Exception: CurrentScope::AccessDenied

Inherits:
StandardError
  • Object
show all
Defined in:
lib/current_scope.rb

Overview

Raised when the resolver denies an action gated by Guard (or when the management UI is accessed without a full-access role). Accessors:

#permission — denied key (stable API for branded 403s). Defaults to the
            positional message when permission: is omitted so legacy
            raise sites still populate it. Prefer this over #message.
#message    — StandardError message (positional arg). Gem raise sites pass
            the key as both message and permission; they can diverge if
            a caller passes an explicit permission: keyword.
#reason     — machine-readable cause (also on X-Current-Scope-Reason)
#record     — the record under decision when the gate had one; nil for
            collection / impersonation-gate denials
#subject    — effective subject when known; nil if none was in scope

Reasons surfaced by current_scope_denied:

:sod_veto           — the record's initiator can't perform an SoD action on it
:no_grant           — nothing granted the permission (the default deny)
:model_undeclared   — a record-less deny that a scoped grant would have
                    opened, had the controller declared current_scope_model
                    to bind it to a type (#50). Fail-closed, with the fix named.
:model_invalid      — its sibling: current_scope_model WAS declared but
                    returned something the shape guard refuses (a String,
                    an instance, an abstract class — not a concrete AR
                    class). Same cell, different fix, so a different label.
:impersonation_gate — a mutation while impersonating, which is read-only
:not_full_access    — the engine's management UI, which only full_access enters

Every denial in the gem raises this and lands in current_scope_denied, so a denial cannot exist that forgets its reason. (:sod_bypassed is the one audited ALLOW, so it is set by the Guard rather than raised here.)

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(message = nil, reason: nil, permission: nil, record: nil, subject: nil) ⇒ AccessDenied

Returns a new instance of AccessDenied.



50
51
52
53
54
55
56
57
58
 
# File 'lib/current_scope.rb', line 50

def initialize(message = nil, reason: nil, permission: nil, record: nil, subject: nil)
  super(message)
  @reason = reason
  # permission defaults to message so older raise sites and branded-403
  # recipes that only pass the key positionally still populate #permission.
  @permission = permission || message
  @record = record
  @subject = subject
end

Instance Attribute Details

#permission ⇒ Object (readonly)

Returns the value of attribute permission.



48
49
50
 
# File 'lib/current_scope.rb', line 48

def permission
  @permission
end

#reason ⇒ Object (readonly)

Returns the value of attribute reason.



48
49
50
 
# File 'lib/current_scope.rb', line 48

def reason
  @reason
end

#record ⇒ Object (readonly)

Returns the value of attribute record.



48
49
50
 
# File 'lib/current_scope.rb', line 48

def record
  @record
end

#subject ⇒ Object (readonly)

Returns the value of attribute subject.



48
49
50
 
# File 'lib/current_scope.rb', line 48

def subject
  @subject
end