Module: Auth::Authorization

Included in:
Server::Base
Defined in:
lib/jungle_path/app/auth/authorization.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.authorized_admin?(request, params, current_auth, db) ⇒ Boolean 



44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/jungle_path/app/auth/authorization.rb', line 44

def self.authorized_admin? request, params, current_auth, db
	authorized = false
	if current_auth.has_permission?(:admin)
		# auth_admin not allowed to deal with root users/keys/roles...

		authorized = true

		parts = request.path_info.split('/')

		allowed = {
			'organizations' => true,
			'user_organizations' => true,
			'images' => true,
			'sentiment_sets' => true,
			'events' => true,
			'sessions' => true,
			'moderators' => true,
			'foci' => true,
			'categories' => true
		}

		if request.path_info == "/users" # post...
			role_id = params[:role_id]
			authorized = false if role_id and JunglePath::SQL::UserRole.is_root_role_by_role_id(db, role_id) # :auth_admin not allowed to add a root user_role.

		elsif parts[1] == "users" # put or delete
			user_id = parts[2].to_i
			role_id = params[:role_id]
			authorized = false if JunglePath::SQL::UserRole.has_root_role_by_user_id(db, user_id) # :auth_admin not allowed to modify data related to a user with a role of root.
			authorized = false if authorized and role_id and JunglePath::SQL::UserRole.is_root_role_by_role_id(db, role_id) # :auth_admin not allowed to add a root user_role.

		elsif request.path_info == "/user_roles" # post...
			user_id = params[:user_id]
			role_id = params[:role_id]
			authorized = false if JunglePath::SQL::UserRole.has_root_role_by_user_id(db, user_id)
			authorized = false if authorized and JunglePath::SQL::UserRole.is_root_role_by_role_id(db, role_id)

		elsif parts[1] == "user_roles" # put or delete
			user_id = parts[2].to_i
			role_id = parts[3].to_i
			authorized = false if JunglePath::SQL::UserRole.has_root_role_by_user_id(db, user_id)
			authorized = false if authorized and JunglePath::SQL::UserRole.is_root_role_by_role_id(db, role_id)

		elsif allowed[parts[1]]
			authorized = true

		else
			authorized = false
		end
	end
	authorized
end

Instance Method Details

#set_authorization(route_access) ⇒ Object 



7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/jungle_path/app/auth/authorization.rb', line 7

def set_authorization route_access
	before do
		puts "verb: #{request.request_method}."
		puts "path: #{request.path_info}."

		authorized = false

		authorized = JunglePath::Authorization::Paths.is_open_path?(request, route_access)
		authorized = JunglePath::Authorization::Paths.is_authenticated_path?(request, route_access) unless authorized

		unless authorized
			if request.get?
				authorized = true if current_auth.has_permission?(:root)
				authorized = true if current_auth.has_permission?(:read)
			end

			if request.post? or request.put? or request.delete?
				authorized = true if current_auth.has_permission?(:root) unless authorized
				authorized = true if current_auth.has_permission?(:write) unless authorized
				authorized = true if request.path_info == "/query" and current_auth.has_permission?(:read) unless authorized
				authorized = true if request.path_info == "/users/#{current_user.id}" unless authorized
				authorized = true if Auth::Authorization.authorized_admin?(request, params, current_auth, db) unless authorized
				authorized = false if current_auth.has_restriction?(:read)
			end

			authorized = false if current_auth.has_restriction?(:query_only) unless JunglePath::Authorization::Paths.is_query_only_path? request, current_auth
		end

		unless authorized
			message = "request was not allowed.\n\nrequest: #{request.request_method} #{request.path_info}\nuser_name: #{current_user.user_name}\nroles: #{current_auth.roles}\npermissions: #{current_auth.permissions}\nrestrictions: #{current_auth.restrictions}"
			# http status code 403 Forbidden.
			puts "request status: 403\n#{message}."
			halt 403, message
		end
	end
end