Class Authorization::ObligationScope
In: lib/declarative_authorization/obligation_scope.rb
Parent: (Rails.version < "3" ? ActiveRecord::NamedScope::Scope : ActiveRecord::Relation)

The ObligationScope class parses any number of obligations into joins and conditions.

In ObligationScope parlance, "association paths" are one-dimensional arrays in which each element represents an attribute or association (or "step"), and "leads" to the next step in the association path.

Suppose we have this path defined in the context of model Foo: +{ :bar => { :baz => { :foo => { :attr => is { user } } } } }+

To parse this path, ObligationScope evaluates each step in the context of the preceding step. The first step is evaluated in the context of the parent scope, the second step is evaluated in the context of the first, and so forth. Every time we encounter a step representing an association, we make note of the fact by storing the path (up to that point), assigning it a table alias intended to match the one that will eventually be chosen by ActiveRecord when executing the find method on the scope.

+@table_aliases = {

  [] => 'foos',
  [:bar] => 'bars',
  [:bar, :baz] => 'bazzes',
  [:bar, :baz, :foo] => 'foos_bazzes' # Alias avoids collisions with 'foos' (already used)

}+

At the "end" of each path, we expect to find a comparison operation of some kind, generally comparing an attribute of the most recent association with some other value (such as an ID, constant, or array of values). When we encounter a step representing a comparison, we make note of the fact by storing the path (up to that point) and the comparison operation together. (Note that individual obligations’ conditions are kept separate, to allow their conditions to be OR‘ed together in the generated scope options.)

+@obligation_conditions[<obligation>][[:bar, :baz, :foo]] = [

  [ :attr, :is, <user.id> ]

]+

TODO update doc for Relations: After successfully parsing an obligation, all of the stored paths and conditions are converted into scope options (stored in proxy_options as +:joins+ and +:conditions+). The resulting scope may then be used to find all scoped objects for which at least one of the parsed obligations is fully met.

+@proxy_options[:joins] = { :bar => { :baz => :foo } } @proxy_options[:conditions] = [ ‘foos_bazzes.attr = :foos_bazzes__id_0’, { :foos_bazzes__id_0 => 1 } ]+

Methods

Public Class methods

Public Instance methods

Consumes the given obligation, converting it into scope join and condition options.

Protected Instance methods

Adds the given expression to the current obligation‘s indicated path‘s conditions.

Condition expressions must follow the format +[ <attribute>, <operator>, <value> ]+.

Adds the given path to the list of obligation joins, if we haven‘t seen it before.

At the end of every association path, we expect to see a comparison of some kind; for example, +:attr => [ :is, :value ]+.

This method parses the comparison and creates an obligation condition from it.

Parses the next step in the association path. If it‘s an association, we advance down the path. Otherwise, it‘s an attribute, and we need to evaluate it as a comparison operation.

Attempts to map a reflection for the given path. Raises if already defined.

Attempts to map a table alias for the given path. Raises if already defined.

Returns the model associated with the given path.

Returns a hash mapping obligations to zero or more condition path sets.

Parses all of the defined obligation conditions and defines the scope‘s :conditions option.

Parses all of the defined obligation joins and defines the scope‘s :joins or :includes option. TODO: Support non-linear association paths. Right now, we just break down the longest path parsed.

Returns the reflection corresponding to the given path.

Returns a hash mapping paths to reflections.

Returns a proper table alias for the given path. This alias may be used in SQL statements.

Returns a hash mapping paths to proper table aliases to use in SQL statements.

[Validate]