Module: Vigilante::WatchedOperator

Defined in:
lib/vigilante/watched_operator.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.included(base) ⇒ Object 



4
5
6
7
8
9
10
 
# File 'lib/vigilante/watched_operator.rb', line 4

def self.included(base)
  base.has_many :authorizations, :foreign_key => 'operator_id', :dependent => :destroy
  base.has_many :abilities, :through => :authorizations

  base.accepts_nested_attributes_for :authorizations, :reject_if => proc {|x| x[:ability_id].blank?}, :allow_destroy => true
  base.attr_accessible :authorizations_attributes if base.respond_to?(:attr_accessible)
end

Instance Method Details

#add_authorization(role, extent = nil) ⇒ Object

Raises:

  • (StandardError) 


12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/vigilante/watched_operator.rb', line 12

def add_authorization(role, extent=nil)
  ability = Ability.find_by_name(role.downcase)
  raise StandardError.new("Role #{role} is not converted to a corresponding authorization. It does not exist.") if ability.nil?

  #    extent_params = {}
  #    unless extent.nil?
  #      extent_params[:extent] = extent.id
  #      extent_params[:extent_type] = extent.class.name
  #    end

  new_authorization = ::Authorization.create(:operator_id => self.id, :ability_id => ability.id)
  unless extent.nil?
    new_authorization.add_extent(extent)
  end
  authorizations << new_authorization
  new_authorization
end

#add_role(role) ⇒ Object

convenience method: needed?



62
63
64
 
# File 'lib/vigilante/watched_operator.rb', line 62

def add_role(role)
  find_or_create_authorization(role)
end

#add_to_extent(extent, role = nil) ⇒ Object

Extent-specific



94
95
96
97
98
 
# File 'lib/vigilante/watched_operator.rb', line 94

def add_to_extent(extent, role = nil)
  #### TODO: configure default role!!!
  role = 'can-read-all' if role.nil?
  find_or_create_authorization(role, extent)
end

#authorizations_by_ability_name(ability_name) ⇒ Object 



168
169
170
171
 
# File 'lib/vigilante/watched_operator.rb', line 168

def authorizations_by_ability_name(ability_name)
  #TODO: this can be written with better perfomance by using an SQL select instead of the ruby method select
  authorizations.select{|authorization|authorization.ability.name == ability_name}
end

#distinct_authorizations ⇒ Object 



164
165
166
 
# File 'lib/vigilante/watched_operator.rb', line 164

def distinct_authorizations
  authorizations.joins(:ability).select('distinct(name)')
end

#extent_role(extent) ⇒ Object 



100
101
102
103
104
105
106
107
108
 
# File 'lib/vigilante/watched_operator.rb', line 100

def extent_role(extent)
  return nil if extent.nil?
  self.reload.authorizations.each do |auth|
    if auth.has_extent?
      return auth.ability.name if auth.match_extent(extent)
    end
  end
  nil
end

#extent_roles ⇒ Object 



114
115
116
 
# File 'lib/vigilante/watched_operator.rb', line 114

def extent_roles
  self.authorizations.select{|x| x.has_extent? }.collect{|x| x.ability.name }
end

#extents_with_roles ⇒ Object 



118
119
120
121
122
123
124
125
126
127
128
129
130
 
# File 'lib/vigilante/watched_operator.rb', line 118

def extents_with_roles
  extent_hash = Hash.new { |h, k| h[k] = [] }
  self.authorizations.each do |authorization|
    if authorization.has_extent?
      authorization.authorization_extents.each do |x|
        extent_hash[x.extent_objid] << authorization.ability.name
      end
    else
      extent_hash[:all] << authorization.ability.name
    end
  end
  extent_hash
end

#find_authorization(role, extent = nil) ⇒ Object 



30
31
32
33
34
35
 
# File 'lib/vigilante/watched_operator.rb', line 30

def find_authorization(role, extent=nil)
  authorizations.each do |auth|
    return auth if auth.ability.name.downcase == role.downcase && (auth.match_extent(extent) || extent == :any)
  end
  nil
end

#find_or_create_authorization(role, extent = nil) ⇒ Object 



37
38
39
40
41
42
43
44
45
 
# File 'lib/vigilante/watched_operator.rb', line 37

def find_or_create_authorization(role, extent = nil)
  auth = find_authorization(role, :any)
  if auth.nil?
    auth = add_authorization(role, extent)
  elsif extent.present?
    auth.add_extent(extent)
  end
  auth
end

#has_extent? ⇒ Boolean

Returns:

  • (Boolean) 


110
111
112
 
# File 'lib/vigilante/watched_operator.rb', line 110

def has_extent?
  extent_roles.count >= 1
end

#max_ability(extent = nil) ⇒ Object 



77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/vigilante/watched_operator.rb', line 77

def max_ability(extent=nil)
  if extent && has_extent?
    result_max = 0
    self.reload.authorizations.each do |auth|
      if auth.has_extent?
        result_max = auth.ability.importance if auth.match_extent(extent) && auth.ability.importance > result_max
      end
    end
    result_max
  else
    @max_importance ||= abilities.maximum(:importance)
  end
end

#minimize_authorizations ⇒ Object 



173
174
175
176
177
178
179
180
181
182
183
184
185
186
 
# File 'lib/vigilante/watched_operator.rb', line 173

def minimize_authorizations
  distinct_authorizations.each do |ability|
    authorizations_with_possible_duplicates = authorizations_by_ability_name(ability.name)
    if authorizations_with_possible_duplicates.size > 1
      keep_auth = authorizations_with_possible_duplicates.delete_at(0)
      authorizations_with_possible_duplicates.each do |dup_auth|
        dup_auth.authorization_extents.each do |auth_ext|
          keep_auth.authorization_extents.create(:extent_objid => auth_ext.extent_objid, :extent_type => auth_ext.extent_type)
        end
        dup_auth.destroy
      end
    end
  end
end

#permits ⇒ Object 



198
199
200
 
# File 'lib/vigilante/watched_operator.rb', line 198

def permits
  @permissions ||= build_permissions_hash
end

#permits=(permissions) ⇒ Object

keep permits



193
194
195
196
 
# File 'lib/vigilante/watched_operator.rb', line 193

def permits=(permissions)
  # make a copy!
  @permissions = {}.merge(permissions)
end

#roles ⇒ Object

convenience method: list all assigned roles (without extent?)



67
68
69
70
71
 
# File 'lib/vigilante/watched_operator.rb', line 67

def roles
  # we can't use abilities as those are not defined when creating a new operator that is not yet saved
  #result = abilities.collect(&:name)
  authorizations.collect{|auth| auth.ability.try(:name)}
end

#roles=(roles_arr) ⇒ Object

an array containing any of existing ability-names

will add the corresponding ability



54
55
56
57
58
59
 
# File 'lib/vigilante/watched_operator.rb', line 54

def roles=(roles_arr)
  self.authorizations = []
  roles_arr.each do |role|
    find_or_create_authorization(role) unless role.blank?
  end
end

#show_roles ⇒ Object 



73
74
75
 
# File 'lib/vigilante/watched_operator.rb', line 73

def show_roles
  authorizations.collect {|a| a.ability.try(:name) + "[" + a.authorization_extents.collect{|e| e.extent}.join(',') + "]"}
end

#simplify_authorizations ⇒ Object 



157
158
159
160
161
162
 
# File 'lib/vigilante/watched_operator.rb', line 157

def simplify_authorizations
  if authorizations.count != distinct_authorizations.count
    minimize_authorizations
    self.reload
  end
end

#validate_authorizations(max_allowed_importance, only_with_extents) ⇒ Object 



133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
 
# File 'lib/vigilante/watched_operator.rb', line 133

def validate_authorizations(max_allowed_importance, only_with_extents)
  authorizations = self.authorizations

  authorizations.each do |auth|
    ability = auth.ability

    if ability.needs_extent? && auth.authorization_extents.empty?
      errors.add(:authorizations, "ability #{ability.name} requires an organisation!")
    end
    if ability.importance > max_allowed_importance || (!ability.needs_extent? && only_with_extents)
      errors.add(:authorizations, "you do not have the necessary permission to add ability #{ability.name}")
    end
  end

  logger.debug "###### Validate_operator_authorizations: authorizations = #{authorizations.inspect}"
  logger.debug "###### Validate_operator_authorizations: authorizations = #{abilities.inspect}"

  if authorizations.empty?
    valid? # add the other errors, if any
    errors.add(:authorizations, 'must have at least one ability')
  end
end