Module: CommandTower::Authorization::EffectiveEntityGrants

Defined in:
lib/command_tower/authorization/effective_entity_grants.rb

Overview

Composed RBAC graph → effective entity name sets. Backend policy only. Not a frontend authorization shortcut.

Constant Summary collapse

ALL = 
:all

Class Method Summary collapse

Class Method Details

.allow_everything?(user) ⇒ Boolean

Returns:

  • (Boolean) 


12
13
14
15
16
17
 
# File 'lib/command_tower/authorization/effective_entity_grants.rb', line 12

def allow_everything?(user)
  Array(user.roles).any? do |role_name|
    role = CommandTower::Authorization::Role.roles[role_name]
    role&.allow_everything
  end
end

.for_role(role_name) ⇒ Object 



39
40
41
 
# File 'lib/command_tower/authorization/effective_entity_grants.rb', line 39

def for_role(role_name)
  for_role_names([role_name])
end

.for_role_names(role_names) ⇒ Object 



25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/command_tower/authorization/effective_entity_grants.rb', line 25

def for_role_names(role_names)
  names = Array(role_names).map(&:to_s)
  if names.any? { |name| CommandTower::Authorization::Role.roles[name]&.allow_everything }
    return ALL
  end

  names.each_with_object(Set.new) do |name, grants|
    role = CommandTower::Authorization::Role.roles[name]
    next unless role

    role.entities.each { |entity| grants << entity.name.to_s }
  end
end

.for_user(user) ⇒ Object 



19
20
21
22
23
 
# File 'lib/command_tower/authorization/effective_entity_grants.rb', line 19

def for_user(user)
  return ALL if allow_everything?(user)

  for_role_names(Array(user.roles))
end

.includes?(grants, entity_name) ⇒ Boolean

Returns:

  • (Boolean) 


43
44
45
 
# File 'lib/command_tower/authorization/effective_entity_grants.rb', line 43

def includes?(grants, entity_name)
  grants == ALL || grants.include?(entity_name.to_s)
end

.subset?(candidate_grants, actor_grants) ⇒ Boolean

Returns:

  • (Boolean) 


47
48
49
50
51
52
 
# File 'lib/command_tower/authorization/effective_entity_grants.rb', line 47

def subset?(candidate_grants, actor_grants)
  return true if actor_grants == ALL
  return false if candidate_grants == ALL

  candidate_grants.subset?(actor_grants)
end