uhees-declarative_authorization 0.3.1 → 0.3.2.2.1

data/CHANGELOG

@@ -1,3 +1,9 @@
+* Change Support: Suggestion grouping, sort by affected users [sb]
+
+* Changed context derived from objects to #class.name.tableize to fix STI [sb]
+
+* Simplified controller authorization with filter_resource_access [sb]
+
 * Allow passing explicit context in addition to object in permitted_to? [Olly Lylo, sb]
 
 * Change Supporter: suggest changes to authorization rules [sb]

data/README.rdoc

@@ -79,12 +79,26 @@ generated yourself or at http://www.tzi.org/~sbartsch/declarative_authorization
 
 == Controller
 
-If authentication is in place, enabling user-specific access control may be
-as simple as one call to filter_access_to :all which simply requires the 
-according privileges for present actions.  E.g. the privilege index_users is
-required for action index.  This works as a first default configuration
-for RESTful controllers, with these privileges easily handled in the
-authorization configuration, which will be described below.
+If authentication is in place, there are two ways to enable user-specific
+access control on controller actions.  For resource controllers, which more
+or less follow the CRUD pattern, +filter_resource_access+ is the simplest
+approach.  It sets up instance variables in before filters and calls
+filter_access_to with the appropriate parameters to protect the CRUD methods.
+
+    class EmployeesController < ApplicationController
+      filter_resource_access
+      ...
+    end
+
+See Authorization::AuthorizationInController::ClassMethods for options on
+nested resources and custom member and collection actions.
+
+If you prefer less magic or your controller has no resemblance with the resource
+controllers, directly calling filter_access_to may be the better option.  Examples
+are given in the following.  E.g. the privilege index users is required for
+action index.  This works as a first default configuration for RESTful
+controllers, with these privileges easily handled in the authorization
+configuration, which will be described below.
 
     class EmployeesController < ApplicationController
       filter_access_to :all
@@ -456,7 +470,7 @@ and Ubuntu) and has only been tested under Linux.
 
 = Help and Contact
 
-We have an issue tracker[http://stffn.lighthouseapp.com/projects/20733-declarative_authorization] 
+We have an issue tracker[http://github.com/stffn/declarative_authorization/issues]
 for bugs and feature requests as well as a 
 Google Group[http://groups.google.com/group/declarative_authorization] for
 discussions on the usage of the plugin.  You are very welcome to contribute.
@@ -475,11 +489,14 @@ sbartsch at tzi.org
 Thanks to
 * Eike Carls
 * Erik Dahlstrand
+* Jeroen van Dijk
 * Jeremy Friesen
 * Brian Langenfeld
+* Georg Ledermann
 * Geoff Longman
 * Olly Lylo
 * Mark Mansour
+* Thomas Maurer
 * Mike Vincent
 
 

data/app/controllers/authorization_rules_controller.rb

@@ -35,7 +35,10 @@ class AuthorizationRulesController < ApplicationController
     @users.sort! {|a, b| a.login <=> b.login }
     
     @privileges = authorization_engine.auth_rules.collect {|rule| rule.privileges.to_a}.flatten.uniq
-    @privileges = @privileges.collect {|priv| Authorization::DevelopmentSupport::AnalyzerEngine::Privilege.for_sym(priv, authorization_engine).descendants.map(&:to_sym) }.flatten.uniq
+    @privileges = @privileges.collect do |priv|
+      priv = Authorization::DevelopmentSupport::AnalyzerEngine::Privilege.for_sym(priv, authorization_engine)
+      (priv.descendants + priv.ancestors).map(&:to_sym)
+    end.flatten.uniq
     @privileges.sort_by {|priv| priv.to_s}
     @privilege = params[:privilege].to_sym rescue @privileges.first
     @contexts = authorization_engine.auth_rules.collect {|rule| rule.contexts.to_a}.flatten.uniq
@@ -64,19 +67,40 @@ class AuthorizationRulesController < ApplicationController
       deserialize_changes(spec).flatten
     end
 
-    users_keys = users_permission.keys
     analyzer = Authorization::DevelopmentSupport::ChangeSupporter.new(authorization_engine)
     
     privilege = params[:privilege].to_sym
     context = params[:context].to_sym
+    all_users = User.all
     @context = context
-    @approaches = analyzer.find_approaches_for(:users => users_keys, :prohibited_actions => prohibited_actions) do
+    @approaches = analyzer.find_approaches_for(:users => all_users, :prohibited_actions => prohibited_actions) do
       users.each_with_index do |user, idx|
-        args = [privilege, {:context => context, :user => user}]
-        assert(users_permission[users_keys[idx]] ? permit?(*args) : !permit?(*args))
+        unless users_permission[all_users[idx]].nil?
+          args = [privilege, {:context => context, :user => user}]
+          assert(users_permission[all_users[idx]] ? permit?(*args) : !permit?(*args))
+        end
       end
     end
 
+    @affected_users = @approaches.each_with_object({}) do |approach, memo|
+      memo[approach] = approach.affected_users(authorization_engine, all_users, privilege, context).length
+    end
+    max_affected_users = @affected_users.values.max
+    if params[:affected_users]
+      @approaches = @approaches.sort_by do |approach|
+        affected_users_count = @affected_users[approach]
+        if params[:affected_users] == "many"
+          #approach.weight.to_f / [affected_users_count, 0.1].min
+          approach.weight + (max_affected_users - affected_users_count) * 10
+        else
+          #approach.weight * affected_users_count
+          approach.weight + affected_users_count * 10
+        end
+      end
+    end
+
+    @grouped_approaches = analyzer.group_approaches(@approaches)
+
     respond_to do |format|
       format.js do
         render :partial => 'suggestions'

data/app/helpers/authorization_rules_helper.rb

@@ -46,7 +46,7 @@ module AuthorizationRulesHelper
   
   def navigation
     link_to("Rules", authorization_rules_path) << ' | ' <<
-    link_to("Change Supporter", change_authorization_rules_path) << ' | ' <<
+    link_to("Change Support", change_authorization_rules_path) << ' | ' <<
     link_to("Graphical view", graph_authorization_rules_path) << ' | ' <<
     link_to("Usages", authorization_usages_path) #<< ' | ' <<
   #  'Edit | ' <<
@@ -118,8 +118,8 @@ module AuthorizationRulesHelper
 
   def prohibit_link (step, text, title, options)
     options[:with_removal] ?
-          ' ' + link_to_function("[x]", "prohibit_action('#{serialize_action(step)}', '#{text}')",
-                    :class => 'unimportant', :title => title) :
+          link_to_function("[x]", "prohibit_action('#{serialize_action(step)}', '#{text}')",
+                    :class => 'prohibit', :title => title) :
           ''
   end
   
@@ -149,6 +149,10 @@ module AuthorizationRulesHelper
     @changes && @changes[args[0]] && @changes[args[0]].include?(args[1..-1])
   end
 
+  def affected_users_count (approach)
+    @affected_users[approach]
+  end
+
   def auth_usage_info_classes (auth_info)
     classes = []
     if auth_info[:controller_permissions]

data/app/views/authorization_rules/_change.erb

@@ -1,5 +1,5 @@
 <form>
-<h2>1. Choose permission to change</h2>
+<h2>Which permission to change?</h2>
 <p class="action-options">
   <label>Privilege</label>
   <%= select_tag :privilege, options_for_select(@privileges.map(&:to_s).sort, @privilege.to_s) %>
@@ -7,10 +7,19 @@
   <label>On</label>
   <%= select_tag :context, options_for_select(@contexts.map(&:to_s).sort, @context.to_s) %>
   <br/>
-  <%= link_to_function "Current permissions", "show_current_permissions()", :class => 'unimportant' %>
+  <label></label>
+  <%= link_to_function "Show current permissions", "show_current_permissions()", :class => 'unimportant' %>
+  <br/><br/>
+  How many users should be <strong>affected</strong>?
+  <br/>
+  <label></label>
+  <%= radio_button_tag :affected_users, :few, params[:affected_users] == 'few' %>
+  <label class="inline">A <strong>few</strong> users</label>
+  <%= radio_button_tag :affected_users, :many, params[:affected_users] == 'many' %>
+  <label class="inline"><strong>Many</strong> users</label>
 </p>
 
-<h2>2. Whose permission should be changed?</h2>
+<h2>Whose permission should be changed?</h2>
 <table class="change-options">
   <thead>
     <tr>

data/app/views/authorization_rules/_show_graph.erb

@@ -32,6 +32,6 @@
     }
 <% end %>
 <div id="graph-container" style="display:none">
-<%= link_to_function "Hide", "$('graph-container').hide()" %><br/>
-<object id="graph" data="" type="image/svg+xml" style="max-width:100%"/>
+<%= link_to_function "Hide", "$('graph-container').hide()", :class => 'important' %><br/>
+<object id="graph" data="" type="image/svg+xml" style="max-width:100%;margin-top: 0.5em"/>
 </div>

data/app/views/authorization_rules/_suggestions.erb

@@ -4,21 +4,45 @@
   <% if @approaches.first.changes.empty? %>
     <p>No changes necessary.</p>
   <% else %>
-    <p>Suggested changes (<%= link_to_function "show", "show_suggest_graph('#{serialize_changes(@approaches.first)}', '#{serialize_relevant_roles(@approaches.first)}', '#{@context}', relevant_user_ids())" %>):</p>
-    <%= render "suggestion", :object => @approaches.first %>
+    <p class="unimportant">
+      <%= pluralize(@approaches.length, 'approach') %> in
+      <%= pluralize(@grouped_approaches.length, 'group') %>
+      <%= params[:affected_users] ? "– #{params[:affected_users] == 'few' ? "fewer" : "most"} affected users first" : "" %>
+    </p>
+    <ul>
+      <% @grouped_approaches.each_with_index do |grouped_approach, group_index| %>
+        <% ([grouped_approach.approach] + grouped_approach.similar_approaches).each_with_index do |approach, index| %>
+          <li <%= (group_index < 3 || params[:show_all]) && index == 0 ? '' : 'style="display: none"' %> class="<%= index == 0 ? 'primary' : "secondary" %> group-<%= group_index %>">
+            <!--<span class="ord"><%= (index + 1) %></span>-->
+            <span class="unimportant">Affected users</span> <strong><%= affected_users_count(approach) %></strong> &nbsp;
+            <span class="unimportant">Complexity</span> <strong><%= approach.weight %></strong> &nbsp;
+            <%= link_to_function "Diagram", "show_suggest_graph('#{serialize_changes(approach)}', '#{serialize_relevant_roles(approach)}', '#{@context}', relevant_user_ids())", :class => "show-approach" %>
+            <ul>
+              <% approach.changes.each do |action| %>
+                <% (action.to_a[0].is_a?(Enumerable) ? action.to_a : [action.to_a]).each do |step| %>
+                  <li>
+                    <%= describe_step(step.to_a, :with_removal => true) %>
+                  </li>
+                <% end %>
+              <% end %>
+            </ul>
+            <% if index == 0 %>
+              <% if grouped_approach.similar_approaches.empty? %>
+                <span class="unimportant show-others-in-group">No further suggestions in this group</span>
+              <% else %>
+                <%= link_to_function "Show further #{pluralize grouped_approach.similar_approaches.length, "suggestion"} in this group", "show_group_approaches(#{group_index})", :class => "show-others-in-group" %>
+              <% end %>
+            <% end %>
+            <%= link_to_function "Hide further suggestions", "hide_group_approaches(#{group_index})" if index > 0 and index == grouped_approach.similar_approaches.length %>
+          </li>
+          <% if index == 0 and group_index == 2 and @grouped_approaches.length > 3 %>
+            <li <%= !params[:show_all] ? '' : 'style="display: none"' %>><%= link_to_function "Show further #{pluralize(@grouped_approaches.length - 3, 'group')}", "show_all_groups(); $(this).up().hide()" %></li>
+          <% end %>
+        <% end %>
+      <% end %>
+    </ul>
+
   <% end %>
 <% else %>
   <p><strong>No approach found.</strong></p>
 <% end %>
-
-<% if @approaches.length > 1 %>
-  <p <%= !params[:show_all] ? '' : 'style="display: none"' %>><a href="#" onclick="$(this).up().hide();$('more-suggestions').show();return false">Show other <%= pluralize(@approaches.length - 1, 'approach') %></a></p>
-  <div id="more-suggestions" <%= params[:show_all] ? '' : 'style="display: none"' %>>
-    <% @approaches[1..-1].each_with_index do |approach, index| %>
-      <p>
-        <%= (index + 2).ordinalize %> best approach (<%= pluralize(approach.changes.length, 'step') %>, <%= link_to_function "show", "show_suggest_graph('#{serialize_changes(approach)}', '#{serialize_relevant_roles(approach)}', '#{@context}', relevant_user_ids())" %>)
-        <%= render "suggestion", :object => approach %>
-      </p>
-    <% end %>
-  </div>
-<% end %>

data/app/views/authorization_rules/change.html.erb

@@ -4,12 +4,13 @@
 <%= link_to_function "Hide", "$(this).up().hide()", :class => 'important' %>
 <%= link_to_function "Toggle stacked roles", "toggle_graph_params('suggest-graph', 'stacked_roles');" %>
 <%= link_to_function "Toggle only users' roles", "toggle_graph_params('suggest-graph', 'only_relevant_roles');" %><br/>
-<object id="suggest-graph" data="" type="image/svg+xml" style="max-width: 98%;max-height: 95%"/>
+<object id="suggest-graph" data="" type="image/svg+xml" style="max-width: 98%;max-height: 95%;margin-top: 0.5em"/>
 </div>
 <%= render 'show_graph' %>
 
 <style type="text/css">
   .action-options label { display: block; float: left; width: 7em; padding-bottom: 0.5em }
+  .action-options label.inline { display: inline; float: none }
   .action-options select { float: left; }
   .action-options br { clear: both; }
   .action-options { margin-bottom: 2em }
@@ -23,21 +24,33 @@
   .submit { margin-top: 0 }
   .submit input { font-weight: bold; font-size: 120% }
   #suggest-result { 
-    position: absolute; left: 60%; right: 10px;
-    border-left: 2px solid grey;
-    padding-left: 1em;
+    position: absolute; left: 55%; right: 10px;
+    border-left: 1px solid grey;
+    padding-left: 2em;
     z-index: 10;
   }
+  #suggest-result>ul { padding-left: 0 }
+  #suggest-result>ul>li { list-style: none;  margin-bottom: 1em }
+  #suggest-result>ul>li.secondary { padding-left: 2em }
+  #suggest-result li { padding-left: 0 }
+  #suggest-result ul ul { padding-left: 2em }
+  #suggest-result .ord { float: left; display: block; width: 2em; font-weight: bold; color: grey }
+  .show-approach, .show-others-in-group { visibility: hidden }
+  .prohibit { text-decoration: none; visibility: hidden }
+  li:hover .show-approach, li:hover .prohibit,
+    li:hover .show-others-in-group { visibility: visible }
   #suggest-graph-container {
-    background: white; border:1px solid #ccc;
+    background: white; border:1px solid grey;
     position:fixed; z-index: 20;
-    left:10%; bottom: 10%; right: 10%; top: 10%
+    left:10%; bottom: 10%; right: 10%; top: 10%;
+    padding: 0.5em
   }
   #graph-container {
-    background: white; margin: 1em; border:1px solid #ccc;
+    background: white; margin: 1em; border:1px solid grey; padding: 0.5em;
     max-width:50%; position:fixed; z-index: 20; right:0;
   }
-  .unimportant, .remove { color: grey }
+  .unimportant, .remove, .prohibit { color: grey }
+  .important { font-weight: bold }
   .remove { cursor: pointer }
 </style>
 <% javascript_tag do %>
@@ -72,8 +85,9 @@
     function install_change_observers () {
         $$('#change select').each(function (el) {
             el.observe('change', function (event) {
+                var form = $('change').down('form');
                 new Ajax.Updater({success: 'change'}, '<%= url_for %>', {
-                  parameters: { context: $F('context'), privilege: $F('privilege') },
+                  parameters: Form.serializeElements(form.select('select').concat(form.getInputs('radio', 'affected_users')), true),
                   method: 'get',
                   onComplete: function () {
                       install_change_observers();
@@ -98,6 +112,20 @@
         show_graph($F('privilege'), $F('context')/*, relevant_user_ids()*/);
     }
 
+    function show_all_groups () {
+      $$('#suggest-result>ul>li.primary').invoke("show");
+    }
+
+    function show_group_approaches (group_no) {
+      $$('#suggest-result>ul>li.secondary.group-' + group_no).invoke("show");
+      $$('#suggest-result>ul>li.primary.group-' + group_no + ' a.show-others-in-group').invoke("hide");
+    }
+
+    function hide_group_approaches (group_no) {
+      $$('#suggest-result>ul>li.secondary.group-' + group_no).invoke("hide");
+      $$('#suggest-result>ul>li.primary.group-' + group_no + ' a.show-others-in-group').invoke("show");
+    }
+
     function relevant_user_ids () {
       return $$('#change .user_id').collect(function (el) {
         return el.innerHTML;

data/lib/declarative_authorization/authorization.rb

@@ -33,10 +33,10 @@ module Authorization
     Thread.current["current_user"] = user
   end
   
-  @@ignore_access_control = false
   # For use in test cases only
   def self.ignore_access_control (state = nil) # :nodoc:
-    false
+    Thread.current["ignore_access_control"] = state unless state.nil?
+    Thread.current["ignore_access_control"] || false
   end
 
   def self.activate_authorization_rules_browser? # :nodoc:
@@ -117,10 +117,9 @@ module Authorization
     # Options:
     # [:+context+]
     #   The context part of the privilege.
-    #   Defaults either to the +table_name+ of the given :+object+, if given.
-    #   That is, either :+users+ for :+object+ of type User.  
-    #   Raises AuthorizationUsageError if
-    #   context is missing and not to be infered.
+    #   Defaults either to the tableized +class_name+ of the given :+object+, if given.
+    #   That is, :+users+ for :+object+ of type User.  
+    #   Raises AuthorizationUsageError if context is missing and not to be infered.
     # [:+object+] An context object to test attribute checks against.
     # [:+skip_attribute_test+]
     #   Skips those attribute checks in the 
@@ -153,7 +152,11 @@ module Authorization
         options[:object] = options[:object].new
       end
       
-      options[:context] ||= options[:object] && options[:object].class.table_name.to_sym rescue NoMethodError
+      options[:context] ||= options[:object] && (
+        options[:object].class.respond_to?(:decl_auth_context) ?
+            options[:object].class.decl_auth_context :
+            options[:object].class.name.tableize.to_sym
+      ) rescue NoMethodError
       
       user, roles, privileges = user_roles_privleges_from_options(privilege, options)
 

data/lib/declarative_authorization/development_support/analyzer.rb

@@ -100,7 +100,7 @@ module Authorization
         SMALL_ROLES_RATIO = 0.2
 
         def analyze_policy
-          small_roles.count > 1 and small_roles.count.to_f / roles.count.to_f > SMALL_ROLES_RATIO
+          small_roles.length > 1 and small_roles.length.to_f / roles.length.to_f > SMALL_ROLES_RATIO
         end
 
         def message (object)
@@ -109,7 +109,7 @@ module Authorization
 
         private
         def small_roles
-          roles.select {|role| role.rules.count < SMALL_ROLE_RULES_COUNT }
+          roles.select {|role| role.rules.length < SMALL_ROLE_RULES_COUNT }
         end
       end
 

data/lib/declarative_authorization/development_support/change_supporter.rb

@@ -8,7 +8,6 @@ module Authorization
     #   * Objective function:
     #     * affected user count,
     #     * as specific as possible (roles, privileges)
-    #       -> counter-productive?
     #     * as little changes as necessary
     #   * Modify role, privilege hierarchy
     #   * Merge, split roles
@@ -18,7 +17,7 @@ module Authorization
     #   * group similar candidates: only show abstract methods?
     #   * restructure GUI layout: more room for analyzing suggestions
     #   * changelog, previous tests, etc.
-    #   * different permissions in tests
+    #   * multiple permissions in tests
     # * Evaluation of approaches with Analyzer algorithms
     # * Authorization constraints
     #
@@ -41,6 +40,11 @@ module Authorization
     #
     class ChangeSupporter < AbstractAnalyzer
 
+      # Returns a list of possible approaches for changes to the current
+      # authorization rules that achieve a given goal.  The goal is given as
+      # permission tests in the block.  The instance method +users+ is available
+      # when the block is executed to refer to the then-current users, whose
+      # roles might have changed as one suggestion.
       def find_approaches_for (options, &tests)
         @prohibited_actions = (options[:prohibited_actions] || []).to_set
 
@@ -63,10 +67,29 @@ module Authorization
         end
 
         # remove subsets
-
         suggestions.sort!
       end
 
+      # Returns an array of GroupedApproaches for the given array of approaches.
+      # Only groups directly adjacent approaches
+      def group_approaches (approaches)
+        approaches.each_with_object([]) do |approach, grouped|
+          if grouped.last and grouped.last.approach.similar_to(approach)
+            grouped.last.similar_approaches << approach
+          else
+            grouped << GroupedApproach.new(approach)
+          end
+        end
+      end
+
+      class GroupedApproach
+        attr_accessor :approach, :similar_approaches
+        def initialize (approach)
+          @approach = approach
+          @similar_approaches = []
+        end
+      end
+
       class ApproachChecker
         attr_reader :users, :failed_tests
 
@@ -119,6 +142,15 @@ module Authorization
           res
         end
 
+        def affected_users (original_engine, original_users, privilege, context)
+          (0...@users.length).select do |i|
+            original_engine.permit?(privilege, :context => context,
+              :skip_attribute_test => true, :user => original_users[i]) !=
+                @engine.permit?(privilege, :context => context,
+                  :skip_attribute_test => true, :user => @users[i])
+          end.collect {|i| original_users[i]}
+        end
+
         def initialize_copy (other)
           @engine = @engine.clone
           @users = @users.clone
@@ -171,7 +203,17 @@ module Authorization
         end
 
         def sort_value
-          changes.sum(&:weight) + @failed_tests.length
+          weight + @failed_tests.length
+        end
+
+        def weight
+          changes.sum(&:weight)
+        end
+
+        def similar_to (other)
+          other.weight == weight and
+              other.changes.map {|change| change.class.name}.sort ==
+                changes.map {|change| change.class.name}.sort
         end
 
         def inspect