Class: Mumukit::Auth::Permissions

Inherits:
Object
  • Object
show all
Includes:
Protection, Roles
Defined in:
lib/mumukit/auth/permissions.rb

Constant Summary

Constants included from Roles

Roles::ROLES

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Protection

#protect!, #protect_delegation!

Constructor Details

#initialize(scopes = {}) ⇒ Permissions

Returns a new instance of Permissions.



9
10
11
12
13
 
# File 'lib/mumukit/auth/permissions.rb', line 9

def initialize(scopes={})
  raise 'invalid scopes' if scopes.any? { |key, value| value.class != Mumukit::Auth::Scope }

  @scopes = scopes.with_indifferent_access
end

Instance Attribute Details

#scopes ⇒ Object

Returns the value of attribute scopes.



7
8
9
 
# File 'lib/mumukit/auth/permissions.rb', line 7

def scopes
  @scopes
end

Class Method Details

.dump(permission) ⇒ Object 



100
101
102
 
# File 'lib/mumukit/auth/permissions.rb', line 100

def self.dump(permission)
  permission.to_json
end

.load(json) ⇒ Object 



92
93
94
95
96
97
98
 
# File 'lib/mumukit/auth/permissions.rb', line 92

def self.load(json)
  if json.nil?
    parse({})
  else
    parse(JSON.parse(json))
  end
end

.parse(hash) ⇒ Object 



81
82
83
84
85
 
# File 'lib/mumukit/auth/permissions.rb', line 81

def self.parse(hash)
  return new if hash.blank?

  new(hash.map { |role, grants| [role, Mumukit::Auth::Scope.parse(grants)] }.to_h)
end

.reparse(something) ⇒ Object 



87
88
89
90
 
# File 'lib/mumukit/auth/permissions.rb', line 87

def self.reparse(something)
  something ||= {}
  parse(something.to_h)
end

Instance Method Details

#==(other) ⇒ Object Also known as: eql? 



117
118
119
 
# File 'lib/mumukit/auth/permissions.rb', line 117

def ==(other)
  self.class == other.class && self.scopes == other.scopes
end

#accessible_organizations ⇒ Object

Deprecated: use ‘student_granted_organizations` organizations instead



32
33
34
35
36
 
# File 'lib/mumukit/auth/permissions.rb', line 32

def accessible_organizations
  warn "Don't use accessible_organizations, since this method is probably not doing what you would expect.\n" +
       "Use student_granted_organizations if you still need its behaviour"
  student_granted_organizations
end

#add_permission!(role, *grants) ⇒ Object 



52
53
54
 
# File 'lib/mumukit/auth/permissions.rb', line 52

def add_permission!(role, *grants)
  scope_for(role).add_grant! *grants
end

#any_granted_organizations ⇒ Object 



44
45
46
 
# File 'lib/mumukit/auth/permissions.rb', line 44

def any_granted_organizations
  scopes.values.flat_map(&:grants).map(&:organization).to_set
end

#as_json(options = {}) ⇒ Object 



77
78
79
 
# File 'lib/mumukit/auth/permissions.rb', line 77

def as_json(options={})
  scopes.as_json(options)
end

#as_set ⇒ Object 



113
114
115
 
# File 'lib/mumukit/auth/permissions.rb', line 113

def as_set
  Set.new scopes.flat_map { |role, scope| scope.grants.map {|grant| [role, grant]} }
end

#assign_to?(other, previous) ⇒ Boolean

Returns:

  • (Boolean) 


104
105
106
107
 
# File 'lib/mumukit/auth/permissions.rb', line 104

def assign_to?(other, previous)
  diff = previous.as_set ^ other.as_set
  diff.all? { |role, grant| has_permission?(role, grant) }
end

#delegate_to?(other) ⇒ Boolean

Returns:

  • (Boolean) 


69
70
71
 
# File 'lib/mumukit/auth/permissions.rb', line 69

def delegate_to?(other)
  other.scopes.all? { |role, scope| has_all_permissions?(role, scope) }
end

#grant_strings_for(role) ⇒ Object 



73
74
75
 
# File 'lib/mumukit/auth/permissions.rb', line 73

def grant_strings_for(role)
  scope_for(role).grants.map(&:to_s)
end

#granted_organizations_for(role) ⇒ Object 



48
49
50
 
# File 'lib/mumukit/auth/permissions.rb', line 48

def granted_organizations_for(role)
  scope_for(role)&.grants&.map(&:organization).to_set
end

#has_permission?(role, resource_slug) ⇒ Boolean

Returns:

  • (Boolean) 


15
16
17
 
# File 'lib/mumukit/auth/permissions.rb', line 15

def has_permission?(role, resource_slug)
  Mumukit::Auth::Role.parse(role).allows?(resource_slug, self)
end

#has_role?(role) ⇒ Boolean

Returns:

  • (Boolean) 


23
24
25
 
# File 'lib/mumukit/auth/permissions.rb', line 23

def has_role?(role)
  scopes[role].present?
end

#hash ⇒ Object 



123
124
125
 
# File 'lib/mumukit/auth/permissions.rb', line 123

def hash
  scopes.hash
end

#inspect ⇒ Object 



131
132
133
 
# File 'lib/mumukit/auth/permissions.rb', line 131

def inspect
  "<Mumukit::Auth::Permissions #{to_s}>"
end

#merge(other) ⇒ Object 



56
57
58
 
# File 'lib/mumukit/auth/permissions.rb', line 56

def merge(other)
  self.class.new(scopes.merge(other.scopes) { |_key, left, right| left.merge right })
end

#protect_permissions_assignment!(other, previous) ⇒ Object

Raises:



109
110
111
 
# File 'lib/mumukit/auth/permissions.rb', line 109

def protect_permissions_assignment!(other, previous)
  raise Mumukit::Auth::UnauthorizedAccessError unless assign_to?(self.class.reparse(other), previous)
end

#remove_permission!(role, grant) ⇒ Object 



60
61
62
 
# File 'lib/mumukit/auth/permissions.rb', line 60

def remove_permission!(role, grant)
  scope_for(role).remove_grant!(grant)
end

#role_allows?(role, resource_slug) ⇒ Boolean

Returns:

  • (Boolean) 


19
20
21
 
# File 'lib/mumukit/auth/permissions.rb', line 19

def role_allows?(role, resource_slug)
  scope_for(role).allows?(resource_slug)
end

#scope_for(role) ⇒ Object 



27
28
29
 
# File 'lib/mumukit/auth/permissions.rb', line 27

def scope_for(role)
  self.scopes[role] ||= Mumukit::Auth::Scope.new
end

#student_granted_organizations ⇒ Object

Answers the organizations for which the user has been explicitly granted acceses as student. This method does not include the organizations the user has access because of the roles hierarchy



40
41
42
 
# File 'lib/mumukit/auth/permissions.rb', line 40

def student_granted_organizations
  granted_organizations_for :student
end

#to_h ⇒ Object 



135
136
137
 
# File 'lib/mumukit/auth/permissions.rb', line 135

def to_h
  as_json
end

#to_s ⇒ Object 



127
128
129
 
# File 'lib/mumukit/auth/permissions.rb', line 127

def to_s
  '!' + scopes.map { |role, scope| "#{role}:#{scope}" }.join(';')
end

#update_permission!(role, old_grant, new_grant) ⇒ Object 



64
65
66
67
 
# File 'lib/mumukit/auth/permissions.rb', line 64

def update_permission!(role, old_grant, new_grant)
  remove_permission! role, old_grant
  add_permission! role, new_grant
end