CanDo is a small gem to implement a simple user access system based on users, roles & capabilites, where:
- each user can have 0, 1 or many roles
- each role can have 0, 1 or many capabilites
Users have capabilities by getting roles assigned (role == collection of
capabilities). Within the code, the can
helper method can be used to test
whether a user has a certain capability or not (see below for a working code example).
- Usage example
- Installation
- Configuration and usage
- Using CanDo in your project's code
- Versioning
- Licensing
Using the CanDo in your code (working code with an empty database):
require 'cando'
include CanDo
CanDo.init do
# if passed, this will be executed if the user does not have the
# asked-for capability (only applies if 'can' is passed a block)
cannot_block do |user_urn, capability|
raise "#{user_urn} can not #{capability} .. user capabilities are: #{capabilities(user_urn)}"
end
connect "mysql://cando_user:cando_passwd@host:port/database"
end
# if the role or a capability does not exist, it'll be created
define_role("r1", ["capability1", "capability3"])
define_role("r2", ["capability2"])
define_role("r3", ["capability3"])
# if the user does not exist, he'll be created -- the roles must be available
assign_roles("user1", ["r1"])
# add other roles by unifying arrays with '|'
assign_roles("user1", roles("user1") | ["r2","r3"])
assign_roles("user2", ["r1"])
# use 'can' block syntax
can("user1", :capability1) do
puts "user has capability1"
end
# this will raise an exception as declared in the init block
can("user1", :super_admin) do
puts "hey hoh" # this will not be printed
end
# when no block is given, 'can' returns true or false/nil
unless can("user2", :capability2)
puts "user does not have capability1"
end
Download and install rake with the following.
gem install cando
If you want to use an individual database for cando, create the db + credentials (adjust values):
CREATE DATABASE IF NOT EXISTS cando DEFAULT CHARACTER SET utf8 DEFAULT COLLATE utf8_general_ci;
GRANT ALL ON `cando`.* to 'cando_user'@'localhost' identified by 'cando_passwd';
Whenever you want to use a CanDo rake task, you need to set the database config via the env var $CANDO_DB
:
export CANDO_DB=mysql://cando_user:cando_passwd@localhost/cando
for other dbs, see the sequel
documentation.
**Note that you will have to require the gem for your respective dbms, i.e. the
mysql
-gem for mysql, the sqlite3
-gem for sqlite, etc. **
Cando provides a rake task to get you started. This will setup the necessary
tables (they are all prefixed with cando
and thus should not interfere with
your database.
rake cando:init
Cando provides several useful rake tasks for easy cli-based operations. In order
to use those edit (or create) the Rakefile
and include
require 'cando'
To get an overview, execute:
$ rake -T cando
rake cando:init # Initialize cando (creates schema and runs migration)
rake cando:list # List roles
rake cando:add # Add a new role (pass in role name and capabilities with role=<name> capabilities=<cap1>,<cap2>,...
rake cando:update # Update role (pass in role name and capabilities with role=<name> capabilities=<cap1>,<cap2>,...
rake cando:remove # Remove role (pass in role name with role=<name>)
rake cando:assign # Assign role to user (args: roles=<r1>,<r2>,<rn> user=<user_urn>)
rake cando:users # List users and their roles
Please see the api documentation for up to date documentation.
connect to db (usually called within init block):
CanDo.connect "mysql://user:passwd@host:port/database"
create a role; capabilities will be created if they don't exist yet:
define_role("role_name", ["capability1","capability2", "capability3", ...])
assign role(s) to a user: if no user with that id exist, a new one will be created; if a role does not exist, an exception is raised. You can pass in a role object or just role names; pass in empty array to remove all roles:
role3 = CanDo::Role.first
assign_roles("user1", ["role1", "role2", role3])
get user's capabilities; returns an array of strings:
capabilities("user1")
get user's roles; returns an array of strings:
roles("user1")
set default handler if can("u","c"){ ... }
fails (usually called within init block):
CanDo.cannot_block { |user_urn, capability| raise "#{user_urn} is missing #{capability}" }
guard block by can
function; will execute cannot_block
if user is missing
this capability (see example below):
can("user1", :capability1) do
puts "woohoo"
end
use can
function as an expression -- cannot_block
will not be executed if
expressions resolves to false
:
if can("user1", :capability1)
puts "woohoo"
else
puts ":("
end
CanDo adheres to Semantic Versioning 2.0.0. If there is a violation of this scheme, report it as a bug.Specifically, if a patch or minor version is released and breaks backward compatibility, that version should be immediately yanked and/or a new version should be immediately released that restores compatibility. Any change that breaks the public API will only be introduced at a major-version release. As a result of this policy, you can (and should) specify any dependency on by using the Pessimistic Version Constraint with two digits of precision.
See the LICENSE file for details.
The MIT License (MIT)
Copyright © 2014 Daniel Bornkessel
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.