README.md in consul-0.4.1 vs README.md in consul-0.4.2
- old
+ new
@@ -1,13 +1,17 @@
Consul - A scope-based authorization solution
=============================================
+[![Build Status](https://secure.travis-ci.org/makandra/consul.png?branch=master)](https://travis-ci.org/makandra/consul)
+
Consul is a authorization solution for Ruby on Rails that uses scopes to control what a user can see or edit.
We have used Consul in combination with [assignable_values](https://github.com/makandra/assignable_values) to solve a variety of authorization requirements ranging from boring to bizarre.
+Also see our crash course video: [Solving bizare authorization requirements with Rails](http://bizarre-authorization.talks.makandra.com/).
+
Describing a power for your application
---------------------------------------
You describe access to your application by putting a `Power` model into `app/models/power.rb`:
@@ -57,12 +61,12 @@
You can also write power checks like this:
power.include?(:notes)
power.include!(:notes)
- power.include?(:note, Note.last)
- power.include!(:note, Note.last)
+ power.include?(:notes, Note.last)
+ power.include!(:notes, Note.last)
Boolean powers
--------------
@@ -81,10 +85,64 @@
power.dashboard? # => true
power.dashboard! # => raises Consul::Powerless unless Power#dashboard? returns true
+Powers that give no access at all
+---------------------------------
+
+Note that there is a difference between having access to an empty list of records, and having no access at all.
+If you want to express that a user has no access at all, make the respective power return `nil`.
+
+Note how the power in the example below returns `nil` unless the user is an admin:
+
+ class Power
+ ...
+
+ power :users do
+ User if @user.admin?
+ end
+
+ end
+
+When a non-admin queries the `:users` power, she will get the following behavior:
+
+ power.notes # => returns nil
+ power.notes? # => returns false
+ power.notes! # => raises Consul::Powerless
+ power.note?(Note.last) # => returns false
+ power.note!(Note.last) # => raises Consul::Powerless
+
+
+Other types of powers
+---------------------
+
+A power can return any type of object. For instance, you often want to return an array:
+
+ class Power
+ ...
+
+ power :assignable_note_states do
+ if admin?
+ %w[draft pending published retracted]
+ else
+ %w[draft pending]
+ end
+ end
+
+ end
+
+You can query it like any other power. E.g. if a non-admin queries this power she will get the following behavior:
+
+ power.assignable_note_states # => ['draft', 'pending']
+ power.assignable_note_states? # => returns true
+ power.assignable_note_states! # => does nothing (because the power isn't nil)
+ power.assignable_note_state?('draft') # => returns true
+ power.assignable_note_state?('published') # => returns false
+ power.assignable_note_state!('published') # => raises Consul::Powerless
+
+
Role-based permissions
----------------------
Consul has no built-in support for role-based permissions, but you can easily implement it yourself. Let's say your `User` model has a string column `role` which can be `"author"` or `"admin"`:
@@ -327,12 +385,12 @@
Development
-----------
-A Rails 2 test application lives in `spec/app_root`. You can run specs from the project root by saying:
+Test applications for various Rails versions lives in `spec`. You can run specs from the project root by saying:
- bundle exec rake spec
+ bundle exec rake all:spec
If you would like to contribute:
- Fork the repository.
- Push your changes **with specs**.