README.md in access-granted-0.0.2 vs README.md in access-granted-0.1.0

- old
+ new

@@ -1,41 +1,56 @@ # AccessGranted [![Build Status](https://travis-ci.org/pokonski/access-granted.png?branch=master)](https://travis-ci.org/pokonski/access-granted) [![Code Climate](https://codeclimate.com/github/pokonski/access-granted.png)](https://codeclimate.com/github/pokonski/access-granted) Multi-role and whitelist based authorization gem for Rails. And it's lightweight (~300 lines of code)! +### Supported Ruby versions + +Guaranteed to work on MRI 1.9.3/2.0/2.1, Rubinius >= 2.1.1 and JRuby >= 1.7.6. + # Summary AccessGranted is meant as replacement for CanCan to solve three major problems: 1. built-in support for roles - Easy to read acess policy code where permissions are cleanly grouped into roles which may or may not apply to a user. - Additionally permissions are forced to be unique in the scope a role greatly simplifying the + Easy to read access policy code where permissions are cleanly grouped into roles which may or may not apply to a user. + Additionally permissions are forced to be unique in the scope a role. Thus greatly simplifying the permission resolving and extremely reducing the code-base. 2. white-list based This means that you define what a role **can** do, not overidding permissions with `cannot` in a specific order which results in an ugly and unmaintainable code. + **Note**: `cannot` is still possible, but has a specifc use. See [Usage](#usage) below. + 3. Permissions can work on basically any object and AccessGranted is framework-agnostic, - (the only Rails-specific methods are `can?`/`cannot?`/`authorize!` helpers injected + (the Rails-specific methods are `can?`/`cannot?`/`authorize!` helpers injected into the framework only when it's present). See [Usage](#usage) for an example of a complete AccessPolicy file. -## Compatibility +## Compatibility with CanCan This gem was created as a replacement for CanCan and therefore it requires minimum work to switch. -1. Both `can?`/`cannot?` and `authorize!` methods work in Rails controllers and views, so - **you don't have to adjust your views at all**. -2. Syntax for defining permissions in AccessPolicy file (Ability in CanCan) is exactly the same, +### Main differences + +1. AccessGranted does not extend ActiveRecord in any way, so it does not have the `accessible_by?` + method which could be used for querying objects available to current user. + This was very complex and only worked with permissions defined using hash conditions, so + I decided to not implement this functionality as it was mostly ignored by CanCan users. + +2. Both `can?`/`cannot?` and `authorize!` methods work in Rails controllers and views, just like in CanCan. + The only change you have to make is replace all `can? :manage, Class` with precise action. + `can :manage` is stil available for **defining** methods and serves as a shortcut for defining `:read`, `:create`, `:update`, `:destroy` + in one line. + + Due to introduction of Roles checking for generic `:manage` permission is very complicated and also confusing for developers. + +3. Syntax for defining permissions in AccessPolicy file (Ability in CanCan) is exactly the same, with added roles on top. See [Usage](#usage) below. -3. **Main difference**: AccessGranted does not extend ActiveRecord in any way, so it does not have the `accessible_by?` - method to keep the code as simple as possible. - That is because `accessible_by?` was very limited making it useless in most cases (complex permissions with lambdas). ## Installation Add this line to your application's Gemfile: @@ -68,34 +83,35 @@ # (even if they are moderators or admins) role :banned, { is_banned: true } do cannot [:create, :update, :destroy], Post # same as above, :manage is just a shortcut for - # `[:create, :update, :destroy]` + # `[:read, :create, :update, :destroy]` cannot :manage, Comment end # Takes precedences over roles placed lower - # and explicitly lets admin mamange everything. + # and explicitly lets admin manage everything. role :admin, { is_admin: true } do can :manage, Post can :manage, Comment end # You can also use Procs to determine # if the role should apply to a given user. role :moderator, proc {|u| u.moderator? } do - # overwrites permission that only allows removing own content in :member + # takes precedence over :update/:destroy + # permissions defined in member role below # and lets moderators edit and delete all posts can [:update, :destroy], Post # and a new permission which lets moderators # modify user accounts can :update, User end - # Applies to everyone logged in. # The basic role. + # Applies to everyone logged in. role :member do can :create, Post # For more advanced permissions # you must use blocks. Hash