Class: CommandTower::Authorize::Validate

Inherits:
Object
  • Object
show all
Includes:
ServiceLogging
Defined in:
app/services/command_tower/authorize/validate.rb

Overview

RBAC decision for a controller action. Shared by the engine's authorize_user! transport filter and the modern AuthorizeRequest service, so it stays a plain domain object with a narrow decision contract.

Defined Under Namespace

Classes: Decision

Constant Summary collapse

NOT_REQUIRED_MSG = 
"Authorization not required at this time"
AUTHORIZED_MSG = 
"User is Authorized for action"
UNAUTHORIZED_MSG = 
"Unauthorized Access. Incorrect User Privileges"

Class Method Summary collapse

Instance Method Summary collapse

Methods included from ServiceLogging

included

Constructor Details

#initialize(user:, controller:, method:) ⇒ Validate

Returns a new instance of Validate.



41
42
43
44
45
 
# File 'app/services/command_tower/authorize/validate.rb', line 41

def initialize(user:, controller:, method:)
  @user = user
  @controller = controller
  @action = method
end

Class Method Details

.call(user:, controller:, method:) ⇒ Object 



37
38
39
 
# File 'app/services/command_tower/authorize/validate.rb', line 37

def self.call(user:, controller:, method:)
  new(user:, controller:, method:).call
end

Instance Method Details

#call ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'app/services/command_tower/authorize/validate.rb', line 47

def call
  unless authorization_required?
    log_debug("controller:#{controller}; method:#{action} -- No Authorization required")
    return Decision.authorized(user:, authorization_required: false, msg: NOT_REQUIRED_MSG)
  end

  # At this point we know authorization on the route is required
  # Iterate through the users roles to find a matching role that allows authorization
  # If at least 1 of the users roles passes validation, we can allow access to the path
  log_debug("User Roles: #{user.roles}")
  authorized = user_role_objects.any? do |_role_name, role_object|
    result = role_object.authorized?(controller:, method: action, user:)
    log_debug("Role:#{result[:role]};Authorized:[#{result[:authorized]}];Reason:[#{result[:reason]}]")
    result[:authorized] == true
  end

  unless authorized
    log_warn("controller:#{controller}; method:#{action} -- #{UNAUTHORIZED_MSG}")
    return Decision.denied(user:, msg: UNAUTHORIZED_MSG)
  end

  Decision.authorized(user:, authorization_required: true, msg: AUTHORIZED_MSG)
end