releaf-permissions 0.2.1 → 1.0.3

data/lib/releaf/permissions/access_control.rb

@@ -0,0 +1,37 @@
+module Releaf::Permissions
+  class AccessControl
+    include Virtus.model(strict: true)
+    attribute :user, Object
+
+    def self.initialize_component
+      ActiveSupport.on_load :base_controller do
+        Releaf::ActionController.send(:include, Releaf::Permissions::ControllerSupport)
+      end
+    end
+
+    def self.draw_component_routes(router)
+      router.devise_for(Releaf.application.config.permissions.devise_for, path: "", controllers: { sessions: "releaf/permissions/sessions" })
+    end
+
+    def controller_permitted?(controller_name)
+      allowed_controllers.include?(controller_name)
+    end
+
+    def allowed_controllers
+      permanent_allowed_controllers + role_allowed_controllers
+    end
+
+    def role_allowed_controllers
+      user.role.permissions.map{|permission| controller_name_from_permission(permission.permission) }.compact
+    end
+
+    def controller_name_from_permission(permission)
+      match = permission.match(/^controller\.(.+)/)
+      match[1] if match
+    end
+
+    def permanent_allowed_controllers
+      Releaf.application.config.permissions.permanent_allowed_controllers
+    end
+  end
+end

data/lib/releaf/permissions/configuration.rb

@@ -0,0 +1,26 @@
+module Releaf::Permissions
+  class Configuration
+    include Virtus.model(strict: true)
+    attribute :devise_for, String
+    attribute :access_control, Object
+    attribute :permanent_allowed_controllers, Array
+
+    def devise_model_name
+      devise_for.tr("/", "_")
+    end
+
+    def devise_model_class
+      devise_for.classify.constantize
+    end
+
+    def self.configure_component
+      Releaf.application.config.add_configuration(
+        new(
+          devise_for: "releaf/permissions/user",
+          access_control: Releaf::Permissions::AccessControl,
+          permanent_allowed_controllers: ['releaf/root', 'releaf/errors']
+        )
+      )
+    end
+  end
+end

data/lib/releaf/permissions/controller_support.rb

@@ -0,0 +1,33 @@
+module Releaf::Permissions
+  module ControllerSupport
+    extend ActiveSupport::Concern
+
+    included do
+      prepend_before_action :set_locale, :verify_controller_access!, :authenticate!
+    end
+
+    def set_locale
+      I18n.locale = user.locale
+    end
+
+    def verify_controller_access!
+      unless Releaf.application.config.permissions.access_control.new(user: user).controller_permitted?(short_name)
+        raise Releaf::AccessDenied
+      end
+    end
+
+    def user
+      send("current_#{Releaf.application.config.permissions.devise_model_name}")
+    end
+
+    def authorized?
+      method_name = "#{Releaf.application.config.permissions.devise_model_name}_signed_in?"
+      send(method_name)
+    end
+
+    def authenticate!
+      method_name = "authenticate_#{Releaf.application.config.permissions.devise_model_name}!"
+      send(method_name)
+    end
+  end
+end

data/lib/releaf/permissions/default_controller_resolver.rb

@@ -0,0 +1,22 @@
+module Releaf::Permissions
+  class DefaultControllerResolver < Releaf::Root::DefaultControllerResolver
+
+    def self.configure_component
+      Releaf.application.config.root.default_controller_resolver = self
+    end
+
+    def controllers
+      # Note: This basically sorts allowed controllers in order specified by
+      # Releaf.application.config.available_controllers
+      ([user.role.default_controller] + super).uniq & allowed_controllers
+    end
+
+    def allowed_controllers
+      Releaf.application.config.permissions.access_control.new(user: user).allowed_controllers
+    end
+
+    def user
+      current_controller.user
+    end
+  end
+end

data/lib/releaf/permissions/engine.rb

@@ -1,24 +1,7 @@
-require 'devise'
-
 module Releaf::Permissions
-  require 'releaf/permissions/devise_component'
-  require 'releaf/permissions/profile_component'
-  require 'releaf/permissions/roles_component'
-  require 'releaf/permissions/users_component'
-  require 'releaf/permissions/builders_autoload'
-
   class Engine < ::Rails::Engine
     initializer 'precompile', group: :all do |app|
-      app.config.assets.precompile += %w(releaf/controllers/releaf/permissions/*)
+      app.config.assets.precompile += %w(controllers/releaf/permissions/*)
     end
   end
-
-  def self.components
-    [
-      Releaf::Permissions::DeviseComponent,
-      Releaf::Permissions::RolesComponent,
-      Releaf::Permissions::UsersComponent,
-      Releaf::Permissions::ProfileComponent
-    ]
-  end
 end

data/lib/releaf/permissions/layout.rb

@@ -0,0 +1,5 @@
+module Releaf::Permissions::Layout
+  def self.configure_component
+    Releaf.application.config.layout_builder_class_name = 'Releaf::Permissions::Page::LayoutBuilder'
+  end
+end

data/lib/releaf/permissions/{profile_component.rb → profile.rb}

@@ -1,9 +1,13 @@
-module Releaf::Permissions::ProfileComponent
+module Releaf::Permissions::Profile
+
+  def self.configure_component
+    Releaf.application.config.additional_controllers = Releaf.application.config.additional_controllers + ['releaf/permissions/profile']
+  end
+
   def self.draw_component_routes router
     router.namespace :releaf, path: nil do
       router.get "profile", to: "permissions/profile#edit", as: :permissions_user_profile
       router.patch "profile", to: "permissions/profile#update"
-      router.post "profile/settings", to: "permissions/profile#settings", as: :permissions_user_profile_settings
     end
   end
 end

data/lib/releaf/permissions/{roles_component.rb → roles.rb}

@@ -1,5 +1,5 @@
-module Releaf::Permissions::RolesComponent
-  extend Releaf::Core::Component
+module Releaf::Permissions::Roles
+  extend Releaf::Component
 
   def self.draw_component_routes router
     resource_route(router, :permissions, :roles)

data/lib/releaf/permissions/settings_manager.rb

@@ -0,0 +1,22 @@
+module Releaf::Permissions
+  class SettingsManager
+    def self.configure_component
+      Releaf.application.config.settings_manager = self
+    end
+
+    def self.read(controller:, key:)
+      controller.user.settings[key] if controller.respond_to? :user
+    end
+
+    def self.write(controller:, key:, value:)
+      # Sometimes concurrency happens, so lets try until
+      # record get updated
+      begin
+        controller.user.settings[key] = value
+      rescue ActiveRecord::RecordNotUnique
+        retry
+      end
+    end
+  end
+end
+

data/lib/releaf/permissions/users.rb

@@ -0,0 +1,11 @@
+module Releaf::Permissions::Users
+  extend Releaf::Component
+
+  def self.configure_component
+    Releaf.application.config.permissions.devise_for = 'releaf/permissions/user'
+  end
+
+  def self.draw_component_routes(router)
+    resource_route(router, :permissions, :users)
+  end
+end

data/spec/builders/releaf/permissions/page/header_builder_spec.rb

@@ -0,0 +1,87 @@
+require "rails_helper"
+
+describe Releaf::Permissions::Page::HeaderBuilder, type: :class do
+  class PageHeaderBuilderTestHelper < ActionView::Base
+    include Rails.application.routes.url_helpers
+    include FontAwesome::Rails::IconHelper
+
+    def protect_against_forgery?
+      true
+    end
+
+    def form_authenticity_token
+      "xxx"
+    end
+
+    def request_forgery_protection_token
+      "yyy"
+    end
+  end
+
+  subject { described_class.new(template) }
+  let(:template){ PageHeaderBuilderTestHelper.new }
+
+  describe "#items" do
+    it "returns array of home link, profile block and logout form content" do
+      allow(subject).to receive(:home_link).and_return("a")
+      allow(subject).to receive(:profile_block).and_return("b")
+      allow(subject).to receive(:sign_out_form).and_return("c")
+      expect(subject.items).to eq(["a", "b", "c"])
+    end
+  end
+
+  describe "#profile_path" do
+    it "returns profile edit url for defined profile controller" do
+      expect(subject.profile_path).to eq("/admin/profile")
+    end
+  end
+
+  describe "#profile_block" do
+    it "returns profile block with content" do
+      allow(subject).to receive(:profile_user_name).and_return("neim")
+      allow(subject).to receive(:profile_path).and_return("url_b")
+      content = '<a class="button profile" href="url_b"><span class="name">neim</span></a>'
+      expect(subject.profile_block).to eq(content)
+    end
+  end
+
+  describe "#user" do
+    it "returns permissions manager user" do
+      controller = Releaf::RootController.new
+      allow(subject).to receive(:controller).and_return(controller)
+      allow(controller).to receive(:user).and_return("x")
+      expect(subject.user).to eq("x")
+    end
+  end
+
+  describe "#profile_user_name" do
+    it "returns title for user instance" do
+      user = Releaf::Permissions::User.new(name: "a", surname: "b")
+      allow(subject).to receive(:user).and_return(user)
+      allow(subject).to receive(:resource_title).with(user).and_return("x t")
+      expect(subject.profile_user_name).to eq("x t")
+    end
+  end
+
+  describe "#sign_out_path" do
+    it "returns sign out url" do
+      expect(subject.sign_out_path).to eq("/admin/sign_out")
+    end
+  end
+
+  describe "#sign_out_form" do
+    it "returns sign out form" do
+      allow(subject).to receive(:sign_out_path).and_return("url_a")
+      content = %Q[
+        <form class="sign-out" action="url_a" accept-charset="UTF-8" method="post">
+          <input name="utf8" type="hidden" value="&#x2713;" />
+          <input type="hidden" name="_method" value="delete" />
+          <input type="hidden" name="yyy" value="xxx" />
+          <button class="button only-icon" type="submit" title="Sign out">
+            <i class="fa fa-power-off fa-icon-header"></i>
+          </button>
+      </form>]
+      expect(subject.sign_out_form).to match_html( content )
+    end
+  end
+end

data/spec/builders/releaf/permissions/page/layout_builder_spec.rb

@@ -0,0 +1,64 @@
+require "rails_helper"
+
+describe Releaf::Permissions::Page::LayoutBuilder, type: :class do
+  class PermissionsLayoutBuilderView < ActionView::Base; end
+  let(:controller){ Releaf::RootController.new }
+  let(:template){ PermissionsLayoutBuilderView.new }
+  subject { described_class.new(template) }
+
+  before do
+    allow(subject).to receive(:controller).and_return(controller)
+  end
+
+  it "inherits Releaf::Builders::Page::LayoutBuilder" do
+    expect(described_class.superclass).to eq(Releaf::Builders::Page::LayoutBuilder)
+  end
+
+  describe "#header_builder" do
+    it "returns `Releaf::Permissions::Page::HeaderBuilder` class" do
+      expect(subject.header_builder).to eq(Releaf::Permissions::Page::HeaderBuilder)
+    end
+  end
+
+  describe "#menu_builder" do
+    it "returns `Releaf::Permissions::Page::MenuBuilder` class" do
+      expect(subject.menu_builder).to eq(Releaf::Permissions::Page::MenuBuilder)
+    end
+  end
+
+  describe "#body_content" do
+    before do
+      allow(subject).to receive(:header).and_return("_header")
+      allow(subject).to receive(:menu).and_return("_menu")
+      allow(subject).to receive(:notifications).and_return("_notifications")
+    end
+
+    context "when controller responds to `authorized?` and `authorized?` call return true" do
+      it "returns `super` content" do
+        allow(controller).to receive(:authorized?).and_return(true)
+        expect(subject.body_content{ "x" }).to eq("_header_menu<main id=\"main\">x</main>_notifications")
+      end
+    end
+
+    context "when controller responds to `authorized?` and `authorized?` call return false" do
+      it "returns given block content" do
+        allow(controller).to receive(:authorized?).and_return(false)
+        expect(subject.body_content{ "x" }).to eq("x")
+      end
+    end
+
+    context "when controller does not responds to `authorized?`" do
+      it "returns given block content" do
+        allow(controller).to receive(:respond_to?).with(:authorized?).and_return(false)
+        expect(subject.body_content{ "x" }).to eq("x")
+      end
+    end
+  end
+  #def body_content(&block)
+    #if controller.respond_to?(:authorized?) && controller.authorized?
+      #super
+    #else
+      #yield
+    #end
+  #end
+end

data/spec/builders/releaf/permissions/page/menu_builder_spec.rb

@@ -0,0 +1,100 @@
+require "rails_helper"
+
+describe Releaf::Permissions::Page::MenuBuilder, type: :class do
+  class MenuBuilderTestHelper < ActionView::Base
+    include FontAwesome::Rails::IconHelper
+  end
+
+  let(:controller){ Releaf::ActionController.new }
+  let(:template){ MenuBuilderTestHelper.new }
+  let(:group_item){ Releaf::ControllerGroupDefinition.new(name: "x", items: []) }
+  let(:controller_item){ Releaf::ControllerDefinition.new(name: "y", controller: "_controller_") }
+  subject { described_class.new(template) }
+
+  before do
+    allow(template).to receive(:controller).and_return(controller)
+  end
+
+  it "inherits `Releaf::Builders::Page::MenuBuilder`" do
+    expect(described_class.ancestors).to include(Releaf::Builders::Page::MenuBuilder)
+  end
+
+  describe "#menu_item" do
+    before do
+      allow(subject).to receive(:item_attributes).and_return({})
+      allow(subject).to receive(:menu_item_group).and_return("_content_")
+    end
+
+    context "when item is permitted" do
+      it "returns parent method content" do
+        allow(subject).to receive(:menu_item_permitted?).with(group_item).and_return(true)
+        expect(subject.menu_item(group_item)).to eq("<li>_content_</li>")
+      end
+    end
+
+    context "when item is not permitted" do
+      it "returns nil" do
+        allow(subject).to receive(:menu_item_permitted?).with(group_item).and_return(false)
+        expect(subject.menu_item(group_item)).to be nil
+      end
+    end
+  end
+
+  describe "#menu_item_permitted?" do
+    context "when item is instance of `Releaf::ControllerGroupDefinition`" do
+      before do
+        allow(group_item).to receive(:controllers).and_return([
+          Releaf::ControllerDefinition.new(name: "a1", controller: "c1"),
+          Releaf::ControllerDefinition.new(name: "a2", controller: "c2"),
+          Releaf::ControllerDefinition.new(name: "a3", controller: "c3"),
+        ])
+      end
+
+      context "when any of group item controller is allowed" do
+        it "returns true" do
+          allow(subject).to receive(:controller_permitted?).with("c1").and_return(false)
+          allow(subject).to receive(:controller_permitted?).with("c2").and_return(true)
+          expect(subject).to_not receive(:controller_permitted?).with("c3")
+          expect(subject.menu_item_permitted?(group_item)).to be true
+        end
+      end
+
+      context "when none of group item controller is allowed" do
+        it "returns false" do
+          allow(subject).to receive(:controller_permitted?).with("c1").and_return(false)
+          allow(subject).to receive(:controller_permitted?).with("c2").and_return(false)
+          allow(subject).to receive(:controller_permitted?).with("c3").and_return(false)
+          expect(subject.menu_item_permitted?(group_item)).to be false
+        end
+      end
+    end
+
+    context "when item is instance of `Releaf::ControllerDefinition`" do
+      context "when item controller is allowed" do
+        it "returns true" do
+          allow(subject).to receive(:controller_permitted?).with("_controller_").and_return(true)
+          expect(subject.menu_item_permitted?(controller_item)).to be true
+        end
+      end
+
+      context "when item controller is not allowed" do
+        it "returns false" do
+          allow(subject).to receive(:controller_permitted?).with("_controller_").and_return(false)
+          expect(subject.menu_item_permitted?(controller_item)).to be false
+        end
+      end
+    end
+  end
+
+  describe "#controller_permitted?" do
+    it "returns access controller controller permission query result for given controller name" do
+      user = Releaf::Permissions::User.new
+      allow(controller).to receive(:user).and_return("x")
+      access_control = Releaf::Permissions::AccessControl.new(user: user)
+      allow(Releaf.application.config.permissions.access_control).to receive(:new).with(user: "x").and_return(access_control)
+      allow(access_control).to receive(:controller_permitted?).with("kjasdasd").and_return("_true")
+
+      expect(subject.controller_permitted?("kjasdasd")).to eq("_true")
+    end
+  end
+end