Class: Mumukit::Auth::Permissions

Inherits:
Object
  • Object
show all
Includes:
Protection, Roles
Defined in:
lib/mumukit/auth/permissions.rb

Constant Summary

Constants included from Roles

Roles::ROLES

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Protection

#protect!, #protect_delegation!

Constructor Details

#initialize(scopes = {}) ⇒ Permissions

Returns a new instance of Permissions.



9
10
11
12
13
 
# File 'lib/mumukit/auth/permissions.rb', line 9

def initialize(scopes={})
  raise 'invalid scopes' if scopes.any? { |key, value| value.class != Mumukit::Auth::Scope }

  @scopes = scopes.with_indifferent_access
end

Instance Attribute Details

#scopes ⇒ Object

Returns the value of attribute scopes.



7
8
9
 
# File 'lib/mumukit/auth/permissions.rb', line 7

def scopes
  @scopes
end

Class Method Details

.dump(permission) ⇒ Object 



83
84
85
 
# File 'lib/mumukit/auth/permissions.rb', line 83

def self.dump(permission)
  permission.to_json
end

.load(json) ⇒ Object 



75
76
77
78
79
80
81
 
# File 'lib/mumukit/auth/permissions.rb', line 75

def self.load(json)
  if json.nil?
    parse({})
  else
    parse(JSON.parse(json))
  end
end

.parse(hash) ⇒ Object 



64
65
66
67
68
 
# File 'lib/mumukit/auth/permissions.rb', line 64

def self.parse(hash)
  return new if hash.blank?

  new(hash.map { |role, grants| [role, Mumukit::Auth::Scope.parse(grants)] }.to_h)
end

.reparse(something) ⇒ Object 



70
71
72
73
 
# File 'lib/mumukit/auth/permissions.rb', line 70

def self.reparse(something)
  something ||= {}
  parse(something.to_h)
end

Instance Method Details

#==(other) ⇒ Object Also known as: eql? 



100
101
102
 
# File 'lib/mumukit/auth/permissions.rb', line 100

def ==(other)
  self.class == other.class && self.scopes == other.scopes
end

#accessible_organizations ⇒ Object 



31
32
33
 
# File 'lib/mumukit/auth/permissions.rb', line 31

def accessible_organizations
  scope_for(:student)&.grants&.map { |grant| grant.to_mumukit_slug.organization }.to_set
end

#add_permission!(role, *grants) ⇒ Object 



35
36
37
 
# File 'lib/mumukit/auth/permissions.rb', line 35

def add_permission!(role, *grants)
  scope_for(role).add_grant! *grants
end

#as_json(options = {}) ⇒ Object 



60
61
62
 
# File 'lib/mumukit/auth/permissions.rb', line 60

def as_json(options={})
  scopes.as_json(options)
end

#as_set ⇒ Object 



96
97
98
 
# File 'lib/mumukit/auth/permissions.rb', line 96

def as_set
  Set.new scopes.flat_map { |role, scope| scope.grants.map {|grant| [role, grant]} }
end

#assign_to?(other, previous) ⇒ Boolean

Returns:

  • (Boolean) 


87
88
89
90
 
# File 'lib/mumukit/auth/permissions.rb', line 87

def assign_to?(other, previous)
  diff = previous.as_set ^ other.as_set
  diff.all? { |role, grant| has_permission?(role, grant) }
end

#delegate_to?(other) ⇒ Boolean

Returns:

  • (Boolean) 


52
53
54
 
# File 'lib/mumukit/auth/permissions.rb', line 52

def delegate_to?(other)
  other.scopes.all? { |role, scope| has_all_permissions?(role, scope) }
end

#grant_strings_for(role) ⇒ Object 



56
57
58
 
# File 'lib/mumukit/auth/permissions.rb', line 56

def grant_strings_for(role)
  scope_for(role).grants.map(&:to_s)
end

#has_permission?(role, resource_slug) ⇒ Boolean

Returns:

  • (Boolean) 


15
16
17
 
# File 'lib/mumukit/auth/permissions.rb', line 15

def has_permission?(role, resource_slug)
  Mumukit::Auth::Role.parse(role).allows?(resource_slug, self)
end

#has_role?(role) ⇒ Boolean

Returns:

  • (Boolean) 


23
24
25
 
# File 'lib/mumukit/auth/permissions.rb', line 23

def has_role?(role)
  scopes[role].present?
end

#hash ⇒ Object 



106
107
108
 
# File 'lib/mumukit/auth/permissions.rb', line 106

def hash
  scopes.hash
end

#inspect ⇒ Object 



114
115
116
 
# File 'lib/mumukit/auth/permissions.rb', line 114

def inspect
  "<Mumukit::Auth::Permissions #{to_s}>"
end

#merge(other) ⇒ Object 



39
40
41
 
# File 'lib/mumukit/auth/permissions.rb', line 39

def merge(other)
  self.class.new(scopes.merge(other.scopes) { |_key, left, right| left.merge right })
end

#protect_permissions_assignment!(other, previous) ⇒ Object

Raises:



92
93
94
 
# File 'lib/mumukit/auth/permissions.rb', line 92

def protect_permissions_assignment!(other, previous)
  raise Mumukit::Auth::UnauthorizedAccessError unless assign_to?(self.class.reparse(other), previous)
end

#remove_permission!(role, grant) ⇒ Object 



43
44
45
 
# File 'lib/mumukit/auth/permissions.rb', line 43

def remove_permission!(role, grant)
  scope_for(role).remove_grant!(grant)
end

#role_allows?(role, resource_slug) ⇒ Boolean

Returns:

  • (Boolean) 


19
20
21
 
# File 'lib/mumukit/auth/permissions.rb', line 19

def role_allows?(role, resource_slug)
  scope_for(role).allows?(resource_slug)
end

#scope_for(role) ⇒ Object 



27
28
29
 
# File 'lib/mumukit/auth/permissions.rb', line 27

def scope_for(role)
  self.scopes[role] ||= Mumukit::Auth::Scope.new
end

#to_h ⇒ Object 



118
119
120
 
# File 'lib/mumukit/auth/permissions.rb', line 118

def to_h
  as_json
end

#to_s ⇒ Object 



110
111
112
 
# File 'lib/mumukit/auth/permissions.rb', line 110

def to_s
  '!' + scopes.map { |role, scope| "#{role}:#{scope}" }.join(';')
end

#update_permission!(role, old_grant, new_grant) ⇒ Object 



47
48
49
50
 
# File 'lib/mumukit/auth/permissions.rb', line 47

def update_permission!(role, old_grant, new_grant)
  remove_permission! role, old_grant
  add_permission! role, new_grant
end