module Blacklight::AccessControls::Ability

Attributes

cache[R]
current_user[R]
options[R]

Public Class Methods

new(user, options = {}) click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 21
def initialize(user, options = {})
  @current_user = user || guest_user
  @options = options
  @cache = Blacklight::AccessControls::PermissionsCache.new
  grant_permissions
end
user_class() click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 30
def self.user_class
  Blacklight::AccessControls.config.user_model.constantize
end

Public Instance Methods

default_user_groups() click to toggle source

Everyone is automatically a member of group 'public'

# File lib/blacklight/access_controls/ability.rb, line 109
def default_user_groups
  ['public']
end
discover_groups(id) click to toggle source

read implies discover, so discover_groups is the union of read and discover groups

# File lib/blacklight/access_controls/ability.rb, line 114
def discover_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dg = read_groups(id) | (doc[self.class.discover_group_field] || [])
  Rails.logger.debug("[CANCAN] discover_groups: #{dg.inspect}")
  dg
end
discover_permissions() click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 46
def discover_permissions
  can :discover, String do |id|
    test_discover(id)
  end

  can :discover, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_discover(obj.id)
  end
end
discover_users(id) click to toggle source

read implies discover, so discover_users is the union of read and discover users

# File lib/blacklight/access_controls/ability.rb, line 123
def discover_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dp = read_users(id) | (doc[self.class.discover_user_field] || [])
  Rails.logger.debug("[CANCAN] discover_users: #{dp.inspect}")
  dp
end
download_groups(id) click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 149
def download_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dg = Array(doc[self.class.download_group_field])
  Rails.logger.debug("[CANCAN] download_groups: #{dg.inspect}")
  dg
end
download_permissions() click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 69
def download_permissions
  can :download, String do |id|
    test_download(id)
  end

  can :download, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_download(obj.id)
  end
end
download_users(id) click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 157
def download_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  dp = Array(doc[self.class.download_user_field])
  Rails.logger.debug("[CANCAN] download_users: #{dp.inspect}")
  dp
end
grant_permissions() click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 39
def grant_permissions
  Rails.logger.debug('Usergroups are ' + user_groups.inspect)
  ability_logic.each do |method|
    send(method)
  end
end
guest_user() click to toggle source

A user who isn't logged in

# File lib/blacklight/access_controls/ability.rb, line 35
def guest_user
  Blacklight::AccessControls::Ability.user_class.new
end
read_groups(id) click to toggle source

download access implies read access, so read_groups is the union of download and read groups.

# File lib/blacklight/access_controls/ability.rb, line 132
def read_groups(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  rg = download_groups(id) | Array(doc[self.class.read_group_field])
  Rails.logger.debug("[CANCAN] read_groups: #{rg.inspect}")
  rg
end
read_permissions() click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 57
def read_permissions
  # Loading an object from your datastore might be slow (e.g. Fedora), so assume that if a string is passed, it's an object id
  can :read, String do |id|
    test_read(id)
  end

  can :read, SolrDocument do |obj|
    cache.put(obj.id, obj)
    test_read(obj.id)
  end
end
read_users(id) click to toggle source

download access implies read access, so read_users is the union of download and read users.

# File lib/blacklight/access_controls/ability.rb, line 141
def read_users(id)
  doc = permissions_doc(id)
  return [] if doc.nil?
  rp = download_users(id) | Array(doc[self.class.read_user_field])
  Rails.logger.debug("[CANCAN] read_users: #{rp.inspect}")
  rp
end
test_discover(id) click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 80
def test_discover(id)
  Rails.logger.debug("[CANCAN] Checking discover permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & discover_groups(id)
  !group_intersection.empty? || discover_users(id).include?(current_user.user_key)
end
test_download(id) click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 92
def test_download(id)
  Rails.logger.debug("[CANCAN] Checking download permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & download_groups(id)
  !group_intersection.empty? || download_users(id).include?(current_user.user_key)
end
test_read(id) click to toggle source
# File lib/blacklight/access_controls/ability.rb, line 86
def test_read(id)
  Rails.logger.debug("[CANCAN] Checking read permissions for user: #{current_user.user_key} with groups: #{user_groups.inspect}")
  group_intersection = user_groups & read_groups(id)
  !group_intersection.empty? || read_users(id).include?(current_user.user_key)
end
user_groups() click to toggle source

You can override this method if you are using a different AuthZ (such as LDAP)

# File lib/blacklight/access_controls/ability.rb, line 99
def user_groups
  return @user_groups if @user_groups

  @user_groups = default_user_groups
  @user_groups |= current_user.groups if current_user.respond_to? :groups
  @user_groups |= ['registered'] unless current_user.new_record?
  @user_groups
end