不使用第三方的 gem 实现一个权限系统

# db/migrate/xxx_create_users.rb
class CreateUsers < ActiveRecord::Migration
  def change
    create_table :users do |t|
+     t.string :name, null: false
+     t.timestamps null: false
    end
  end
end

# db/migrate/xxx_create_permissions_users.rb

class CreatePermissionsUsers < ActiveRecord::Migration
  def change
    create_table :permissions_users do |t|
      t.integer :user_id
      t.integer :permission_id
      t.timestamps null: false
    end
  end
end

# db/migrate/xxx_create_permissions.rb
class CreatePermissions < ActiveRecord::Migration
  def change
    create_table :permissions do |t|
+     t.string :name, null: false
+     t.timestamps null: false
    end
  end
end

# db/migrate/xxx_create_posts.rb

class CreatePosts < ActiveRecord::Migration
  def change
    create_table :posts do |t|
+     t.string :title
+	  t.text :content
+	  t.integer :user_id
      t.timestamps null: false
    end
  end
end

# app/models/user.rb

class User < ActiveRecord::Base

+ has_and_belongs_to_many :permissions
+ validate :name, uniqueness: true

end

# app/models/permission.rb

class Permission < ActiveRecord::Base

+ has_and_belongs_to_many :users
+ validates :name, uniqueness: true

end

# app/models/permit.rb

class Permit < BasicObject

  def self.permission_mapper
    # 默认情况下如果实例能够响应与权限同名的方法，就表示用户拥有此权限
    default_m = ::Hash.new(->{true})

    # 有些权限需要增加特定的参数和逻辑
    custome_m = {
      edit_post: ->(post){ post.user_id == @user.id}
    }

    default_m.merge(custome_m)
  end

  def initialize(user)
    # 权限的实际拥有者
    @user = user
    
    # 这里没有使用常量去存储权限映射，是为了防止权限映射在程序员不知情的情况下被修改
    @permission_mapper = ::Permit.permission_mapper

    # 用于存储和权限同名方法的容器
    @permission_mod = ::Module.new

    load_permissions
  end

  def can?(name, *args)
    __send__(name, *args)
  end

  private

  # 继承于 BasicObject 的 Permit 没有 extend 方法，我们需要自己实现 extend 方法
  def extend(mod)
    mod.__send__(:extend_object, self)
  end

  def load_permissions

    # 从数据库加载权限纪录, 并把权限纪录定义成方法
    @user.permissions.each {|p|
      k = p.name.to_sym
      v = @permission_mapper[k]
      @permission_mod.send(:define_method, k, &v)
    }

    # 为本实例扩展和权限同名的方法，不会影响到 Permit 的其他实例
    extend @permission_mod
  end

  # 用户没有某个权限，调用与此权限同名的方法时，会返回 false，表示此权限不可访问
  def method_missing(permission_name, *args)
    false
  end

end

# db/seeds.rb

users = User.create([{name: 'user0'},
                     {name: 'user1'},
                     {name: 'admin0'},
                     {name: 'admin1'}
                    ])


permissions = Permission.create([{name: 'login_admin'},
                                 {name: 'create_post'},
                                 {name: 'edit_post'},
                                 {name: 'crud_users'},
                                 {name: 'crud_posts'}
                                ])

# config/routes.rb

Rails.application.routes.draw do

+ resources :posts
  
end

# app/controllers/posts_controller.rb

class PostsController < ApplicationController

+  def index
+    @posts = Post.order('created_at desc').includes(:users)
+  end

+  def new
+    @post = Post.new
+  end

+  def create
+  end
  
end

# app/controllers/application_controller.rb

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception
  
   # 可以在 view 里使用 :current_user 和 :permit? 方法
+  helper_method :current_user, :permit?

   # 为了简单起见，我们没有实现一个完整的注册登录功能
   # 通过在 params 里传递 user name 来识别当前用户
   # 比如: http://localhost:3000/posts/new?current_user=user0
+  def current_user
+    @current_user ||= User.find_by(name: params[:current_user])
+  end

   # 将 current_user 的 permit 缓存起来
   # 并且如果当前用户为空则建立一个游客用户(User.new)
+  def current_permit
+    @current_permit ||= Permit.new(current_user || User.new)
+  end


   # 判断当前登录用户是否具有名字为 name 的权限
+  def permit?(name, *args)
+    current_permit.can?(name, *args)
+  end

   # fence 是篱笆的意思，我们可以通过篱笆保护我们的代码不被不认可的用户访问
   # 如果代码里有多个 render 或者 redirect_to 我们需要使用
   # fence(name, *args) {...} 的形式
+  def fence(name, *args, &block)
+    if !permit?(name, *args)
+      render status: 403, json: {code: 403, msg: 'forbidden'}.to_json
+    else
+      block.call if block_given?
+    end
+  end
  
end

u = User.find_by(name: 'user0')
p = Permission.find_by(name: 'create_post')

u.permissions << p
u.save

# app/controllers/posts_controller.rb

class PostsController < ApplicationController

  def create
+   fence :create_post do
+     @post = current_user.posts.create(post_params)
+     if @post.valid?
+       redirect_to action: 'index'
+     else
+       render :new
+     end  
+   end
  end
  
+ private

+ def post_params
+   params.require(:post).permit(:title, :content)
+ end
  
end

# app/models/user.rb

class Post < ActiveRecord::Base
  validates :title, :content, presence: true

+ belongs_to :user
end

u = User.find_by(name: 'user1')
p = Permission.find_by(name: 'edit_post')

u.permissions << p
u.save

 {edit_post: ->(post){ post.user_id == @user.id }}

# app/controllers/posts_controller.rb

class PostsController < ApplicationController

+  def edit
+    @post = Post.find(params[:id])
+    fence(:edit_post, @post) do
+      render :edit
+    end
+  end
  
end

u = User.find_by(name: 'user0')
p = Permission.find_by(name: 'edit_post')

u.permissions << p
u.save