Module: Blacklight::AccessControls::Ability

Extended by:
ActiveSupport::Concern
Included in:
Ability
Defined in:
lib/blacklight/access_controls/ability.rb

Defined Under Namespace

Modules: ClassMethods

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#cache ⇒ Object (readonly)

Returns the value of attribute cache.



27
28
29
 
# File 'lib/blacklight/access_controls/ability.rb', line 27

def cache
  @cache
end

#current_user ⇒ Object (readonly)

Returns the value of attribute current_user.



27
28
29
 
# File 'lib/blacklight/access_controls/ability.rb', line 27

def current_user
  @current_user
end

#options ⇒ Object (readonly)

Returns the value of attribute options.



27
28
29
 
# File 'lib/blacklight/access_controls/ability.rb', line 27

def options
  @options
end

Class Method Details

.user_class ⇒ Object 



29
30
31
 
# File 'lib/blacklight/access_controls/ability.rb', line 29

def self.user_class
  Blacklight::AccessControls.config.user_model.constantize
end

Instance Method Details

#default_user_groups ⇒ Object

Everyone is automatically a member of group ‘public’



107
108
109
 
# File 'lib/blacklight/access_controls/ability.rb', line 107

def default_user_groups
  ['public']
end

#discover_groups(id) ⇒ Object

read implies discover, so discover_groups is the union of read and discover groups



112
113
114
115
116
117
118
 
# File 'lib/blacklight/access_controls/ability.rb', line 112

def discover_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dg = read_groups(id) | (doc[self.class.discover_group_field] || [])
  Rails.logger.debug("[CANCAN] discover_groups: #{dg.inspect}")
  dg
end

#discover_permissions ⇒ Object 



45
46
47
48
49
50
51
52
53
54
 
# File 'lib/blacklight/access_controls/ability.rb', line 45

def discover_permissions
  can :discover, String do |id|
    test_discover(id)
  end

  can :discover, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_discover(obj.id)
  end
end

#discover_users(id) ⇒ Object

read implies discover, so discover_users is the union of read and discover users



121
122
123
124
125
126
127
 
# File 'lib/blacklight/access_controls/ability.rb', line 121

def discover_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dp = read_users(id) | (doc[self.class.discover_user_field] || [])
  Rails.logger.debug("[CANCAN] discover_users: #{dp.inspect}")
  dp
end

#download_groups(id) ⇒ Object 



147
148
149
150
151
152
153
 
# File 'lib/blacklight/access_controls/ability.rb', line 147

def download_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dg = Array(doc[self.class.download_group_field])
  Rails.logger.debug("[CANCAN] download_groups: #{dg.inspect}")
  dg
end

#download_permissions ⇒ Object 



67
68
69
70
71
72
73
74
75
76
 
# File 'lib/blacklight/access_controls/ability.rb', line 67

def download_permissions
  can :download, String do |id|
    test_download(id)
  end

  can :download, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_download(obj.id)
  end
end

#download_users(id) ⇒ Object 



155
156
157
158
159
160
161
 
# File 'lib/blacklight/access_controls/ability.rb', line 155

def download_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dp = Array(doc[self.class.download_user_field])
  Rails.logger.debug("[CANCAN] download_users: #{dp.inspect}")
  dp
end

#grant_permissions ⇒ Object 



38
39
40
41
42
43
 
# File 'lib/blacklight/access_controls/ability.rb', line 38

def grant_permissions
  Rails.logger.debug('Usergroups are ' + user_groups.inspect)
  ability_logic.each do |method|
    send(method)
  end
end

#guest_user ⇒ Object

A user who isn’t logged in



34
35
36
 
# File 'lib/blacklight/access_controls/ability.rb', line 34

def guest_user
  Blacklight::AccessControls::Ability.user_class.new
end

#initialize(user, options = {}) ⇒ Object 



20
21
22
23
24
25
 
# File 'lib/blacklight/access_controls/ability.rb', line 20

def initialize(user, options = {})
  @current_user = user || guest_user
  @options = options
  @cache = Blacklight::AccessControls::PermissionsCache.new
  grant_permissions
end

#read_groups(id) ⇒ Object

download access implies read access, so read_groups is the union of download and read groups.



130
131
132
133
134
135
136
 
# File 'lib/blacklight/access_controls/ability.rb', line 130

def read_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  rg = download_groups(id) | Array(doc[self.class.read_group_field])
  Rails.logger.debug("[CANCAN] read_groups: #{rg.inspect}")
  rg
end

#read_permissions ⇒ Object 



56
57
58
59
60
61
62
63
64
65
 
# File 'lib/blacklight/access_controls/ability.rb', line 56

def read_permissions
  can :read, String do |id|
    test_read(id)
  end

  can :read, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_read(obj.id)
  end
end

#read_users(id) ⇒ Object

download access implies read access, so read_users is the union of download and read users.



139
140
141
142
143
144
145
 
# File 'lib/blacklight/access_controls/ability.rb', line 139

def read_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  rp = download_users(id) | Array(doc[self.class.read_user_field])
  Rails.logger.debug("[CANCAN] read_users: #{rp.inspect}")
  rp
end

#test_discover(id) ⇒ Object 



78
79
80
81
82
 
# File 'lib/blacklight/access_controls/ability.rb', line 78

def test_discover(id)
  Rails.logger.debug("[CANCAN] Checking discover permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & discover_groups(id)
  !group_intersection.empty? || discover_users(id).include?(current_user.user_key)
end

#test_download(id) ⇒ Object 



90
91
92
93
94
 
# File 'lib/blacklight/access_controls/ability.rb', line 90

def test_download(id)
  Rails.logger.debug("[CANCAN] Checking download permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & download_groups(id)
  !group_intersection.empty? || download_users(id).include?(current_user.user_key)
end

#test_read(id) ⇒ Object 



84
85
86
87
88
 
# File 'lib/blacklight/access_controls/ability.rb', line 84

def test_read(id)
  Rails.logger.debug("[CANCAN] Checking read permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & read_groups(id)
  !group_intersection.empty? || read_users(id).include?(current_user.user_key)
end

#user_groups ⇒ Object

You can override this method if you are using a different AuthZ (such as LDAP)



97
98
99
100
101
102
103
104
 
# File 'lib/blacklight/access_controls/ability.rb', line 97

def user_groups
  return @user_groups if @user_groups

  @user_groups = default_user_groups
  @user_groups |= current_user.groups if current_user.respond_to? :groups
  @user_groups |= ['registered'] unless current_user.new_record?
  @user_groups
end