Class: HaveAPI::Authorization

Inherits:
Object
  • Object
show all
Defined in:
lib/haveapi/authorization.rb

Instance Method Summary collapse

Constructor Details

#initialize(&block) ⇒ Authorization

Returns a new instance of Authorization.



3
4
5
 
# File 'lib/haveapi/authorization.rb', line 3

def initialize(&block)
  @blocks = [block]
end

Instance Method Details

#allow ⇒ Object 



64
65
66
 
# File 'lib/haveapi/authorization.rb', line 64

def allow
  throw(:rule, true)
end

#authorized?(user, path_params) ⇒ Boolean

Returns true if user is authorized. Block must call allow to authorize user, default rule is deny.

Returns:



14
15
16
17
18
19
20
21
22
23
24
 
# File 'lib/haveapi/authorization.rb', line 14

def authorized?(user, path_params)
  @restrict = []

  catch(:rule) do
    @blocks.each do |block|
      instance_exec(user, path_params, &block)
    end

    deny # will not be called if some block throws allow
  end
end

#deny ⇒ Object 



68
69
70
 
# File 'lib/haveapi/authorization.rb', line 68

def deny
  throw(:rule, false)
end

#filter_input(input, params) ⇒ Object 



86
87
88
 
# File 'lib/haveapi/authorization.rb', line 86

def filter_input(input, params)
  filter_inner(input, @input, params, false)
end

#filter_output(output, params, format = false) ⇒ Object 



90
91
92
 
# File 'lib/haveapi/authorization.rb', line 90

def filter_output(output, params, format = false)
  filter_inner(output, @output, params, format)
end

#initialize_clone(other) ⇒ Object 



7
8
9
10
 
# File 'lib/haveapi/authorization.rb', line 7

def initialize_clone(other)
  super
  @blocks = other.instance_variable_get('@blocks').clone
end

#input(whitelist: nil, blacklist: nil) ⇒ Object

Restrict parameters client can set/change.

Parameters:

  • whitelist (Array<Symbol>) (defaults to: nil) —

    allow only listed parameters

  • blacklist (Array<Symbol>) (defaults to: nil) —

    allow all parameters except listed ones



47
48
49
50
51
52
 
# File 'lib/haveapi/authorization.rb', line 47

def input(whitelist: nil, blacklist: nil)
  @input = {
    whitelist:,
    blacklist:
  }
end

#output(whitelist: nil, blacklist: nil) ⇒ Object

Restrict parameters client can retrieve.

Parameters:

  • whitelist (Array<Symbol>) (defaults to: nil) —

    allow only listed parameters

  • blacklist (Array<Symbol>) (defaults to: nil) —

    allow all parameters except listed ones



57
58
59
60
61
62
 
# File 'lib/haveapi/authorization.rb', line 57

def output(whitelist: nil, blacklist: nil)
  @output = {
    whitelist:,
    blacklist:
  }
end

#permitted_input_names(params) ⇒ Object 



94
95
96
 
# File 'lib/haveapi/authorization.rb', line 94

def permitted_input_names(params)
  permitted_params(params, @input).map(&:name)
end

#prepend_block(block) ⇒ Object 



26
27
28
 
# File 'lib/haveapi/authorization.rb', line 26

def prepend_block(block)
  @blocks.insert(0, block)
end

#restrict(**kwargs) ⇒ Object

Apply restrictions on query which selects objects from database. Most common usage is restrict user to access only objects he owns.



32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/haveapi/authorization.rb', line 32

def restrict(**kwargs)
  normalized = normalize_hash_keys(kwargs)

  normalized.each do |key, value|
    @restrict.each do |restriction|
      deny if restriction.has_key?(key) && restriction[key] != value
    end
  end

  @restrict << normalized
end

#restrictions ⇒ Object 



72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/haveapi/authorization.rb', line 72

def restrictions
  ret = {}

  @restrict.each do |r|
    r.each do |key, value|
      deny if ret.has_key?(key) && ret[key] != value

      ret[key] = value
    end
  end

  ret
end