user_access_manager 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: da0bfe068f33d7ac47665128eb8ba9de9c8b3076
+  data.tar.gz: 6d72cf6bf45756521a8c4c12bbb160a693ffdd5b
+SHA512:
+  metadata.gz: 506a70a2fc35f194eb7f9310655df6b1ef78dd0300067be67474b49bda4dc55294729fff5884f2eab9106c0b5c39a3df334a985868aec4250ca0645c54e17334
+  data.tar.gz: 412978e8c6612d2319ee92c623464a9789dfac4ea8f786dcf53506388abc84003ec7478b592a2cc4bb22aeab378dae4b46be46f74d158ee6284d3ebb05f5edd9

data/.gitignore

@@ -0,0 +1,11 @@
+/.bundle/
+/.yardoc
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+
+# rspec failure tracking
+.rspec_status

data/.rspec

@@ -0,0 +1,3 @@
+--format documentation
+--color
+--require spec_helper

data/.travis.yml

@@ -0,0 +1,6 @@
+---
+language: ruby
+cache: bundler
+rvm:
+  - 2.3.4
+before_install: gem install bundler -v 2.1.4

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,74 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at sk.mijanur.rahaman@mettletech.in. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [https://contributor-covenant.org/version/1/4][version]
+
+[homepage]: https://contributor-covenant.org
+[version]: https://contributor-covenant.org/version/1/4/

data/Gemfile

@@ -0,0 +1,7 @@
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in user_access_manager.gemspec
+gemspec
+
+gem "rake", "~> 12.0"
+gem "rspec", "~> 3.0"

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2020 MijanurR
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,54 @@
+# UserAccessManager
+
+ Some time clients wants to restrict user from accessing  the sensitive module/url of an application based on their roles. This gem serve this purpose very efficiently with minimal implementation.it mainly deals with the url pattern.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'user_access_manager'
+```
+
+And then execute:
+
+    $ bundle install
+
+Or install it yourself as:
+
+    $ gem install user_access_manager
+
+## Usage
+
+  In the Application controller add AccessPolicy  module
+  ```include AccessPolicy```
+  define a yml under config and named it as ``access_policies.yml``. (you can download sample file here)
+  define a custom method in Application controller.
+  ```
+  def authorize_user_access
+    user_role =  <get user role from current user>  
+    authorize_access(user_role)
+  end
+  
+  ```
+  
+  apply before_action on the action that you are going to restrict
+   ``` before_action :authorize_user_access ```
+  
+  
+  
+  
+  
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/MijanurR/user_access_manager. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/MijanurR/user_access_manager/blob/master/CODE_OF_CONDUCT.md).
+
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
+
+## Code of Conduct
+
+Everyone interacting in the UserAccessManager project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/MijanurR/user_access_manager/blob/master/CODE_OF_CONDUCT.md).

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec

data/bin/console

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+require "bundler/setup"
+require "user_access_manager"
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require "pry"
+# Pry.start
+
+require "irb"
+IRB.start(__FILE__)

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/lib/access_policy.rb

@@ -0,0 +1,109 @@
+module AccessPolicy 
+    require 'jsonpath'
+    def authorize_access(user_role) 
+        user_role = 'default' if user_role.nil? 
+        request_url = request.path
+        http_method = request.method_symbol.downcase.to_s   
+        eligible_rules = get_rules(user_role,request_url)
+        eligible_inherited_rules = get_inherited_rules(user_role,request_url) #array of arrays
+        matched_rule = get_matched_rule(eligible_rules,http_method) 
+        if matched_rule.length.zero?
+            eligible_inherited_rules.each do |rules_arr|
+                matched_rule = get_matched_rule(rules_arr,http_method)
+                break if !matched_rule.length.zero?
+            end
+        end
+         
+        #decison maker
+        action_type = ''
+        action_type = policy_data()[user_role]['default-action']  if matched_rule.length.zero?
+        action_type = matched_rule.first['action']  if !matched_rule.length.zero? 
+        
+        if( action_type =='deny')
+            res_json = generate_message_response_json('Access to the requested resource is not allowed')
+            render json: res_json, status: 403
+        end
+    end 
+    def get_rules(parent_key,request_url)
+        policy_master = policy_data()
+        eligible_rules = []
+        policy_master[parent_key]["rules"].each do |rule|
+            pattern ='absolute' #default
+            pattern = rule['url']['pattern'] if  rule['url'].key?('pattern')
+            eligible_rules << rule   if pattern == 'absolute' && request_url == rule['url']['value']
+            eligible_rules << rule   if pattern == 'regex' && matched_url?(request_url,rule['url']['value'])
+        end
+        return eligible_rules
+    end
+    
+    def policy_data()
+        return Rails.configuration.AccessPolicyMaster
+    end
+    
+    def get_inherited_rules(parent_key,request_url)
+        inherited_roles_arr =[]
+        inherited_rules_arr =[]
+        policy_master = policy_data()
+        inherited_role = policy_master[parent_key]["inherits"]
+        if !(inherited_role.nil?) 
+            while(!inherited_role.nil?) do 
+                inherited_roles_arr << inherited_role 
+                inherited_rules_arr << get_rules(inherited_role,request_url)
+                inherited_role = policy_master[inherited_role]["inherits"] 
+            end 
+        end
+        return inherited_rules_arr
+    end
+    
+    def matched_url?(url,regex_str)
+        !!(url =~ Regexp.new(regex_str ))
+    end
+    
+    def get_matched_rule(eligible_rules,http_method)
+        matched_rules =[]
+        prioriy_arr =[]
+        eligible_rules.each do |rule|
+            match_found= true
+            methods_present = rule.key?('methods')
+            params_present = rule.key?('params')
+            if(methods_present)
+                match_found = false if !(rule['methods'].map(&:downcase).include?(http_method.downcase))
+            end
+            if(params_present)
+                eligible_http_params = rule['params'].select{|x| x['method'].downcase == http_method.downcase} #array
+                
+                if !eligible_http_params.length.zero?
+                    eligible_http_param = eligible_http_params.first
+                    param_location ='url' #default
+                    param_location = eligible_http_param['param-location'] if eligible_http_param.key?('param-location')
+                    param_path = eligible_http_param['param-path'] #string
+                    permitted_values = [] #array
+                    permitted_values =  eligible_http_param['values'] if eligible_http_param.key?('values')
+                    incoming_params_val=nil
+                    if(param_location =='url' ||param_location =='body' )
+                        incoming_params_val = params[param_path.to_sym]
+                    elsif
+                        raw_post = JSON.parse(request.raw_post)
+                        incoming_params_val = JsonPath.on(raw_post, param_path).first
+                    end
+                    match_found = false if !(permitted_values.include?(incoming_params_val))  
+                end  
+            end
+            
+            if match_found
+                matched_rules<< rule  
+                prioriy_arr<< rule['priority']
+            end
+        end #eligible rules end
+        if !(matched_rules.length.zero?)
+            max_priority = prioriy_arr.map(&:to_i).max
+            # select only highest priority rule
+            matched_rules = matched_rules.select{|x| x['priority'] == max_priority}
+        
+        end
+        return matched_rules
+    end
+    
+    
+end
+

data/lib/user_access_manager.rb

@@ -0,0 +1,6 @@
+require "user_access_manager/version"
+
+module UserAccessManager
+  class Error < StandardError; end
+  # Your code goes here...
+end

data/lib/user_access_manager/version.rb

@@ -0,0 +1,3 @@
+module UserAccessManager
+  VERSION = "0.1.0"
+end

data/user_access_manager.gemspec

@@ -0,0 +1,24 @@
+require_relative 'lib/user_access_manager/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "user_access_manager"
+  spec.version       = UserAccessManager::VERSION
+  spec.authors       = ["MijanurR"]
+  spec.email         = ["sk.mijanur.rahaman@mettletech.in"]
+
+  spec.summary       = %q{Manage resource based on their roles} 
+  spec.homepage      = "https://github.com/MijanurR/user_access_manager"
+  spec.license       = "MIT"
+  spec.required_ruby_version = Gem::Requirement.new(">= 2.3.0")
+
+
+  # Specify which files should be added to the gem when it is released.
+  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
+    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  end
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+  spec.add_development_dependency 'jsonpath', '~> 1.0', '>= 1.0.6'
+end

metadata

@@ -0,0 +1,78 @@
+--- !ruby/object:Gem::Specification
+name: user_access_manager
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- MijanurR
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2020-12-14 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jsonpath
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.6
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.6
+description: 
+email:
+- sk.mijanur.rahaman@mettletech.in
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
+- CODE_OF_CONDUCT.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- bin/console
+- bin/setup
+- lib/access_policy.rb
+- lib/user_access_manager.rb
+- lib/user_access_manager/version.rb
+- user_access_manager.gemspec
+homepage: https://github.com/MijanurR/user_access_manager
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.3.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.11
+signing_key: 
+specification_version: 4
+summary: Manage resource based on their roles
+test_files: []