Module: Rbacan

Defined in:

lib/rbacan.rb,
lib/rbacan/engine.rb,
lib/rbacan/version.rb,
app/models/rbacan/role.rb,
lib/rbacan/permittable.rb,
lib/rbacan/authorizable.rb,
lib/rbacan/view_helpers.rb,
lib/rbacan/authorization.rb,
lib/rbacan/not_authorized.rb,
app/models/rbacan/user_role.rb,
lib/rbacan/route_constraint.rb,
app/models/rbacan/permission.rb,
lib/rbacan/host_authorization.rb,
lib/rbacan/roles_and_permissions.rb,
app/models/rbacan/role_permission.rb,
app/models/rbacan/application_record.rb,
lib/generators/rbacan/install_generator.rb

Defined Under Namespace

Modules: Authorizable, Authorization, Generators, Permittable, RolesAndPermissions, ViewHelpers Classes: ApplicationRecord, AssignmentRequest, AuthorizationContext, AuthorizationRequest, ConfigurationError, Engine, Error, NotAuthorized, Permission, Role, RolePermission, RouteConstraint, UnsafeLegacyApi, UserRole

Constant Summary

VERSION =

'0.5.0'

@@authorization_adapter =

nil

@@assignment_adapter =

nil

@@legacy_mode =

false

@@permittable_class =

'User'

@@role_class =

'Rbacan::Role'

@@role_table =

'roles'

@@role_key =

:name

@@user_role_class =

'Rbacan::UserRole'

@@user_role_table =

'user_roles'

@@permission_class =

'Rbacan::Permission'

@@permission_table =

'permissions'

@@permission_key =

:name

@@role_permission_class =

'Rbacan::RolePermission'

@@role_permission_table =

'role_permissions'

@@unauthorized_handler =

:raise

@@unauthorized_redirect_path =

'/'

@@primary_key_type =

nil

@@tenant_scoped =

false

@@tenant_class =

'Tenant'

Class Method Summary

• .assign_permission_to_role(role_name, permission_name) ⇒ Object
• .assign_role(user:, role:, context:) ⇒ Object
• .authorized?(user:, permission: nil, role: nil, context:) ⇒ Boolean
• .configure {|_self| ... } ⇒ Object
• .create_permission(permission_name) ⇒ Object
• .create_role(role_name) ⇒ Object
• .ensure_legacy_mode!(method_name) ⇒ Object
• .resolve_primary_key_type ⇒ Object

  Resolves the effective primary key type.

• .revoke_role(user:, role:, context:) ⇒ Object

Class Method Details

.assign_permission_to_role(role_name, permission_name) ⇒ Object

# File 'lib/rbacan.rb', line 97

def self.assign_permission_to_role(role_name, permission_name)
  ensure_legacy_mode!(:assign_permission_to_role)

  chosen_role = @@role_class.constantize.find_by(@@role_key => role_name.to_s)
  given_permission = @@permission_class.constantize.find_by(@@permission_key => permission_name.to_s)
  @@role_permission_class.constantize.create(
    role_id: chosen_role.id,
    permission_id: given_permission.id
  )
end

.assign_role(user:, role:, context:) ⇒ Object

# File 'lib/rbacan/host_authorization.rb', line 118

def assign_role(user:, role:, context:)
  call_assignment_adapter(:assign, user: user, role: role, context: context)
end

.authorized?(user:, permission: nil, role: nil, context:) ⇒ Boolean

Returns:

• (Boolean)

# File 'lib/rbacan/host_authorization.rb', line 103

def authorized?(user:, permission: nil, role: nil, context:)
  validate_authorization_target!(permission, role)
  validate_context!(context)
  return false unless user && authorization_adapter

  request = AuthorizationRequest.new(
    user: user,
    permission: permission&.to_s,
    role: role&.to_s,
    context: context
  )

  !!call_authorization_adapter(request)
end

.configure {|_self| ... } ⇒ Object

Yields:

• (_self)

Yield Parameters:

• _self (Rbacan) —

  the object that the method was called on

# File 'lib/rbacan.rb', line 108

def self.configure
  yield self
end

.create_permission(permission_name) ⇒ Object

# File 'lib/rbacan.rb', line 91

def self.create_permission(permission_name)
  ensure_legacy_mode!(:create_permission)

  @@permission_class.constantize.create(@@permission_key => permission_name.to_s)
end

.create_role(role_name) ⇒ Object

# File 'lib/rbacan.rb', line 85

def self.create_role(role_name)
  ensure_legacy_mode!(:create_role)

  @@role_class.constantize.create(@@role_key => role_name.to_s)
end

.ensure_legacy_mode!(method_name) ⇒ Object

Raises:

• (UnsafeLegacyApi)

# File 'lib/rbacan/host_authorization.rb', line 96

def ensure_legacy_mode!(method_name)
  return if legacy_mode

  raise UnsafeLegacyApi,
        "#{method_name} is a legacy unscoped API; set Rbacan.legacy_mode = true to opt in"
end

.resolve_primary_key_type ⇒ Object

Resolves the effective primary key type. Checks the explicit config first, then falls back to the Rails generator config.

# File 'lib/rbacan.rb', line 77

def self.resolve_primary_key_type
  return primary_key_type if primary_key_type.present?

  Rails.configuration.generators.options.dig(:active_record, :primary_key_type)
rescue StandardError
  nil
end

.revoke_role(user:, role:, context:) ⇒ Object

# File 'lib/rbacan/host_authorization.rb', line 122

def revoke_role(user:, role:, context:)
  call_assignment_adapter(:revoke, user: user, role: role, context: context)
end