website/index.txt in lockdown-0.2.0 vs website/index.txt in lockdown-0.3.1

- old
+ new

@@ -4,11 +4,11 @@ h3. Lockdown has not been officially released! This page is a Work-In-Progress. The first version will be released by May 1st. h2. What -Lockdown is a authentication/authorization system for RubyOnRails and Merb designed for simplicity and extensibility. All access rules are in (initially) defined in lib/lockdown/access.rb. With the included ORM support (ActiveRecord or DataMapper) and management screens you can add user defined rules to the system. +Lockdown is a authentication/authorization system for RubyOnRails and Merb designed for simplicity and extensibility. All access rules are defined in lib/lockdown/init.rb. With the included ORM support (ActiveRecord or DataMapper) and management screens you can add user defined rules to the system. If there is a "spec" directory, a test helper file will be included to provied some basic functionality for use with RSpec. This will show you how to create mock user objects and sign in as an adminstrator. Also included is functionality to auto-populate created_by and updated_by fields. @@ -22,12 +22,19 @@ $ sudo gem install lockdown $ cd <your_project_directory> $ lockdown . </pre> -This will create a "lockdown" directory in the lib dir add two files: access.rb and session.rb. Modify access.rb to define the rules that apply to your system. +This will create a "lockdown" directory in the lib dir add two files: init.rb and session.rb. Modify init.rb to set defaults and define the rules that apply to your system. +If you want the full 'subsystem' (models, views, controllers, helpers): + +<pre> +$ cd <your_project_directory> +$ ./script/generate lockdown_all +</pre> + I recommend reading this page to get a feel for Lockdown's functionality. h2. How it works Lockdown stores an array of access rights in the session. For example, if you have a standard REST users controller, the access rights would be: @@ -41,11 +48,11 @@ users/destroy (delete for Merb) </pre> The above list will be stored in the session as an array and each request is tested against this list. So this means, you <strong>should not use client side session storage</strong>. If you can, I recommend using memcache, but a database session store will suffice. -To define access rights you need to modify lib/lockdown/access.rb. This is the default access.rb included with Lockdown: +To define access rights you need to modify lib/lockdown/init.rb. This is the default init.rb included with Lockdown: <pre syntax="ruby"> require "lockdown" module Lockdown # @@ -141,12 +148,15 @@ # ** The registered_users method is "special", please don't rename. # Not as special as the others, but still... # # All newly created users are assigned to this User Group by default # + # Sample registered_users permission: + # [:my_account] + # def registered_users - #[:my_account] + [] end # # Define your own user groups below # @@ -154,49 +164,29 @@ end # end UserGroups module end # end Lockdown module </pre> + h2. Some History Lockdown was initially designed as a authentication/authorization system to be configured by system administrators. This means it was database driven and had an interface to manage the access rights. I didn't like the static methodology of using code scattered amongst the controllers to define my access rights for the system. I also didn't like the fact that everything was accessible unless you restricted access. So, I designed Lockdown to restrict access to all resources unless rights have been granted. The system was nice and worked well until I had a project that required RSpec tests. I don't have anything against testing frameworks (now that I've see the light) but what bothered me most what the fact that I would have to duplicate the information I already defined in my migrations as mock data. I simply refused to do that extra work. So, a serious refactoring of Lockdown was required. -<blockquote>This is where the access.rb file was born. This file contains the rules that grant/deny access to your system. More on this later.</blockquote> After the RSpec project was completed, the refactoring continued. This time the focus was on releasing the code to the masses. I like this system a lot and think both the system itself and the community could benefit from releasing this as an open source project. In the middle of my refactoring for a public release, I made the decision to use Merb (when the choice was mine). This meant I needed to modify Lockdown for use with Merb. So this is what I have done. There is code in place for using Lockdown with Rails, after all, that's where Lockdown was born. However, I have not yet tested the Rails functionality after this last refactor. In addition, the deployment mechanism for Rails has to be tested. Writing code for public release is difficult and much different from architecting/coding for a closed source project. A lot of things you could get by with in a proprietary application won't be well received by the general public. In addition, if you don't make things easy, the adoption rate will probably be non-existent. -h2. Features - -<strong>I have these components (for the most part)...figuring out how to package them. The following is just an idea right now... </strong> -<br/> -<br/> -The goal of Lockdown is to give you only what you want from the system. - -The initial install is all that is required to lock down your system. However, you'll probably want the authorization functionality. You can get this by: - -<pre syntax="ruby">rake lockdown:install:authorization</pre> - -If you want to install ORM support: - -<pre syntax="ruby">rake lockdown:install:orm</pre> - -If you want to install management screens (ORM support included): -<pre syntax="ruby">rake lockdown:install:management</pre> - -If you want to install authorization + management screens: -<pre syntax="ruby">rake lockdown:install:all</pre> - - h2. Forum + +If you are having a problem understanding how to use Lockdown, please post your question on the lockdown group. If it's documentation related, I will keep this page updated to help everyone. "http://groups.google.com/group/stonean_lockdown?hl=en":http://groups.google.com/group/stonean_lockdown?hl=en h2. How to submit patches