lib/strongbolt/user_abilities.rb
def can? action, instance, attrs = :any, all_instance = false
        without_grant do

          # Get the actual instance if we were given AR
          instance = instance.try(:first) if instance.is_a?(ActiveRecord::Relation)
          return false if instance.nil?

          # We require this to be an *existing* user, that the action and attribute be symbols
          # and that the instance is a class or a String
          raise ArgumentError, "Action must be a symbol and instance must be Class, String, Symbol or AR" unless self.id.present? && action.is_a?(Symbol) &&
             (instance.is_a?(ActiveRecord::Base) || instance.is_a?(Class) || instance.is_a?(String)) && attrs.is_a?(Symbol)

          # Pre-populate all the capabilities into a results cache for quick lookup. Permissions for all "non-owned" objects are
          # immediately available; additional lookups are required for owned objects (e.g. User, CheckoutBag, etc.).
          # The results cache key is formatted as "action model attribute" (attribute can be any, all or an actual attribute)
          # -any, all, an ID, or "owned" (if the ID will be verified later) is appended to the key based on which instances
          # a user has access to
          populate_capabilities_cache unless @results_cache.present?
          # Determine the model name and the actual model (if we need to traverse the hierarchy)
          if instance.is_a?(ActiveRecord::Base)
            model = instance.class
            model_name = model.send(:name_for_authorization)
          elsif instance.is_a?(Class)
            model = instance
            model_name = model.send(:name_for_authorization)
          else
            model = nil # We could do model_name.constantize, but there's a big cost to doing this
                        # if we don't need it, so just defer until we determine there's an actual need
            model_name = instance
          end

          # Look up the various possible valid entries in the cache that would allow us to see this
          return capability_in_cache?(action, instance, model_name, attrs, all_instance)

        end #end w/o grant
      end
#
# Main method for user, used to check whether the user
# is authorized to perform a certain action on an instance/class
#
Main method for user, used to check whether the user
is authorized to perform a certain action on an instance/class
Main method for user used to check whether the user is authorized to perform a certain action on an instance / class
def can? action, instance, attrs = :any, all_instance = false
        without_grant do
          instance = instance.try(:first) if instance.is_a?(ActiveRecord::Relation)
          return false if instance.nil?
          raise ArgumentError, "Action must be a symbol and instance must be Class, String, Symbol or AR" unless self.id.present? && action.is_a?(Symbol) &&
             (instance.is_a?(ActiveRecord::Base) || instance.is_a?(Class) || instance.is_a?(String)) && attrs.is_a?(Symbol)
          populate_capabilities_cache unless @results_cache.present?
          if instance.is_a?(ActiveRecord::Base)
            model = instance.class
            model_name = model.send(:name_for_authorization)
          elsif instance.is_a?(Class)
            model = instance
            model_name = model.send(:name_for_authorization)
          else
            model = nil 
            model_name = instance
          end
          return capability_in_cache?(action, instance, model_name, attrs, all_instance)
        end 
      end
def can? action , instance , attrs = :any , all_instance = false without_grant do instance = instance . try ( :first ) if instance . is_a? ( ActiveRecord :: Relation ) return false if instance . nil? raise ArgumentError , "Action must be a symbol and instance must be Class, String, Symbol or AR" unless self . id . present? && action . is_a? ( Symbol ) && ( instance . is_a? ( ActiveRecord :: Base ) || instance . is_a? ( Class ) || instance . is_a? ( String ) ) && attrs . is_a? ( Symbol ) populate_capabilities_cache unless @results_cache . present? if instance . is_a? ( ActiveRecord :: Base ) model = instance . class model_name = model . send ( :name_for_authorization ) elsif instance . is_a? ( Class ) model = instance model_name = model . send ( :name_for_authorization ) else model = nil model_name = instance end return capability_in_cache? ( action , instance , model_name , attrs , all_instance ) end end
Main method for user, used to check whether the user
is authorized to perform a certain action on an instance/class
Main method for user used to check whether the user is authorized to perform a certain action on an instance / class
# Get the actual instance if we were given AR # We require this to be an *existing* user, that the action and attribute be symbols # and that the instance is a class or a String # Pre-populate all the capabilities into a results cache for quick lookup. Permissions for all "non-owned" objects are # immediately available; additional lookups are required for owned objects (e.g. User, CheckoutBag, etc.). # The results cache key is formatted as "action model attribute" (attribute can be any, all or an actual attribute) # -any, all, an ID, or "owned" (if the ID will be verified later) is appended to the key based on which instances # a user has access to # Determine the model name and the actual model (if we need to traverse the hierarchy) # We could do model_name.constantize, but there's a big cost to doing this # if we don't need it, so just defer until we determine there's an actual need # Look up the various possible valid entries in the cache that would allow us to see this #end w/o grant
action
instance
attrs
all_instance