module ActiveRecordPermissions::Permissions::SecurityMethods

Public Instance Methods

authorized_for?(options = {}) click to toggle source

A generic authorization query. This is what will be called programatically, since the actual permission methods can't be guaranteed to exist. And because we want to intelligently combine multiple applicable methods.

options should be a CRUD verb (:create, :read, :update, :destroy) options should be the name of a model attribute options is the name of a method

# File lib/active_scaffold/active_record_permissions.rb, line 89
def authorized_for?(options = {})
  raise ArgumentError, "unknown crud type #{options[:crud_type]}" if options[:crud_type] and ![:create, :read, :update, :delete].include?(options[:crud_type])

  # collect other possibly-related methods that actually exist
  methods = cached_authorized_for_methods(options)
  return ActiveRecordPermissions.default_permission if methods.empty?
  return send(methods.first) if methods.one?

  # if any method returns false, then return false
  return false if methods.any? {|m| !send(m)}
  true
end
authorized_for_methods(options) click to toggle source
# File lib/active_scaffold/active_record_permissions.rb, line 113
def authorized_for_methods(options)
  # column_authorized_for_crud_type? has the highest priority over other methods,
  # you can disable a crud verb and enable that verb for a column
  # (for example, disable update and enable inplace_edit in a column)
  method = column_and_crud_type_security_method(options[:column], options[:crud_type])
  return [method] if method and respond_to?(method)

  # authorized_for_action? has higher priority than other methods,
  # you can disable a crud verb and enable an action with that crud verb
  # (for example, disable update and enable an action with update as crud type)
  method = action_security_method(options[:action])
  return [method] if method and respond_to?(method)

  # collect other possibly-related methods that actually exist
  methods = [
    column_security_method(options[:column]),
    crud_type_security_method(options[:crud_type]),
  ].compact.select {|m| respond_to?(m)}
end
cached_authorized_for_methods(options) click to toggle source
# File lib/active_scaffold/active_record_permissions.rb, line 102
def cached_authorized_for_methods(options)
  key = "#{options[:crud_type]}##{options[:column]}##{options[:action]}"
  if self.is_a? Class
    self.class_security_methods ||= {}
    self.class_security_methods[key] ||= authorized_for_methods(options)
  else
    self.class.instance_security_methods ||= {}
    self.class.instance_security_methods[key] ||= authorized_for_methods(options)
  end
end