Class: Lanes::API::AuthenticationProvider

Inherits:
Object
  • Object
show all
Defined in:
lib/lanes/access/authentication_provider.rb,
lib/lanes/api/null_authentication_provider.rb

Constant Summary collapse

USER = 
DummyUser.new

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(request) ⇒ AuthenticationProvider

Returns a new instance of AuthenticationProvider.



7
8
9
 
# File 'lib/lanes/access/authentication_provider.rb', line 7

def initialize(request)
    @request=request
end

Instance Attribute Details

#request ⇒ Object (readonly)

Returns the value of attribute request.



5
6
7
 
# File 'lib/lanes/access/authentication_provider.rb', line 5

def request
  @request
end

Instance Method Details

#allowed_access_to?(klass, options = {}) ⇒ Boolean

Returns:

  • (Boolean) 


35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/lanes/access/authentication_provider.rb', line 35

def allowed_access_to?(klass, options = {})
    return true if options[:public] == true and current_user.nil?
    return false if current_user.nil?
    case request.request_method
    when 'GET'
        klass.can_read_attributes?(request.params,current_user)
    when 'POST','PATCH','PUT'
        klass.can_write_attributes?(request.params,current_user)
    when 'DELETE'
        klass.can_delete_attributes?(request.params,current_user)
    else
        false
    end
end

#current_user ⇒ Object 



11
12
13
14
15
16
17
18
19
 
# File 'lib/lanes/access/authentication_provider.rb', line 11

def current_user
    @current_user ||= (
        if Lanes.env.test? && request.env['HTTP_X_TESTING_USER'].present?
            Lanes::User.where(login: request.env['HTTP_X_TESTING_USER']).first
        else
            Lanes::User.where(id: request.session['user_id']).first
        end
    )
end

#error_message ⇒ Object 



21
22
23
 
# File 'lib/lanes/access/authentication_provider.rb', line 21

def error_message
    current_user ? "User not found" : error_message_for_access
end

#error_message_for_access ⇒ Object 



25
26
27
28
29
30
31
32
33
 
# File 'lib/lanes/access/authentication_provider.rb', line 25

def error_message_for_access
    return "Unable to " + case request.request_method
                          when 'GET' then "read"
                          when 'POST','PATCH','PUT' then "write"
                          when 'DELETE' then "delete"
                          else
                              "perform action"
                          end
end

#fail_request(req) ⇒ Object 



70
71
72
73
74
75
76
 
# File 'lib/lanes/access/authentication_provider.rb', line 70

def fail_request(req)
    Lanes.logger.warn request.env['HTTP_X_TESTING_USER']
    Lanes.logger.warn "Unauthorized access attempted to #{req.url}"
    req.halt( 401, Oj.dump({
        success:false, errors: {user: "Access Denied"}, message: "Access Denied"
    }))
end

#wrap_model_access(model, req, options) ⇒ Object 



60
61
62
63
64
65
66
67
68
 
# File 'lib/lanes/access/authentication_provider.rb', line 60

def wrap_model_access(model, req, options = {})
    if allowed_access_to?(model, options)
        ::Lanes::User.scoped_to(current_user) do | user |
            yield
        end
    else
        fail_request(req)
    end
end

#wrap_reply(model, req) ⇒ Object 



27
28
29
 
# File 'lib/lanes/api/null_authentication_provider.rb', line 27

def wrap_reply(model, req)
    yield
end

#wrap_request(req) ⇒ Object 



50
51
52
53
54
55
56
57
58
 
# File 'lib/lanes/access/authentication_provider.rb', line 50

def wrap_request(req)
    if current_user
        ::Lanes::User.scoped_to(current_user) do | user |
            yield
        end
    else
        fail_request(req)
    end
end