rolypoly 0.1.2 → 0.2.0

checksums.yaml

@@ -1,15 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    NmU4ZmFmOTUwZjg3YTliMmZjMGJjZGVjZmJmOGQxYTY2NTk2YmU0ZA==
-  data.tar.gz: !binary |-
-    ZjA1MmZkZmJhM2Q2NDAzZTdhNWI0YjQ5NzM3NjI2Y2MwYTQ5MDc4Yw==
+SHA1:
+  metadata.gz: 8cbaff5553d1ea031bdb189ab537a9ff7c72aadd
+  data.tar.gz: 332873a3a06a886b821e12a0977ae9da8a13a781
 SHA512:
-  metadata.gz: !binary |-
-    YjVjNjhiMWJjZmI2MzA2OGQ2YjRhNDVkYmQ2ZTE3ODVkMGFkNDFiNTFhMGIw
-    NDNiMmJiMjFiZGQwOGM2MjgyOTlkNWJlOGYwNWMwMTlkMTY4NTdhN2YwOTdk
-    YzJlZjQ5N2RjZjliNjE2M2JhNTVmNGRiMjE1MTUzNmFiMzYyMjM=
-  data.tar.gz: !binary |-
-    YTlhNWY1MzhjNDEzZDE5OTFmNWRiNzViZTY0NTM5OGQwNzI4YjIxYzc2NDNi
-    N2Q4MjFiYTBlNjY2MTNkYWYyZTJlOTlhOGIxZTMwMmJmZDcxNjU3ODY1ZGY0
-    ZGJjY2FlZDZjMTZmYzcxNTI4YmY4NWVjNGFlZjUzMGZkZWUzYWU=
+  metadata.gz: 1e25dbecd6ba8902d65f210a800179c6e63908bd24daf6f77775c314ea22d9e3418abfbffc06c08f496157bcb1b7462faf30d73fef054844481026851496b0d5
+  data.tar.gz: f76e7eebd9c64d69e4bc098a2730304dab04922dbe0e3206a77227ca4d0e1b3bc9ac838e8f3e4313393b17d972d3823566b840bbf72fdccb85d6d12c1c6c4f7e

data/.ruby-version

@@ -1 +1 @@
-ruby-1.9.3-p448
+2.2.0

data/README.md

@@ -93,6 +93,49 @@ class ProfilesController < ApplicationController
 end
 ```
 
+# Allow roles with a resource
+`allow_with_resource` acts similarly to `allow` but executes a resource check on the `SomeCustomerRoleObject` to access the endpoint.
+
+This requires a method to be defined on `SomeCustomRoleObject` that checks if the resource is valid for that role.
+
+The `role_resource` needs to be defined on the controller to pass the resource that the role will be validated against.
+If `role_resource` is not defined it will be defaulted to an empty hash `{}`.
+
+
+```ruby
+class SomeCustomRoleObject
+  def resource?(resource)
+    self.resources.includes?(resource)
+  end
+end
+
+class ProfilesController < ApplicationController
+  allow_with_resource(:admin).to_access(:index)
+  allow_with_resource(:owner).to_access(:edit)
+  publicize(:show)
+
+  def index
+    current_roles # => [#<SomeCustomRoleObject to_role_string: "admin", resource?: true >]
+  end
+
+  def edit # Raises permission error before entering this
+    current_roles # => []
+  end
+
+  def show
+    current_roles # => []
+  end
+
+  private def current_user_roles
+    current_user.roles # => [#<SomeCustomRoleObject to_role_string: "admin", resource?: true>, #<SomeCustomRoleObject to_role_string: "scorekeeper", resource?: false>]
+  end
+
+  private def role_resource
+    { resource: params[:resource_id] }
+  end
+end
+```
+
 ## Contributing
 
 1. Fork it

data/lib/rolypoly/controller_role_dsl.rb

@@ -17,6 +17,10 @@ module Rolypoly
       unless sub.method_defined? :current_user_roles
         define_method(:current_user_roles) { [] }
       end
+
+      unless sub.method_defined? :role_resource
+        define_method(:role_resource) { {} }
+      end
       sub.send :extend, ClassMethods
     end
 
@@ -31,8 +35,8 @@ module Rolypoly
     def current_roles
       return [] if rolypoly_gatekeepers.empty?
       current_gatekeepers.reduce([]) { |array, gatekeeper|
-        if gatekeeper.role? current_user_roles
-          array += Array(gatekeeper.allowed_roles(current_user_roles, action_name))
+        if gatekeeper.role?(current_user_roles, role_resource)
+          array += Array(gatekeeper.allowed_roles(current_user_roles, action_name, role_resource))
         end
         array
       }
@@ -52,7 +56,7 @@ module Rolypoly
     def rolypoly_role_access?
       rolypoly_gatekeepers.empty? ||
         rolypoly_gatekeepers.any? { |gatekeeper|
-          gatekeeper.allow? current_roles, action_name
+          gatekeeper.allow?(current_roles, action_name, role_resource)
         }
     end
     private :rolypoly_role_access?
@@ -75,6 +79,10 @@ module Rolypoly
         build_gatekeeper roles, nil
       end
 
+      def allow_with_resource(*roles)
+        build_gatekeeper roles, nil, true
+      end
+
       def publicize(*actions)
         restrict(*actions).to_none
       end
@@ -90,8 +98,8 @@ module Rolypoly
         end
       end
 
-      def build_gatekeeper(roles, actions)
-        RoleGatekeeper.new(roles, actions).tap { |gatekeeper|
+      def build_gatekeeper(roles, actions, require_resource = false)
+        RoleGatekeeper.new(roles, actions, require_resource).tap { |gatekeeper|
           rolypoly_gatekeepers << gatekeeper
         }
       end

data/lib/rolypoly/role_gatekeeper.rb

@@ -2,9 +2,10 @@ require 'set'
 module Rolypoly
   class RoleGatekeeper
     attr_reader :roles
-    def initialize(roles, actions)
+    def initialize(roles, actions, require_resource)
       self.roles = Set.new Array(roles).map(&:to_s)
       self.actions = Set.new Array(actions).map(&:to_s)
+      self.require_resource = require_resource
       self.all_actions = false
       self.public = false
     end
@@ -31,14 +32,14 @@ module Rolypoly
       self.all_actions = true
     end
 
-    def allow?(current_roles, action)
+    def allow?(current_roles, action, resource)
       action?(action) &&
-        role?(current_roles)
+        role?(current_roles, resource)
     end
 
-    def allowed_roles(current_roles, action)
+    def allowed_roles(current_roles, action, resource)
       return [] if public? || !action?(action)
-      match_roles(current_roles)
+      match_roles(current_roles, resource)
     end
 
     def all_public
@@ -46,7 +47,8 @@ module Rolypoly
       self.all_actions = true
     end
 
-    def role?(check_roles)
+    def role?(check_roles, resource)
+      check_roles = filter_roles_by_resource(check_roles, resource)
       check_roles = Set.new sanitize_role_input(check_roles)
       public? || !(check_roles & roles).empty?
     end
@@ -65,8 +67,10 @@ module Rolypoly
     attr_accessor :actions
     attr_accessor :all_actions
     attr_accessor :public
+    attr_accessor :require_resource
 
-    def match_roles(check_roles)
+    def match_roles(check_roles, resource)
+      check_roles = filter_roles_by_resource(check_roles, resource)
       check_roles.reduce([]) { |array, role_object|
         array << role_object if roles.include?(sanitize_role_object(role_object))
         array
@@ -74,6 +78,14 @@ module Rolypoly
     end
     private :match_roles
 
+    def filter_roles_by_resource(check_roles, resource)
+      return check_roles if check_roles.nil? || !require_resource
+      check_roles.select do |check_role|
+        check_role.respond_to?(:resource?) && check_role.resource?(resource)
+      end
+    end
+    private :filter_roles_by_resource
+
     def sanitize_role_input(role_objects)
       Array(role_objects).map { |r| sanitize_role_object(r) }
     end

data/lib/rolypoly/version.rb

@@ -1,3 +1,3 @@
 module Rolypoly
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

data/rolypoly.gemspec

@@ -6,8 +6,8 @@ require 'rolypoly/version'
 Gem::Specification.new do |spec|
   spec.name          = "rolypoly"
   spec.version       = Rolypoly::VERSION
-  spec.authors       = ["Jon Phenow"]
-  spec.email         = ["j.phenow@gmail.com"]
+  spec.authors       = ["Jon Phenow", "Jake Waletzko"]
+  spec.email         = ["j.phenow@gmail.com", "jnwaletzko@gmail.com"]
   spec.description   = %q{Tools for handling per-action and per-app Role authorization}
   spec.summary       = %q{Tools for handling per-action and per-app Role authorization}
   spec.homepage      = "https://github.com/sportngin/rolypoly"
@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 1.3"
+  spec.add_development_dependency "bundler", "~> 1.8"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rspec"
 end

data/spec/lib/rolypoly/controller_role_dsl_spec.rb

@@ -15,6 +15,7 @@ module Rolypoly
     subject { example_controller }
     it { should respond_to :restrict }
     it { should respond_to :allow }
+    it { should respond_to :allow_with_resource }
 
     describe "setting up with DSL" do
       describe "from allow side" do
@@ -23,14 +24,15 @@ module Rolypoly
         before do
           subject.allow(:admin).to_access(:index)
           subject.publicize(:landing)
-          controller_instance.stub current_user_roles: current_user_roles, action_name: action_name
+          allow(controller_instance).to receive(:current_user_roles).and_return(current_user_roles)
+          allow(controller_instance).to receive(:action_name).and_return(action_name)
         end
 
         describe "#index" do
           let(:action_name) { "index" }
 
           it "is not public" do
-            controller_instance.should_not be_public
+            expect(controller_instance).to_not be_public
           end
 
           it "allows admin access" do
@@ -39,7 +41,7 @@ module Rolypoly
           end
 
           it "can get current_roles from controller" do
-            controller_instance.current_roles.should == [RoleObject.new(:admin)]
+            expect(controller_instance.current_roles).to eq([RoleObject.new(:admin)])
           end
         end
 
@@ -51,7 +53,7 @@ module Rolypoly
           end
 
           it "is not public" do
-            controller_instance.should_not be_public
+            expect(controller_instance).to_not be_public
           end
         end
 
@@ -70,11 +72,57 @@ module Rolypoly
             end
 
             it "is public" do
-              controller_instance.should be_public
+              expect(controller_instance).to be_public
             end
           end
         end
       end
+
+      describe "from allow_with_resource side" do
+        let(:controller_instance) { subject.new }
+        let(:admin_role) { RoleObject.new(:admin) }
+        let(:scorekeeper_role) { RoleObject.new(:scorekeeper) }
+        let(:current_user_roles) { [admin_role, scorekeeper_role] }
+        let(:role_resource) { {resource: 123} }
+        let(:check_access!) { controller_instance.rolypoly_check_role_access! }
+
+        before do
+          subject.allow_with_resource(:admin).to_access(:index)
+          subject.publicize(:landing)
+          allow(admin_role).to receive(:resource?).and_return true
+          allow(controller_instance).to receive(:current_user_roles).and_return(current_user_roles)
+          allow(controller_instance).to receive(:action_name).and_return(action_name)
+          allow(controller_instance).to receive(:role_resource).and_return(role_resource)
+        end
+
+        describe "#index" do
+          let(:action_name) { "index" }
+
+          it { expect(controller_instance).to_not be_public }
+          it { expect{ check_access! }.not_to raise_error }
+          it { expect(controller_instance.current_roles).to eq([RoleObject.new(:admin)])}
+        end
+
+        describe "#show" do
+          let(:action_name) { "show" }
+
+          it { expect{ check_access! }.to raise_error(Rolypoly::FailedRoleCheckError)}
+          it { expect(controller_instance).to_not be_public }
+        end
+
+        describe "#landing" do
+          let(:action_name) { "landing" }
+
+          it { expect{ check_access! }.not_to raise_error }
+
+          describe "with no role" do
+            let(:current_roles) { [] }
+
+            it { expect { check_access! }.not_to raise_error }
+            it { expect(controller_instance).to be_public }
+          end
+        end
+      end
     end
   end
 end

data/spec/lib/rolypoly/role_gatekeeper_spec.rb

@@ -4,102 +4,144 @@ module Rolypoly
   describe RoleGatekeeper do
     let(:roles) { %w[admin scorekeeper] }
     let(:actions) { %w[index show] }
+    let(:resource) { {} }
 
-    subject { described_class.new roles, actions }
+    context "resource not required" do
+      subject { described_class.new roles, actions, false }
 
-    shared_examples_for "allow should behave correctly" do
-      it "shouldn't auto-allow" do
-        subject.allow?(nil, nil).should be_false
-      end
-
-      it "should allow scorekeepr access to index" do
-        subject.allow?([:scorekeeper], "index").should be_true
-      end
-
-      it "should not allow scorekeepr access to edit" do
-        subject.allow?([:scorekeeper], "edit").should be_false
-      end
-
-      describe "all public" do
-        before do
-          subject.all_public
-        end
-
-        it "should allow whatever" do
-          subject.allow?(nil, nil).should be_true
+      shared_examples_for "allow should behave correctly" do
+        it "shouldn't auto-allow" do
+          expect(subject.allow?(nil, nil, resource)).to be false
         end
 
         it "should allow scorekeepr access to index" do
-          subject.allow?([:scorekeeper], "index").should be_true
+          expect(subject.allow?([:scorekeeper], "index", resource)).to be true
         end
 
-        it "should allow scorekeepr access to edit" do
-          subject.allow?([:scorekeeper], "edit").should be_true
+        it "should not allow scorekeepr access to edit" do
+          expect(subject.allow?([:scorekeeper], "edit", resource)).to be false
         end
-      end
 
-      describe "all roles" do
-        before do
-          subject.to_none
-        end
+        describe "all public" do
+          before do
+            subject.all_public
+          end
 
-        it "shouldn't auto-allow" do
-          subject.allow?(nil, nil).should be_false
+          it "should allow whatever" do
+            expect(subject.allow?(nil, nil, resource)).to be true
+          end
+
+          it "should allow scorekeepr access to index" do
+            expect(subject.allow?([:scorekeeper], "index", resource)).to be true
+          end
+
+          it "should allow scorekeepr access to edit" do
+            expect(subject.allow?([:scorekeeper], "edit", resource)).to be true
+          end
         end
 
-        it "should allow scorekeepr access to index" do
-          subject.allow?([:janitor], "index").should be_true
-          subject.allow?([:admin], "index").should be_true
+        describe "all roles" do
+          before do
+            subject.to_none
+          end
+
+          it "shouldn't auto-allow" do
+            expect(subject.allow?(nil, nil, resource)).to be false
+          end
+
+          it "should allow scorekeepr access to index" do
+            expect(subject.allow?([:janitor], "index", resource)).to be true
+            expect(subject.allow?([:admin], "index", resource)).to be true
+          end
+
+          it "to should not allow scorekeepr access to edit" do
+            expect(subject.allow?([:scorekeeper], "edit", resource)).to be false
+            expect(subject.allow?([:janitor], "edit", resource)).to be false
+          end
         end
 
-        it "should not allow scorekeepr access to edit" do
-          subject.allow?([:scorekeeper], "edit").should be_false
-          subject.allow?([:janitor], "edit").should be_false
+        describe "all actions" do
+          before do
+            subject.to_all
+          end
+
+          it "shouldn't auto-allow" do
+            expect(subject.allow?(nil, nil, resource)).to be false
+          end
+
+          it "should allow scorekeepr access to index" do
+            expect(subject.allow?([:scorekeeper], "index", resource)).to be true
+          end
+
+          it "shouldn't allow janitor access to any" do
+            expect(subject.allow?([:janitor], "index", resource)).to be false
+          end
+
+          it "should allow scorekeepr access to edit" do
+            expect(subject.allow?([:scorekeeper], "edit", resource)).to be true
+          end
         end
       end
+      it_should_behave_like "allow should behave correctly"
+
+      describe "with only roles set" do
+        let(:actions) { [] }
 
-      describe "all actions" do
         before do
-          subject.to_all
+          subject.to_access(:index, :show)
         end
 
-        it "shouldn't auto-allow" do
-          subject.allow?(nil, nil).should be_false
-        end
+        it_should_behave_like "allow should behave correctly"
+      end
 
-        it "should allow scorekeepr access to index" do
-          subject.allow?([:scorekeeper], "index").should be_true
-        end
+      describe "with only actions set" do
+        let(:roles) { [] }
 
-        it "shouldn't allow janitor access to any" do
-          subject.allow?([:janitor], "index").should be_false
+        before do
+          subject.to(:admin, :scorekeeper)
         end
 
-        it "should allow scorekeepr access to edit" do
-          subject.allow?([:scorekeeper], "edit").should be_true
+        it_should_behave_like "allow should behave correctly"
+      end
+
+      describe "with resource defined" do
+        let(:resource) { [organization: 123] }
+
+        before do
+          subject.to(:admin, :scorekeeper)
         end
+
+        it_should_behave_like "allow should behave correctly"
       end
     end
-    it_should_behave_like "allow should behave correctly"
 
-    describe "with only roles set" do
-      let(:actions) { [] }
+    context "resource required" do
+      let(:scorekeeper_role) { RoleObject.new(:scorekeeper) }
+
+      subject { described_class.new roles, actions, true }
+
+      describe "resource does not match" do
+        before do
+          allow(scorekeeper_role).to receive(:resource?).and_return false
+          allow(scorekeeper_role).to receive(:to_role_string).and_return "scorekeeper"
+        end 
 
-      before do
-        subject.to_access(:index, :show)
+        it { expect(subject.allow?(nil, nil, resource)).to be false }
+        it { expect(subject.allow?([scorekeeper_role], "index", resource)).to be false }
+        it { expect(subject.allow?([scorekeeper_role], "edit", resource)).to be false }
       end
 
-      it_should_behave_like "allow should behave correctly"
-    end
+      describe "resource matches" do
+        let(:resource) { {resource: 123} }
 
-    describe "with only actions set" do
-      let(:roles) { [] }
+        before do
+          allow(scorekeeper_role).to receive(:resource?).and_return true
+        end
 
-      before do
-        subject.to(:admin, :scorekeeper)
+        it { expect(subject.allow?(nil, nil, resource)).to be false }
+        it { expect(subject.allow?([scorekeeper_role], "index", resource)).to be true }
+        it { expect(subject.allow?([scorekeeper_role], "edit", resource)).to be false }
       end
-
-      it_should_behave_like "allow should behave correctly"
     end
   end
 end

data/spec/spec_helper.rb

@@ -6,7 +6,6 @@
 # See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
 require 'rolypoly'
 RSpec.configure do |config|
-  config.treat_symbols_as_metadata_keys_with_true_values = true
   config.run_all_when_everything_filtered = true
   config.filter_run :focus
 

metadata

@@ -1,68 +1,70 @@
 --- !ruby/object:Gem::Specification
 name: rolypoly
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Jon Phenow
+- Jake Waletzko
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-12-02 00:00:00.000000000 Z
+date: 2016-12-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.8'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ! '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: Tools for handling per-action and per-app Role authorization
 email:
 - j.phenow@gmail.com
+- jnwaletzko@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .rspec
-- .ruby-gemset
-- .ruby-version
+- ".gitignore"
+- ".rspec"
+- ".ruby-gemset"
+- ".ruby-version"
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -85,17 +87,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ! '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.11
+rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
 summary: Tools for handling per-action and per-app Role authorization