class PapersPlease::Policy

Attributes

roles[RW]
user[R]

Public Class Methods

new(user) click to toggle source
# File lib/papers_please/policy.rb, line 6
def initialize(user)
  @user          = user
  @roles         = {}
  @cache         = {}

  configure
end

Public Instance Methods

add_permissions(keys) { |roles| ... } click to toggle source

Add permissions to the Role

# File lib/papers_please/policy.rb, line 31
def add_permissions(keys)
  return unless block_given?

  Array(keys).each do |key|
    raise MissingRole unless roles.key?(key)

    yield roles[key]
  end
end
Also aliased as: permit
add_role(name, predicate = nil, &block) click to toggle source

Add a role to the Policy

# File lib/papers_please/policy.rb, line 19
def add_role(name, predicate = nil, &block)
  name = name.to_sym
  raise DuplicateRole if roles.key?(name)

  role = Role.new(name, predicate: predicate, definition: block)
  roles[name] = role

  role
end
Also aliased as: role
applicable_roles() click to toggle source

Fetch roles that apply to the current user

# File lib/papers_please/policy.rb, line 88
def applicable_roles
  @applicable_roles ||= roles.select do |_, role|
    role.applies_to?(user)
  end
end
authorize!(action, subject) click to toggle source
# File lib/papers_please/policy.rb, line 69
def authorize!(action, subject)
  raise AccessDenied, "Access denied for #{action} on #{subject}" if cannot?(action, subject)

  subject
end
can?(action, subject = nil) click to toggle source

Look up a stored permission block and call with the current user and subject

# File lib/papers_please/policy.rb, line 44
def can?(action, subject = nil)
  applicable_roles.each do |_, role|
    permission = role.find_permission(action, subject)
    next if permission.nil?

    # Proxy permission check if granted by other
    if permission.granted_by_other?
      # Get proxied subject
      subject = subject.is_a?(Class) ? permission.granting_class : permission.granted_by.call(user, subject)

      # Get proxied permission
      permission = role.find_permission(action, subject)
    end

    # Check permission
    return permission.granted?(user, subject, action) unless permission.nil?
  end

  false
end
cannot?(*args) click to toggle source
# File lib/papers_please/policy.rb, line 65
def cannot?(*args)
  !can?(*args)
end
configure() click to toggle source
# File lib/papers_please/policy.rb, line 14
def configure
  raise NotImplementedError, 'The #configure method of the access policy was not implemented'
end
permit(keys)
Alias for: add_permissions
query(action, klass)
Alias for: scope_for
role(name, predicate = nil, &block)
Alias for: add_role
scope_for(action, klass) click to toggle source

Look up a stored scope block and call with the current user and class

# File lib/papers_please/policy.rb, line 77
def scope_for(action, klass)
  applicable_roles.each do |_, role|
    permission = role.find_permission(action, klass)
    return permission.fetch(user, klass, action) unless permission.nil?
  end

  nil
end
Also aliased as: query