Module: Blacklight::AccessControls::Ability

Extended by:
ActiveSupport::Concern
Included in:
Ability
Defined in:
lib/blacklight/access_controls/ability.rb

Defined Under Namespace

Modules: ClassMethods

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#cache ⇒ Object (readonly)

Returns the value of attribute cache.



28
29
30
 
# File 'lib/blacklight/access_controls/ability.rb', line 28

def cache
  @cache
end

#current_user ⇒ Object (readonly)

Returns the value of attribute current_user.



28
29
30
 
# File 'lib/blacklight/access_controls/ability.rb', line 28

def current_user
  @current_user
end

#options ⇒ Object (readonly)

Returns the value of attribute options.



28
29
30
 
# File 'lib/blacklight/access_controls/ability.rb', line 28

def options
  @options
end

Class Method Details

.user_class ⇒ Object 



30
31
32
 
# File 'lib/blacklight/access_controls/ability.rb', line 30

def self.user_class
  Blacklight::AccessControls.config.user_model.constantize
end

Instance Method Details

#default_user_groups ⇒ Object

Everyone is automatically a member of group ‘public’



109
110
111
 
# File 'lib/blacklight/access_controls/ability.rb', line 109

def default_user_groups
  ['public']
end

#discover_groups(id) ⇒ Object

read implies discover, so discover_groups is the union of read and discover groups



114
115
116
117
118
119
120
 
# File 'lib/blacklight/access_controls/ability.rb', line 114

def discover_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dg = read_groups(id) | (doc[self.class.discover_group_field] || [])
  Rails.logger.debug("[CANCAN] discover_groups: #{dg.inspect}")
  dg
end

#discover_permissions ⇒ Object 



46
47
48
49
50
51
52
53
54
55
 
# File 'lib/blacklight/access_controls/ability.rb', line 46

def discover_permissions
  can :discover, String do |id|
    test_discover(id)
  end

  can :discover, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_discover(obj.id)
  end
end

#discover_users(id) ⇒ Object

read implies discover, so discover_users is the union of read and discover users



123
124
125
126
127
128
129
 
# File 'lib/blacklight/access_controls/ability.rb', line 123

def discover_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dp = read_users(id) | (doc[self.class.discover_user_field] || [])
  Rails.logger.debug("[CANCAN] discover_users: #{dp.inspect}")
  dp
end

#download_groups(id) ⇒ Object 



149
150
151
152
153
154
155
 
# File 'lib/blacklight/access_controls/ability.rb', line 149

def download_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dg = Array(doc[self.class.download_group_field])
  Rails.logger.debug("[CANCAN] download_groups: #{dg.inspect}")
  dg
end

#download_permissions ⇒ Object 



69
70
71
72
73
74
75
76
77
78
 
# File 'lib/blacklight/access_controls/ability.rb', line 69

def download_permissions
  can :download, String do |id|
    test_download(id)
  end

  can :download, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_download(obj.id)
  end
end

#download_users(id) ⇒ Object 



157
158
159
160
161
162
163
 
# File 'lib/blacklight/access_controls/ability.rb', line 157

def download_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dp = Array(doc[self.class.download_user_field])
  Rails.logger.debug("[CANCAN] download_users: #{dp.inspect}")
  dp
end

#grant_permissions ⇒ Object 



39
40
41
42
43
44
 
# File 'lib/blacklight/access_controls/ability.rb', line 39

def grant_permissions
  Rails.logger.debug('Usergroups are ' + user_groups.inspect)
  ability_logic.each do |method|
    send(method)
  end
end

#guest_user ⇒ Object

A user who isn’t logged in



35
36
37
 
# File 'lib/blacklight/access_controls/ability.rb', line 35

def guest_user
  Blacklight::AccessControls::Ability.user_class.new
end

#initialize(user, options = {}) ⇒ Object 



21
22
23
24
25
26
 
# File 'lib/blacklight/access_controls/ability.rb', line 21

def initialize(user, options = {})
  @current_user = user || guest_user
  @options = options
  @cache = Blacklight::AccessControls::PermissionsCache.new
  grant_permissions
end

#read_groups(id) ⇒ Object

download access implies read access, so read_groups is the union of download and read groups.



132
133
134
135
136
137
138
 
# File 'lib/blacklight/access_controls/ability.rb', line 132

def read_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  rg = download_groups(id) | Array(doc[self.class.read_group_field])
  Rails.logger.debug("[CANCAN] read_groups: #{rg.inspect}")
  rg
end

#read_permissions ⇒ Object 



57
58
59
60
61
62
63
64
65
66
67
 
# File 'lib/blacklight/access_controls/ability.rb', line 57

def read_permissions
  # Loading an object from your datastore might be slow (e.g. Fedora), so assume that if a string is passed, it's an object id
  can :read, String do |id|
    test_read(id)
  end

  can :read, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_read(obj.id)
  end
end

#read_users(id) ⇒ Object

download access implies read access, so read_users is the union of download and read users.



141
142
143
144
145
146
147
 
# File 'lib/blacklight/access_controls/ability.rb', line 141

def read_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  rp = download_users(id) | Array(doc[self.class.read_user_field])
  Rails.logger.debug("[CANCAN] read_users: #{rp.inspect}")
  rp
end

#test_discover(id) ⇒ Object 



80
81
82
83
84
 
# File 'lib/blacklight/access_controls/ability.rb', line 80

def test_discover(id)
  Rails.logger.debug("[CANCAN] Checking discover permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & discover_groups(id)
  !group_intersection.empty? || discover_users(id).include?(current_user.user_key)
end

#test_download(id) ⇒ Object 



92
93
94
95
96
 
# File 'lib/blacklight/access_controls/ability.rb', line 92

def test_download(id)
  Rails.logger.debug("[CANCAN] Checking download permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & download_groups(id)
  !group_intersection.empty? || download_users(id).include?(current_user.user_key)
end

#test_read(id) ⇒ Object 



86
87
88
89
90
 
# File 'lib/blacklight/access_controls/ability.rb', line 86

def test_read(id)
  Rails.logger.debug("[CANCAN] Checking read permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & read_groups(id)
  !group_intersection.empty? || read_users(id).include?(current_user.user_key)
end

#user_groups ⇒ Object

You can override this method if you are using a different AuthZ (such as LDAP)



99
100
101
102
103
104
105
106
 
# File 'lib/blacklight/access_controls/ability.rb', line 99

def user_groups
  return @user_groups if @user_groups

  @user_groups = default_user_groups
  @user_groups |= current_user.groups if current_user.respond_to? :groups
  @user_groups |= ['registered'] unless current_user.new_record?
  @user_groups
end