From 05808abc7df60adee45512af992b7fcebfe22867 Mon Sep 17 00:00:00 2001 From: Paul Bob Date: Tue, 22 Oct 2024 18:25:50 +0300 Subject: [PATCH 1/4] fix: implicit_authorization on default authorization service --- app/controllers/avo/associations_controller.rb | 2 +- lib/avo/fields/has_base_field.rb | 4 +++- spec/dummy/config/initializers/avo.rb | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/app/controllers/avo/associations_controller.rb b/app/controllers/avo/associations_controller.rb index 27377cf28..c6b9b806c 100644 --- a/app/controllers/avo/associations_controller.rb +++ b/app/controllers/avo/associations_controller.rb @@ -154,7 +154,7 @@ def authorize_if_defined(method, record = @record) if @authorization.has_method?(method.to_sym) @authorization.authorize_action method.to_sym - elsif Avo.configuration.authorization_client.present? && Avo.configuration.implicit_authorization + elsif !@authorization.is_a?(Avo::Services::AuthorizationService) && Avo.configuration.implicit_authorization raise Avo::NotAuthorizedError.new end end diff --git a/lib/avo/fields/has_base_field.rb b/lib/avo/fields/has_base_field.rb index d691fce73..b1a9b6635 100644 --- a/lib/avo/fields/has_base_field.rb +++ b/lib/avo/fields/has_base_field.rb @@ -99,8 +99,10 @@ def authorized? if service.has_method? method service.authorize_action(method, raise_exception: false) - else + elsif !service.is_a?(Avo::Services::AuthorizationService) !Avo.configuration.implicit_authorization + else + true end end diff --git a/spec/dummy/config/initializers/avo.rb b/spec/dummy/config/initializers/avo.rb index 5dedffd36..c6e3fdfc7 100644 --- a/spec/dummy/config/initializers/avo.rb +++ b/spec/dummy/config/initializers/avo.rb @@ -32,6 +32,7 @@ config.locale = :en # config.raise_error_on_missing_policy = true # config.authorization_client = "Avo::Services::AuthorizationClients::ExtraPunditClient" + config.implicit_authorization = true ## == Customization == config.id_links_to_resource = true From 5151c3147272b89d69f0f61128334045bb942bb8 Mon Sep 17 00:00:00 2001 From: Paul Bob Date: Tue, 22 Oct 2024 18:36:19 +0300 Subject: [PATCH 2/4] fix `authorize_association_for` --- lib/avo/concerns/checks_assoc_authorization.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/avo/concerns/checks_assoc_authorization.rb b/lib/avo/concerns/checks_assoc_authorization.rb index 117392d96..e0b97b084 100644 --- a/lib/avo/concerns/checks_assoc_authorization.rb +++ b/lib/avo/concerns/checks_assoc_authorization.rb @@ -34,8 +34,10 @@ def authorize_association_for(policy_method) if service.has_method?(method_name, raise_exception: false) service.authorize_action(method_name, record:, raise_exception: false) - else + else !service.is_a?(Avo::Services::AuthorizationService) !Avo.configuration.implicit_authorization + else + true end end end From 57084142620ed05e5eed3b1b60b3a72158a7372d Mon Sep 17 00:00:00 2001 From: Paul Bob Date: Tue, 22 Oct 2024 18:37:09 +0300 Subject: [PATCH 3/4] comment --- spec/dummy/config/initializers/avo.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/spec/dummy/config/initializers/avo.rb b/spec/dummy/config/initializers/avo.rb index c6e3fdfc7..706ccb8e1 100644 --- a/spec/dummy/config/initializers/avo.rb +++ b/spec/dummy/config/initializers/avo.rb @@ -32,6 +32,7 @@ config.locale = :en # config.raise_error_on_missing_policy = true # config.authorization_client = "Avo::Services::AuthorizationClients::ExtraPunditClient" + # Shouldn't impact on community only if custom authorization service was configured. config.implicit_authorization = true ## == Customization == From 1a5c7966c518cc2901862dfef4d25d52a43d13d0 Mon Sep 17 00:00:00 2001 From: Paul Bob Date: Tue, 22 Oct 2024 18:37:52 +0300 Subject: [PATCH 4/4] syntax fix --- lib/avo/concerns/checks_assoc_authorization.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/avo/concerns/checks_assoc_authorization.rb b/lib/avo/concerns/checks_assoc_authorization.rb index e0b97b084..8ac8502f6 100644 --- a/lib/avo/concerns/checks_assoc_authorization.rb +++ b/lib/avo/concerns/checks_assoc_authorization.rb @@ -34,7 +34,7 @@ def authorize_association_for(policy_method) if service.has_method?(method_name, raise_exception: false) service.authorize_action(method_name, record:, raise_exception: false) - else !service.is_a?(Avo::Services::AuthorizationService) + elsif !service.is_a?(Avo::Services::AuthorizationService) !Avo.configuration.implicit_authorization else true