vigilante 1.0.6 → 1.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1f2d45e60a17ae2b8f06c9b6aa47e876621072d5
-  data.tar.gz: cb9ff533bb9cc95b34e567986e1f8b5221dc62a6
+  metadata.gz: c6b42cabb2b3994a8c768046c4721afa1ee9a306
+  data.tar.gz: 2d40422c1c3700ec5bbe2fe00ba98852fd994f8f
 SHA512:
-  metadata.gz: 1bdb0977b997234eee874f4850ffd5f5d724251f9d48be0c43095917a81d3a4aeb17d136cd7b940002e1d3f7a9a4f285bd843d02777be359520b52b3b65ed8a9
-  data.tar.gz: 4495f38059766ff6e73f6e9137bb925922d00f83f6c1a805ead89128c5ba739129dcfa8d674acc9da0feba17ae99b6b59a900db8721f344f0a1659c7d869aa8a
+  metadata.gz: 3e2f8964d2f40e8d7f3514ca3156208dfa15a31d4bfa187aad2ddb322c78d1c9fbc801f8f7074d43d040b224804eb6baf4983e7facfb35597c14c20f4481aa56
+  data.tar.gz: 1b3cb2d860aec190c4002862b002adf2d3eeb71c1cacd4dc361c55d3f23d59803da095b6b63c71da168885feee6d26f4073f9fa4928eb46c968b664d935ccfef

data/VERSION

@@ -1 +1 @@
-1.0.6
+1.0.7

data/lib/vigilante/watched_operator.rb

@@ -74,6 +74,21 @@ module Vigilante
       authorizations.collect {|a| a.ability.try(:name) + "[" + a.authorization_extents.collect{|e| e.extent}.join(',') + "]"}
     end
 
+    def max_ability(extent=nil)
+      if extent && has_extent?
+        result_max = 0
+        self.reload.authorizations.each do |auth|
+          if auth.has_extent?
+            result_max = auth.ability.importance if auth.match_extent(extent) && auth.ability.importance > result_max
+          end
+        end
+        result_max
+      else
+        @max_importance ||= abilities.maximum(:importance)
+      end
+    end
+
+
     #### Extent-specific
 
     def add_to_extent(extent, role = nil)
@@ -93,13 +108,84 @@ module Vigilante
     end
 
     def has_extent?
-      asp_roles.count >= 1
+      extent_roles.count >= 1
     end
 
     def extent_roles
       self.authorizations.select{|x| x.has_extent? }.collect{|x| x.ability.name }
     end
 
+    def extents_with_roles
+      extent_hash = Hash.new { |h, k| h[k] = [] }
+      self.authorizations.each do |authorization|
+        if authorization.has_extent?
+          authorization.authorization_extents.each do |x|
+            extent_hash[x.extent_objid] << authorization.ability.name
+          end
+        else
+          extent_hash[:all] << authorization.ability.name
+        end
+      end
+      extent_hash
+    end
+
+
+    def validate_authorizations(max_allowed_importance, only_with_extents)
+      authorizations = self.authorizations
+
+      authorizations.each do |auth|
+        ability = auth.ability
+
+        if ability.needs_extent? && auth.authorization_extents.empty?
+          errors.add(:authorizations, "ability #{ability.name} requires an organisation!")
+        end
+        if ability.importance > max_allowed_importance || (!ability.needs_extent? && only_with_extents)
+          errors.add(:authorizations, "you do not have the necessary permission to add ability #{ability.name}")
+        end
+      end
+
+      logger.debug "###### Validate_operator_authorizations: authorizations = #{authorizations.inspect}"
+      logger.debug "###### Validate_operator_authorizations: authorizations = #{abilities.inspect}"
+
+      if authorizations.empty?
+        valid? # add the other errors, if any
+        errors.add(:authorizations, 'must have at least one ability')
+      end
+    end
+
+
+    def simplify_authorizations
+      if authorizations.count != distinct_authorizations.count
+        minimize_authorizations
+        self.reload
+      end
+    end
+
+    def distinct_authorizations
+      authorizations.joins(:ability).select('distinct(name)')
+    end
+
+    def authorizations_by_ability_name(ability_name)
+      #TODO: this can be written with better perfomance by using an SQL select instead of the ruby method select
+      authorizations.select{|authorization|authorization.ability.name == ability_name}
+    end
+
+    def minimize_authorizations
+      distinct_authorizations.each do |ability|
+        authorizations_with_possible_duplicates = authorizations_by_ability_name(ability.name)
+        if authorizations_with_possible_duplicates.size > 1
+          keep_auth = authorizations_with_possible_duplicates.delete_at(0)
+          authorizations_with_possible_duplicates.each do |dup_auth|
+            dup_auth.authorization_extents.each do |auth_ext|
+              keep_auth.authorization_extents.create(:extent_objid => auth_ext.extent_objid, :extent_type => auth_ext.extent_type)
+            end
+            dup_auth.destroy
+          end
+        end
+      end
+    end
+
+
 
     #### Permits: what is an user/operator/... allowed to do
 

data/spec/models/watched_operator_spec.rb

@@ -0,0 +1,68 @@
+require 'spec_helper.rb'
+
+describe Author do
+  # test the code inserted into the Author (from the "watched_operator" module )
+
+  # !!! TODO: fix extracted test-code
+  #
+  # context "validate_authorizations" do
+  #   # validate_authorizations expects
+  #   # - the current-operators max permission (weight)
+  #   # - whether the current-operators has an extent or not
+  #   #
+  #   # These two are then combined to check whether added authorizations are valid or not
+  #   before(:each) do
+  #     @test_operator = FactoryGirl.create(:operator)
+  #   end
+  #   context "no authorizations added" do
+  #     before(:each) do
+  #       @test_operator.validate_authorizations(100, true)
+  #     end
+  #     it "sets an error on authorizations" do
+  #       @test_operator.errors[:authorizations].size.should == 1
+  #     end
+  #     it "must have at least one ability" do
+  #       @test_operator.errors[:authorizations].should == ["must have at least one ability"]
+  #     end
+  #   end
+  #   context "with one authorization added that needs extent, without an extent" do
+  #     before(:each) do
+  #       @test_operator.abilities << Ability.find_by_name("asp_admin")
+  #       @test_operator.validate_authorizations(100, true)
+  #     end
+  #     it "sets an error on authorizations" do
+  #       @test_operator.errors[:authorizations].size.should == 1
+  #     end
+  #     it "this ability requires an organisation" do
+  #       @test_operator.errors[:authorizations].should == ["ability asp_admin requires an organisation!"]
+  #     end
+  #   end
+  #   context "with one authorization added that does not need an extent, but the current operator does" do
+  #     before(:each) do
+  #       @test_operator.abilities << Ability.find_by_name("can-read-all")
+  #       @test_operator.validate_authorizations(100, true)
+  #     end
+  #     it "sets an error on authorizations" do
+  #       @test_operator.errors[:authorizations].size.should == 1
+  #     end
+  #     it "this ability requires an organisation" do
+  #       @test_operator.errors[:authorizations].should == ["you do not have the necessary permission to add ability can-read-all"]
+  #     end
+  #   end
+  #   context "with one authorization added that exceeds the current operator's permissions'" do
+  #     before(:each) do
+  #       @test_operator.abilities << Ability.find_by_name("can-read-all")
+  #       @test_operator.validate_authorizations(9, false)
+  #     end
+  #     it "sets an error on authorizations" do
+  #       @test_operator.errors[:authorizations].size.should == 1
+  #     end
+  #     it "this ability requires an organisation" do
+  #       @test_operator.errors[:authorizations].should == ["you do not have the necessary permission to add ability can-read-all"]
+  #     end
+  #   end
+  #   # !!!!! should also add all the positive cases, that do NOT add an error ...
+  # end
+
+
+end

data/vigilante.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: vigilante 1.0.6 ruby lib
+# stub: vigilante 1.0.7 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "vigilante"
-  s.version = "1.0.6"
+  s.version = "1.0.7"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Nathan Van der Auwera"]
-  s.date = "2015-09-07"
+  s.date = "2015-09-22"
   s.description = "Vigilante is a db-backed authorisation, completely configurable and dynamic; where permissions can be limited to extents."
   s.email = "nathan@dixis.com"
   s.extra_rdoc_files = [
@@ -112,6 +112,7 @@ Gem::Specification.new do |s|
     "spec/models/authorization_spec.rb",
     "spec/models/permission_hash_spec.rb",
     "spec/models/permission_spec.rb",
+    "spec/models/watched_operator_spec.rb",
     "spec/spec_helper.rb",
     "spec/vigilante_spec.rb",
     "vigilante.gemspec"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vigilante
 version: !ruby/object:Gem::Version
-  version: 1.0.6
+  version: 1.0.7
 platform: ruby
 authors:
 - Nathan Van der Auwera
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-07 00:00:00.000000000 Z
+date: 2015-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -154,6 +154,7 @@ files:
 - spec/models/authorization_spec.rb
 - spec/models/permission_hash_spec.rb
 - spec/models/permission_spec.rb
+- spec/models/watched_operator_spec.rb
 - spec/spec_helper.rb
 - spec/vigilante_spec.rb
 - vigilante.gemspec