module ActiveScaffold::ModelPermissions::Permissions::SecurityMethods

Public Instance Methods

authorized_for?(options = {}) click to toggle source

A generic authorization query. This is what will be called programatically, since the actual permission methods can’t be guaranteed to exist. And because we want to intelligently combine multiple applicable methods.

options should be a CRUD verb (:create, :read, :update, :destroy) options should be the name of a model attribute options is the name of a method

# File lib/active_scaffold/model_permissions.rb, line 31
def authorized_for?(options = {})
  raise ArgumentError, "unknown crud type #{options[:crud_type]}" if options[:crud_type] and ![:create, :read, :update, :delete].include?(options[:crud_type])

  # column_authorized_for_crud_type? has the highest priority over other methods,
  # you can disable a crud verb and enable that verb for a column
  # (for example, disable update and enable inplace_edit in a column)
  method = column_and_crud_type_security_method(options[:column], options[:crud_type])
  return send(method) if method and respond_to?(method)

  # authorized_for_action? has higher priority than other methods,
  # you can disable a crud verb and enable an action with that crud verb
  # (for example, disable update and enable an action with update as crud type)
  method = action_security_method(options[:action])
  return send(method) if method and respond_to?(method)

  # collect other possibly-related methods that actually exist
  methods = [
    column_security_method(options[:column]),
    crud_type_security_method(options[:crud_type]),
  ].compact.select {|m| respond_to?(m)}

  # if any method returns false, then return false
  return false if methods.any? {|m| !send(m)}

  # if any method actually exists then it must've returned true, so return true
  return true unless methods.empty?

  # if no method exists, return the default permission
  return ModelPermissions.default_permission
end

Private Instance Methods

action_security_method(action) click to toggle source
# File lib/active_scaffold/model_permissions.rb, line 72
def action_security_method(action)
  "authorized_for_#{action}?" if action
end
column_and_crud_type_security_method(column, crud_type) click to toggle source
# File lib/active_scaffold/model_permissions.rb, line 76
def column_and_crud_type_security_method(column, crud_type)
  "#{column}_authorized_for_#{crud_type}?" if column and crud_type
end
column_security_method(column) click to toggle source
# File lib/active_scaffold/model_permissions.rb, line 64
def column_security_method(column)
  "#{column}_authorized?" if column
end
crud_type_security_method(crud_type) click to toggle source
# File lib/active_scaffold/model_permissions.rb, line 68
def crud_type_security_method(crud_type)
  "authorized_for_#{crud_type}?" if crud_type
end