declarative_authorization Demo App
This Rails application serves as a demonstrator of the features of the declarative_authorization features. The declarative_authorization plugin provides an RBAC-inspired and declarative approach to authorization. It implements a DSL for specifying authorization rules outside of the program code. See the declarative_authorization README for more information.
The demo app is a small conference management application, offering conference management for admins, conference and session sign up for registered users and a view of the available conferences and sessions to guests.
For easing the testing of the various roles, a simple user switcher is provided as a drop-down at the top of each page.
The declarative_authorization plugin lives at github.com/stffn/declarative_authorization
Clone the demo apps repository
git clone git://github.com/stffn/decl_auth_demo_app.git
Set up the database connection data by copying and possibly modifying config/database.yml
cp config/database.yml.example config/database.yml
Activate demo data, if you like
cp db/development.sqlite3.example db/development.sqlite3
Initialize plugin submodules
git submodule init git submodule update
Start server and point your browser to localhost:3000
./script/server firefox http://localhost:3000
Conference -----* ConferenceAttendee *------ User -. | | | | (is given by) | * | | Talk *-(gives)-------------------------------' | | * `----------------------------------* TalkAttendees
Most Interesting Spots
A few tipps on where to start:
Controller authorization with before_filters to load context objects at app/controllers/conference_controller.rb for a standard case and app/controllers/talks_controller.rb for a nested controller.
Query rewriting to only retrieve those records from the database that the current user has certain privileges on in app/controllers/conferences_controller.rb in ConferencesController#index
Model authorization for conferences in app/models/conference.rb
View authorization: e.g. app/views/conferences/index.html.erb app/views/talks/index.html.erb
Authorization rules in config/authorization_rules.rb
Testing with specific roles in test/unit/conferences_test.rb for user-specific model tests, test/functional/conference_controller_test.rb for get/post/delete_with, test/test_helper.rb for the test environment setup for decl_auth
Controller#current_user in lib/authenticated_system.rb, which is included in ApplicationController
Setting Authorization.current_user for model security in app/controllers/application_controller.rb
A user model that responds to User#role_symbols with an Array of role symbols in app/models/user.rb
declarative_authorization comes with a browser for the application's authorization rules and usages. Have a look at the information on the demo's authorization after having started the app by pointing your browser to:
Steffen Bartsch TZI, Universität Bremen, Germany sbartsch at tzi.org
Copyright © 2008 Steffen Bartsch, TZI, Universität Bremen, Germany released under the MIT license