guachiman-rails
Basic Authorization gem for rails based on RailsCast #385 Authorization from Scratch by Ryan Bates. Built on top of guachiman.
Installation
Add this line to your application's Gemfile:
gem 'guachiman-rails'And then execute:
$ bundleOr install it directly:
$ gem install guachiman-railsUsage
Run rails g guachiman:install
This will generate a authorization.rb file in app/models.
Include Guachiman::Authorizable in ApplicationController and optionally implement a
current_user method there (it defaults to nil).
# app/controllers/application_controller.rb
include Guachiman::Authorizable
def current_user
@current_user ||= User.find_by_auth_token(cookies[:auth_token]) if cookies[:auth_token]
endSkip authorization
class UsersController < ApplicationController
skip_before_action :authorize, if: :admin?
# ...
private
def admin?
current_user && current_user.admin?
end
endHandle authorization failure
The default implementation is to raise Guachiman::UnauthorizedError. You can rescue the error with a regular
Rails rescue_from call or override the #unauthorized method directly:
def unauthorized
if request.get? && !request.xhr?
session[:next] = request.url
redirect_to root_path, alert: t(:unauthorized)
else
render nothing: true, status: :unauthorized
end
endNow you can describe your authorization object in this way:
class Authorization
include Guachiman
def initialize(current_user)
allow :sessions, :new, :create
allow :users, :new, :create
allow :users, :show, :edit, :update do |user|
current_user && current_user.id == user.id
end
end
endThe method #current_resource will default to nil but you can override in the controllers:
class UsersController < ApplicationController
# ...
private
def current_resource
@user ||= User.find(params[:id]) if params[:id].present?
end
endLicense
MIT