Module: RequestRefinery::ControllerMethods

Included in:
ApplicationController
Defined in:
lib/request_refinery.rb

Instance Method Summary collapse

Instance Method Details

#authorized_to?(omniParam, user: current_user, permissions: nil) ⇒ Boolean

returns a boolean indicating whether the user has the permission/permissions in omniParam the intended use is to pass it a symbol or an array of symbols, but there are various other options below: omniParam can be a string representing Permission.name, a symbol representing the same, or the actual Permission object omniParam can also be an array containg any combination of the aforementioned single parameters

Returns:

  • (Boolean) 


11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
 
# File 'lib/request_refinery.rb', line 11

def authorized_to? omniParam, user:current_user, permissions:nil
	perms = permissions
	perms = user.permission_syms if perms === nil or (!perms.is_a? Array or !perms[0].is_a? Symbol)

	return true if perms.include? :all

	if omniParam.is_a? Symbol
		return perms.include? omniParam
	elsif omniParam.is_a? String
		return perms.include? omniParam.to_sym
	elsif omniParam.is_a? RequestRefinery::Permission
		return perms.include? omniParam.name.to_sym
	elsif omniParam.is_a? Array
		return omniParam.all?{|x| authorized_to? x,user:user, permissions:perms}
	elsif omniParam.is_a? RequestRefinery::Permission::ActiveRecord_Associations_CollectionProxy
		return authorized_to? omniParam.to_a, user:user, permissions:perms
	elsif omniParam.is_a? Role	# not going to handle Role because that would weaken the connection between access to a resource and a specific permission
	elsif omniParam.is_a? Hash 	# does not make sense
	elsif omniParam.is_a? User 	# does not make sense
	else
		return false
	end
	return false
end

#enforce_request_permissions(user: current_user) ⇒ Object 



36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/request_refinery.rb', line 36

def enforce_request_permissions user:current_user
	# Allow all DeviseController methods
	return if self.class.superclass.to_s == DeviseController.to_s

	# collect the method, controller, and action
	# look for a matching controller filter
	filter = RequestRefinery::ControllerFilter.where(http_method:request.method.downcase,controller:self.class.to_s,action_name:@_action_name).first

	# look for a http_method specific controller-wide filter (ie - the action_name will be blank) if there is not one for the method, and use that filter for the request instead
	filter = RequestRefinery::ControllerFilter.where(http_method:request.method.downcase,controller:self.class.to_s,action_name:nil).first if filter.blank?

	# look for a controller-wide filter (ie - the action_name and http_method will be blank) if there is not one for the method, and use that filter for the request instead
	filter = RequestRefinery::ControllerFilter.where(http_method:nil,controller:self.class.to_s,action_name:nil).first if filter.blank?

	# look for an http_method-wide filter (only the http_method will be filled in) if there is not one for the controller (not recommended since this loosens the security)
	filter = RequestRefinery::ControllerFilter.where(http_method:request.method.downcase,controller:nil,action_name:nil).first if filter.blank?

	# handle unauthorized request with unauthorized_request method if filter.blank?
	return unauthorized_request if filter.blank?

	# get the required permissions and user permissions
	# handle unauthorized request with unauthorized_request method unless authorized_to? filter.permissions
	unauthorized_request(filter:filter) unless authorized_to? filter.permissions

	puts "\n\nConfirmed that #{user.email} is authorized to #{filter.http_method.upcase}::>#{filter.controller}.#{filter.action_name}\n\n" if authorized_to? filter.permissions
end

#unauthorized_request(user: current_user, filter: nil) ⇒ Object

can render any page, but a redirect will result in a redirect loop



64
65
66
67
68
 
# File 'lib/request_refinery.rb', line 64

def unauthorized_request user:current_user,filter:nil
	puts "\n\nNo filter matches the given http method, controller, or controller method, rerouting..." if filter.blank?
	puts "\n\nUser #{user.email} is not authorized to #{filter.http_method.upcase}::>#{filter.controller || 'all'}.#{filter.action_name || 'all'}, rerouting...\n\n" unless filter.blank?
	render json: "Unauthorized Request"
end