mirror of
https://github.com/varvet/pundit.git
synced 2022-11-09 12:30:11 -05:00
2f20c58484
* The AuthorizationNotPerformedError is very descriptive of the situation when authorization is forgotten. In the case of no scoping, it can be a head scratcher. * This new error type is implemented as a subclass of the current error type to prevent regressions in existing code. While this is not ideal, it is the simplest solution I could come up with for compatibility.
97 lines
2.6 KiB
Ruby
97 lines
2.6 KiB
Ruby
require "pundit/version"
|
|
require "pundit/policy_finder"
|
|
require "active_support/concern"
|
|
require "active_support/core_ext/string/inflections"
|
|
require "active_support/core_ext/object/blank"
|
|
require "active_support/core_ext/module/introspection"
|
|
require "active_support/dependencies/autoload"
|
|
|
|
module Pundit
|
|
class NotAuthorizedError < StandardError
|
|
attr_accessor :query, :record, :policy
|
|
end
|
|
class AuthorizationNotPerformedError < StandardError; end
|
|
class PolicyScopingNotPerformedError < AuthorizationNotPerformedError; end
|
|
class NotDefinedError < StandardError; end
|
|
|
|
extend ActiveSupport::Concern
|
|
|
|
class << self
|
|
def policy_scope(user, scope, namespace = Object)
|
|
policy_scope = PolicyFinder.new(scope, namespace).scope
|
|
policy_scope.new(user, scope).resolve if policy_scope
|
|
end
|
|
|
|
def policy_scope!(user, scope, namespace = Object)
|
|
PolicyFinder.new(scope, namespace).scope!.new(user, scope).resolve
|
|
end
|
|
|
|
def policy(user, record, namespace = Object)
|
|
policy = PolicyFinder.new(record, namespace).policy
|
|
policy.new(user, record) if policy
|
|
end
|
|
|
|
def policy!(user, record, namespace = Object)
|
|
PolicyFinder.new(record, namespace).policy!.new(user, record)
|
|
end
|
|
end
|
|
|
|
included do
|
|
if respond_to?(:helper_method)
|
|
helper_method :policy_scope
|
|
helper_method :policy
|
|
helper_method :pundit_user
|
|
end
|
|
if respond_to?(:hide_action)
|
|
hide_action :policy_scope
|
|
hide_action :policy_scope=
|
|
hide_action :policy
|
|
hide_action :policy=
|
|
hide_action :authorize
|
|
hide_action :verify_authorized
|
|
hide_action :verify_policy_scoped
|
|
hide_action :pundit_user
|
|
end
|
|
end
|
|
|
|
def verify_authorized
|
|
raise AuthorizationNotPerformedError unless @_policy_authorized
|
|
end
|
|
|
|
def verify_policy_scoped
|
|
raise PolicyScopingNotPerformedError unless @_policy_scoped
|
|
end
|
|
|
|
def authorize(record, query=nil)
|
|
query ||= params[:action].to_s + "?"
|
|
@_policy_authorized = true
|
|
|
|
policy = policy(record)
|
|
unless policy.public_send(query)
|
|
error = NotAuthorizedError.new("not allowed to #{query} this #{record}")
|
|
error.query, error.record, error.policy = query, record, policy
|
|
|
|
raise error
|
|
end
|
|
|
|
true
|
|
end
|
|
|
|
def policy_scope(scope)
|
|
@_policy_scoped = true
|
|
@policy_scope or Pundit.policy_scope!(pundit_user, scope, self.class.parent)
|
|
end
|
|
attr_writer :policy_scope
|
|
|
|
def policy(record)
|
|
@_policy or Pundit.policy!(pundit_user, record, self.class.parent)
|
|
end
|
|
|
|
def policy=(policy)
|
|
@_policy = policy
|
|
end
|
|
|
|
def pundit_user
|
|
current_user
|
|
end
|
|
end
|