项目作者: maxim

项目描述 :
Authorize without false negatives
高级语言: Ruby
项目地址: git://github.com/maxim/authoraise.git
创建时间: 2015-03-10T03:11:18Z
项目社区:https://github.com/maxim/authoraise

开源协议:MIT License

下载


Authoraise

Code Climate

This gem is not like other authorization gems because it doesn’t enforce any kind of structure or vocabulary on your app. Its only job is to wrap and audit your boolean expressions that you use for authorization.

So instead of writing boolean expressions like this.

  1. options[:post] &&
  2. (options[:post].published? || (options[:post].user == options[:user]))

You would write them like this

  1. policy = Authoraise::Policy.new
  2. policy.allow { |post| post.published? }
  3. policy.allow { |post, user| post.user == user }
  4. policy.authorize(options)

Or like this (my personal favorite)

  1. policy = Authoraise::Policy.new do |p|
  2. p.allow { |post| post.published? }
  3. p.allow { |post, user| post.user == user }
  4. end
  5. policy.authorize(options)

Or like this, where declaration and authorization both happen inline

  1. authorize(options) do |policy|
  2. policy.allow { |post| post.published? }
  3. policy.allow { |post, user| post.user == user }
  4. end

You may wonder why would you do that. Well, when your authorization logic gets more complex, you might start forgetting to pass in all the options that are used to check access. When that happens, your boolean expressions return false, causing false negatives. Take a look at the first example above, and think what happens if post is not published and options[:user] is not passed in. Hint: you just get a false. Your program would lie to you, because really you never gave it a user to check, so how does it know if it’s a false? It’s straight up missing some data.

This gem solves the problem by raising helpful error messages, but also allowing you to ignore the issue where it’s intended to be that way. So in the examples above if you pass an unpublished post and forget to pass in a user in the options, you will see a helpful error message.

Usage

Follow these examples to understand how things work in various cases.

  1. require 'authoraise'
  2. # Authorization policy can be defined as follows...
  3. policy = Authoraise::Policy.new
  4. policy.allow { |user| user == 'sammy' }
  5. policy.allow { |post| post == 'happy_post' }
  6. # ...and used as follows.
  7. policy.authorize(user: 'sammy', post: 'happy_post') # => true
  8. policy.authorize(user: 'bob', post: 'happy_post') # => true
  9. policy.authorize(user: 'bob', post: 'sad_post') # => false
  10. policy.authorize(user: 'sammy') # => true
  11. # Another way is to both define and run a policy using this block form.
  12. include Authoraise
  13. authorize(user: 'sammy', post: 'article') do |policy|
  14. policy.allow { |user| user == 'sammy' }
  15. end
  16. # => true
  17. # Oops, in this example I forgot to pass the post, but user also didn't match.
  18. authorize(user: 'bob') do |policy|
  19. policy.allow { |user| user == 'sammy' }
  20. policy.allow { |post| post == 'foo' }
  21. end
  22. # => Authoraise::Error: Inconclusive authorization, missing keys: [:post]
  23. # Forgot to pass the post object, but user was actually enough.
  24. authorize(user: 'sammy') do |policy|
  25. policy.allow { |user| user == 'sammy' }
  26. policy.allow { |post| post == 'foo' }
  27. end
  28. # => true
  29. # Didn't forget to pass anything, but it didn't match, so this is a legit fail.
  30. authorize(user: 'bob', post: 'foo') do |policy|
  31. policy.allow { |user| user == 'sammy' }
  32. policy.allow { |post| post == 'bar' }
  33. end
  34. # => false
  35. # Let's see what happens in strict mode.
  36. Authoraise.strict_mode = true
  37. # In strict mode any missing key raises an error, even if other checks passed.
  38. authorize(user: 'sammy') do |policy|
  39. policy.allow { |user| user == 'sammy' }
  40. policy.allow { |post| post == 'foo' }
  41. end
  42. # => Authoraise::Error: Strict mode found missing keys: [:post]

Installation

Add this line to your application’s Gemfile:

  1. gem 'authoraise'

And then execute:

  1. $ bundle

Or install it yourself as:

  1. $ gem install authoraise

Development

After checking out the repo, run bin/setup to install dependencies. Then, run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release to create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Contributing

  1. Fork it ( https://github.com/maxim/authoraise/fork )
  2. Create your feature branch (git checkout -b my-new-feature)
  3. Commit your changes (git commit -am 'Add some feature')
  4. Push to the branch (git push origin my-new-feature)
  5. Create a new Pull Request