lib/authz/controllers/authorization_manager.rb
def authorized?(controller:, action:, using: nil, skip_scoping: false)
        # 1. Check if the user is correctly skipping scoping
        skip_scoping = skip_scoping == true
        if using.blank? && !skip_scoping
          raise MissingScopingInstance, controller: controller, action: action
        end

        # 2. At least one of the user's roles have both Permission and Scope
        usr = authz_user
        usr.roles.each do |role|
          # a. Check authorization on controller action
          auth_on_action = role.cached_has_permission?(controller, action)
          next unless auth_on_action

          # b. Check authorization on scoping privileges
          auth_on_scope = skip_scoping || ScopingManager.has_access_to_instance?(role, using, usr)

          # c. If a rule is fully authorized, return
          return true if auth_on_action && auth_on_scope
        end

        # 3. After searching all roles, no authorization found
        return false
      end
# Determines if a user is authorized to perform a certain controller action
# on a given instance
# @param controller [String] name of the controller
# @param action [String] name of the controller action
# @param using [Object] the instance used to determine scope access
# @param skip_scoping [Boolean] option for ignoring scoping during verification
# @return [Boolean] true if authorized, false otherwise
# @api public
# @!visibility public
Determines if a user is authorized to perform a certain controller action
on a given instance
Determines if a user is authorized to perform a certain controller action on a given instance
def authorized?(controller:, action:, using: nil, skip_scoping: false)
        skip_scoping = skip_scoping == true
        if using.blank? && !skip_scoping
          raise MissingScopingInstance, controller: controller, action: action
        end
        usr = authz_user
        usr.roles.each do |role|
          auth_on_action = role.cached_has_permission?(controller, action)
          next unless auth_on_action
          auth_on_scope = skip_scoping || ScopingManager.has_access_to_instance?(role, using, usr)
          return true if auth_on_action && auth_on_scope
        end
        return false
      end
def authorized? ( controller : , action : , using : nil , skip_scoping : false ) skip_scoping = skip_scoping == true if using . blank? && ! skip_scoping raise MissingScopingInstance , controller : controller , action : action end usr = authz_user usr . roles . each do | role | auth_on_action = role . cached_has_permission? ( controller , action ) next unless auth_on_action auth_on_scope = skip_scoping || ScopingManager . has_access_to_instance? ( role , using , usr ) return true if auth_on_action && auth_on_scope end return false end
Determines if a user is authorized to perform a certain controller action
on a given instance
Determines if a user is authorized to perform a certain controller action on a given instance
# 1. Check if the user is correctly skipping scoping # 2. At least one of the user's roles have both Permission and Scope # a. Check authorization on controller action # b. Check authorization on scoping privileges # c. If a rule is fully authorized, return # 3. After searching all roles, no authorization found
true if authorized, false otherwise
true if authorized false otherwise
Boolean
controller
name of the controller
name of the controller
action
name of the controller action
name of the controller action
using
the instance used to determine scope access
the instance used to determine scope access
skip_scoping
option for ignoring scoping during verification
option for ignoring scoping during verification
api
None
!visibility
None