Module: Card::Set::All::Permissions

Extended by:
Card::Set
Defined in:
tmpsets/set/mod001-01_core/all/permissions.rb

Defined Under Namespace

Modules: Accounts, Follow

Instance Method Summary collapse

Methods included from Card::Set

abstract_set?, all_set?, card_accessor, card_reader, card_writer, clean_empty_module_from_hash, clean_empty_modules, define_active_job, define_event_method, define_event_perform_later_method, define_on_format, ensure_set, event, extended, format, phase_method, process_base_module_list, process_base_modules, register_set, register_set_format, shortname, view, write_tmp_file

Instance Method Details

#add_to_read_rule_update_queue(updates) ⇒ Object 



194
195
196
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 194

def add_to_read_rule_update_queue updates
  @read_rule_update_queue = Array.wrap(@read_rule_update_queue).concat updates
end

#deny_because(why) ⇒ Object 



71
72
73
74
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 71

def deny_because why
  @permission_errors << why if @permission_errors
  @action_ok = false
end

#have_recaptcha_keys? ⇒ Boolean

Returns:

  • (Boolean) 


232
233
234
235
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 232

def have_recaptcha_keys?
  @@have_recaptcha_keys = defined?(@@have_recaptcha_keys) ? @@have_recaptcha_keys :
    !!( Card.config.recaptcha_public_key && Card.config.recaptcha_private_key )
end

#ok!(action, opts = {}) ⇒ Object 



30
31
32
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 30

def ok! action, opts={}
  raise Card::PermissionDenied.new self unless ok? action, opts
end

#ok?(action) ⇒ Boolean

Returns:

  • (Boolean) 


17
18
19
20
21
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 17

def ok? action
  @action_ok = true
  send "ok_to_#{action}"
  @action_ok
end

#ok_to_comment ⇒ Object 



139
140
141
142
143
144
145
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 139

def ok_to_comment
  permit :comment, 'comment on'
  if @action_ok
    deny_because "No comments allowed on templates" if is_template?
    deny_because "No comments allowed on structured content" if structure
  end
end

#ok_to_create ⇒ Object 



103
104
105
106
107
108
109
110
111
112
113
114
115
116
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 103

def ok_to_create
  permit :create
  if @action_ok and junction?
    [:left, :right].each do |side|
      next if side==:left && @superleft   # left is supercard; create permissions will get checked there.
      part_card = send side, new: {}
      if part_card && part_card.new_card? # if no card, there must be other errors
        unless part_card.ok? :create
          deny_because you_cant("create #{part_card.name}")
        end
      end
    end
  end
end

#ok_to_delete ⇒ Object 



135
136
137
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 135

def ok_to_delete
  permit :delete
end

#ok_to_read ⇒ Object 



118
119
120
121
122
123
124
125
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 118

def ok_to_read
  if !Auth.always_ok?
    @read_rule_id ||= permission_rule_card(:read).first.id.to_i
    if !Auth.as_card.read_rules.member? @read_rule_id
      deny_because you_cant "read this"
    end
  end
end

#ok_to_update ⇒ Object 



127
128
129
130
131
132
133
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 127

def ok_to_update
  permit :update
  if @action_ok and type_id_changed? and !permitted? :create
    deny_because you_cant( "change to this type (need create permission)" )
  end
  ok_to_read if @action_ok
end

#ok_with_fetch?(action, opts = {}) ⇒ Boolean

Returns:

  • (Boolean) 


23
24
25
26
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 23

def ok_with_fetch? action, opts={}
  card = opts[:trait].nil? ? self : fetch(opts)
  card && card.ok_without_fetch?(action)
end

#permission_rule_card(action) ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 40

def permission_rule_card action
  opcard = rule_card action

  unless opcard # RULE missing.  should not be possible.  generalize this to handling of all required rules
    errors.add :permission_denied, "No #{action} rule for #{name}"
    raise Card::PermissionDenied.new(self)
  end

  rcard = Auth.as_bot do
    if ['_left','[[_left]]'].member?(opcard.db_content) && self.junction?  # compound cards can inherit permissions from left parent
      lcard = left_or_new( skip_virtual: true, skip_modules: true )
      if action==:create && lcard.real? && !lcard.action==:create
        action = :update
      end
      lcard.permission_rule_card(action).first
    else
      opcard
    end
  end
  return rcard, opcard.rule_class_name
end

#permit(action, verb = nil) ⇒ Object 



91
92
93
94
95
96
97
98
99
100
101
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 91

def permit action, verb=nil

  if Card.config.read_only # not called by ok_to_read
    deny_because "Currently in read-only mode"
  end

  verb ||= action.to_s
  unless permitted? action
    deny_because you_cant("#{verb} #{name.present? ? name : 'this'}")
  end
end

#permitted?(action) ⇒ Boolean

Returns:

  • (Boolean) 


76
77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 76

def permitted? action

  if !Card.config.read_only
    return true if action != :comment and Auth.always_ok?

    permitted_ids = who_can action
    if action == :comment && Auth.always_ok?
      # admin can comment if anyone can
      !permitted_ids.empty?
    else
      Auth.among? permitted_ids
    end
  end
end

#recaptcha_on? ⇒ Boolean

Returns:

  • (Boolean) 


223
224
225
226
227
228
229
230
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 223

def recaptcha_on?
  have_recaptcha_keys? &&
  Env[:controller]     &&
  !Auth.signed_in?     &&
  !Auth.needs_setup?   &&
  !Auth.always_ok?     &&
  Card.toggle( rule :captcha )
end

#rule_class_name ⇒ Object 



62
63
64
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 62

def rule_class_name
  trunk.type_id == Card::SetID ? cardname.trunk_name.tag : nil
end

#track_permission_errors ⇒ Object 



210
211
212
213
214
215
216
217
218
219
220
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 210

def track_permission_errors
  @permission_errors = []
  result = yield

  @permission_errors.each do |message|
    errors.add :permission_denied, message
  end
  @permission_errors = nil

  result
end

#update_read_rule ⇒ Object 



169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 169

def update_read_rule
  Card.record_timestamps = false

  reset_patterns # why is this needed?
  rcard, rclass = permission_rule_card :read
  self.read_rule_id = rcard.id #these two are just to make sure vals are correct on current object
  #warn "updating read rule for #{inspect} to #{rcard.inspect}, #{rclass}"

  self.read_rule_class = rclass
  Card.where(id: self.id).update_all(read_rule_id: rcard.id, read_rule_class: rclass)
  expire

  # currently doing a brute force search for every card that may be impacted.  may want to optimize(?)
  Auth.as_bot do
    Card.search(left: self.name).each do |plus_card|
      if plus_card.rule(:read) == '_left'
        plus_card.update_read_rule
      end
    end
  end

ensure
  Card.record_timestamps = true
end

#who_can(action) ⇒ Object 



34
35
36
37
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 34

def who_can action
  #warn "who_can[#{name}] #{(prc=permission_rule_card(action)).inspect}, #{prc.first.item_cards.map(&:id)}" if action == :update
  permission_rule_card(action).first.item_cards.map &:id
end

#you_cant(what) ⇒ Object 



66
67
68
 
# File 'tmpsets/set/mod001-01_core/all/permissions.rb', line 66

def you_cant what
  "You don't have permission to #{what}"
end