Module: Clickwrap::Verification

Defined in:
lib/clickwrap/verification.rb

Overview

Answers "does this actor currently satisfy this policy?" and, when the answer is no, exactly why.

The convention across the whole gem is consistent: predicates answer booleans, verify returns a Result, and bang methods raise a typed error carrying that same Result. An application should never have to parse an English message to make an authorization decision, so the reason is always one of the stable symbols in Clickwrap::Vocabulary::VERIFICATION_ERRORS and the human sentence is localized separately.

Defined Under Namespace

Classes: Result

Constant Summary collapse

UNSPECIFIED = 
Object.new.freeze

Class Method Summary collapse

Class Method Details

.verify(policy_or_event, actor: nil, subject: nil, tenant: nil, acting_for: UNSPECIFIED, policy: nil, at: nil, require_current_revision: false) ⇒ Object

Verifies a policy for an actor, or re-verifies one specific recorded event. Both are the same question asked from different ends: the first is "is there current evidence", the second is "is this evidence still good for this exact operation".

"The same question" is a promise, so both ends answer every part of it. subject: re-derives the subject fingerprint from the live record, and require_current_revision: true re-asks whether the act was made under the wording that is current now — on an event id exactly as on a policy key. That is the whole reason a host never has to reach into Clickwrap::PolicyRevision or Clickwrap::SubjectFingerprint to ask "is this old evidence still good?":

Clickwrap.verify(event_id, subject: order_batch, require_current_revision: true)


135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
 
# File 'lib/clickwrap/verification.rb', line 135

def verify(policy_or_event, actor: nil, subject: nil, tenant: nil, acting_for: UNSPECIFIED,
           policy: nil, at: nil, require_current_revision: false)
  at ||= Clickwrap.now

  if policy_or_event.is_a?(String) && Identifier.valid?(policy_or_event)
    verify_event(policy_or_event, policy: policy, subject: subject,
                                  acting_for: acting_for, at: at,
                                  require_current_revision: require_current_revision)
  else
    acting_for = nil if acting_for.equal?(UNSPECIFIED)
    verify_policy(policy_or_event, actor: actor, subject: subject, tenant: tenant,
                                   acting_for: acting_for, at: at,
                                   require_current_revision: require_current_revision)
  end
end