Class: Checkpoint::Authority

Inherits:
Object
  • Object
show all
Defined in:
lib/checkpoint/authority.rb

Overview

An Authority is the central point of contact for authorization questions in Checkpoint. It checks whether there are permits that would allow a given action to be taken.

Defined Under Namespace

Classes: RejectAll

Instance Method Summary collapse

Constructor Details

#initialize(agent_resolver: Agent::Resolver.new, credential_resolver: Credential::Resolver.new, resource_resolver: Resource::Resolver.new, permits: Permits.new) ⇒ Authority

Returns a new instance of Authority.



13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/checkpoint/authority.rb', line 13

def initialize(
  agent_resolver: Agent::Resolver.new,
  credential_resolver: Credential::Resolver.new,
  resource_resolver: Resource::Resolver.new,
  permits: Permits.new)

  @agent_resolver      = agent_resolver
  @credential_resolver = credential_resolver
  @resource_resolver   = resource_resolver
  @permits             = permits
end

Instance Method Details

#permits?(agent, credential, resource) ⇒ Boolean

Returns:

  • (Boolean) 


25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/checkpoint/authority.rb', line 25

def permits?(agent, credential, resource)
  # Conceptually equivalent to:
  #   can?(agent, action, target)
  #   can?(current_user, 'edit', @listing)

  #  user   => agent tokens
  #  action => credential tokens
  #  target => resource tokens

  # Permit.where(agent: agents, credential: credentials, resource: resources)
  # SELECT * FROM permits
  # WHERE agent IN('user:gkostin', 'account-type:umich', 'affiliation:lib-staff')
  # AND credential IN('permission:edit', 'role:editor')
  # AND resource IN('listing:17', 'type:listing')

  #  agent_type, agent_id    | cred_type, cred_id | resource_type, resource_id
  #  ------------------------------------------------------------------------
  #  'user:gkostin'          | 'permission:edit'  | 'listing:17'
  #  'account-type:umich'    | 'role:editor'      | 'type:listing'
  #  'affiliation:lib-staff' |                    | 'listing:*'

  #        ^^^                       ^^^^              ^^^^
  #   if current_user has at least one row in each of of these columns,
  #   they have been "granted permission"
  permits.for(
    agent_resolver.resolve(agent),
    credential_resolver.resolve(credential),
    resource_resolver.resolve(resource)
  ).any?
end