This gem is no longer maintained.

Expose allows you to dynamically adjust the ‘attr_accessible’ or ‘attr_protected’ of a model. This is only for managing mass-assignment security, and not overall security.

The following would let you mass_assign :sometimes_important when the :state
is 'new' or 'pending'.

class Account < ActiveRecord::Base
  include Expose::Model

  # name:string
  # sometimes_important:string
  # state:string ... example [:new, :pending, :closed]

  expose :sometimes_important,
    :if => Proc.new { |account| [:new,:pending].include?(account.state) }

  # same result as line above (just using)
  expose :sometimes_important, :state => [:new, :pending]

  # similar to line above
  expose :sometimes_important,
    :unless => Proc.new { |account| [:closed].include?(account.state) }

  # same as line above
  expose :sometimes_important, :not_state => :closed

  # using whitelist strategy
  attr_accessible :name

  # OR, using blacklist strategy
  # attr_protected :sometimes_important 

end

This gem has only been tested with Rails 3.1.rc3, but should work with Rails 3.X. It only uses the hook :mass_assignment_authorizer.

This gem is in the early stages of development, so use at your own risk.

Plans/Ideas:

- add 'protect' version, which does the opposite of 'expose'
- maybe disable attr_protected.  Using this gem shows an interest in
  mass-assignment security.  Why not ensure use of a whitelist only
  strategy.
- add controller version (so that session data can be used, ie: role of
  logged in user)
- add better error handling and option checking, maybe add some logging
- do not require ActiveRecord, but rather ActiveModel
- not require adding 'include Expose::Model'.  When I do, the class variable
  '_exposures' is shared by all subclasses of ActiveRecord::Base, and each
  declared model then sees the same '_exposures'.

Install the gem:

gem install expose

Or add Expose to your Gemfile and bundle it up:

gem 'expose'

‘expose’ handles a series of options. Those are:

• :if * - When true, the attribute will be added to whitelist.

• :unless * - When false, the attribute will be added to whitelist.

• :state * - When in this state, the attribute will be added to whitelist.

• :not_state * - When not in this state, the attribute will be added to whitelist.

• Mark G (github.com/attack)

• you

• trusted-params (github.com/ryanb/trusted-params) - An ActiveController only version, not compatible with Rails 3.X.

If you discover any bugs or want to drop a line, feel free to create an issue on GitHub.

github.com/attack/expose/issues

MIT License. Copyright 2011 Mark G. github.com/attack