Module: Authorization::AuthorizationInController

Defined in:
lib/declarative_authorization/in_controller.rb

Defined Under Namespace

Modules: ClassMethods

Constant Summary collapse

DEFAULT_DENY = 
false
@@failed_auto_loading_is_not_found =

If attribute_check is set for filter_access_to, decl_auth will try to load the appropriate object from the current controller’s model with the id from params. If that fails, a 404 Not Found is often the right way to handle the error. If you have additional measures in place that restricts the find scope, handling this error as a permission denied might be a better way. Set failed_auto_loading_is_not_found to false for the latter behaviour.

true

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.failed_auto_loading_is_not_found=(new_value) ⇒ Object 



26
27
28
 
# File 'lib/declarative_authorization/in_controller.rb', line 26

def self.failed_auto_loading_is_not_found= (new_value)
  @@failed_auto_loading_is_not_found = new_value
end

.failed_auto_loading_is_not_found? ⇒ Boolean

Returns:

  • (Boolean) 


23
24
25
 
# File 'lib/declarative_authorization/in_controller.rb', line 23

def self.failed_auto_loading_is_not_found?
  @@failed_auto_loading_is_not_found
end

.included(base) ⇒ Object

:nodoc:



7
8
9
10
11
 
# File 'lib/declarative_authorization/in_controller.rb', line 7

def self.included(base) # :nodoc:
  base.extend(ClassMethods)
  base.hide_action :authorization_engine, :permitted_to?,
    :permitted_to!
end

Instance Method Details

#authorization_engine ⇒ Object

Returns the Authorization::Engine for the current controller.



31
32
33
 
# File 'lib/declarative_authorization/in_controller.rb', line 31

def authorization_engine
  @authorization_engine ||= Authorization::Engine.instance
end

#has_any_role?(*roles, &block) ⇒ Boolean

Intended to be used where you want to allow users with any single listed role to view the content in question

Returns:

  • (Boolean) 


91
92
93
94
95
96
97
98
 
# File 'lib/declarative_authorization/in_controller.rb', line 91

def has_any_role?(*roles,&block)
  user_roles = authorization_engine.roles_for(current_user)
  result = roles.any? do |role|
    user_roles.include?(role)
  end
  yield if result and block_given?
  result
end

#has_any_role_with_hierarchy?(*roles, &block) ⇒ Boolean

As has_any_role? except checks all roles included in the role hierarchy

Returns:

  • (Boolean) 


111
112
113
114
115
116
117
118
 
# File 'lib/declarative_authorization/in_controller.rb', line 111

def has_any_role_with_hierarchy?(*roles, &block)
  user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
  result = roles.any? do |role|
    user_roles.include?(role)
  end
  yield if result and block_given?
  result
end

#has_role?(*roles, &block) ⇒ Boolean

While permitted_to? is used for authorization, in some cases content should only be shown to some users without being concerned with authorization. E.g. to only show the most relevant menu options to a certain group of users. That is what has_role? should be used for.

Returns:

  • (Boolean) 


80
81
82
83
84
85
86
87
 
# File 'lib/declarative_authorization/in_controller.rb', line 80

def has_role? (*roles, &block)
  user_roles = authorization_engine.roles_for(current_user)
  result = roles.all? do |role|
    user_roles.include?(role)
  end
  yield if result and block_given?
  result
end

#has_role_with_hierarchy?(*roles, &block) ⇒ Boolean

As has_role? except checks all roles included in the role hierarchy

Returns:

  • (Boolean) 


101
102
103
104
105
106
107
108
 
# File 'lib/declarative_authorization/in_controller.rb', line 101

def has_role_with_hierarchy?(*roles, &block)
  user_roles = authorization_engine.roles_with_hierarchy_for(current_user)
  result = roles.all? do |role|
    user_roles.include?(role)
  end
  yield if result and block_given?
  result
end

#permitted_to!(privilege, object_or_sym = nil, options = {}, &block) ⇒ Object

Works similar to the permitted_to? method, but throws the authorization exceptions, just like Engine#permit!



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/declarative_authorization/in_controller.rb', line 51

def permitted_to! (privilege, object_or_sym = nil, options = {}, &block)
  context = object = nil
  if object_or_sym.nil?
    context = self.class.decl_auth_context
  elsif !object_or_sym.respond_to?(:proxy_reflection) and object_or_sym.is_a?(Symbol)
    context = object_or_sym
  else
    object = object_or_sym
  end

  non_bang = options.delete(:non_bang)
  args = [
    privilege,
    {:user => current_user,
     :object => object,
     :context => context,
     :skip_attribute_test => object.nil?}.merge(options)
  ]
  if non_bang
    authorization_engine.permit?(*args, &block)
  else
    authorization_engine.permit!(*args, &block)
  end
end

#permitted_to?(privilege, object_or_sym = nil, options = {}, &block) ⇒ Boolean

If the current user meets the given privilege, permitted_to? returns true and yields to the optional block. The attribute checks that are defined in the authorization rules are only evaluated if an object is given for context.

See examples for Authorization::AuthorizationHelper #permitted_to?

If no object or context is specified, the controller_name is used as context.

Returns:

  • (Boolean) 


45
46
47
 
# File 'lib/declarative_authorization/in_controller.rb', line 45

def permitted_to? (privilege, object_or_sym = nil, options = {}, &block)
  permitted_to!(privilege, object_or_sym, options.merge(:non_bang => true), &block)
end