zaikio-jwt_auth 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd2758c610957007baf7499e46f22d286a5c61dceb5895270080f20af8e5a57d
-  data.tar.gz: 5c945887dca4cd07ebfc836a5cbadb81667a56dbed0c6f67152dba297d4399fd
+  metadata.gz: e7fc3c22cfc4c1f3664674815aa450cea8d3607bfc75c9e0fded0849ac199763
+  data.tar.gz: e3452768d900d0f992165e60df3d32743a763da97969a2ddf7b331a60d253f6f
 SHA512:
-  metadata.gz: 73a3192d97b3f20caab44a96306258cd7b1b0240fb9e912726e3dfd536ef46183e0590a9cb513ed4be6afb66f4ee3c0a415153c4a7e7259a7bd569374e30eab4
-  data.tar.gz: bb9db302ba5caafeae825b25c244a91d213c1026d879c62ca2da230db6f29ade726121fcd0c0727c1e5625a84e2ed2cfb282a25ecaa827562efe6e6a9cb1a58f
+  metadata.gz: fde1af79e8a59aabfbe96d3f020f3180881d220a69ce209e4e4b8d82048e91d9d754c39d97d8604dccbde3aa9c02ef5aa526bb7b444d94b98f53c632efed8932
+  data.tar.gz: 538fb9c7471206bee6c72725720869d2545ded691ae9901f09c0966d42d1d77eb94dfecf9ebd31935ad982c93512584a99b17a095bd16c7eb237ad084a4c3d7c

data/README.md

@@ -63,6 +63,26 @@ end
 
 By convention, `authorize_by_jwt_scopes` automatically maps all CRUD actions in a controller. Requests for `show` and `index` with a read or read_write scope are allowed. All other actions like `create`, `update` and `destroy` are accepted if the scope is a write or read_write scope. Therefore it is strongly recommended to always create standard Rails resources. If a custom action is required, you will need to authorize yourself using the `after_jwt_auth`.
 
+#### Modifying required scopes
+If you nonetheless want to change the required scopes for CRUD routes, you can use the `type` option which accepts the following values: `:read`, `:write`, `:read_write`
+
+```rb
+class API::ResourcesController < API::ApplicationController
+  # Require a write or read_write scope on the index route
+  authorize_by_jwt_scopes 'resources', only: :index, type: :write
+end
+```
+
+#### Using custom actions
+You can also specify authorization for custom actions. When doing so the `type` option is required.
+
+```rb
+class API::ResourcesController < API::ApplicationController
+  # Require the index use to have a write or read_write scope
+  authorize_by_jwt_scopes 'resources', only: :my_custom_route, type: :write
+end
+```
+
 ### 6. Optionally, if you are using SSO: Check revoked tokens
 
 Additionally, the API provides a method called `revoked_jwt?` which expects the `jti` of the JWT.

data/lib/zaikio/jwt_auth/token_data.rb

@@ -13,6 +13,14 @@ module Zaikio
         }.freeze
       end
 
+      def self.permissions_by_type
+        {
+          read: %w[r rw],
+          write: %w[rw w],
+          read_write: %w[r rw w]
+        }
+      end
+
       def initialize(payload)
         @payload = payload
       end
@@ -38,8 +46,8 @@ module Zaikio
       end
 
       # scope_options is an array of objects with:
-      # scope, app_name (optional), except/only (array, optional)
-      def scope_by_configurations?(scope_configurations, action_name, context)
+      # scope, app_name (optional), except/only (array, optional), type (read, write, readwrite)
+      def scope_by_configurations?(scope_configurations, action_name, context) # rubocop:disable Metrics/AbcSize
         configuration = scope_configurations.find do |scope_configuration|
           action_matches = action_matches_config?(scope_configuration, action_name)
 
@@ -54,7 +62,7 @@ module Zaikio
 
         return true unless configuration
 
-        scope?(configuration[:scopes], action_name, configuration[:app_name])
+        scope?(configuration[:scopes], action_name, app_name: configuration[:app_name], type: configuration[:type])
       end
 
       def action_matches_config?(scope_configuration, action_name)
@@ -67,14 +75,14 @@ module Zaikio
         end
       end
 
-      def scope?(allowed_scopes, action_name, app_name = nil)
+      def scope?(allowed_scopes, action_name, app_name: nil, type: nil)
         app_name ||= Zaikio::JWTAuth.configuration.app_name
         Array(allowed_scopes).map(&:to_s).any? do |allowed_scope|
           scope.any? do |s|
             parts = s.split(".")
             parts[0] == app_name &&
               parts[1] == allowed_scope &&
-              action_in_permission?(action_name, parts[2])
+              action_permitted?(action_name, parts[2], type: type)
           end
         end
       end
@@ -101,8 +109,14 @@ module Zaikio
 
       private
 
-      def action_in_permission?(action_name, permission)
-        self.class.actions_by_permission[permission].include?(action_name)
+      def action_permitted?(action_name, permission, type: nil)
+        if type
+          return false unless self.class.permissions_by_type.key?(type)
+
+          self.class.permissions_by_type[type].include?(permission)
+        else
+          self.class.actions_by_permission[permission].include?(action_name)
+        end
       end
     end
   end

data/lib/zaikio/jwt_auth/version.rb

@@ -1,5 +1,5 @@
 module Zaikio
   module JWTAuth
-    VERSION = "0.4.1".freeze
+    VERSION = "0.4.2".freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: zaikio-jwt_auth
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - crispymtn
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-15 00:00:00.000000000 Z
+date: 2021-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oj