Class: Otto::Security::PermissionStrategy

Inherits:
AuthStrategy show all
Defined in:
lib/otto/security/authentication.rb

Overview

Permission-based authentication strategy

Instance Method Summary collapse

Constructor Details

#initialize(required_permissions, session_key: 'user_permissions') ⇒ PermissionStrategy

Returns a new instance of PermissionStrategy.



171
172
173
174
 
# File 'lib/otto/security/authentication.rb', line 171

def initialize(required_permissions, session_key: 'user_permissions')
  @required_permissions = Array(required_permissions)
  @session_key = session_key
end

Instance Method Details

#authenticate(env, requirement) ⇒ Object 



176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
 
# File 'lib/otto/security/authentication.rb', line 176

def authenticate(env, requirement)
  session = env['rack.session']
  return failure('No session available') unless session

  user_permissions = session[@session_key] || []
  user_permissions = Array(user_permissions)

  # Extract permission from requirement (e.g., "permission:write" -> "write")
  required_permission = requirement.split(':', 2).last

  if user_permissions.include?(required_permission)
    success(user_permissions: user_permissions, required_permission: required_permission)
  else
    failure("Insufficient privileges - requires permission: #{required_permission}")
  end
end

#user_context(env) ⇒ Object 



193
194
195
196
197
198
199
 
# File 'lib/otto/security/authentication.rb', line 193

def user_context(env)
  session = env['rack.session']
  return {} unless session

  user_permissions = session[@session_key] || []
  { user_permissions: Array(user_permissions) }
end