stffn-declarative_authorization 0.3.0 → 0.3.1

data/lib/declarative_authorization/development_support/development_support.rb

@@ -0,0 +1,243 @@
+
+module Authorization
+  module DevelopmentSupport
+    class AbstractAnalyzer
+      attr_reader :engine
+
+      def initialize (engine)
+        @engine = engine
+      end
+
+      def roles
+        AnalyzerEngine.roles(engine)
+      end
+
+      def rules
+        roles.collect {|role| role.rules }.flatten
+      end
+    end
+
+    # Groups utility methods and classes to better work with authorization object
+    # model.
+    module AnalyzerEngine
+
+      def self.roles (engine)
+        Role.all(engine)
+      end
+
+      def self.relevant_roles (engine, users)
+        users.collect {|user| user.role_symbols.map {|role_sym| Role.for_sym(role_sym, engine)}}.
+            flatten.uniq.collect {|role| [role] + role.ancestors}.flatten.uniq
+      end
+
+      def self.rule_for_permission (engine,  privilege, context, role)
+        AnalyzerEngine.roles(engine).
+              find {|cloned_role| cloned_role.to_sym == role.to_sym}.rules.find do |rule|
+            rule.contexts.include?(context) and rule.privileges.include?(privilege)
+          end
+      end
+
+      def self.apply_change (engine, change)
+        case change[0]
+        when :add_role
+          role_symbol = change[1]
+          if engine.roles.include?(role_symbol)
+            false
+          else
+            engine.roles << role_symbol
+            true
+          end
+        when :add_privilege
+          privilege, context, role = change[1,3]
+          role = Role.for_sym(role.to_sym, engine)
+          privilege = Privilege.for_sym(privilege.to_sym, engine)
+          if ([privilege] + privilege.ancestors).any? {|ancestor_privilege| ([role] + role.ancestors).any? {|ancestor_role| !ancestor_role.rules_for_permission(ancestor_privilege, context).empty?}}
+            false
+          else
+            engine.auth_rules << AuthorizationRule.new(role.to_sym,
+                [privilege.to_sym], [context])
+            true
+          end
+        when :remove_privilege
+          privilege, context, role = change[1,3]
+          role = Role.for_sym(role.to_sym, engine)
+          privilege = Privilege.for_sym(privilege.to_sym, engine)
+          rules_with_priv = role.rules_for_permission(privilege, context)
+          if rules_with_priv.empty?
+            false
+          else
+            rules_with_priv.each do |rule|
+              rule.rule.privileges.delete(privilege.to_sym)
+              engine.auth_rules.delete(rule.rule) if rule.rule.privileges.empty?
+            end
+            true
+          end
+        end
+      end
+
+      class Role
+        @@role_objects = {}
+        attr_reader :role
+        def initialize (role, rules, engine)
+          @role = role
+          @rules = rules
+          @engine = engine
+        end
+
+        def source_line
+          @rules.empty? ? nil : @rules.first.source_line
+        end
+        def source_file
+          @rules.empty? ? nil : @rules.first.source_file
+        end
+
+        # ancestors' privileges are included in in the current role
+        def ancestors (role_symbol = nil)
+          role_symbol ||= @role
+          (@engine.role_hierarchy[role_symbol] || []).
+              collect {|lower_role| ancestors(lower_role) }.flatten +
+            (role_symbol == @role ? [] : [Role.for_sym(role_symbol, @engine)])
+        end
+        def descendants (role_symbol = nil)
+          role_symbol ||= @role
+          (@engine.rev_role_hierarchy[role_symbol] || []).
+              collect {|higher_role| descendants(higher_role) }.flatten +
+            (role_symbol == @role ? [] : [Role.for_sym(role_symbol, @engine)])
+        end
+
+        def rules
+          @rules ||= @engine.auth_rules.select {|rule| rule.role == @role}.
+              collect {|rule| Rule.new(rule, @engine)}
+        end
+        def rules_for_permission (privilege, context)
+          rules.select do |rule|
+            rule.matches?([@role], [privilege.to_sym], context)
+          end
+        end
+
+        def to_sym
+          @role
+        end
+        def self.for_sym (role_sym, engine)
+          @@role_objects[[role_sym, engine]] ||= new(role_sym, nil, engine)
+        end
+
+        def self.all (engine)
+          rules_by_role = engine.auth_rules.inject({}) do |memo, rule|
+            memo[rule.role] ||= []
+            memo[rule.role] << rule
+            memo
+          end
+          engine.roles.collect do |role|
+            new(role, (rules_by_role[role] || []).
+                  collect {|rule| Rule.new(rule, engine)}, engine)
+          end
+        end
+        def self.all_for_privilege (privilege, context, engine)
+          privilege = privilege.is_a?(Symbol) ? Privilege.for_sym(privilege, engine) : privilege
+          privilege_symbols = ([privilege] + privilege.ancestors).map(&:to_sym)
+          all(engine).select {|role| role.rules.any? {|rule| rule.matches?([role.to_sym], privilege_symbols, context)}}.
+              collect {|role| [role] + role.descendants}.flatten.uniq
+        end
+      end
+
+      class Rule
+        @@rule_objects = {}
+        delegate :source_line, :source_file, :contexts, :matches?, :to => :@rule
+        attr_reader :rule
+        def initialize (rule, engine)
+          @rule = rule
+          @engine = engine
+        end
+        def privileges
+          PrivilegesSet.new(self, @engine, @rule.privileges.collect {|privilege| Privilege.for_sym(privilege, @engine) })
+        end
+        def self.for_rule (rule, engine)
+          @@rule_objects[[rule, engine]] ||= new(rule, engine)
+        end
+      end
+
+      class Privilege
+        @@privilege_objects = {}
+        def initialize (privilege, engine)
+          @privilege = privilege
+          @engine = engine
+        end
+
+        # Ancestor privileges are higher in the hierarchy.
+        # Doesn't take context into account.
+        def ancestors (priv_symbol = nil)
+          priv_symbol ||= @privilege
+          # context-specific?
+          (@engine.rev_priv_hierarchy[[priv_symbol, nil]] || []).
+              collect {|higher_priv| ancestors(higher_priv) }.flatten +
+            (priv_symbol == @privilege ? [] : [Privilege.for_sym(priv_symbol, @engine)])
+        end
+        def descendants (priv_symbol = nil)
+          priv_symbol ||= @privilege
+          # context-specific?
+          (@engine.privilege_hierarchy[priv_symbol] || []).
+              collect {|lower_priv, context| descendants(lower_priv) }.flatten +
+            (priv_symbol == @privilege ? [] : [Privilege.for_sym(priv_symbol, @engine)])
+        end
+
+        def rules
+          @rules ||= find_rules_for_privilege
+        end
+        def source_line
+          rules.empty? ? nil : rules.first.source_line
+        end
+        def source_file
+          rules.empty? ? nil : rules.first.source_file
+        end
+
+        def to_sym
+          @privilege
+        end
+        def self.for_sym (privilege_sym, engine)
+          @@privilege_objects[[privilege_sym, engine]] ||= new(privilege_sym, engine)
+        end
+
+        private
+        def find_rules_for_privilege
+          @engine.auth_rules.select {|rule| rule.privileges.include?(@privilege)}.
+              collect {|rule| Rule.for_rule(rule, @engine)}
+        end
+      end
+
+      class PrivilegesSet < Set
+        def initialize (*args)
+          if args.length > 2
+            @rule = args.shift
+            @engine = args.shift
+          end
+          super(*args)
+        end
+        def include? (privilege)
+          if privilege.is_a?(Symbol)
+            super(privilege_from_symbol(privilege))
+          else
+            super
+          end
+        end
+        def delete (privilege)
+          @rule.rule.privileges.delete(privilege.to_sym)
+          if privilege.is_a?(Symbol)
+            super(privilege_from_symbol(privilege))
+          else
+            super
+          end
+        end
+
+        def intersects? (privileges)
+          intersection(privileges).length > 0
+        end
+
+        private
+        def privilege_from_symbol (privilege_sym)
+          Privilege.for_sym(privilege_sym, @engine)
+        end
+      end
+    end
+  end
+end

data/lib/declarative_authorization/helper.rb

@@ -23,9 +23,13 @@ module Authorization
     #     <% for user in @users %>
     #     <%= link_to 'Edit', edit_user_path(user) if permitted_to? :update, user %>
     #     <% end %>
+    #
+    # To pass in an object and override the context, you can use the optional
+    # options:
+    #     permitted_to? :update, user, :context => :account
     # 
-    def permitted_to? (privilege, object_or_sym = nil, &block)
-      controller.permitted_to?(privilege, object_or_sym, &block)
+    def permitted_to? (privilege, object_or_sym = nil, options = {}, &block)
+      controller.permitted_to?(privilege, object_or_sym, options, &block)
     end
   
     # While permitted_to? is used for authorization in views, in some cases

data/lib/declarative_authorization/in_controller.rb

@@ -24,36 +24,38 @@ module Authorization
     # 
     # See examples for Authorization::AuthorizationHelper #permitted_to?
     #
-    def permitted_to? (privilege, object_or_sym = nil, &block)
-      context = object = nil
-      if object_or_sym.is_a?(Symbol)
-        context = object_or_sym
-      else
-        object = object_or_sym
-      end
-      # TODO infer context also from self.class.name
-      authorization_engine.permit?(privilege, 
-          {:user => current_user, 
-           :object => object,
-           :context => context,
-           :skip_attribute_test => object.nil?}, 
-          &block)
+    # If no object or context is specified, the controller_name is used as
+    # context.
+    #
+    def permitted_to? (privilege, object_or_sym = nil, options = {}, &block)
+      permitted_to!(privilege, object_or_sym, options.merge(:non_bang => true), &block)
     end
     
-    # Works similar to the permitted_to? method, but doesn't accept a block
-    # and throws the authorization exceptions, just like Engine#permit!
-    def permitted_to! (privilege, object_or_sym = nil)
+    # Works similar to the permitted_to? method, but
+    # throws the authorization exceptions, just like Engine#permit!
+    def permitted_to! (privilege, object_or_sym = nil, options = {}, &block)
       context = object = nil
-      if object_or_sym.is_a?(Symbol)
+      if object_or_sym.nil?
+        context = self.class.controller_name.to_sym
+      elsif object_or_sym.is_a?(Symbol)
         context = object_or_sym
       else
         object = object_or_sym
       end
-      authorization_engine.permit!(privilege, 
-          {:user => current_user, 
-           :object => object,
-           :context => context,
-           :skip_attribute_test => object.nil?})
+
+      non_bang = options.delete(:non_bang)
+      args = [
+        privilege,
+        {:user => current_user,
+         :object => object,
+         :context => context,
+         :skip_attribute_test => object.nil?}.merge(options)
+      ]
+      if non_bang
+        authorization_engine.permit?(*args, &block)
+      else
+        authorization_engine.permit!(*args, &block)
+      end
     end
 
     # While permitted_to? is used for authorization, in some cases
@@ -115,7 +117,36 @@ module Authorization
         end
       end
     end
-    
+
+    def load_controller_object (context) # :nodoc:
+      instance_var = :"@#{context.to_s.singularize}"
+      model = context.to_s.classify.constantize
+      instance_variable_set(instance_var, model.find(params[:id]))
+    end
+
+    def load_parent_controller_object (parent_context) # :nodoc:
+      instance_var = :"@#{parent_context.to_s.singularize}"
+      model = parent_context.to_s.classify.constantize
+      instance_variable_set(instance_var, model.find(params[:"#{parent_context.to_s.singularize}_id"]))
+    end
+
+    def new_controller_object_from_params (context, parent_context) # :nodoc:
+      model_or_proxy = parent_context ?
+           instance_variable_get(:"@#{parent_context.to_s.singularize}").send(context.to_sym) :
+           context.to_s.classify.constantize
+      instance_var = :"@#{context.to_s.singularize}"
+      instance_variable_set(instance_var,
+          model_or_proxy.new(params[context.to_s.singularize]))
+    end
+
+    def new_controller_object_for_collection (context, parent_context) # :nodoc:
+      model_or_proxy = parent_context ?
+           instance_variable_get(:"@#{parent_context.to_s.singularize}").send(context.to_sym) :
+           context.to_s.classify.constantize
+      instance_var = :"@#{context.to_s.singularize}"
+      instance_variable_set(instance_var, model_or_proxy.new)
+    end
+
     module ClassMethods
       #
       # Defines a filter to be applied according to the authorization of the
@@ -258,6 +289,176 @@ module Authorization
           end
         end
       end
+
+      # To DRY up the filter_access_to statements in restful controllers,
+      # filter_resource_access combines typical filter_access_to and
+      # before_filter calls, which set up the instance variables.
+      #
+      # The simplest case are top-level resource controllers with only the
+      # seven CRUD methods, e.g.
+      #   class CompanyController < ApplicationController
+      #     filter_resource_access
+      #
+      #     def index...
+      #   end
+      # Here, all CRUD actions are protected through a filter_access_to :all
+      # statement.  :+attribute_check+ is enabled for all actions except for
+      # the collection action :+index+.  To have an object for attribute checks
+      # available, filter_resource_access will set the instance variable
+      # @+company+ in before filters.  For the member actions (:+show+, :+edit+,
+      # :+update+, :+destroy+) @company is set to Company.find(params[:id]).
+      # For +new+ actions (:+new+, :+create+), filter_resource_access creates
+      # a new object from company parameters: Company.new(params[:company].
+      #
+      # For nested resources, the parent object may be loaded automatically.
+      #   class BranchController < ApplicationController
+      #     filter_resource_access :nested_in => :companies
+      #   end
+      # Again, the CRUD actions are protected.  Now, for all CRUD actions,
+      # the parent object @company is loaded from params[:company_id].  It is
+      # also used when creating @branch for +new+ actions.  Here, attribute_check
+      # is enabled for the collection :+index+ as well, checking attributes on a
+      # @company.branches.new method.
+      #
+      # You can override the default object loading by implementing any of the
+      # following instance methods on the controller.  Examples are given for the
+      # BranchController (with +nested_in+ set to :+companies+):
+      # [+new_branch_from_params+]
+      #   Used for +new+ actions.
+      # [+new_branch_for_collection+]
+      #   Used for +collection+ actions if the +nested_in+ option is set.
+      # [+load_branch+]
+      #   Used for +member+ actions.
+      # [+load_company+]
+      #   Used for all +new+, +member+, and +collection+ actions if the 
+      #   +nested_in+ option is set.
+      #
+      # All options:
+      # [:+member+]
+      #   Member methods are actions like +show+, which have an params[:id] from
+      #   which to load the controller object and assign it to @controller_name,
+      #   e.g. @+branch+.  By default, member actions are [:+show+, :+edit+, :+update+,
+      #   :+destroy+].
+      # [:+additional_member+]
+      #   Allows to add additional member actions to the default resource +member+
+      #   actions.
+      # [:+collection+]
+      #   Collection actions are like :+index+, actions without any controller object
+      #   to check attributes of.  If +nested_in+ is given, a new object is
+      #   created from the parent object, e.g. @company.branches.new.  Without
+      #   +nested_in+, attribute check is deactivated for these actions.  By
+      #   default, collection is set to :+index+.
+      # [:+additional_collection+]
+      #   Allows to add additional collaction actions to the default resource +collection+
+      #   actions.
+      # [:+new+]
+      #   +new+ methods are actions such as +new+ and +create+, which don't
+      #   receive a params[:id] to load an object from, but
+      #   a params[:controller_name_singular] hash with attributes for a new
+      #   object.  The attributes will be used here to create a new object and
+      #   check the object against the authorization rules.  The object is
+      #   assigned to @controller_name_singular, e.g. @branch.
+      #
+      #   If +nested_in+ is given, the new object
+      #   is created from the parent_object.controller_name
+      #   proxy, e.g. company.branches.new(params[:branch]).  By default,
+      #   +new+ is set to [:new, :create].
+      # [:+additional_new+]
+      #   Allows to add additional new actions to the default resource +new+ actions.
+      # [:+context+]
+      #   The context is used to determine the model to load objects from for the
+      #   before_filters and the context of privileges to use in authorization
+      #   checks.
+      # [:+nested_in+]
+      #   Specifies the parent controller if the resource is nested in another
+      #   one.  This is used to automatically load the parent object, e.g.
+      #   @+company+ from params[:company_id] for a BranchController nested in
+      #   a CompanyController.
+      # [:+no_attribute_check+]
+      #   Allows to set actions for which no attribute check should be perfomed.
+      #   See filter_access_to on details.  By default, with no +nested_in+,
+      #   +no_attribute_check+ is set to all collections.  If +nested_in+ is given
+      #   +no_attribute_check+ is empty by default.
+      #
+      def filter_resource_access(options = {})
+        options = {
+          :new        => [:new, :create],
+          :additional_new => nil,
+          :member     => [:show, :edit, :update, :destroy],
+          :additional_member => nil,
+          :collection => [:index],
+          :additional_collection => nil,
+          #:new_method_for_collection => nil,  # only symbol method name
+          #:new_method => nil,                 # only symbol method name
+          #:load_method => nil,                # only symbol method name
+          :no_attribute_check => nil,
+          :context    => nil,
+          :nested_in  => nil,
+        }.merge(options)
+
+        new_actions = actions_from_option(options[:new]).merge(
+            actions_from_option(options[:additional_new]))
+        members = actions_from_option(options[:member]).merge(
+            actions_from_option(options[:additional_member]))
+        collections = actions_from_option(options[:collection]).merge(
+            actions_from_option(options[:additional_collection]))
+
+        options[:no_attribute_check] ||= collections.keys unless options[:nested_in]
+
+        unless options[:nested_in].blank?
+          load_method = :"load_#{options[:nested_in].to_s.singularize}"
+          before_filter do |controller|
+            if controller.respond_to?(load_method)
+              controller.send(load_method)
+            else
+              controller.send(:load_parent_controller_object, options[:nested_in])
+            end
+          end
+
+          new_for_collection_method = :"new_#{controller_name.singularize}_for_collection"
+          before_filter :only => collections.keys do |controller|
+            # new_for_collection
+            if controller.respond_to?(new_for_collection_method)
+              controller.send(new_for_collection_method)
+            else
+              controller.send(:new_controller_object_for_collection,
+                  options[:context] || controller_name, options[:nested_in])
+            end
+          end
+        end
+
+        new_from_params_method = :"new_#{controller_name.singularize}_from_params"
+        before_filter :only => new_actions.keys do |controller|
+          # new_from_params
+          if controller.respond_to?(new_from_params_method)
+            controller.send(new_from_params_method)
+          else
+            controller.send(:new_controller_object_from_params,
+                options[:context] || controller_name, options[:nested_in])
+          end
+        end
+        load_method = :"load_#{controller_name.singularize}"
+        before_filter :only => members.keys do |controller|
+          # load controller object
+          if controller.respond_to?(load_method)
+            controller.send(load_method)
+          else
+            controller.send(:load_controller_object, options[:context] || controller_name)
+          end
+        end
+        filter_access_to :all, :attribute_check => true, :context => options[:context]
+
+        members.merge(new_actions).merge(collections).each do |action, privilege|
+          if action != privilege or (options[:no_attribute_check] and options[:no_attribute_check].include?(action))
+            filter_options = {
+              :context          => options[:context],
+              :attribute_check  => !options[:no_attribute_check] || !options[:no_attribute_check].include?(action)
+            }
+            filter_options[:require] = privilege if action != privilege
+            filter_access_to(action, filter_options)
+          end
+        end
+      end
       
       protected
       def filter_access_permissions # :nodoc:
@@ -273,6 +474,26 @@ module Authorization
       def filter_access_permissions? # :nodoc:
         class_variable_defined?(:@@declarative_authorization_permissions)
       end
+
+      def actions_from_option (option) # :nodoc:
+        case option
+        when nil
+          {}
+        when Symbol, String
+          {option.to_sym => option.to_sym}
+        when Hash
+          option
+        when Enumerable
+          option.each_with_object({}) do |action, hash|
+            if action.is_a?(Array)
+              raise "Unexpected option format: #{option.inspect}" if action.length != 2
+              hash[action.first] = action.last
+            else
+              hash[action.to_sym] = action.to_sym
+            end
+          end
+        end
+      end
     end
   end
   
@@ -332,8 +553,15 @@ module Authorization
         instance_var = :"@#{load_object_model.name.underscore}"
         object = contr.instance_variable_get(instance_var)
         unless object
-          # catch ActiveRecord::RecordNotFound?
-          object = load_object_model.find(contr.params[:id])
+          begin
+            object = load_object_model.find(contr.params[:id])
+          rescue ActiveRecord::RecordNotFound
+            logger.debug("filter_access_to tried to find " +
+                "#{load_object_model.inspect} from params[:id] " +
+                "(#{contr.params[:id].inspect}), because attribute_check is enabled " +
+                "and #{instance_var.to_s} isn't set.")
+            raise
+          end
           contr.instance_variable_set(instance_var, object)
         end
         object