Skip to content

Commit 582549d

Browse files
zwalkerzwalker
committed
zw - refactoring common code out of praxis and rails versions of authorization modules
1 parent 23df862 commit 582549d

File tree

3 files changed

+107
-184
lines changed

3 files changed

+107
-184
lines changed

‎lib/declarative_authorization/in_controller.rb‎

Lines changed: 2 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
# Authorization::AuthorizationInController
21
require File.dirname(__FILE__) + '/authorization.rb'
2+
require File.dirname(__FILE__) + '/in_controller_common.rb'
33

44
module Authorization
55
module AuthorizationInController
6+
include AuthorizationInControllerCommon
67

78
def self.included(base) # :nodoc:
89
base.extend(ClassMethods)
@@ -11,96 +12,6 @@ def self.included(base) # :nodoc:
1112
end
1213
end
1314

14-
DEFAULT_DENY = false
15-
16-
# If attribute_check is set for filter_access_to, decl_auth_context will try to
17-
# load the appropriate object from the current controller's model with
18-
# the id from params[:id]. If that fails, a 404 Not Found is often the
19-
# right way to handle the error. If you have additional measures in place
20-
# that restricts the find scope, handling this error as a permission denied
21-
# might be a better way. Set failed_auto_loading_is_not_found to false
22-
# for the latter behavior.
23-
@@failed_auto_loading_is_not_found = true
24-
def self.failed_auto_loading_is_not_found?
25-
@@failed_auto_loading_is_not_found
26-
end
27-
def self.failed_auto_loading_is_not_found=(new_value)
28-
@@failed_auto_loading_is_not_found = new_value
29-
end
30-
31-
# Returns the Authorization::Engine for the current controller.
32-
def authorization_engine
33-
@authorization_engine ||= Authorization::Engine.instance
34-
end
35-
36-
# If the current user meets the given privilege, permitted_to? returns true
37-
# and yields to the optional block. The attribute checks that are defined
38-
# in the authorization rules are only evaluated if an object is given
39-
# for context.
40-
#
41-
# See examples for Authorization::AuthorizationHelper #permitted_to?
42-
#
43-
# If no object or context is specified, the controller_name is used as
44-
# context.
45-
#
46-
def permitted_to?(privilege, object_or_sym = nil, options = {})
47-
if authorization_engine.permit!(privilege, options_for_permit(object_or_sym, options, false))
48-
yield if block_given?
49-
true
50-
else
51-
false
52-
end
53-
end
54-
55-
# Works similar to the permitted_to? method, but
56-
# throws the authorization exceptions, just like Engine#permit!
57-
def permitted_to!(privilege, object_or_sym = nil, options = {})
58-
authorization_engine.permit!(privilege, options_for_permit(object_or_sym, options, true))
59-
end
60-
61-
# While permitted_to? is used for authorization, in some cases
62-
# content should only be shown to some users without being concerned
63-
# with authorization. E.g. to only show the most relevant menu options
64-
# to a certain group of users. That is what has_role? should be used for.
65-
def has_role?(*roles)
66-
user_roles = authorization_engine.roles_for(current_user)
67-
result = roles.all? do |role|
68-
user_roles.include?(role)
69-
end
70-
yield if result and block_given?
71-
result
72-
end
73-
74-
# Intended to be used where you want to allow users with any single listed role to view
75-
# the content in question
76-
def has_any_role?(*roles)
77-
user_roles = authorization_engine.roles_for(current_user)
78-
result = roles.any? do |role|
79-
user_roles.include?(role)
80-
end
81-
yield if result and block_given?
82-
result
83-
end
84-
85-
# As has_role? except checks all roles included in the role hierarchy
86-
def has_role_with_hierarchy?(*roles)
87-
user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
88-
result = roles.all? do |role|
89-
user_roles.include?(role)
90-
end
91-
yield if result and block_given?
92-
result
93-
end
94-
95-
# As has_any_role? except checks all roles included in the role hierarchy
96-
def has_any_role_with_hierarchy?(*roles)
97-
user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
98-
result = roles.any? do |role|
99-
user_roles.include?(role)
100-
end
101-
yield if result and block_given?
102-
result
103-
end
10415

10516
protected
10617
def filter_access_filter # :nodoc:

‎lib/declarative_authorization/in_controller_common.rb‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
# require File.dirname(__FILE__) + '/authorization.rb'
2+
3+
module Authorization
4+
module AuthorizationInControllerCommon
5+
6+
DEFAULT_DENY = false
7+
8+
def self.included(base)
9+
base.module_eval do
10+
# If attribute_check is set for filter_access_to, decl_auth_context will try to
11+
# load the appropriate object from the current controller's model with
12+
# the id from params[:id]. If that fails, a 404 Not Found is often the
13+
# right way to handle the error. If you have additional measures in place
14+
# that restricts the find scope, handling this error as a permission denied
15+
# might be a better way. Set failed_auto_loading_is_not_found to false
16+
# for the latter behavior.
17+
@@failed_auto_loading_is_not_found = true
18+
19+
def self.failed_auto_loading_is_not_found?
20+
@@failed_auto_loading_is_not_found
21+
end
22+
23+
def self.failed_auto_loading_is_not_found=(new_value)
24+
@@failed_auto_loading_is_not_found = new_value
25+
end
26+
end
27+
end
28+
29+
# Returns the Authorization::Engine for the current controller.
30+
def authorization_engine
31+
@authorization_engine ||= Authorization::Engine.instance
32+
end
33+
34+
# If the current user meets the given privilege, permitted_to? returns true
35+
# and yields to the optional block. The attribute checks that are defined
36+
# in the authorization rules are only evaluated if an object is given
37+
# for context.
38+
#
39+
# See examples for Authorization::AuthorizationHelper #permitted_to?
40+
#
41+
# If no object or context is specified, the controller_name is used as
42+
# context.
43+
#
44+
def permitted_to?(privilege, object_or_sym = nil, options = {})
45+
if authorization_engine.permit!(privilege, options_for_permit(object_or_sym, options, false))
46+
yield if block_given?
47+
true
48+
else
49+
false
50+
end
51+
end
52+
53+
# Works similar to the permitted_to? method, but
54+
# throws the authorization exceptions, just like Engine#permit!
55+
def permitted_to!(privilege, object_or_sym = nil, options = {})
56+
authorization_engine.permit!(privilege, options_for_permit(object_or_sym, options, true))
57+
end
58+
59+
# While permitted_to? is used for authorization, in some cases
60+
# content should only be shown to some users without being concerned
61+
# with authorization. E.g. to only show the most relevant menu options
62+
# to a certain group of users. That is what has_role? should be used for.
63+
def has_role?(*roles)
64+
user_roles = authorization_engine.roles_for(current_user)
65+
result = roles.all? do |role|
66+
user_roles.include?(role)
67+
end
68+
yield if result and block_given?
69+
result
70+
end
71+
72+
# Intended to be used where you want to allow users with any single listed role to view
73+
# the content in question
74+
def has_any_role?(*roles)
75+
user_roles = authorization_engine.roles_for(current_user)
76+
result = roles.any? do |role|
77+
user_roles.include?(role)
78+
end
79+
yield if result and block_given?
80+
result
81+
end
82+
83+
# As has_role? except checks all roles included in the role hierarchy
84+
def has_role_with_hierarchy?(*roles)
85+
user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
86+
result = roles.all? do |role|
87+
user_roles.include?(role)
88+
end
89+
yield if result and block_given?
90+
result
91+
end
92+
93+
# As has_any_role? except checks all roles included in the role hierarchy
94+
def has_any_role_with_hierarchy?(*roles)
95+
user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
96+
result = roles.any? do |role|
97+
user_roles.include?(role)
98+
end
99+
yield if result and block_given?
100+
result
101+
end
102+
end
103+
end

‎lib/declarative_authorization/in_praxis_controller.rb‎

Lines changed: 2 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
# Authorization::AuthorizationInController
21
require File.dirname(__FILE__) + '/authorization.rb'
2+
require File.dirname(__FILE__) + '/in_controller_common.rb'
33

44
module Authorization
55
module AuthorizationInPraxisController
6+
include AuthorizationInControllerCommon
67

78
def self.included(base) # :nodoc:
89
base.extend(ClassMethods)
@@ -13,97 +14,6 @@ def self.included(base) # :nodoc:
1314
end
1415
end
1516

16-
DEFAULT_DENY = false
17-
18-
# If attribute_check is set for filter_access_to, decl_auth_context will try to
19-
# load the appropriate object from the current controller's model with
20-
# the id from params[:id]. If that fails, a 404 Not Found is often the
21-
# right way to handle the error. If you have additional measures in place
22-
# that restricts the find scope, handling this error as a permission denied
23-
# might be a better way. Set failed_auto_loading_is_not_found to false
24-
# for the latter behavior.
25-
@@failed_auto_loading_is_not_found = true
26-
def self.failed_auto_loading_is_not_found?
27-
@@failed_auto_loading_is_not_found
28-
end
29-
def self.failed_auto_loading_is_not_found=(new_value)
30-
@@failed_auto_loading_is_not_found = new_value
31-
end
32-
33-
# Returns the Authorization::Engine for the current controller.
34-
def authorization_engine
35-
@authorization_engine ||= Authorization::Engine.instance
36-
end
37-
38-
# If the current user meets the given privilege, permitted_to? returns true
39-
# and yields to the optional block. The attribute checks that are defined
40-
# in the authorization rules are only evaluated if an object is given
41-
# for context.
42-
#
43-
# See examples for Authorization::AuthorizationHelper #permitted_to?
44-
#
45-
# If no object or context is specified, the controller_name is used as
46-
# context.
47-
#
48-
def permitted_to?(privilege, object_or_sym = nil, options = {})
49-
if authorization_engine.permit!(privilege, options_for_permit(object_or_sym, options, false))
50-
yield if block_given?
51-
true
52-
else
53-
false
54-
end
55-
end
56-
57-
# Works similar to the permitted_to? method, but
58-
# throws the authorization exceptions, just like Engine#permit!
59-
def permitted_to!(privilege, object_or_sym = nil, options = {})
60-
authorization_engine.permit!(privilege, options_for_permit(object_or_sym, options, true))
61-
end
62-
63-
# While permitted_to? is used for authorization, in some cases
64-
# content should only be shown to some users without being concerned
65-
# with authorization. E.g. to only show the most relevant menu options
66-
# to a certain group of users. That is what has_role? should be used for.
67-
def has_role?(*roles)
68-
user_roles = authorization_engine.roles_for(current_user)
69-
result = roles.all? do |role|
70-
user_roles.include?(role)
71-
end
72-
yield if result and block_given?
73-
result
74-
end
75-
76-
# Intended to be used where you want to allow users with any single listed role to view
77-
# the content in question
78-
def has_any_role?(*roles)
79-
user_roles = authorization_engine.roles_for(current_user)
80-
result = roles.any? do |role|
81-
user_roles.include?(role)
82-
end
83-
yield if result and block_given?
84-
result
85-
end
86-
87-
# As has_role? except checks all roles included in the role hierarchy
88-
def has_role_with_hierarchy?(*roles)
89-
user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
90-
result = roles.all? do |role|
91-
user_roles.include?(role)
92-
end
93-
yield if result and block_given?
94-
result
95-
end
96-
97-
# As has_any_role? except checks all roles included in the role hierarchy
98-
def has_any_role_with_hierarchy?(*roles)
99-
user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
100-
result = roles.any? do |role|
101-
user_roles.include?(role)
102-
end
103-
yield if result and block_given?
104-
result
105-
end
106-
10717
def controller_name
10818
self.class.name.demodulize.underscore
10919
end
@@ -151,7 +61,6 @@ def filter_access_filter # :nodoc:
15161
send(:permission_denied)
15262
else
15363
Praxis::Responses::Forbidden.new(body: "You are not allowed to access this action.")
154-
# send(:render, :plain => "You are not allowed to access this action.", :status => :forbidden)
15564
end
15665
end
15766
end

0 commit comments

Comments
 (0)