Class: Vert::Authorization::PermissionResolver

Inherits:
Object
  • Object
show all
Defined in:
lib/vert/authorization/permission_resolver.rb

Constant Summary collapse

CACHE_TTL = 
5.minutes
CACHE_PREFIX = 
"vert:permissions"

Class Method Summary collapse

Class Method Details

.get_allowed_fields(user, permission_code, context = {}) ⇒ Object 



28
29
30
31
32
 
# File 'lib/vert/authorization/permission_resolver.rb', line 28

def get_allowed_fields(user, permission_code, context = {})
  return nil if super_admin?(user)
  fields = get_field_restrictions(user, permission_code, context)
  fields&.dig("granted_fields")
end

.get_condition(user, permission_code, condition_key, context = {}) ⇒ Object 



22
23
24
25
26
 
# File 'lib/vert/authorization/permission_resolver.rb', line 22

def get_condition(user, permission_code, condition_key, context = {})
  return nil unless user
  conditions = get_permission_conditions(user, permission_code, context)
  conditions&.dig(condition_key.to_s)
end

.get_denied_fields(user, permission_code, context = {}) ⇒ Object 



34
35
36
37
38
 
# File 'lib/vert/authorization/permission_resolver.rb', line 34

def get_denied_fields(user, permission_code, context = {})
  return [] if super_admin?(user)
  fields = get_field_restrictions(user, permission_code, context)
  fields&.dig("denied_fields") || []
end

.has_permission?(user, permission_code, context = {}) ⇒ Boolean

Returns:

  • (Boolean) 


10
11
12
13
14
15
16
17
18
19
20
 
# File 'lib/vert/authorization/permission_resolver.rb', line 10

def has_permission?(user, permission_code, context = {})
  return false unless user
  return true if super_admin?(user)

  cached = get_cached_permission(user, permission_code, context)
  return cached unless cached.nil?

  result = resolve_permission(user, permission_code, context)
  cache_permission(user, permission_code, context, result)
  result
end

.invalidate_role_cache(role_id) ⇒ Object 



61
62
63
64
65
 
# File 'lib/vert/authorization/permission_resolver.rb', line 61

def invalidate_role_cache(role_id)
  if defined?(UserRole)
    UserRole.where(role_id: role_id).pluck(:user_id).each { |user_id| invalidate_user_cache(user_id) }
  end
end

.invalidate_user_cache(user_id) ⇒ Object 



53
54
55
56
57
58
59
 
# File 'lib/vert/authorization/permission_resolver.rb', line 53

def invalidate_user_cache(user_id)
  return if user_id.blank?
  # Sanitize to avoid Redis KEYS pattern injection (e.g. * or ? in user_id)
  safe_id = user_id.to_s.gsub(%r{[*?\[\]\{\}\\]}, "")
  pattern = "#{CACHE_PREFIX}:#{safe_id}:*"
  redis_delete_pattern(pattern)
end

.user_permissions(user, context = {}) ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'lib/vert/authorization/permission_resolver.rb', line 40

def user_permissions(user, context = {})
  return [] unless user
  return ["*"] if super_admin?(user)

  cache_key = user_permissions_cache_key(user, context)
  cached = redis_get(cache_key)
  return cached if cached

  permissions = collect_user_permissions(user, context)
  redis_set(cache_key, permissions, CACHE_TTL)
  permissions
end