class SkinnyControllers::Policy::Base

Attributes

authorized_via_parent[RW]
object[RW]
user[RW]

Public Class Methods

new(user, object, authorized_via_parent: false) click to toggle source

@param [User] user the being to check if they have access to `object` @param [ActiveRecord::Base] object the object that we are wanting to check

the authorization of `user` for

@param [Boolean] authorized_via_parent if this object is authorized via

a prior authorization from a parent class / association
# File lib/skinny_controllers/policy/base.rb, line 12
def initialize(user, object, authorized_via_parent: false)
  self.user = user
  self.object = object
  self.authorized_via_parent = authorized_via_parent
end

Public Instance Methods

default?() click to toggle source

if a method is not defined for a particular verb or action, this will be used.

@example Operation::Object::SendReceipt.run is called, since

`send_receipt` doesn't exist in this class, this `default?`
method will be used.
# File lib/skinny_controllers/policy/base.rb, line 48
def default?
  SkinnyControllers.allow_by_default
end
method_missing(method_name, *args, &block) click to toggle source

@param [Symbol] method_name @param [Array] args @param [Proc] block

Calls superclass method
# File lib/skinny_controllers/policy/base.rb, line 21
def method_missing(method_name, *args, &block)
  # unless the method ends in a question mark, re-route to default method_missing
  return super unless method_name.to_s =~ /(.+)\?/

  action = Regexp.last_match(1)
  # alias destroy to delete
  # TODO: this means that a destroy method, if defined,
  #       will never be called.... good or bad?
  #       should there be a difference between delete and destroy?
  return send('delete?') if action == 'destroy'

  # we know that these methods don't take any parameters,
  # so args and block can be ignored
  SkinnyControllers.logger.warn("method '#{action}' in policy '#{self.class.name}' was not found. Using :default?")
  send(:default?)
end
read?(o = object) click to toggle source

this should be used when checking access to a single object

# File lib/skinny_controllers/policy/base.rb, line 53
def read?(o = object)
  default?
end
read_all?() click to toggle source

this should be used when checking access to multilpe objects it will call `read?` on each object of the array

if the operation used a scope to find records from an association, then `authorized_via_parent` could be true, in which case, the loop would be skipped.

TODO: think of a way to override the authorized_via_parent functionality

# File lib/skinny_controllers/policy/base.rb, line 65
def read_all?
  return true if authorized_via_parent

  # Might be deceptive...
  return true if object.nil? || object.empty?

  # This is expensive, so try to avoid it
  # TODO: look in to creating a cache for
  # these look ups that's invalidated upon
  # object save
  accessible = object.map { |ea| read?(ea) }
  accessible.all?
end
respond_to_missing?(method_name, include_private = false) click to toggle source
Calls superclass method
# File lib/skinny_controllers/policy/base.rb, line 38
def respond_to_missing?(method_name, include_private = false)
  method_name.to_s =~ /(.+)\?/ || super
end