stffn / declarative_authorization

I receive the following error when trying to call a show action in my users controller

Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:535:in object_attribute_value'<br/> /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:428:invalidate?' /Library/Ruby/Gems/1.8/gems/activerecord-2.3.5/lib/active_record/base.rb:2036:in all?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:427:ineach' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:427:in all?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:427:invalidate?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:374:in validate?' /Library/Ruby/Gems/1.8/gems/activerecord-2.3.5/lib/active_record/base.rb:2036:inany?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:372:in each' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:372:inany?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:372:in send' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:372:invalidate?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:174:in permit!' /Library/Ruby/Gems/1.8/gems/activerecord-2.3.5/lib/active_record/base.rb:2036:inany?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:174:in each' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:174:inany?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:174:in permit!' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/authorization.rb:184:inpermit?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/in_controller.rb:70:in permitted_to!' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/in_controller.rb:46:inpermitted_to?' /Library/Ruby/Gems/1.8/gems/declarative_authorization-0.4/lib/declarative_authorization/helper.rb:32:in permitted_to?' /Users/kevin/Development/web/osr/app/views/users/show.html.erb:8:in_run_erb_app47views47users47show46html46erb' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/renderable.rb:34:in send' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/renderable.rb:34:inrender' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/base.rb:306:in with_template' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/renderable.rb:30:inrender' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/template.rb:205:in render_template' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/base.rb:265:inrender' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/base.rb:348:in _render_with_layout' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_view/base.rb:262:inrender' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:1250:in render_for_file' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:951:inrender_without_benchmark' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/benchmarking.rb:51:in render' /Library/Ruby/Gems/1.8/gems/activesupport-2.3.5/lib/active_support/core_ext/benchmark.rb:17:inms' /Library/Ruby/Gems/1.8/gems/activesupport-2.3.5/lib/active_support/core_ext/benchmark.rb:17:in ms' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/benchmarking.rb:51:inrender' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/mime_responds.rb:135:in send' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/mime_responds.rb:135:incustom' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/mime_responds.rb:179:in call' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/mime_responds.rb:179:inrespond' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/mime_responds.rb:173:in each' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/mime_responds.rb:173:inrespond' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/mime_responds.rb:107:in respond_to' /Users/kevin/Development/web/osr/app/controllers/users_controller.rb:37:inshow' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:1331:in send' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:1331:inperform_action_without_filters' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/filters.rb:617:in call_filters' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/filters.rb:610:inperform_action_without_benchmark' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/benchmarking.rb:68:in perform_action_without_rescue' /Library/Ruby/Gems/1.8/gems/activesupport-2.3.5/lib/active_support/core_ext/benchmark.rb:17:inms' /Library/Ruby/Gems/1.8/gems/activesupport-2.3.5/lib/active_support/core_ext/benchmark.rb:17:in ms' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/benchmarking.rb:68:inperform_action_without_rescue' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/rescue.rb:160:in perform_action_without_flash' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/flash.rb:146:inperform_action' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:532:in send' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:532:inprocess_without_filters' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/filters.rb:606:in process' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:391:inprocess' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/base.rb:386:in call' /Library/Ruby/Gems/1.8/gems/actionpack-2.3.5/lib/action_controller/routing/route_set.rb:437:incall'

This is how my role is set up:
role :user do

includes :guest
has_permission_on :reviews, :to => [:new, :create]
has_permission_on :reviews, :to => [:edit, :update] do
  if_attribute :user => is { user }
end

has_permission_on :users, :to => [:edit, :update] do
  if_attribute :user => is { user }
end

end

And this is the problem permission call
<%= link_to 'Edit profile', edit_user_path(@user), :id => 'edit_profile' if permitted_to? :edit, @user %>

If you have a has_many :through relationship as follows:
(taken from http://github.com/stffn/decl_auth_demo_app)

conference <1------*> conference_attendees <*--------1> user

class Conference < ActiveRecord::Base
  has_many :conference_attendees
  has_many :attendees, :through => :conference_attendees, :source => :user

If you want to give read for a conference to all users attending that conference you would type

has_permission_on :conferences, :to => :read do
  if_attribute :attendees =>  contains {user}
end

That works fine. But what if you have a attribute on the conference_attendees model that you need to consider as well. Perhaps you wan't to give read right to all users attending a conference and that have paid (paid beeing a boolean in the conference_attendees model).

has_permission_on :conferences, :to => :read do
  if_attribute :conference_attendees =>  {:user => is {user}, :paid => true}
end

This will work when using Conference.with_permissions_to(:read) but will fail if :attribute_check => true

To replicate this error:

1. In your decl_auth_demo_app change authorization_rules.rb line 4 from if_attribute :published => true
   to
   if_attribute :conference_attendees => {:user => is{user}}
   
2. Go to /conferences as presenter_2
   
3. You will see conference Emerging Technologies 2009
   

4. Click on the conference and you will get "You are not allowed to access this action."

   Permission denied: Error when calling user on [#<ConferenceAttendee id: 15, user_id: 3, conference_id: 2>] for validating attribute: undefined method `user' for [#<ConferenceAttendee id: 15, user_id: 3, conference_id: 2>]:Array
   Filter chain halted as [:filter_access_filter] rendered_or_redirected.
   

Hi,
i've created following rules

  role :guest do   
    has_permission_on :news_articles, :to => :news_articles_view do
      if_attribute :status => is {'approved'}
    end
  end

and

  privilege :news_articles_view do
    includes :index, :show, :tag, :category 
  end

but NewsArticle instances with other that approved status still visible :( could you tell me plz - where i'm wrong?

PS: other roles/permissions works fine
PPS: thanks a lot for perfect plugin :)

Showing /usr/lib/ruby-enterprise-1.8.7/lib/ruby/gems/1.8/gems/declarative_authorization-0.4/app/views/authorization_rules/_change.erb where line #35 raised:

undefined method `to_sym' for nil:NilClass

Extracted source (around line #35):

32:
33:
34: <% @users.each do |user| %>
35:
36: <%=h user.id %>

Update permissions are only checked on the first save. If this is the intended behavior, it should be clear in the documentation.

post = Post.first
post.owner_id = 2
post.save
# Invalid update, exception is thrown

post = Post.first
post.contents = "..."
post.save
# Valid update, no exception thrown

post.owner_id = 2
post.save
# Invalid update, but no exception is thrown

With version 0.4 we have a bug like in issue #7 again:

MyModel.with_permissions_to(:read).foo_scope
=> One query, all is fine

MyModel.foo_scope.with_permissions_to(:read)
=> Two queries: The first for "MyModel.foo.find :all" (unnessecary), the second is the right one.

If you can't reproduce this, I will try to build a failing test or something.

Please push the gem to gemcutter. It's a matter of

gem push yourgem-0.0.1.gem

authorization.rb, line 412:

    if value.is_a?(Hash)
      if attr_value.is_a?(Array)
        raise AuthorizationUsageError, "Unable evaluate multiple attributes " +
          "on a collection.  Cannot use '=>' operator on #{attr.inspect} " +
          "(#{attr_value.inspect}) for attributes #{value.inspect}."

What if i want to check length of some association?

has_permission_on :pages, :to => :publish do

if_attribute :paragraphs => { :length => is_not { 0 } }

end

has_role? returns: Authorization::AuthorizationUsageError Exception: User object doesn't respond to roles

I would imagine the desired return value to be false on guest user.

There is a critical issue in d_a which fires up unneeded database queries. I stumbled upon the issue while profiling my own application, which makes heavy use of d_a AND uses a lot of named scopes. Some requests in my app are very slow and I discovered that there are many SQL queries in the log which are not needed. This queries are generated by d_a. Because I don't know how to fix it I will give you a detailed description to reproduce the issue based on the d_a_demo_app:

1) Install the official demo app from http://github.com/stffn/decl_auth_demo_app on your development machine

2) The demo app does not use any named scope, so add this example scope to talk.rb:

named_scope :with_abstract, :conditions => "talks.abstract IS NOT NULL"

3) Start the console and type in this example query:

Conference.first.talks.with_abstract.with_permissions_to(:read).find :all, :limit => 2

4) In the development.log you find this:

SELECT * FROM "conferences" LIMIT 1
SELECT * FROM "talks" WHERE ("talks".conference_id = 1) AND ((talks.abstract IS NOT NULL) AND ("talks".conference_id = 1)) 
SELECT "talks".* FROM "talks" INNER JOIN "conferences" ON "conferences".id = "talks".conference_id WHERE ("talks".conference_id = 1) AND (((("conferences"."published" = 't')) AND (talks.abstract IS NOT NULL)) AND ("talks".conference_id = 1)) LIMIT 2

Please have a look at the second query. It is not needed at all and should not be there! So far as I see, this time consuming query is only generated if the scope "with_permissions_to" is combined with an existing named scope.

You also see a second issue (duplicate condition the WHERE clause), but this is another story (not as important).

The line in_controller.rb:559 should be:

contr.logger.debug...

instead of:

logger.debug...

object_attribute_value raises AuthorizationUsageError exception when the send method fails with NoMethodError. It would be better if in this case the method returned just nil flunking the rule. In my application I have polymorphic association: Paragraph belongs_to(:owner, :polymorphic => true), [ ManPage, WomanPage ] has_many(:paragraphs, :as => :owner). Owners have different attributes. Rules look like this:

has_permissions_on :paragraphs, :to => :manage do

if_attribute :owner => { :man => is { user } }

if_attribute :owner => { :woman => is { user } }

end

So WomanPage does not have :man, and we get NoMethodError.

missing parameter &block in method permitted_to?

As described in this thread in the google group:
http://groups.google.com/group/declarative_authorization/browse_thread/thread/2029d99b9d7df2cb#

It's not possible to do nesting like this:

Authorization::Maintenance::without_access_control do
  do_something
  Authorization::Maintenance::without_access_control do
    do_something
  end
  do_something # => here the access control takes place again!
end