README.md in consul-0.4.1 vs README.md in consul-0.4.2

- old
+ new

@@ -1,13 +1,17 @@ Consul - A scope-based authorization solution ============================================= +[![Build Status](https://secure.travis-ci.org/makandra/consul.png?branch=master)](https://travis-ci.org/makandra/consul) + Consul is a authorization solution for Ruby on Rails that uses scopes to control what a user can see or edit. We have used Consul in combination with [assignable_values](https://github.com/makandra/assignable_values) to solve a variety of authorization requirements ranging from boring to bizarre. +Also see our crash course video: [Solving bizare authorization requirements with Rails](http://bizarre-authorization.talks.makandra.com/). + Describing a power for your application --------------------------------------- You describe access to your application by putting a `Power` model into `app/models/power.rb`: @@ -57,12 +61,12 @@ You can also write power checks like this: power.include?(:notes) power.include!(:notes) - power.include?(:note, Note.last) - power.include!(:note, Note.last) + power.include?(:notes, Note.last) + power.include!(:notes, Note.last) Boolean powers -------------- @@ -81,10 +85,64 @@ power.dashboard? # => true power.dashboard! # => raises Consul::Powerless unless Power#dashboard? returns true +Powers that give no access at all +--------------------------------- + +Note that there is a difference between having access to an empty list of records, and having no access at all. +If you want to express that a user has no access at all, make the respective power return `nil`. + +Note how the power in the example below returns `nil` unless the user is an admin: + + class Power + ... + + power :users do + User if @user.admin? + end + + end + +When a non-admin queries the `:users` power, she will get the following behavior: + + power.notes # => returns nil + power.notes? # => returns false + power.notes! # => raises Consul::Powerless + power.note?(Note.last) # => returns false + power.note!(Note.last) # => raises Consul::Powerless + + +Other types of powers +--------------------- + +A power can return any type of object. For instance, you often want to return an array: + + class Power + ... + + power :assignable_note_states do + if admin? + %w[draft pending published retracted] + else + %w[draft pending] + end + end + + end + +You can query it like any other power. E.g. if a non-admin queries this power she will get the following behavior: + + power.assignable_note_states # => ['draft', 'pending'] + power.assignable_note_states? # => returns true + power.assignable_note_states! # => does nothing (because the power isn't nil) + power.assignable_note_state?('draft') # => returns true + power.assignable_note_state?('published') # => returns false + power.assignable_note_state!('published') # => raises Consul::Powerless + + Role-based permissions ---------------------- Consul has no built-in support for role-based permissions, but you can easily implement it yourself. Let's say your `User` model has a string column `role` which can be `"author"` or `"admin"`: @@ -327,12 +385,12 @@ Development ----------- -A Rails 2 test application lives in `spec/app_root`. You can run specs from the project root by saying: +Test applications for various Rails versions lives in `spec`. You can run specs from the project root by saying: - bundle exec rake spec + bundle exec rake all:spec If you would like to contribute: - Fork the repository. - Push your changes **with specs**.