search

nathanl / authority

*CURRENTLY UNMAINTAINED*. Authority helps you authorize actions in your Rails app. It's ORM-neutral and has very little fancy syntax; just group your models under one or more Authorizer classes and write plain Ruby methods on them.
MIT License
1.21k stars 67 forks source link

Authorization check done in an after filter #55

Closed div closed 11 years ago

div commented 11 years ago

Added a simple check in an after_filter ensuring that authorisation was indeed performed. If called from ApplicationController this method will make sure you explicitly define all the actions that do not need authorisation to be performed, kind of whitelisting approach. The implementation is basically taken from cancan.

nathanl commented 11 years ago

It took me some time to understand this feature, but I like it! I think it can make applications safer.

Of course, by the time we get to the after_filter, the action has already been completed, with or without authorization. But hopefully this exception will get the developers' attention while before their code reaches production.

I'm going to make a couple of comments on the code for changes I'd like to see.

div commented 11 years ago

Hey, Nathan! Please take a look and I can squash if all is fine.

nathanl commented 11 years ago

This looks great! I'm really pleased with this feature and look forward to using it myself. You did a great job on it.

Thanks so much! Squash as you like and let me know when you want it merged.

div commented 11 years ago

Thanks for the kind words! I think i would prefer not to squash so to not mess things up, since i've merged master in already.

nathanl commented 11 years ago

Merged! Thanks so much!

I'm going to add some info in the README and in the CHANGELOG. I'd like to put a little line of thanks in the CHANGELOG for your work on this. Your profile doesn't list your actual name. Would you like me to credit you as @div or something else?

div commented 11 years ago

Thanks, I'm Igor Davydov, had no idea there's no real name there.

nathanl commented 11 years ago

Great. See how this looks to you: https://github.com/nathanl/authority/pull/58