exelord / monarchy

Hierarchical access management system with advanced roles inheritance. 🦋

Monarchy is a ruby gem offering a complete solution to manage an authorization access in Ruby on Rails applications. A hierarchical structure as well as built-in roles inheritance options make it the most powerful tool to control access to application data resources.

Thanks to closure_tree - a gem used to manage binary trees - Monarchy can deliver the best-in-class algorithmic performance and enables developers to forget about hierarchies and complicated structures.

If you feel limited while using rolify, feel free to use Monarchy with its advanced capacity to inherit roles and collect all accessible resources with just one method.

Usage Example

After Monarchy setup you can enjoy with roles inheritance and accessible resources.

# Create roles
admin_role = Monarchy.role_class.create(name: :admin, level: 5, inherited: true)
manager_role = Monarchy.role_class.create(name: :manager, level: 4, inherited_role: admin_role, inherited: true)

# Create resources
project1 = Project.create()
project2 = Project.create(parent: project1)
project3 = Project.create(parent: project2)
project4 = Project.create(parent: project1)

# Grant user
user.grant(:manager, project2)

# Accessible projects
Project.accessible_for(user)  # returns [project1, project2, project3]

# User inherited roles
user.roles_for(project1) # returns a default role eg. [guest_role]
user.roles_for(project2) # returns [manager_role]
user.roles_for(project3) # returns [admin_role]
user.roles_for(project4) # returns empty array []

# Graphical visualization

#                              project1 (default role, eg. guest)
#                                 |
#                                 |
#   (granted as manager) project2   project4 (no access)
#                           |
#                           |
#                        project3 (admin | inherited role from manager_role)

Requirements

Monarchy requires:

• Ruby 2.3

Documentation

We are preparing an official website with documentation. Meanwhile you can look to the docs directory for actual documentation.

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/exelord/Monarchy. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

License

This version of the gem is available as open source under the terms of the MIT License.

monarchy's Issues

Complete Readme and WIKI

Debug mode ability

Ability to get more detailed information where we run Monarchy methods, so for example if we run in Monarchy.debug = true we will see stack trace with corresponding application code, so we can easier track potential performance issues (for example) or even better if we can somehow connect it with bullet log/warning.

Integrate resource and roles abilities

Closure Tree Root

Implement ClosureTree/closure_tree#232

When deleting Role delete also members role relation

Prevent granting role with the same level

Prevent to grant user a role with level which exist in user's roles scope.

TODO:

• Write validation in member_roles to prevent that action
• Write some tests

Ownership relation

Consider to add automatically ownerships of resource.

Scope modules into Treelify

Scope models and database tables to treelify module

Dynamic relationships

Register and generate automatically all relationships for all resources.

  has_many :accounts, through: :hierarchies, class_name: 'Account', source: 'resource', source_type: 'Account'
  has_many :projects, through: :hierarchies, class_name: 'Project', source: 'resource', source_type: 'Project'
  has_many :memos, through: :hierarchies, class_name: 'Memo', source: 'resource', source_type: 'Memo'

Rise errors where incorrect resource was assigned

Rise errors where incorrect resources were assigned as parents or children.

Todo:

• every resource which want to be assigned as parent or child must be acts_as_resource
• write tests

Internal hierarchy model

Create internal hierarchy model and fix closure_tree that need database connection on gem initialisation

Closure tree require database connection in initialize gem process. :/

TODO:

• uncomment https://github.com/Exelord/Treelify/blob/master/lib/treelify/hierarchy.rb and make the build works :) (try to run successfully rails s and fix tests)

Open issue?: ClosureTree/closure_tree#203

Probably missing tests

TODO:

• Default role is granted automatically?
• roles: [ owner, guest(default) ] - When revoking owner: access is still granted? (due to guest role?)
• What happening in case of revoking role that not exist?

Rspec warnings

Fix warnings after run rspec command

Create Monarchy Website

Create Monarchy website on Github pages built in Ember.

Rework on roles_for

User #roles_for method should returns an array wth all accessible role with highest level

Remove potential n-query

Remove potential n-query in .in and .accessible_for

Improve performance

Optimize AAH and AAU

Renaming gem :D

There's waiting cool name for Treelify.

Move documentation to Website

Move documentation from WIKI to Github pages.

Custom Up and down roles inheritence

Some roles have to have downgraded level after down inheritance.
Eg.
When you grant user to a resource A as Owner and then create a child for resource A as resource B you want to inherit role from A to B but with downgraded level eg. as manager.

In fact in resource A user will be owner and in resource B will be manager

TODO:

• create a column named downgraded_role and set as nil by default
• rework on role_for method to obtain a correct downgraded role if exist
• write tests

And think about upgraded_role... Maybe there will be also some use cases.

Better revoking roles

Make second method revoke_role! for force revoking access to resource in case when role that was revoked was the last one. (Works like current method revoke_role)

Rework on revoke_role:

• when role that was revoked was the last one grant default role and keep access to resource

Rise warnings

Rise warning eg when you grant user a role that doesn't exist

Revoke user from resource

Fix parent as

Fix parent as for custom foreign keys

Default role - is it still needed?

#50

Extend `parent_as` method

Extend parent_as method to receive also an array with models names and propagate the parent method.