb` — Rails engine that auto-loads `app/models`.
-
-**Generator** (`rails generate rbacan:install`) copies four migration files, `db/copy_to_seeds.rb`, and `config/initializers/rbacan.rb` into the host app.
-
-**Configuration** (host app's `config/initializers/rbacan.rb`):
-```ruby
-Rbacan.configure do |config|
-  config.permittable_class = "User"  # change if your user model has a different name
-end
-```
-
-## Releasing a new version
-
-1. Bump `lib/rbacan/version.rb`
-2. `gem build rbacan.gemspec`
-3. `gem push rbacan-<version>.gem`
-
-RubyGems push host is `https://rubygems.org`. GitHub repo: `https://github.com/hamdi777/RBACan`.
-
-## Known state
-
-The spec suite has a placeholder test (`expect(false).to eq(true)`) in `spec/rbacan_spec.rb` that intentionally fails — it was never replaced with real tests.

data/Gemfile

@@ -1,4 +0,0 @@
-source "https://rubygems.org"
-
-# Specify your gem's dependencies in rbacan.gemspec
-gemspec