Class: Textus::Domain::Authorizer

Inherits:
Object
  • Object
show all
Defined in:
lib/textus/domain/authorizer.rb

Overview

Authorization service. Single source of truth for “given a manifest entry and a role, may this caller read/write?”. Extracted from Application::Context so the rule lives in Domain alongside Permission.

Instance Method Summary collapse

Constructor Details

#initialize(manifest:) ⇒ Authorizer

Returns a new instance of Authorizer.



9
10
11
 
# File 'lib/textus/domain/authorizer.rb', line 9

def initialize(manifest:)
  @manifest = manifest
end

Instance Method Details

#authorize_read!(mentry, role:) ⇒ Object

Raises:



28
29
30
31
32
33
34
 
# File 'lib/textus/domain/authorizer.rb', line 28

def authorize_read!(mentry, role:)
  return if can_read?(mentry.zone, role: role)

  readers = @manifest.zone_readers[mentry.zone]
  readers = nil if readers == :all
  raise ReadForbidden.new(mentry.key, mentry.zone, readers: readers)
end

#authorize_write!(mentry, role:) ⇒ Object

Raises:



21
22
23
24
25
26
 
# File 'lib/textus/domain/authorizer.rb', line 21

def authorize_write!(mentry, role:)
  return if can_write?(mentry.zone, role: role)

  writers = @manifest.zone_writers(mentry.zone)
  raise WriteForbidden.new(mentry.key, mentry.zone, writers: writers)
end

#can_read?(zone, role:) ⇒ Boolean

Returns:

  • (Boolean) 


17
18
19
 
# File 'lib/textus/domain/authorizer.rb', line 17

def can_read?(zone, role:)
  @manifest.permission_for(zone.to_s).allows_read?(role)
end

#can_write?(zone, role:) ⇒ Boolean

Returns:

  • (Boolean) 


13
14
15
 
# File 'lib/textus/domain/authorizer.rb', line 13

def can_write?(zone, role:)
  @manifest.permission_for(zone.to_s).allows_write?(role)
end