class ActionAuthorization::Resource

This class represents a generic list of models that are about to authorized.

It is instantiated automatically by +ActionController::Metal#check_authorization+ and there should be little need to instantiate it directly.

Attributes

action[R]

@return [String, Symbol] The action which :actor is attempting to complete.

actor[R]

@return [Model] The model attempting authorization (usually a User).

options[R]

@return The options which are being used for authorization.

resources[R]

@return The list of models being authorized.

Public Class Methods

new(action, actor, *resources, **options) click to toggle source

Creates a new instance of Resource.

@param action [String, Symbol] The name of the action being performed. @param actor [Model] The model attempting authorization. @param *resources [Model] The list of models being authorized. @param **options Any additional options regarding the authorization options.

# File lib/authorizer/resource.rb, line 30
def initialize(action, actor, *resources, **options)
    @action = action
    @actor = actor
    @resources = resources
    @options = options
end

Public Instance Methods

get() click to toggle source

Returns the list of models passed into the constructor if the list passes authorization, otherwise raises ForbiddenError. @returns The list of models being authorized.

# File lib/authorizer/resource.rb, line 42
def get
  return @resources if @resources.nil?
  return @resources if @resources.length == 0
  
  behavior = @options[:behavior]
  if !behavior
      behavior = :filter
  end
  
  case behavior
  when :allow_all
      collect_permitted(return_res: true) {|results| results.length > 0}
  when :deny_all
      collect_permitted {|results| results.length == @resources.length}
  when :filter
      collect_permitted {|results| results.length > 0}
  else
    collect_permitted {|results| results.length > 0}
  end
end

Private Instance Methods

collect_permitted(return_res: false) { |results| ... } click to toggle source
# File lib/authorizer/resource.rb, line 65
def collect_permitted(return_res: false)
    results = @resources.filter do |r|
        begin
            r.is_authorized(@action, @actor) != nil
        rescue
            false
        end
    end

    unless yield(results)
        raise ForbiddenError
    end
    return @resources if return_res
    results
end