zero_authorization 0.0.6 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6dbae5e807b3a048f369f867098aeace3ce95c2b
-  data.tar.gz: 8bcd765f8f9662ad520a8ff8acc8795a321872e2
+  metadata.gz: c71ff5e0e8ab8e104e78ba8c1c3c86528a552a5c
+  data.tar.gz: 9d960e3adbe023f1bbcf1321642cbc2a5d1a54aa
 SHA512:
-  metadata.gz: fcb9621a90f49f0542d3041ec78f6f08ec6d453248be73e6f437d9e6a15438362b0ebb0033fec036a5c40b786386032dbc87fd6d321a590a60b5aad28900839d
-  data.tar.gz: 5eb5276bedb765a10586b7f86a229c5bc16578b1aa2a9cf7f5b87e7de04cb6ce248d0b559a73210afcf765096ba70d5c17adc689728fa2e859f4a41c797d4b15
+  metadata.gz: 6b88ea53e319c66c3d04c116563df6af81375217d4934f135668fca7839dccba1467fb9450c6177e5e52fd969f752ac8cf6fb0c79a0fc6bba82f7af4643b0aad
+  data.tar.gz: a8d2a23fab3871be610f7296c2b3fae38a6e027d6c63caf667d4bfbfe957aa73b77371c76e5c7421aab4734f853603fd264c643262196a6b825cbe09d61ae9a3

data/README.md

@@ -1,6 +1,6 @@
 # ZeroAuthorization
 
-TODO: Write a gem description
+Functionality to add authorization on Rails model's write operations plus any other set of defined methods.
 
 ## Installation
 
@@ -18,7 +18,62 @@ Or install it yourself as:
 
 ## Usage
 
-TODO: Write usage instructions here
+1. Specify what any specific role of current root entity(logged_user) can do/can't do in roles_n_privileges.yml
+
+        :role_role_name_one:
+          :can_do:
+            :Account:
+            - :create
+            - :save
+            - :update
+            :User:
+            - :create
+            - :save
+            - :update
+            :ModelCrudHistory: :anything
+            :Permission: :anything
+          :cant_do:
+            :Project:
+            - :destroy
+        :role_role_name_two:
+          :can_do:
+            :Project:
+            - :create
+            - :save:
+                :if:
+                  :authorize?
+            - :update:
+                :if:
+                  :authorize?
+            - :destroy:
+                :if:
+                  :authorize?
+        :role_role_name_three:
+          :can_do:
+            :Plant:
+            - :create
+            - :save
+            - :update
+            - :destroy
+          :cant_do: :anything
+
+2. Restrict models for activity and let rule-set(s) via zero-authorization take control of activity
+
+    1 Add initializer file with content (if all existing models needs to have restrictions. Easy way out).
+
+        # Make a file restrict_models.rb in Rails.root/config/initializers
+        Rails.application.eager_load!
+        ActiveRecord::Base.descendants.each do |descendant|
+          descendant.send(:include, ZeroAuthorization::Engine)
+        end
+
+    2 To hand pick some models for restriction
+
+        class ModelName < ActiveRecord::Base
+          include ZeroAuthorization::Engine
+        end
+
+4. (Re-)boot application.
 
 ## Contributing
 

data/lib/zero_authorization/engine.rb

@@ -0,0 +1,177 @@
+module ZeroAuthorization
+  module Engine
+    def self.included(base)
+      puts "Initializing ZeroAuthorization for #{base.name}"
+
+      base.extend(ClassMethods)
+
+      # Initializing authentication mode. Options are
+      # :strict =>'raise exception and deny operation if not authorized' ,
+      # :warning => 'display only warning without exception' [DEFAULT],
+      # :superficial =>'allow operation without authorization'
+      base.send(:initialize_authorization_mode)
+
+      # Applying restriction on methods
+      base.send(:initialize_methods_restriction)
+
+      # Applying restriction on crud write operations
+      base.send(:before_save, :is_zero_authorized_4_save)
+      base.send(:before_create, :is_zero_authorized_4_create)
+      base.send(:before_update, :is_zero_authorized_4_update)
+      base.send(:before_destroy, :is_zero_authorized_4_destroy)
+
+
+      private
+
+      # Authorization for authorization mode :strict
+      def authorize_strictly(action)
+        role = ZeroAuthorization::Role.role
+        raise 'ZeroAuthorizationRoleNotAvailable' if role.nil?
+
+        if zero_authorized_core(role, action)
+          return true
+        else
+          logger.debug 'ZeroAuthorization: Not authorized to perform activity.'
+          raise 'NotAuthorized'
+        end
+
+        false
+      end
+
+      # Authorization for authorization mode :warning
+      def authorize_with_warning(action)
+        role = ZeroAuthorization::Role.role
+        raise 'ZeroAuthorizationRoleNotAvailable' if role.nil?
+
+        if zero_authorized_core(role, action)
+          return true
+        else
+          logger.debug 'ERROR: ZeroAuthorization: Not authorized to perform activity.'
+          self.errors.add(:authorization_error, 'occurred, Unauthorized to perform this activity')
+        end
+
+        false
+      end
+
+      # Authorization for authorization mode :superficial
+      def authorize_superficially(action)
+        logger.debug 'ZeroAuthorizationMode: superficial. By passing authorization.'
+        return true
+      end
+
+      # Return authorization mode
+      def zero_authorized_checker(action)
+        if self.class.authorization_mode == :strict
+          return authorize_strictly(action)
+        elsif self.class.authorization_mode == :warning
+          return authorize_with_warning(action)
+        elsif self.class.authorization_mode == :superficial
+          return authorize_superficially(action)
+        else
+          raise 'InvalidAuthorizationMode'
+        end
+      end
+
+      # Core of authorization after reading/parsing rule set for current role
+      def zero_authorized_core(role, action)
+        _auth_flag = false
+        unless role.rule_set[:can_do].nil?
+          if role.rule_set[:can_do] == :anything
+            _auth_flag = true
+
+          elsif role.rule_set[:can_do].is_a?(Hash)
+
+            if role.rule_set[:can_do][self.class.name.to_sym] == :anything
+              _auth_flag = true
+            else
+              logger.debug "----------- self.class.name.to_sym: #{self.class.name.to_sym}"
+              symbolized_actions = role.rule_set[:can_do][self.class.name.to_sym].collect { |x| x if x.is_a?(Symbol) }.compact
+              _auth_flag = if symbolized_actions.include?(action)
+                             true
+                           else
+                             conditional_check =nil
+                             (role.rule_set[:can_do][self.class.name.to_sym]- symbolized_actions).each do |action_rule_hash|
+                               conditional_check = action_rule_hash[action] if action_rule_hash.keys.include? action
+                             end
+                             conditional_check ||= {}
+                             conditional_check= conditional_check[:if]
+                             return self.send(conditional_check) unless conditional_check.nil?
+                             false
+                           end
+              #_auth_flag = true if (role.rule_set[:can_do][self.class.name.to_sym] || []).include?(action)
+            end
+          end
+        end
+        unless role.rule_set[:cant_do].nil?
+          if role.rule_set[:cant_do] == :anything
+            _auth_flag = false
+          elsif role.rule_set[:cant_do].is_a?(Hash)
+            _auth_flag = false if (role.rule_set[:cant_do][self.class.name.to_sym] || []).include?(action)
+          end
+        end
+        _auth_flag
+      end
+
+      def is_zero_authorized_4_save
+        zero_authorized_checker(:save)
+      end
+
+      def is_zero_authorized_4_create
+        zero_authorized_checker(:create)
+      end
+
+      def is_zero_authorized_4_update
+        zero_authorized_checker(:update)
+      end
+
+      def is_zero_authorized_4_destroy
+        zero_authorized_checker(:destroy)
+      end
+    end
+
+    module ClassMethods
+      attr_accessor :authorization_mode
+
+      def list_of_methods_to_guard
+        _model_methods_set = {}
+        Role.roles_n_privileges_hash.each do |role_key, permission_value|
+          unless permission_value[:can_do].nil?
+            _model_methods_set = _model_methods_set.merge(permission_value[:can_do]) { |key, oval, nval| ([oval] << [nval]).flatten.compact.uniq } if permission_value[:can_do].is_a?(Hash)
+          end
+          unless permission_value[:cant_do].nil?
+            _model_methods_set = _model_methods_set.merge(permission_value[:cant_do]) { |key, oval, nval| ([oval] << [nval]).flatten.compact.uniq } if permission_value[:cant_do].is_a?(Hash)
+          end
+        end
+        if _model_methods_set[self.name.to_sym] == :anything
+          _model_methods_set.delete(self.name.to_sym)
+        end
+        (_model_methods_set[self.name.to_sym] || []).clone.delete_if do |x|
+          if x.is_a? Hash
+            x= x.keys.first
+          end
+          [:create, :save, :update, :destroy, :anything].include?(x)
+        end
+      end
+
+      private
+      def initialize_authorization_mode
+        @authorization_mode = :warning # :strict, :warning and :superficial
+      end
+
+      # applying restriction on methods
+      def initialize_methods_restriction
+        list_of_methods_to_guard.each do |method_name|
+          if method_name.is_a? Hash
+            method_name = method_name.keys.first
+          end
+          send(:alias_method, "za_#{method_name}", method_name)
+          define_method "#{method_name}" do |*args|
+            puts 'Restricted method call..'
+            send("za_#{method_name}", *args) if zero_authorized_checker(method_name)
+          end
+        end
+      end
+    end
+  end
+
+end

data/lib/zero_authorization/role.rb

@@ -0,0 +1,51 @@
+module ZeroAuthorization
+
+  class Role
+    cattr_writer :role
+
+    # Initializing role
+    def initialize(role_name)
+      @role_name = role_name
+    end
+
+    def to_s
+      @role_name.to_s
+    end
+
+    # Getting rule_set(s) for the role
+    def rule_set
+      self.class.roles_n_privileges_hash["role_#{@role_name}".to_sym]
+    end
+
+    #Returns a valid role if available defined from config/roles_n_privileges.yml else a nil
+    def self.role
+      roles_n_privileges_hash.keys.collect { |key| key.to_s.gsub(/^role_/, '') }.include?(@@role) ? new(@@role) : nil
+    end
+
+    # Cache read of config/roles_n_privileges.yml for role_privileges_hash
+    def self.roles_n_privileges_hash
+      @roles_n_privileges_hash ||= YAML::load_file(File.join(Rails.root, 'config', 'roles_n_privileges.yml'))
+      @roles_n_privileges_hash
+    end
+
+    # Hard read of config/roles_n_privileges.yml for role_privileges_hash
+    def self.roles_n_privileges_hash_reload
+      @roles_n_privileges_hash = YAML::load_file(File.join(Rails.root, 'config', 'roles_n_privileges.yml'))
+    end
+
+    # Do any activity with any specific temporary role and then revert back to normal situation.
+    # Example:
+    # ZeroAuthorization::Role.temp_role('default') do
+    #  Patron.all.each do |patron|
+    #    patron.some_restricted_method_call!
+    #  end
+    #end
+    def self.temp_role(temp_role, &block)
+      _current_role = self.role.nil? ? self.role : self.role.to_s
+      self.role=temp_role
+      yield
+      self.role=_current_role
+    end
+
+  end
+end

data/lib/zero_authorization/version.rb

@@ -1,3 +1,3 @@
 module ZeroAuthorization
-  VERSION = "0.0.6"
+  VERSION = "1.0.0"
 end

data/lib/zero_authorization.rb

@@ -3,187 +3,11 @@ require 'active_record'
 require 'active_support/core_ext'
 require "zero_authorization/version"
 require 'zero_authorization/exceptions'
-
-
-module ZeroAuthorization
-
-  class Role
-    cattr_writer :role
-    # Initializing role
-    def initialize(role_name)
-      @role_name = role_name
-    end
-
-    def to_s
-      @role_name.to_s
-    end
-
-    # Getting rule_set(s) for the role
-    def rule_set
-      self.class.roles_n_privileges_hash["role_#{@role_name}".to_sym]
-    end
-
-    #Returns role if role can be formed/included in parsed hash's keys of parse_roles_n_privileges_yml
-    def self.role
-      roles_n_privileges_hash.keys.collect { |key| key.to_s.gsub(/^role_/, '') }.include?(@@role) ? new(@@role) : nil
-    end
-
-    # role_privileges_hash in place of yml
-    #TODO: Read it from YML and also provide functionality to reload it after caching
-    def self.roles_n_privileges_hash
-      @roles_n_privileges_hash ||= YAML::load_file(File.join(Rails.root, 'config', 'roles_n_privileges.yml'))
-      @roles_n_privileges_hash
-    end
-
-    def self.roles_n_privileges_hash_reload
-      @roles_n_privileges_hash = YAML::load_file(File.join(Rails.root, 'config', 'roles_n_privileges.yml'))
-    end
-
-  end
-
-  module Engine
-    def self.included(base)
-      puts "Initializing ZeroAuthorization for #{base.name}"
-
-      base.extend(ClassMethods)
-
-      # Initializing authentication mode. Options are
-      # :strict =>'raise exception and deny operation if not authorized' ,
-      # :warning => 'display only warning without exception',
-      # :superficial =>'allow operation without authorization'
-      base.send(:initialize_authorization_mode)
-
-      # Applying restriction on methods
-      base.send(:initialize_methods_restriction)
-
-      # Applying restriction on crud write operations
-      base.send(:before_save, :is_zero_authorized_4_save)
-      base.send(:before_create, :is_zero_authorized_4_create)
-      base.send(:before_update, :is_zero_authorized_4_update)
-      base.send(:before_destroy, :is_zero_authorized_4_destroy)
-
-
-      private
-
-      # Authorization for authorization mode :strict
-      def authorize_strictly(action)
-        role = ZeroAuthorization::Role.role
-        raise 'ZeroAuthorizationRoleNotAvailable' if role.nil?
-
-        if zero_authorized_core(role, action)
-          return true
-        else
-          logger.info 'ZeroAuthorization: Not authorized to perform activity.'
-          raise 'NotAuthorized'
-        end
-
-        false
-      end
-
-      # Authorization for authorization mode :warning
-      def authorize_with_warning(action)
-        role = ZeroAuthorization::Role.role
-        raise 'ZeroAuthorizationRoleNotAvailable' if role.nil?
-
-        if zero_authorized_core(role, action)
-          return true
-        else
-          logger.info 'ERROR: ZeroAuthorization: Not authorized to perform activity.'
-        end
-
-        false
-      end
-
-      # Authorization for authorization mode :superficial
-      def authorize_superficially(action)
-        logger.info 'ZeroAuthorizationMode: superficial. By passing authorization.'
-        return true
-      end
-
-      # Return authorization mode
-      def zero_authorized_checker(action)
-        if self.class.authorization_mode == :strict
-          return authorize_strictly(action)
-        elsif self.class.authorization_mode == :warning
-          return authorize_with_warning(action)
-        elsif self.class.authorization_mode == :superficial
-          return authorize_superficially(action)
-        else
-          raise 'InvalidAuthorizationMode'
-        end
-      end
-
-      # Core of authorization after reading/parsing rule set for current role
-      def zero_authorized_core(role, action)
-        _auth_flag = false
-        unless role.rule_set[:can_do].nil?
-          if role.rule_set[:can_do] == :anything
-            _auth_flag = true
-          elsif role.rule_set[:can_do].is_a?(Hash)
-            _auth_flag = true if (role.rule_set[:can_do][self.class.name.to_sym] || []).include?(action)
-          end
-        end
-        unless role.rule_set[:cant_do].nil?
-          if role.rule_set[:cant_do] == :anything
-            _auth_flag = false
-          elsif role.rule_set[:cant_do].is_a?(Hash)
-            _auth_flag = false if (role.rule_set[:cant_do][self.class.name.to_sym] || []).include?(action)
-          end
-        end
-        _auth_flag
-      end
-
-      def is_zero_authorized_4_save
-        zero_authorized_checker(:save)
-      end
-
-      def is_zero_authorized_4_create
-        zero_authorized_checker(:create)
-      end
-
-      def is_zero_authorized_4_update
-        zero_authorized_checker(:update)
-      end
-
-      def is_zero_authorized_4_destroy
-        zero_authorized_checker(:destroy)
-      end
-    end
-
-    module ClassMethods
-      attr_accessor :authorization_mode
-
-      def list_of_methods_to_guard
-        _model_methods_set = {}
-        Role.roles_n_privileges_hash.each do |role_key, permission_value|
-          unless permission_value[:can_do].nil?
-            _model_methods_set = _model_methods_set.merge(permission_value[:can_do]) { |key, oval, nval| ([oval] << [nval]).flatten.compact.uniq } if permission_value[:can_do].is_a?(Hash)
-          end
-          unless permission_value[:cant_do].nil?
-            _model_methods_set = _model_methods_set.merge(permission_value[:cant_do]) { |key, oval, nval| ([oval] << [nval]).flatten.compact.uniq } if permission_value[:cant_do].is_a?(Hash)
-          end
-        end
-
-        (_model_methods_set[self.name.to_sym] || []).clone.delete_if { |x| [:create, :save, :update, :destroy].include?(x) }
-      end
-
-      private
-      def initialize_authorization_mode
-        @authorization_mode = :strict # :strict, :warning and :superficial
-      end
-
-      # applying restriction on methods TODO 'it will be done by yml'
-      def initialize_methods_restriction
-        list_of_methods_to_guard.each do |method_name|
-          send(:alias_method, "za_#{method_name}", method_name)
-          define_method "#{method_name}" do |*args|
-            puts 'Restricted method call..'
-            send("za_#{method_name}", *args) if zero_authorized_checker(method_name)
-          end
-        end
-      end
-    end
-  end
-
-end
-
+require 'zero_authorization/role'
+require 'zero_authorization/engine'
+
+#Add these lines in initializer of rails application.
+#Rails.application.eager_load!
+#ActiveRecord::Base.descendants.each do |descendant|
+#  descendant.send(:include, ZeroAuthorization::Engine)
+#end

data/zero_authorization.gemspec

@@ -6,10 +6,10 @@ require 'zero_authorization/version'
 Gem::Specification.new do |spec|
   spec.name          = "zero_authorization"
   spec.version       = ZeroAuthorization::VERSION
-  spec.authors       = ["Rajeev Kannav Sharma"]
-  spec.email         = ["rajeevsharma86@gmail.com"]
-  spec.description   = %q{Write a gem description}
-  spec.summary       = %q{Write a gem summary}
+  spec.authors       = ["Rajeev Kannav Sharma", "Praveen Kumar Sinha"]
+  spec.email         = ["rajeevsharma86@gmail.com", "praveen.kumar.sinha@gmail.com"]
+  spec.description   = "Functionality to add authorization on Rails model's write operations plus any other set of defined methods."
+  spec.summary       = "How to setup: Specify what any specific role of current root entity(logged_user) can do/can't do in roles_n_privileges.yml and (re-)boot application."
   spec.homepage      = "https://github.com/rajeevkannav/zero_authorization"
   spec.license       = "MIT"
 
@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 1.3"
-  spec.add_development_dependency "rake"
-  spec.add_development_dependency "activesupport"
+  spec.add_development_dependency 'bundler', "~> 1.3"
+  spec.add_development_dependency 'rake', '~> 0'
+  spec.add_development_dependency 'activesupport', '~> 0'
 end

metadata

@@ -1,14 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: zero_authorization
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 1.0.0
 platform: ruby
 authors:
 - Rajeev Kannav Sharma
+- Praveen Kumar Sinha
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-09-10 00:00:00.000000000 Z
+date: 2014-02-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -28,33 +29,35 @@ dependencies:
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0'
-description: Write a gem description
+description: Functionality to add authorization on Rails model's write operations
+  plus any other set of defined methods.
 email:
 - rajeevsharma86@gmail.com
+- praveen.kumar.sinha@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -66,10 +69,11 @@ files:
 - README.md
 - Rakefile
 - lib/zero_authorization.rb
+- lib/zero_authorization/engine.rb
 - lib/zero_authorization/exceptions.rb
+- lib/zero_authorization/role.rb
 - lib/zero_authorization/version.rb
 - roles_n_privileges.yml
-- roles_n_privileges_1.yml
 - zero_authorization.gemspec
 homepage: https://github.com/rajeevkannav/zero_authorization
 licenses:
@@ -91,8 +95,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.3
+rubygems_version: 2.1.11
 signing_key: 
 specification_version: 4
-summary: Write a gem summary
+summary: 'How to setup: Specify what any specific role of current root entity(logged_user)
+  can do/can''t do in roles_n_privileges.yml and (re-)boot application.'
 test_files: []

data/roles_n_privileges_1.yml

@@ -1,42 +0,0 @@
----
-:role_root:
-  :can_do:
-    :User:
-    - :update
-    - :save
-  :cant_do:
-    :User:
-    - :destroy
-:role_prospect_designer:
-  :can_do:
-    :BuildingBlock:
-    - :create
-    - :save
-    - :update
-    - :destroy
-    - :finalize!
-    :ParameterGroup:
-    - :create
-    - :save
-    - :update
-    - :destroy
-    :BlockParameter:
-    - :create
-    - :save
-    - :update
-    - :destroy
-:role_plant_engineer:
-  :can_do:
-    :Recipe:
-    - :create
-    - :save
-    - :update
-    - :destroy
-:role_super_user:
-  :can_do:
-    :Plant:
-    - :create
-    - :save
-    - :update
-    - :destroy
-  :cant_do: :anything