Class: RoadForest::Authorization::Manager

Inherits:
Object
  • Object
show all
Defined in:
lib/roadforest/authorization.rb

Constant Summary collapse

HASH_FUNCTION = 
"SHA256".freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(salt = nil, authenticator = nil, policy = nil) ⇒ Manager

Returns a new instance of Manager.



59
60
61
62
63
64
65
 
# File 'lib/roadforest/authorization.rb', line 59

def initialize(salt = nil, authenticator = nil, policy = nil)
  @grants = GrantsHolder.new(salt || "roadforest-insecure", HASH_FUNCTION)

  @authenticator = authenticator || AuthenticationChain.new(DefaultAuthenticationStore.new)
  @policy = policy || AuthorizationPolicy.new
  @policy.grants_holder = @grants
end

Instance Attribute Details

#authenticator ⇒ Object

Returns the value of attribute authenticator.



53
54
55
 
# File 'lib/roadforest/authorization.rb', line 53

def authenticator
  @authenticator
end

#grants ⇒ Object (readonly)

Returns the value of attribute grants.



55
56
57
 
# File 'lib/roadforest/authorization.rb', line 55

def grants
  @grants
end

#policy ⇒ Object

Returns the value of attribute policy.



54
55
56
 
# File 'lib/roadforest/authorization.rb', line 54

def policy
  @policy
end

Instance Method Details

#authorization(header, required_grants) ⇒ Object

:public means the request doesn’t need authorization :granted means that it does need authz but the credentials passed are

allowed to access the resource

:refused means that the credentials passed are not allowed to access

the resource

TODO: Resource needs to add s-maxage=0 for :granted requests or public for :public requests to the CacheControl header



85
86
87
88
89
90
91
92
93
94
95
96
97
 
# File 'lib/roadforest/authorization.rb', line 85

def authorization(header, required_grants)
  entity = authenticator.authenticate(header)

  return :refused if entity.nil?

  available_grants = policy.grants_for(entity)

  if required_grants.any?{|required| available_grants.include?(required)}
    return :granted
  else
    return :refused
  end
end

#build_grants(&block) ⇒ Object 



67
68
69
 
# File 'lib/roadforest/authorization.rb', line 67

def build_grants(&block)
  @grants.build_grants(&block)
end

#challenge(options) ⇒ Object 



71
72
73
 
# File 'lib/roadforest/authorization.rb', line 71

def challenge(options)
  @authenticator.challenge(options)
end