rocketjob_mission_control 3.1.0 → 3.2.0

data/app/datatables/rocket_job_mission_control/servers_datatable.rb

@@ -42,7 +42,21 @@ module RocketJobMissionControl
 
     def action_links_html(server)
       actions = '<div class="actions">'
-      if server.stopping?
+      events  = valid_events(server)
+
+      if events.include?(:resume) && view.can?(:resume, server)
+        actions += "#{ link_to "resume", resume_server_path(server), method: :patch, class: 'btn btn-default', data: {confirm: "Resume this server?"}  }"
+      end
+
+      if events.include?(:pause) && view.can?(:pause, server)
+        actions += "#{ link_to "pause", pause_server_path(server), method: :patch, class: 'btn btn-default', data: {confirm: "Pause this server?"} }"
+      end
+
+      if events.include?(:stop) && view.can?(:stop, server)
+        actions += "#{ link_to "stop", stop_server_path(server), method: :patch, class: 'btn btn-danger', data: {confirm: "Stop this server?"} }"
+      end
+
+      if server.stopping? && view.can?(:destroy, server)
         actions      += "Server is stopping..."
         confirmation = ''
         unless server.zombie?
@@ -50,16 +64,14 @@ module RocketJobMissionControl
         end
         confirmation << "Are you sure you want to destroy #{server.name} ?"
         actions += "#{ link_to "destroy", server_path(server), method: :delete, class: 'btn btn-danger', data: {confirm: confirmation}  }"
-      else
-        if server.paused?
-          actions += "#{ link_to "resume", resume_server_path(server), method: :patch, class: 'btn btn-default', data: {confirm: "Resume this server?"}  }"
-        else
-          actions += "#{ link_to "pause", pause_server_path(server), method: :patch, class: 'btn btn-default', data: {confirm: "Pause this server?"} }"
-        end
-        actions += "#{ link_to "stop", stop_server_path(server), method: :patch, class: 'btn btn-danger', data: {confirm: "Stop this server?"} }"
       end
+
       actions += '</div>'
     end
 
+    def valid_events(server)
+      server.aasm.events.collect(&:name)
+    end
+
   end
 end

data/app/models/rocket_job_mission_control/access_policy.rb

@@ -0,0 +1,50 @@
+module RocketJobMissionControl
+  class AccessPolicy
+    include AccessGranted::Policy
+
+    def configure
+      # Destroy Jobs, Dirmon Entries
+      role :admin, {admin: true} do
+        can %i[create destroy], RocketJob::Job
+        can :destroy, RocketJob::DirmonEntry
+      end
+
+      # View the contents of jobs and edit the data within them.
+      # Including encrypted records.
+      role :editor, {editor: true} do
+        can %i[read_records update_records], RocketJob::Job
+      end
+
+      # Stop, Pause, Resume, Destroy (force stop) Rocket Job Servers
+      role :operator, {operator: true} do
+        can %i[stop pause resume destroy update_all], RocketJob::Server
+      end
+
+      # Pause, Resume, Retry, Abort, Edit Jobs
+      role :manager, {manager: true} do
+        can %i[edit pause resume retry abort fail update run_now], RocketJob::Job
+      end
+
+      # Create, Destroy, Enable, Disable, Edit Dirmon Entries
+      role :dirmon, {dirmon: true} do
+        can %i[create enable disable update edit], RocketJob::DirmonEntry
+      end
+
+      # A User can only edit their own jobs
+      role :user, {user: true} do
+        can %i[edit pause resume retry abort update], RocketJob::Job do |job, auth|
+          job.respond_to?(:login) && (job.login == auth.login)
+        end
+      end
+
+      # Read only access
+      role :view do
+        can :read, RocketJob::Job
+        can :read, RocketJob::DirmonEntry
+        can :read, RocketJob::Server
+        can :read, RocketJob::Worker
+      end
+    end
+  end
+end
+

data/app/models/rocket_job_mission_control/authorization.rb

@@ -0,0 +1,22 @@
+module RocketJobMissionControl
+  class Authorization
+    ROLES = %i[admin editor operator manager dirmon user view]
+    attr_accessor *ROLES
+    attr_accessor :login
+
+    def initialize(roles: [], login: nil)
+      @login = login
+      return if roles.blank?
+      invalid_roles = roles - ROLES
+      raise(ArgumentError, "Invalid Roles Supplied: #{invalid_roles.inspect}") unless invalid_roles.empty?
+
+      roles.each { |r| inherit_less_privilege_roles(r) }
+    end
+
+    def inherit_less_privilege_roles(role)
+      index = ROLES.index(role)
+      roles = ROLES[index..-1]
+      roles.each { |role| public_send("#{role}=", true) }
+    end
+  end
+end

data/app/views/rocket_job_mission_control/dirmon_entries/_sidebar.html.erb

@@ -1,7 +1,10 @@
 <ul class='nav hidden-xs' id='lg-menu'>
   <li>
-    <%= link_to(new_dirmon_entry_path) do %>
-      <i class='fas fa-plus'></i> Create
+
+    <% if can?(:create, RocketJob::DirmonEntry) %>
+      <%= link_to(new_dirmon_entry_path) do %>
+        <i class='fas fa-plus'></i> Create
+      <% end %>
     <% end %>
 
     <%= link_to(dirmon_entries_path) do %>

data/app/views/rocket_job_mission_control/dirmon_entries/show.html.erb

@@ -9,21 +9,27 @@
 
     <div class='btn-toolbar job-actions pull-right'>
       <div class='btn-group'>
-        <% if @dirmon_entry.disabled? || @dirmon_entry.pending? %>
+        <% if @dirmon_entry.disabled? || @dirmon_entry.pending? && can?(:enable, @dirmon_entry) %>
           <%= link_to 'Enable', enable_dirmon_entry_path(@dirmon_entry.id), method: :put, class: 'btn btn-default' %>
         <% end %>
 
-        <% if @dirmon_entry.enabled? %>
+        <% if @dirmon_entry.enabled? && can?(:disable, @dirmon_entry)%>
           <%= link_to 'Disable', disable_dirmon_entry_path(@dirmon_entry.id), method: :put, class: 'btn btn-default', data: { confirm: 'Are you sure?' } %>
         <% end %>
       </div>
 
+
       <div class='btn-group'>
+        <% if can?(:destroy, @dirmon_entry)%>
         <%= link_to 'Destroy', dirmon_entry_path(@dirmon_entry), method: :delete, class: 'btn btn-default', data: { confirm: 'Are you sure?' } %>
+        <% end %>
       </div>
 
+
       <div class='btn-group'>
+        <% if can?(:edit, @dirmon_entry)%>
         <%= link_to 'Edit', edit_dirmon_entry_path(@dirmon_entry), class: 'btn btn-default' %>
+        <% end %>
       </div>
     </div>
 

data/app/views/rocket_job_mission_control/jobs/show.html.erb

@@ -31,34 +31,38 @@
         <div class='btn-group'>
           <% valid_events = @job.aasm.events.collect { |e| e.name } %>
 
-          <% if valid_events.include?(:pause) %>
+          <% if valid_events.include?(:pause) && can?(:pause, @job)%>
             <%= job_action_link('Pause', rocket_job_mission_control.pause_job_path(@job), :patch) %>
           <% end %>
 
-          <% if valid_events.include?(:resume) %>
+          <% if valid_events.include?(:resume) && can?(:resume, @job)%>
             <%= job_action_link('Resume', rocket_job_mission_control.resume_job_path(@job), :patch) %>
           <% end %>
 
-          <% if valid_events.include?(:retry) %>
+          <% if valid_events.include?(:retry) && can?(:retry, @job)%>
             <%= job_action_link('Retry', rocket_job_mission_control.retry_job_path(@job), :patch) %>
           <% end %>
         </div>
 
         <div class='btn-group'>
-          <% if valid_events.include?(:fail) %>
+          <% if valid_events.include?(:fail) && can?(:fail, @job)%>
             <%= job_action_link('Fail', rocket_job_mission_control.fail_job_path(@job), :patch) %>
           <% end %>
 
-          <% if valid_events.include?(:abort) %>
+          <% if valid_events.include?(:abort) && can?(:abort, @job) %>
             <%= job_action_link('Abort', rocket_job_mission_control.abort_job_path(@job), :patch) %>
           <% end %>
 
+          <% if can?(:destroy, @job)%>
           <%= job_action_link('Destroy', rocket_job_mission_control.job_path(@job), :delete) %>
+          <% end %>
         </div>
 
         <% unless @job.completed? || @job.aborted? %>
           <div class='btn-group'>
+            <% if can?(:edit, @job)%>
             <%= link_to 'Edit', edit_job_path(@job), class: 'btn btn-default' %>
+            <% end %>
           </div>
         <% end %>
       </div>

data/app/views/rocket_job_mission_control/servers/index.html.erb

@@ -11,14 +11,16 @@
             <div class='server-collection-actions'>
               <ol>
                 <div class='btn-group'>
-                  <% Array(@actions).each do |action| %>
-                    <%= link_to(
-                      "#{action.to_s.humanize.capitalize}",
-                      rocket_job_mission_control.update_all_servers_path(server_action: action),
-                      method: :patch,
-                      data: { confirm: t(:confirm, scope: [:server, :update_all], action: action.to_s.singularize.humanize.downcase) },
-                      class: 'btn btn-default'
-                    )%>
+                  <% if can?(:create, RocketJob::DirmonEntry) %>
+                    <% Array(@actions).each do |action| %>
+                      <%= link_to(
+                              "#{action.to_s.humanize.capitalize}",
+                              rocket_job_mission_control.update_all_servers_path(server_action: action),
+                              method: :patch,
+                              data:   {confirm: t(:confirm, scope: [:server, :update_all], action: action.to_s.singularize.humanize.downcase)},
+                              class:  'btn btn-default'
+                          ) %>
+                    <% end %>
                   <% end %>
                 </div>
               </ol>

data/lib/rocket_job_mission_control/engine.rb

@@ -1,4 +1,10 @@
 module RocketJobMissionControl
+
+  # The authorization callback
+  module Config
+    mattr_accessor :authorization_callback
+  end
+
   class Engine < ::Rails::Engine
     isolate_namespace RocketJobMissionControl
 
@@ -7,11 +13,14 @@ module RocketJobMissionControl
     require 'bootstrap-sass'
     require 'sass-rails'
     require 'jquery-datatables-rails'
+    require 'access-granted'
     begin
       require 'rocketjob_pro'
     rescue LoadError
     end
 
+    config.rocket_job_mission_control = ::RocketJobMissionControl::Config
+
     config.to_prepare do
       Rails.application.config.assets.precompile += %w(
         rocket_job_mission_control/rocket-icon-64x64.png

data/lib/rocket_job_mission_control/version.rb

@@ -1,3 +1,3 @@
 module RocketJobMissionControl
-  VERSION = '3.1.0'
+  VERSION = '3.2.0'
 end

data/test/controllers/rocket_job_mission_control/dirmon_entries_controller_test.rb

@@ -5,6 +5,7 @@ module RocketJobMissionControl
   class DirmonEntriesControllerTest < ActionController::TestCase
     describe DirmonEntriesController do
       before do
+        set_role(:admin)
         RocketJob::DirmonEntry.delete_all
       end
 
@@ -188,7 +189,11 @@ module RocketJobMissionControl
           end
 
           it 'alerts the user' do
-            assert_select 'div.message', "job_class_name: [\"job_class_name must be defined and must be derived from RocketJob::Job\"]"
+            if RocketJob::VERSION.to_f >= 3.5
+              assert_select 'div.message', "job_class_name: [\"Job FakeAndBadJob must be defined and inherit from RocketJob::Job\"]"
+            else
+              assert_select 'div.message', "job_class_name: [\"job_class_name must be defined and must be derived from RocketJob::Job\"]"
+            end
           end
         end
       end
@@ -436,6 +441,78 @@ module RocketJobMissionControl
           end
         end
       end
+
+      describe 'role base authentication control' do
+        let(:dirmon_params) do
+          {
+            name:           'Test',
+            pattern:        '/files/*',
+            job_class_name: job_class_name,
+            properties:     {description: '', priority: '42'}
+          }
+        end
+
+        %i[index disabled enabled failed pending].each do |method|
+          it "#{method} has read only default access" do
+            get method, format: :json
+            assert_response :success
+          end
+        end
+
+        # PATCH
+        %i[enable disable update].each do |method|
+          describe method.to_s do
+            %i[admin editor operator manager dirmon].each do |role|
+              it "allows role #{role} to access #{method}" do
+                set_role(role)
+                params = {id: existing_dirmon_entry.id}
+                params = {params: params} if Rails.version.to_i >= 5
+                patch :enable, params
+
+                assert_response(:redirect)
+              end
+            end
+          end
+        end
+
+        # POST
+        %i[admin editor operator manager dirmon].each do |role|
+          it 'creates dirmon entry' do
+            set_role(role)
+            params = {rocket_job_dirmon_entry: dirmon_params}
+            params = {params: params} if Rails.version.to_i >= 5
+            post :create, params
+
+            assert_response(:redirect)
+          end
+        end
+
+        it 'deletes dirmon entry' do
+          set_role(:admin)
+          params = {id: existing_dirmon_entry.id}
+          params = {params: params} if Rails.version.to_i >= 5
+          delete :destroy, params
+
+          assert_response(:redirect)
+        end
+
+        %i[editor operator manager dirmon].each do |role|
+          it "raises authentication error for #{role}" do
+            set_role(role)
+            assert_raises AccessGranted::AccessDenied do
+              params = {id: existing_dirmon_entry.id}
+              params = {params: params} if Rails.version.to_i >= 5
+              delete :destroy, params
+            end
+          end
+        end
+      end
+    end
+
+    def set_role(r)
+      Config.authorization_callback = -> do
+        {roles: [r]}
+      end
     end
   end
 end

data/test/controllers/rocket_job_mission_control/jobs_controller_test.rb

@@ -14,6 +14,7 @@ module RocketJobMissionControl
 
     describe JobsController do
       before do
+        set_role(:admin)
         RocketJob::Job.delete_all
       end
 
@@ -52,7 +53,7 @@ module RocketJobMissionControl
 
       let :one_job_for_every_state do
         job_states.collect do |state|
-          RocketJob::Jobs::SimpleJob.create!(state: state, worker_name: 'worker')
+          RocketJob::Jobs::SimpleJob.create!(state: state, worker_name: 'worker', started_at: (Time.now - 0.5))
         end
       end
 
@@ -315,6 +316,7 @@ module RocketJobMissionControl
 
             describe "with #{state} server" do
               before do
+                set_role(:admin)
                 one_job_for_every_state
                 get state, format: :json
               end
@@ -393,6 +395,55 @@ module RocketJobMissionControl
         end
       end
 
+      describe 'role base authentication control' do
+        %i[index aborted completed failed paused queued running scheduled].each do |method|
+          it "#{method} has read access as default" do
+            get method, format: :json
+            assert_response :success
+          end
+        end
+
+        %i[update abort retry pause resume run_now fail].each do |method|
+          describe "#{method}" do
+            before do
+              case method
+                when :pause, :fail, :abort
+                  pausable_job.start!
+                when :resume
+                  pausable_job.pause!
+                when :retry, :exception
+                  pausable_job.fail!
+              end
+
+              @params = {id: pausable_job.id, job: {id: pausable_job.id, priority: pausable_job.priority}}
+              @params = {params: @params} if Rails.version.to_i >= 5
+            end
+
+            %i[admin editor operator manager].each do |role|
+              it "redirects with #{method} method and role #{role}" do
+                set_role(role)
+                patch method, @params
+                assert_response(:redirect)
+              end
+            end
+
+            %i[dirmon user].each do |role|
+              it "raises authentication error for #{role}" do
+                set_role(role)
+                assert_raises AccessGranted::AccessDenied do
+                  patch method, @params
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+
+    def set_role(r)
+      Config.authorization_callback = -> do
+        {roles: [r]}
+      end
     end
   end
 end