verifica 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8df98ff228b89e7701f41df3d5617d93183e83c32cdae5c879e347c615f367d7
-  data.tar.gz: 956259725d32e5a6208a03f2a07d682d6facbb1dcaae107687ce59cd1cd8363c
+  metadata.gz: ccea0b2769fa053006c2ec3d0b4cd0d3cc65a3a4b4375ce390dabe3a093f490d
+  data.tar.gz: 0bb0dd63b30f08a1df1af771671312182cde2c159613094f9fd0c664201b6e24
 SHA512:
-  metadata.gz: d3329c9e126220d43a8e9b4a7923541b30139e74f565387bed6012acea9760239d1b5850d19ee2963e63252ddde3008e39486ac66438e6e9215afe18de0d4256
-  data.tar.gz: 1dab1e7bab877e5f63298240db13270c6f46c238643f508037e81f524a99a54f3613e3515690e54886ac032b371d394622e51d5d33d92528ddab8560d7babb2e
+  metadata.gz: 5c3bfab0ce9ccd36cd91baadcc4454e462c9a5d098c6295d3073040d3291030e516d7ae90d200b55b84d4cafd51cd0118c51a1e5a5e0ee075d54e18528033d01
+  data.tar.gz: 6f6011eaec5b7f8a1d810233350a8a68cb7fdf7cf86d8bdc069d51478826ce847461c9d53e5c5f7e83922ac956cb3c1546fd957cb973c5dfee1a71cbc7258726

data/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.1] - 2023-04-15
+
+### Added
+
+- `Sid#country_sid` and `Sid#group_sid` helper methods
+
 ## [1.0.0] - 2023-01-19
 
 Initial public release

data/README.md

@@ -1,4 +1,6 @@
+[![Gem Version](https://badge.fury.io/rb/verifica.svg)](https://badge.fury.io/rb/verifica)
 [![CI](https://github.com/maximgurin/verifica/actions/workflows/ci.yml/badge.svg)](https://github.com/maximgurin/verifica/actions/workflows/ci.yml)
+[![Yard Docs](http://img.shields.io/badge/yard-docs-blue.svg)](http://rubydoc.info/github/maximgurin/verifica)
 [![Codacy Badge](https://app.codacy.com/project/badge/Grade/457e56b0bb514539844a94d85abe99f9)](https://www.codacy.com/gh/maximgurin/verifica/dashboard?utm_source=github.com&utm_medium=referral&utm_content=maximgurin/verifica&utm_campaign=Badge_Grade)
 [![Codacy Badge](https://app.codacy.com/project/badge/Coverage/457e56b0bb514539844a94d85abe99f9)](https://www.codacy.com/gh/maximgurin/verifica/dashboard?utm_source=github.com&utm_medium=referral&utm_content=maximgurin/verifica&utm_campaign=Badge_Coverage)
 ![GitHub](https://img.shields.io/github/license/maximgurin/verifica)
@@ -22,7 +24,7 @@ But anyway, trust nothing. DYOR.*
 
 ## Why Verifica? Isn't Pundit or CanCanCan enough?
 
-Let's say you working on a video platform application:
+Let's say you are working on a video platform application:
 
 - You have 10M videos in the database
 - 7 types of user roles
@@ -70,7 +72,7 @@ authorizer = Verifica.authorizer do |config|
 end
 
 public_video = Video.new(id: 1, author_id: 1000, public: true)
-private_video = Video.new(id: 2, author_id: 1000, public: true)
+private_video = Video.new(id: 2, author_id: 1000, public: false)
 
 superuser = User.new(id: 777, role: "root")
 video_author = User.new(id: 1000, role: "user")
@@ -184,9 +186,9 @@ end
 
 video_acl.to_a
 # =>
-# [#<Verifica::Ace:0x00007fab1955dd60 @action=:view, @allow=true, @sid="authenticated">,          
-#  #<Verifica::Ace:0x00007fab1955dd10 @action=:comment, @allow=true, @sid="authenticated">,       
-#  #<Verifica::Ace:0x00007fab1955dc48 @action=:view, @allow=false, @sid="country:US">]
+# [#<Verifica::Ace:0x00007fab1955dd60 @action=:read, @allow=true, @sid="authenticated">,
+#  #<Verifica::Ace:0x00007fab1955dd10 @action=:comment, @allow=true, @sid="authenticated">,
+#  #<Verifica::Ace:0x00007fab1955dc48 @action=:read, @allow=false, @sid="country:US">]
 ```
 
 ### AclProvider
@@ -210,8 +212,8 @@ end
 ### Authorizer
 
 And finally, Authorizer, the heart of Verifica. It couples all concepts above into an isolated container with no global state.
-Each Authorizer has a list of resource types registered with their companion AclProviders.
-And most importantly, Authorizer has several methods to check the Subject's rights to perform a specific action on a given resource.
+Each Authorizer has a list of resource types registered with their companion AclProviders and
+several methods to check the Subject's rights to perform a specific action on a given resource.
 
 Check the [Basic example](#basic-example) above to see how it all plays together.
 
@@ -318,11 +320,11 @@ class User < ApplicationRecord
     when "moderator"
       [user_sid(id), role_sid("moderator")]
     when "user"
-      sids = [authenticated_sid, user_sid(id), "country:#{country}"]
+      sids = [authenticated_sid, user_sid(id), country_sid(country)]
       organization_id.try { |org_id| sids.push(organization_sid(org_id)) }
       sids
     when "organization_admin"
-      sids = [authenticated_sid, user_sid(id), "country:#{country}"]
+      sids = [authenticated_sid, user_sid(id), country_sid(country)]
       sids.push(organization_sid(organization_id))
       sids.push(role_sid("organization_admin:#{organization_id}"))
     else
@@ -354,7 +356,7 @@ end
 ```
 
 ```ruby
-# app/models/user.rb
+# app/models/video.rb
 
 class Video < ApplicationRecord
   attr_accessor :allowed_actions
@@ -383,7 +385,11 @@ end
 
 class VideosController
   def index
-    @videos = Video.available_for(current_user).order(:name).limit(50)
+    @videos = Video
+      .includes(:distribution_setting, author: [:organization])
+      .available_for(current_user)
+      .order(:name)
+      .limit(50)
   end
   
   def show
@@ -415,8 +421,6 @@ run a background job to find all affected videos and update `read_allow_sids`, `
 Same applies to Distribution Settings and other dependencies.
 - **Rules change handling.** If implementation of `VideoAclProvider` changed you need to run a background job
 to update `read_allow_sids`, `read_deny_sids` columns for all videos.
-- **Cache, N+1 problem.** `VideoAclProvider` retrieves a chain of records associated with each video which leads to
-N+1 problem in a naive implementation.
 
 See also:
 

data/lib/verifica/acl.rb

@@ -54,7 +54,6 @@ module Verifica
 
         allow_deny[:allowed_sids].freeze
         allow_deny[:denied_sids].freeze
-        allow_deny.freeze
       end
 
       @allowed_actions.freeze
@@ -154,7 +153,7 @@ module Verifica
 
     # @example
     #   acl = Verifica::Acl.build { |acl| acl.allow "root", [:read, :write] }
-    #   acl.to_a.map(:to_h)
+    #   acl.to_a.map(&:to_h)
     #   # => [{:sid=>"root", :action=>:read, :allow=>true}, {:sid=>"root", :action=>:write, :allow=>true}]
     #
     # @return [Array<Ace>] a new array representing +self+

data/lib/verifica/authorizer.rb

@@ -141,6 +141,7 @@ module Verifica
     def resource_acl(resource, **context)
       config = config_by_resource(resource)
       acl = config.acl_provider.call(resource, **context)
+      # trade-off flexibility to increase robustness here by requiring a specific type
       unless acl.is_a?(Verifica::Acl)
         type = resource.resource_type
         raise Error, "'#{type}' resource acl_provider should respond to #call with Acl object but got '#{acl.class}'"

data/lib/verifica/sid.rb

@@ -211,5 +211,66 @@ module Verifica
 
       "org:#{organization_id}".freeze
     end
+
+    # Security Identifier of the subject who is a member of the group with given +group_id+
+    #
+    # @note (see #user_sid)
+    #
+    # @example
+    #   class PostAclProvider
+    #     include Verifica::Sid
+    #
+    #     def call(post, **)
+    #       Verifica::Acl.build do |acl|
+    #         post.editor_groups.each do |group_id|
+    #           acl.allow group_sid(group_id), [:edit, :delete]
+    #         end
+    #
+    #         # ...
+    #       end
+    #     end
+    #   end
+    #
+    # @return [String]
+    #
+    # @api public
+    def group_sid(group_id)
+      if group_id.nil?
+        raise ArgumentError, "Nil 'group_id' is unsafe. Use empty string if you absolutely need this behavior"
+      end
+
+      "group:#{group_id}".freeze
+    end
+
+    # Security Identifier of the subject whose country is the country with given +country_id+
+    #
+    # @note (see #user_sid)
+    #
+    # @example
+    #   class PostAclProvider
+    #     include Verifica::Sid
+    #
+    #     def call(post, **)
+    #       Verifica::Acl.build do |acl|
+    #         acl.allow authenticated_sid, [:read, :comment]
+    #         post.banned_countries.each do |country_id|
+    #           acl.deny country_sid(country_id), [:read, :comment]
+    #         end
+    #
+    #         # ...
+    #       end
+    #     end
+    #   end
+    #
+    # @return [String]
+    #
+    # @api public
+    def country_sid(country_id)
+      if country_id.nil?
+        raise ArgumentError, "Nil 'country_id' is unsafe. Use empty string if you absolutely need this behavior"
+      end
+
+      "country:#{country_id}".freeze
+    end
   end
 end

data/lib/verifica/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Verifica
-  VERSION = "1.0.0"
+  VERSION = "1.0.1"
 end

data/lib/verifica.rb

@@ -54,7 +54,7 @@ require_relative "verifica/version"
 #   end
 #
 #   public_video = Video.new(id: 1, author_id: 1000, public: true)
-#   private_video = Video.new(id: 2, author_id: 1000, public: true)
+#   private_video = Video.new(id: 2, author_id: 1000, public: false)
 #
 #   superuser = User.new(id: 777, role: "root")
 #   video_author = User.new(id: 1000, role: "user")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: verifica
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Maxim Gurin
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-19 00:00:00.000000000 Z
+date: 2023-04-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -105,7 +105,7 @@ metadata:
   source_code_uri: https://github.com/maximgurin/verifica
   bug_tracker_uri: https://github.com/maximgurin/verifica/issues
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -120,8 +120,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.3
-signing_key: 
+rubygems_version: 3.4.12
+signing_key:
 specification_version: 4
 summary: The most scalable authorization solution for Ruby
 test_files: []