Class: Legion::Rbac::DenyRule

Inherits:
Object
  • Object
show all
Includes:
Logging::Helper
Defined in:
lib/legion/rbac/permission.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(resource_pattern:, above_level: nil) ⇒ DenyRule

Returns a new instance of DenyRule.



52
53
54
55
56
 
# File 'lib/legion/rbac/permission.rb', line 52

def initialize(resource_pattern:, above_level: nil)
  @resource_pattern = resource_pattern
  @above_level = above_level
  @resource_regex = self.class.send(:pattern_to_regex, resource_pattern)
end

Instance Attribute Details

#above_level ⇒ Object (readonly)

Returns the value of attribute above_level.



50
51
52
 
# File 'lib/legion/rbac/permission.rb', line 50

def above_level
  @above_level
end

#resource_pattern ⇒ Object (readonly)

Returns the value of attribute resource_pattern.



50
51
52
 
# File 'lib/legion/rbac/permission.rb', line 50

def resource_pattern
  @resource_pattern
end

Instance Method Details

#matches?(resource, **opts) ⇒ Boolean

Returns:

  • (Boolean) 


58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/legion/rbac/permission.rb', line 58

def matches?(resource, **opts)
  return false unless pattern_matches?(resource)

  if above_level.nil?
    log.debug("RBAC deny rule matched pattern=#{resource_pattern} resource=#{resource}")
    return true
  end

  level = opts[:level]
  return false if level.nil?

  matched = level > above_level
  log.debug("RBAC deny rule matched pattern=#{resource_pattern} resource=#{resource} level=#{level} above_level=#{above_level}") if matched
  matched
end