Module: S3::Helpers::ACP

Included in:
S3::Helpers
Defined in:
lib/sinatra-s3/helpers/acp.rb

Instance Method Summary collapse

Instance Method Details

#acl_response_for(bit) ⇒ Object 



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
 
# File 'lib/sinatra-s3/helpers/acp.rb', line 10

def acl_response_for(bit)
  only_can_read_acp(bit)

  xml do |x|
    x.AccessControlPolicy :xmlns => "http://s3.amazonaws.com/doc/2006-03-01/" do
      x.Owner do
        x.ID bit.owner.key
        x.DisplayName bit.owner.
      end
      x.AccessControlList do
        bit.acl_list.each_pair do |key,acl|
          x.Grant do
            x.Grantee "xmlns:xsi" => "http://www.w3.org/2001/XMLSchema-instance", "xsi:type" => acl[:type] do
              if acl[:type] == "CanonicalUser"
                x.ID acl[:id]
                x.DisplayName acl[:name]
              else
                x.URI acl[:uri]
              end
            end
            x.Permission acl[:access]
          end
        end
      end
    end
  end
end

#only_can_read_acp(bit) ⇒ Object

Kick out any users which do not have acp read access to a certain resource.

Raises:

  • (S3::AccessDenied) 


6
 
# File 'lib/sinatra-s3/helpers/acp.rb', line 6

def only_can_read_acp bit; raise S3::AccessDenied unless bit.acp_readable_by? @user end

#only_can_write_acp(bit) ⇒ Object

Kick out any users which do not have acp write access to a certain resource.

Raises:

  • (S3::AccessDenied) 


8
 
# File 'lib/sinatra-s3/helpers/acp.rb', line 8

def only_can_write_acp bit; raise S3::AccessDenied unless bit.acp_writable_by? @user end

#requested_acl(slot = nil) ⇒ Object

Parse any ACL requests which have come in.



49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 
# File 'lib/sinatra-s3/helpers/acp.rb', line 49

def requested_acl(slot=nil)
  if slot && params.has_key?('acl')
    only_can_write_acp slot
    env['rack.input'].rewind
    data = env['rack.input'].read
    xml_request = REXML::Document.new(data).root
    xml_request.each_element('//Grant') do |element|
      new_perm = element.elements['Permission'].text
      new_access = "#{Bit.acl_text.invert[new_perm]}00".to_i(8)
      grantee = element.elements['Grantee']

      case grantee.attributes["type"]
      when "CanonicalUser"
        user_check = User.find_by_key(grantee.elements["ID"].text)
        unless user_check.nil? || slot.owner.id == user_check.id
          update_user_access(slot,user_check,new_access)
        end
      when "Group"
        if grantee.elements['URI'].text =~ /AuthenticatedUsers/
          slot.access &= ~(slot.access.to_s(8)[1,1].to_i*10)
          slot.access |= (Bit.acl_text.invert[new_perm]*10).to_s.to_i(8)
        end
        if grantee.elements['URI'].text =~ /AllUsers/
          slot.access &= ~slot.access.to_s(8)[2,1].to_i
          slot.access |= Bit.acl_text.invert[new_perm].to_s.to_i(8)
        end
        slot.save()
      when "AmazonCustomerByEmail"
        user_check = User.find_by_email(grantee.elements["EmailAddress"].text)
        unless user_check.nil? || slot.owner.id == user_check.id
          update_user_access(slot,user_check,new_access)
        end
      when ""
      else
        raise NotImplemented
      end
    end
    {}
  else
	  if @amz['acl'].nil?
	    access = slot.access unless slot.nil?
	    access ||= slot.parent.access unless slot.nil? || slot.parent.nil?
	  else
	    access = CANNED_ACLS[@amz['acl']]
	  end
	  { :access => access.nil? ? CANNED_ACLS['private'] : access }
  end
end

#update_user_access(slot, user, access) ⇒ Object 



38
39
40
41
42
43
44
45
46
 
# File 'lib/sinatra-s3/helpers/acp.rb', line 38

def update_user_access(slot,user,access)
  if slot.acl_list[user.key]
    unless access == slot.acl_list[user.key][:access]
      BitsUser.update_all("access = #{access}", ["bit_id = ? AND user_id = ?", slot.id, user.id ])
    end
  else
    BitsUser.create(:bit_id => slot.id, :user_id => user.id, :access => access)
  end
end