Sign in through GitHub
Authorization from Scratch Part 1

#385 Authorization from Scratch Part 1 pro

Oct 07, 2012 | 15 minutes | Security, Authorization
Authorization can be difficult to implement and test because it often involves complex logic that exists throughout the entire app. Here I demonstrate how to test and implement authorization from scratch.
Subscribe to Watch Episode
Avatar
Tim Raymond 7 months ago

Great episode! Anyone know what that Randomized with seed 43829 line is? I haven't encountered that with Guard or RSpec before...

Avatar
murdoch 7 months ago

Yeah, you should find the following at the bottom of your spec/spec_helper.rb file:

ruby 
# Run specs in random order to surface order dependencies.
config.order = "random"

This has been part of rspec for several months now, you probs just didn't notice it.

Avatar
Tim Raymond 7 months ago

Oh, very cool! Never identified that as a potential issue, but I can see that it definitely could be. Yay rspec goodies!

Avatar
Alan Cohen 6 months ago

It's there to ensure that your test cases are independent: that they pass regardless of the order in which they are run.

Avatar
MikeOnRails 7 months ago

according to my Pry console. Permission class has a class method called "members" which return :user. I don't see where this method is defined...Does anyone know?

Avatar
nickyvu 7 months ago

Members is a method that comes with Struct, which Permission inherits from in Ryan's example. http://ruby-doc.org/core-1.9.3/Struct.html

Avatar
MikeOnRails 7 months ago

when I try to start the forum-after application (with rails s), I'm getting thie following error. Does anyone know what's wrong, as in how to fix it? I did bundle install and it's not changing anything. Please note that I recently uninstalled MacPorts and the error might be associated with that, but i still don't know how to fix it.

ruby 
Completed 500 Internal Server Error in 1479ms

ActionView::Template::Error (dyld: Library not loaded: /opt/local/lib/libssl.1.0.0.dylib
  Referenced from: /usr/local/bin/node
  Reason: image not found

  (in /Users/michaeljohnmitchell/Sites/authorizationPart1/forum-after/app/assets/javascripts/sessions.js.coffee)):
    3:   <head>
    4:     <title>Forum</title>
    5:     <%= stylesheet_link_tag    "application", media: "all" %>
    6:     <%= javascript_include_tag "application" %>
    7:     <%= csrf_meta_tag %>
    8:   </head>
    9:   <body>
  app/views/layouts/application.html.erb:6:in `_app_views_layouts_application_html_erb___3636075050981736840_2167808160'


  Rendered /Users/michaeljohnmitchell/.rvm/gems/ruby-1.9.2-p290@rails3tutorial/gems/actionpack-3.2.8/lib/action_dispatch/middleware/templates/rescues/_trace.erb (2.5ms)
  Rendered /Users/michaeljohnmitchell/.rvm/gems/ruby-1.9.2-p290@rails3tutorial/gems/actionpack-3.2.8/lib/action_dispatch/middleware/templates/rescues/_request_and_response.erb (1.2ms)
  Rendered /Users/michaeljohnmitchell/.rvm/gems/ruby-1.9.2-p290@rails3tutorial/gems/actionpack-3.2.8/lib/action_dispatch/middleware/templates/rescues/template_error.erb within rescues/layout (17.1ms)
^C[2012-10-08 23:48:50] INFO  going to shutdown ...
[2012-10-08 23:48:50] INFO  WEBrick::HTTPServer#start done.
Exiting
Avatar
MikeOnRails 7 months ago

fixed it by doing

brew uninstall node
brew install node

Avatar
Cameron Stitt 7 months ago

I am sure you will put this in Part 2, but I am implementing this in an app right now and needed a way to ensure they were an admin for the associated member they were viewing.

ruby 
if !current_permission.allow?(params[:controller], params[:action], params[:id])

Then you can use the Id to fetch and check on an item if needed.

ruby 
return true if controller == "projects" && action.in?(%w[edit]) && Project.find(id).user == user
Avatar
Ryan Bates 7 months ago

Yep, I am addressing this in part 2.

Avatar
Cameron Stitt 7 months ago

Only just checked back, and will now be watching Part 2. Can fix up my dodgy fix :)

Avatar
peterchchu 7 months ago

Great Job, Ryan!

Can you please tell me why or what is the advantage of having your Permission class inherit from a Struct (class Permission < Struct.new(:user)), why a struct?

Avatar
Ryan Bates 7 months ago

This is just a quick way to get a "user" attribute. It also saves me from having to define the "initialize" method here.

Avatar
peterchchu 7 months ago

Thanks Ryan. This is so cool, I have never thought of using struct in Ruby/Rails, only in C, C++.

Also, unrelated to this. Few months ago, you sent out an email about either cutting the number of episodes/week or raising price. I can tell you that, with no hesitation, I would pay triple, even for now. Your episodes are clear, your teaching is lucid and most important of all, I like learning from you. I am more eager to see your new episodes than the new Family Guy episodes. Really thank you and keep up the outstanding work.

Avatar
hackeron 7 months ago

Since the main check is in the application controller the permission logic feels like a controller to me, why not permissions_controller.rb in the controllers directory? - it just doesn't feel like a model to me. Is it just me?

Avatar
Bharat Ruparel 7 months ago

It would be nice to have a part 3 or something which explains how this thought process carries over to CanCan, since you are the one who wrote it in the first place :)

Avatar
Dmytrii Nagirniak 7 months ago

Tempting for me to point out the allowy gem.

The implementation is very similar to what has been shown in this screencast.
Very lightweight, inspired by CanCan.

Even though it doesn't have much activity it is being used in production heavily (so sometimes project can be "finished" :) )

Avatar
Mike Bethany 7 months ago

ProTip: Don't use "if not," use "unless."

So the authorize method would go from:

def authorize
  if !current_permission.allow?(params[:controller], params[:action])
    redirect_to root_url, alert: "Not authorized."
  end
end

To the more readable:

def authorize
  unless current_permission.allow?(params[:controller], params[:action])
    redirect_to root_url, alert: "Not authorized."
  end
end
Avatar
Jelkster 7 months ago

Thanks for the reminder. I've been using "if not" exclusively. I'll try to break this old habit.

Avatar
Christopher Lai 6 months ago

What is the best way to test using Test Unit?

Should I test it in my functional test or create a unit test?

Avatar
eljago 5 months ago

Great episode.
I'm new to rails and so happy I subscribed.

First sign in through GitHub to post a comment.