Class: Otto::Security::Authentication::AuthorizationFailure

Inherits:
Data
  • Object
show all
Defined in:
lib/otto/security/authentication/authorization_failure.rb

Overview

Result for AUTHORIZATION failures (authenticated, but not permitted).

This is distinct from AuthFailure, which represents an AUTHENTICATION failure (no/invalid/expired credential). A strategy that performs both authentication and authorization in one pass (e.g. a token strategy that also enforces a role/permission encoded in the route requirement) returns:

  • AuthFailure -> credential missing/invalid -> 401 Unauthorized
  • AuthorizationFailure -> credential valid, but denied -> 403 Forbidden

Without this type a combined strategy could only return AuthFailure, and RouteAuthWrapper would collapse an authorization denial to 401 — leaving a client unable to distinguish “authenticate again” from “you lack this permission.” The wrapper maps this type to ResponseBuilder#forbidden (403); see RouteAuthWrapper#handle_all_strategies_failed.

NOTE: Otto’s built-in Layer-1 role check (RoleAuthorization, driven by the role= route token) already yields 403 for role mismatches on a successful StrategyResult. This type covers the complementary case: a strategy that owns authorization itself (including permission tiers, which Layer-1 does not model) and needs to signal a 403 directly.

DELIBERATELY has no terminal member (unlike AuthFailure): an authorization denial must not halt the strategy chain — a later strategy’s success still wins (a different credential may well be permitted). When the chain DOES end in failure, a recorded denial already takes response precedence (403 over 401, even over a terminal halt), so there is nothing a terminal flag here would add.

Instance Attribute Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#auth_method ⇒ Object (readonly)

Returns the value of attribute auth_method

Returns:

  • (Object) —

    the current value of auth_method



36
37
38
 
# File 'lib/otto/security/authentication/authorization_failure.rb', line 36

def auth_method
  @auth_method
end

#failure_reason ⇒ Object (readonly)

Returns the value of attribute failure_reason

Returns:

  • (Object) —

    the current value of failure_reason



36
37
38
 
# File 'lib/otto/security/authentication/authorization_failure.rb', line 36

def failure_reason
  @failure_reason
end

Instance Method Details

#anonymous? ⇒ Boolean

Returns True (no user context attached to a denial).

Returns:

  • (Boolean) —

    True (no user context attached to a denial)



47
48
49
 
# File 'lib/otto/security/authentication/authorization_failure.rb', line 47

def anonymous?
  true
end

#authenticated? ⇒ Boolean

Authorization failures are not an authenticated request state. The request never reaches the handler, so handler-facing predicates report the same “no user context” shape AuthFailure does.

Returns:

  • (Boolean) —

    False



42
43
44
 
# File 'lib/otto/security/authentication/authorization_failure.rb', line 42

def authenticated?
  false
end

#inspect ⇒ String

Returns Debug representation.

Returns:

  • (String) —

    Debug representation



57
58
59
 
# File 'lib/otto/security/authentication/authorization_failure.rb', line 57

def inspect
  "#<AuthorizationFailure reason=#{failure_reason.inspect} method=#{auth_method}>"
end

#user_context ⇒ Hash

Returns Empty hash.

Returns:

  • (Hash) —

    Empty hash



52
53
54
 
# File 'lib/otto/security/authentication/authorization_failure.rb', line 52

def user_context
  {}
end