Perm

Quickstart

gem install perm

Setup

classUserattr_reader:roles,:postsdefinitialize(roles:[])@roles=roles@posts=[]endend

classPostattr_reader:user,:titleattr_accessor:publisheddefinitialize(user:,title:)@user=user@title=title@user.posts <<selfendend

classAuthorizedUser <Perm::Authorizeddefcan_read?(post)returntrueifuser.roles.include?(:admin)returntrueifuser.roles.include?(:editor)returntrueifuser ==post.userpost.publishedenddefcan_update?(post)returntrueifuser.roles.include?(:admin)returntrueifuser.roles.include?(:editor)user ==post.userenddefcan_delete?(post)returntrueifuser.roles.include?(:admin)user ==post.userendend

Usage

Create some users

mary=User.new(roles:[:admin])john=User.new(roles:[:editor,:writer])beth=User.new(roles:[:writer])drew=User.new

Create a post

post=Post.new(user:beth,title:"Authorization made easy")

Wrap each user with an authorizer

authorized_mary=AuthorizedUser.new(mary)authorized_john=AuthorizedUser.new(john)authorized_beth=AuthorizedUser.new(beth)authorized_drew=AuthorizedUser.new(drew)# wrapped users continue to act like usersauthorized_beth.posts# => [#<Post:0x007fe35d081798 @title="Authorization made easy"...# if conflicts arise, simply access the originalauthorized_beth.user

Check permissions

authorized_mary.can_read?(post)# => trueauthorized_mary.can_update?(post)# => trueauthorized_mary.can_delete?(post)# => trueauthorized_john.can_read?(post)# => trueauthorized_john.can_update?(post)# => trueauthorized_john.can_delete?(post)# => falseauthorized_beth.can_read?(post)# => trueauthorized_beth.can_update?(post)# => trueauthorized_beth.can_delete?(post)# => trueauthorized_drew.can_read?(post)# => falseauthorized_drew.can_update?(post)# => falseauthorized_drew.can_delete?(post)# => falsepost.published=trueauthorized_drew.can_read?(post)# => true# we can also check unimplemented permissionsauthorized_mary.can_create?(post)# => falseauthorized_john.can_view?(post)# => false