Class: Checkpoint::Authority

Inherits:
Object
  • Object
show all
Defined in:
lib/checkpoint/authority.rb

Overview

An Authority is the central point of contact for authorization questions in Checkpoint. It checks whether there are permits that would allow a given action to be taken.

Defined Under Namespace

Classes: RejectAll

Instance Method Summary collapse

Constructor Details

#initialize(agent_resolver: Agent::Resolver.new, credential_resolver: Credential::Resolver.new, resource_resolver: Resource::Resolver.new, permits: Permits.new) ⇒ Authority 



13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/checkpoint/authority.rb', line 13

def initialize(
  agent_resolver: Agent::Resolver.new,
  credential_resolver: Credential::Resolver.new,
  resource_resolver: Resource::Resolver.new,
  permits: Permits.new)

  @agent_resolver      = agent_resolver
  @credential_resolver = credential_resolver
  @resource_resolver   = resource_resolver
  @permits             = permits
end

Instance Method Details

#permits?(agent, credential, resource) ⇒ Boolean 



25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/checkpoint/authority.rb', line 25

def permits?(agent, credential, resource)
  # Conceptually equivalent to:
  #   can?(agent, action, target)
  #   can?(current_user, 'edit', @listing)

  #  user   => agent tokens
  #  action => credential tokens
  #  target => resource tokens

  # Permit.where(agent: agents, credential: credentials, resource: resources)
  # SELECT * FROM permits
  # WHERE agent IN('user:gkostin', 'account-type:umich', 'affiliation:lib-staff')
  # AND credential IN('permission:edit', 'role:editor')
  # AND resource IN('listing:17', 'type:listing')

  #  agent_type, agent_id    | cred_type, cred_id | resource_type, resource_id
  #  ------------------------------------------------------------------------
  #  'user:gkostin'          | 'permission:edit'  | 'listing:17'
  #  'account-type:umich'    | 'role:editor'      | 'type:listing'
  #  'affiliation:lib-staff' |                    | 'listing:*'

  #        ^^^                       ^^^^              ^^^^
  #   if current_user has at least one row in each of of these columns,
  #   they have been "granted permission"
  permits.for(
    agent_resolver.resolve(agent),
    credential_resolver.resolve(credential),
    resource_resolver.resolve(resource)
  ).any?
end