"
],
"dist_name" => "Mojolicious-Plugin-Authorization",
"dist_version" => "1.0301",
"license" => "perl",
"module_name" => "Mojolicious::Plugin::Authorization",
"recommends" => {},
"recursive_test_files" => 1,
"requires" => {
"Mojo::Base" => 0
},
"script_files" => []
);
my $build = Module::Build->new(%module_build_args);
$build->create_build_script;
Mojolicious-Plugin-Authorization-1.0301/example/0000755000175100017510000000000012070343140021501 5ustar scolesjscolesjMojolicious-Plugin-Authorization-1.0301/example/miniauthorfile.txt0000644000175100017510000000023012070313716025262 0ustar scolesjscolesj## file format:
## role:privilege1:privilege2:privilege3
## role1:privilege1:privilege3
hypnotoad:view:herd:judge
guest:view
dog:herd
judge:view:judge
Mojolicious-Plugin-Authorization-1.0301/example/miniauthorfile.pm0000644000175100017510000000323612070313716025070 0ustar scolesjscolesjpackage
miniauthorfile; # hide from PAUSE
use strict;
use warnings;
use warnings FATAL => qw{ uninitialized };
use autodie;
use 5.10.0;
################################################################
=pod
=head1 Title
miniautorfile.pm --- mini data base for a role-based access control (RBAC) file.
=head1 Invocation
$ perl miniautorfile.pm
shows off how this module works.
=head1 Versions
0.0: April 11 2012
=cut
################################################################
# file format: role:privilege1:privilege2:privilege3
# role1:privilege1:privilege3
################################################################
sub new {
my $class = shift;
my ($authorfile)= @_;
(-e $authorfile) or die "You must create a user-readable and user-writable authorization file first.\n";
## load persistent role information from an existing authorization file
my %roles;
open(my $FIN, "<", $authorfile);
while (<$FIN>) {
(/^\#/) and next; ## skip comments
(/\w/) or next; ## skip empty lines
(!/([\w :\\])/) and die "Your authorization file has a non-word character ($1), other than : and \\ on line $.: $_\n";
my @values= split(/:/);
my $role = shift(@values);
my $privs;
foreach my $priv (@values){
$priv =~ s/\R//g;
$privs->{$priv} = 1;
}
$roles{$role}= $privs;
}
close($FIN);
return bless({ authorfile => $authorfile, %roles }, $class);
}
################################################################
sub set_role {
my $self = shift;
my ($session,$role) = @_;
#$session->{'role_privs'} = $roles{$role};
$session->{'role'}=$role;
# return ((exists($self->{$_[0]}))?($_[0]):undef);
}
1;
Mojolicious-Plugin-Authorization-1.0301/example/showoff-authorization.pl0000644000175100017510000001336312070313717026424 0ustar scolesjscolesj#!/usr/bin/env perl
use strict;
use warnings;
use warnings FATAL => qw{ uninitialized };
use autodie;
# Disable IPv6, epoll and kqueue
BEGIN { $ENV{MOJO_NO_IPV6} = $ENV{MOJO_POLL} = 1 }
use Mojolicious::Lite;
=pod
=head1 Title
showoff-authorization.pl --- an example of the Mojolicious::Plugin::Authorization module by John Scoles
=head1 Invocation
$ perl showoff-authorization.pl daemon
=head1 Notes
My first crack at a Mojo plugin a steal from Ben van Staveren's Authentication so I owe him and some others
a great note of thanks
Like Authentication this is a very a simple application. It supplies the framwork and you have to give it
the guts which this little progam shows.
I did not add in any Authentication as that is up to you to build. In this test I just assume you are
authenticated on the session and that session has a role hash on it.
=head1 Versions
0.1: May 01 2012
=cut
################################################################
### miniauthorfile.pm lays out basic functionality for the miniauthorfile
use miniauthorfile;
my $roles = miniauthorfile->new('miniauthorfile.txt');
################################################################
plugin 'authorization', {
has_priv => sub {
my $self = shift;
my ($priv, $extradata) = @_;
return 0
unless($self->session('role'));
my $role = $self->session('role');
my $privs = $roles->{$role};
return 1
if exists($privs->{$priv});
return 0;
},
is_role => sub {
my $self = shift;
my ($role, $extradata) = @_;
return 0
unless($self->session('role'));
return 1
if ($self->session('role') eq $role);
return 0;
},
user_privs => sub {
my $self = shift;
my ($extradata) = @_;
return []
unless($self->session('role'));
my $role = $self->session('role');
my $privs = $roles->{$role};
return keys(%{$privs});
},
user_role => sub {
my $self = shift;
my ($extradata) = @_;
return $self->session('role');
},
};
################################################################
get '/' => sub {
my $self = shift;
unless($self->session('role')){
$self->session('role'=>'guest');
}
$self->render('index'); ## index needs to be named to match '/'
};
get '/dogshow' => sub {
my $self = shift;
unless ($self->has_priv('view')) {
$self->render('index');
}
else{
$self->stash('role_name'=> $self->role());
$self->render('dogshow');
}
};
get '/change/:role' => sub {
my $self = shift;
my $role = $self->param('role');
$roles->set_role($self->session,$role);
$self->stash('role_name'=> $self->role());
$self->render('dogshow');
# $self->render(template); ## this is called automatically
};
get '/view' => sub {
my $self = shift;
unless ($self->has_priv('view')) {
$self->render('index');
}
# $self->render(template); ## this is called automatically
};
get '/herd' => sub {
my $self = shift;
unless ($self->has_priv('herd')) {
$self->render('not_allowed');
}
};
get '/judge' => sub {
my $self = shift;
$self->render('not_allowed')
unless ($self->has_priv('judge'));
$self->render('all_glory')
if ($self->is("hypnotoad"))
};
############ these two subs can show you what you can do now, based on authenticated status
get '/my_privs/' => sub {
my $self = shift;
$self->render('not_allowed')
unless ($self->session('role'));
my @privs = $self->privileges();
$self->stash('privs'=> \@privs);
};
## /condition/authonly exists as a webpage ONLY after authentication
app->secret('All GLORY to the Hypnotoad!!'); # used for cookies and persistence
app->start();
################################################################
__DATA__
@@ index.html.ep
% layout 'default';
% title 'Root';
Top Index Page
The purpose of this little web app is to show an example of Mojolicious and its Mojolicious::Authorization module by John Scoles.
Go to the trials as a Guest.
Go to the trials as a Dog.
Go the trials as a Judge.
Go the trials as The Hypnotoad.
@@ dogshow.html.ep
% layout 'default';
% title 'Pan Galatic Sheep Dog Trials';
Welcome "<%= $role_name %>" to the the Pan Galatic Sheep Dog Trials.
Go home
View a Trial
Herd some Sheep
Judge a trial
What are my Privleges
@@ view.html.ep
% layout 'default';
% title 'View Trials';
Enjoy the Trials
He's good.
But our real compition is the Hypnotoad
@@ herd.html.ep
% layout 'default';
% title 'Herd Some Sheep';
Heard Some Sheep
Woof, Bow-Wow
eye-ball
run~chase
put sheep in pen
@@ judge.html.ep
% layout 'default';
% title 'Judge a Dog';
Judge a Dog
5.8
5.9
5.8
5.7
and
4.9
from the Russian Judge
@@ my_privs.html.ep
% layout 'default';
% title 'My Privleges';
Privleges
%foreach my $priv (@{$privs}) {
<%==$priv%>
%}
@@ all_glory.html.ep
% layout 'default';
% title 'Judge a Dog';
Judge a Dog
And the winner is
All Gloy to the Hypnotoad
Clap-Clap-Clap
@@ not_allowed.html.ep
% layout 'default';
% title 'Page Unavailable';
I am sorry do to interferance from suicide booths on 'Eminiar VII' you cannot get to this page
@@ layouts/default.html.ep
<%= title %>
Mojolicious: <%= $0 %>: <%= title %>
<%= content %>
Mojolicious-Plugin-Authorization-1.0301/t/0000755000175100017510000000000012070343140020311 5ustar scolesjscolesjMojolicious-Plugin-Authorization-1.0301/t/00-load.t0000644000175100017510000000012312070313720021627 0ustar scolesjscolesj#!perl -T
use Test::More tests => 1;
use_ok('Mojolicious::Plugin::Authorization');
Mojolicious-Plugin-Authorization-1.0301/t/release-cpan-changes.t0000644000175100017510000000046612070313720024452 0ustar scolesjscolesj#!perl
BEGIN {
unless ($ENV{RELEASE_TESTING}) {
require Test::More;
Test::More::plan(skip_all => 'these tests are for release candidate testing');
}
}
use Test::More;
eval 'use Test::CPAN::Changes';
plan skip_all => 'Test::CPAN::Changes required for this test' if $@;
changes_ok();
done_testing();
Mojolicious-Plugin-Authorization-1.0301/t/01-functional.t0000644000175100017510000000642212070313720023063 0ustar scolesjscolesj#!/usr/bin/env perl
use strict;
use warnings;
# Disable IPv6, epoll and kqueue
BEGIN { $ENV{MOJO_NO_IPV6} = $ENV{MOJO_POLL} = 1 }
use Test::More;
plan tests => 42;
# testing code starts here
use Mojolicious::Lite;
use Test::Mojo;
my %roles = (role1=>{priv1=>1},
role2=>{priv1=>1,priv2=>1});
plugin 'authorization', {
has_priv => sub {
my $self = shift;
my ($priv, $extradata) = @_;
return 0
unless($self->session('role'));
my $role = $self->session('role');
my $privs = $roles{$role};
return 1
if exists($privs->{$priv});
return 0;
},
is_role => sub {
my $self = shift;
my ($role, $extradata) = @_;
return 0
unless($self->session('role'));
return 1
if ($self->session('role') eq $role);
return 0;
},
user_privs => sub {
my $self = shift;
my ($extradata) = @_;
return []
unless($self->session('role'));
my $role = $self->session('role');
my $privs = $roles{$role};
return keys(%{$privs});
},
user_role => sub {
my $self = shift;
my ($extradata) = @_;
return $self->session('role');
},
};
get '/' => sub {
my $self = shift;
$self->session('role'=>'role1');
$self->render(text => 'index page');
};
get '/priv1' => sub {
my $self = shift;
$self->render(text=> $self->has_priv('priv1') ? 'Priv 1' : 'fail');
};
get '/priv2' => sub {
my $self = shift;
$self->render(text=> $self->has_priv('priv2') ? 'Priv 2' : 'fail');
};
get '/privilege1' => sub {
my $self = shift;
$self->render(text=> $self->has_privilege('priv1') ? 'Priv 1' : 'fail');
};
get '/privilege2' => sub {
my $self = shift;
$self->render(text=> $self->has_privilege('priv2') ? 'Priv 2' : 'fail');
};
get '/role1' => sub {
my $self = shift;
$self->render(text=> $self->role('role1') ? 'Role 1' : 'fail');
};
get '/role2' => sub {
my $self = shift;
$self->render(text=> $self->role('role2') ? 'Role 2' : 'fail');
};
get '/change/:role' => sub {
my $self = shift;
my $role = $self->param('role');
$self->session('role'=>$role);
my $new_role = $self->role;
$self->render(text=>$new_role);
};
get '/myrole' => sub {
my $self = shift;
my $new_role = $self->role;
$self->render(text=>$new_role);
};
get '/myprivs' => sub {
my $self = shift;
my @privs = $self->privileges();
my $priv = join(':',@privs);
$self->render(text=>$priv);
};
my $t = Test::Mojo->new;
$t->get_ok('/')->status_is(200)->content_is('index page');
$t->get_ok('/priv1')->status_is(200)->content_is('Priv 1');
$t->get_ok('/priv2')->status_is(200)->content_is('fail');
$t->get_ok('/privilege1')->status_is(200)->content_is('Priv 1');
$t->get_ok('/privilege2')->status_is(200)->content_is('fail');
$t->get_ok('/myrole')->status_is(200)->content_is('role1');
$t->get_ok('/myprivs')->status_is(200)->content_is('priv1');
$t->get_ok('/change/role2')->status_is(200)->content_is('role2');
$t->get_ok('/priv1')->status_is(200)->content_is('Priv 1');
$t->get_ok('/priv2')->status_is(200)->content_is('Priv 2');
$t->get_ok('/privilege1')->status_is(200)->content_is('Priv 1');
$t->get_ok('/privilege2')->status_is(200)->content_is('Priv 2');
$t->get_ok('/myrole')->status_is(200)->content_is('role2');
$t->get_ok('/myprivs')->status_is(200)->content_is('priv1:priv2');
Mojolicious-Plugin-Authorization-1.0301/t/manifest.t0000644000175100017510000000041512070313720022305 0ustar scolesjscolesj#!perl -T
use strict;
use warnings;
use Test::More;
unless ( $ENV{RELEASE_TESTING} ) {
plan( skip_all => "Author tests not required for installation" );
}
eval "use Test::CheckManifest 0.9";
plan skip_all => "Test::CheckManifest 0.9 required" if $@;
ok_manifest();
Mojolicious-Plugin-Authorization-1.0301/README.pod0000644000175100017510000001673312070313715021526 0ustar scolesjscolesj=pod
=head1 NAME
Mojolicious::Plugin::Authorization - A plugin to make Authorization a bit easier
=head1 VERSION
version 1.03
=head1 SYNOPSIS
use Mojolicious::Plugin::Authorization
$self->plugin('Authorization' => {
'has_priv' => sub { ... },
'is_role' => sub { ... },
'user_privs' => sub { ... },
'user_role' => sub { ... },
});
if ($self->has_priv('delete_all', { optional => 'extra data stuff' })) {
...
}
=head1 DESCRIPTION
A very simple API implementation of role-based access control (RBAC). This plugin is only an API you will
have to do all the work of setting up your roles and privileges and then provide four subs that are used by
the plugin.
The plugin expects that the current session will be used to get the role its privileges. It also assumes that
you have already been authenticated and your role set.
That is about it you are free to implement any system you like.
=head1 METHODS
=head2 has_priv('privilege', $extra_data) or has_privilege('privilege', $extra_data)
'hHas_priv'' and ''has_privilege'' will use the supplied C subroutine ref to check if the current session has the
given privilege. Returns true when the session has the privilege or false otherwise.
You can pass additional data along in the extra_data hashref and it will be passed to your C
subroutine as-is.
=head2 is('role',$extra_data)
'is' will use the supplied C subroutine ref to check if the current session is the
given role. Returns true when the session has privilege or false otherwise.
You can pass additional data along in the extra_data hashref and it will be passed to your C
subroutine as-is.
=head2 privileges($extra_data)
'pPrivileges'' will use the supplied C subroutine ref and return the privileges of the current session.
You can pass additional data along in the extra_data hashref and it will be passed to your C
subroutine as-is. The returned data is dependant on the supplied C subroutine.
=head2 role($extra_data)
'role' will use the supplied C subroutine ref and return the role of the current session.
You can pass additional data along in the extra_data hashref and it will be passed to your C
subroutine as-is. The returned data is dependant on the supplied C subroutine.
=head1 CONFIGURATION
The following options must be set for the plugin:
=over 4
=item has_priv (REQUIRED) A coderef for checking to see if the current session has a privilege (see L).
=item is_role (REQUIRED) A coderef for checking to see if the current session is a certain role (see L).
=item user_privs (REQUIRED) A coderef for returning the privileges of the current session (see L).
=item user_role (REQUIRED) A coderef for retiring the role of the current session (see L).
=back
=head2 HAS PRIV
'has_priv' is used when you need to confirm that the current session has the given privilege.
The coderef you pass to the C configuration key has the following signature:
sub {
my ($app, $privilege,$extradata) = @_;
...
}
You must return either 0 for a fail and 1 for a pass. This allows C to work correctly.
=head2 IS
'is' is used when you need to confirm that the current session is set to the given role.
The coderef you pass to the C configuration key has the following signature:
sub {
my ($app, $role, $extradata) = @_;
...
return $role;
}
You must return either 0 for a fail and 1 for a pass. This allows C to work correctly.
=head2 PRIVILEGES
'privileges' is used when you need to get all the privileges of the current session.
The coderef you pass to the C configuration key has the following signature:
sub {
my ($app,$extradata) = @_;
...
return $privileges;
}
You can return anything you want. It would normally be an arrayref of privileges but you are free to
return a scalar, hashref, arrayref, blessed object, or undef.
=head2 ROLE
'role' is used when you need to get the role of the current session.
The coderef you pass to the C configuration key has the following signature:
sub {
my ($app,$extradata) = @_;
...
return $role;
}
You can return anything you want. It would normally be just a scalar but you are free to
return a scalar, hashref, arrayref, blessed object, or undef.
=head1 EXAMPLES
For a code example using this, see the F test,
it uses L and this plugin.
=head1 ROUTING VIA CONDITION
This plugin also exports a routing condition you can use in order to limit access to certain documents to only
sessions that have a privilege.
$r->route('/delete_all')->over(has_priv => 'delete_all')->to('mycontroller#delete_all');
my $delete_all_only = $r->route('/members')->over(has_priv => 'delete_all')->to('members#delete_all');
$delete_all_only->route('delete')->to('members#delete_all');
If the session does not have the 'delete_all' privilege, these routes will not be considered by the dispatcher and unless you have set up a catch-all route,
a 404 Not Found will be generated instead.
Another condition you can use to limit access to certain documents to only those sessions that
have a role.
$r->route('/view_all')->over(is => 'ADMIN')->to('mycontroller#view_all');
my $view_all_only = $r->route('/members')->over(is => 'view_all')->to('members#view_all');
$view_all_only->route('view')->to('members#view_all');
If the session is not the 'ADMIN' role, these routes will not be considered by the dispatcher and unless you have set up a catch-all route,
a 404 Not Found will be generated instead.
This behavior is similar to the "has" condition.
=head1 ROUTING VIA CALLBACK
It is not recommended to route un-authorized requests to anything but a 404 page. If you do route to some sort
of 'You are not allowed page' you are telling a hacker that the URL was correct while the 404 tells them nothing.
This is just my opinion.
=head1 SEE ALSO
L, L
=head1 AUTHOR
John Scoles, C<< >>
=head1 BUGS / CONTRIBUTING
Please report any bugs or feature requests through the web interface at L.
=head1 SUPPORT
You can find documentation for this module with the perldoc command.
perldoc Mojolicious::Plugin::Authorization
You can also look for information at:
=over 4
=item * AnnoCPAN: Annotated CPAN documentation L
=item * CPAN Ratings L
=item * Search CPAN L
=back
=head1 ACKNOWLEDGEMENTS
Ben van Staveren (madcat)
- For 'Mojolicious::Plugin::Authentication' which I used as a guide in writing up this one.
Chuck Finley
- For staring me off on this.
Abhijit Menon-Sen
- For the routing suggestions
Roland Lammel
- For some other good suggestions
=head1 LICENSE AND COPYRIGHT
Copyright 2012 John Scoles.
This program is free software; you can redistribute it and/or modify it
under the terms of either: the GNU General Public License as published
by the Free Software Foundation; or the Artistic License.
See http://dev.perl.org/licenses/ for more information.
=cutMojolicious-Plugin-Authorization-1.0301/Makefile.PL0000644000175100017510000000227012070342202022017 0ustar scolesjscolesjuse strict;
use warnings;
use ExtUtils::MakeMaker 6.30;
my %WriteMakefileArgs = (
"ABSTRACT" => "A plugin to make authorization a bit easier",
"AUTHOR" => "John Scoles ",
"BUILD_REQUIRES" => {
"Module::Build" => "0.38",
"Mojolicious::Lite" => 0,
"Test::Mojo" => 0,
"Test::More" => 0,
"strict" => 0,
"warnings" => 0
},
"CONFIGURE_REQUIRES" => {
"ExtUtils::MakeMaker" => "6.30",
"Module::Build" => "0.38"
},
"DISTNAME" => "Mojolicious-Plugin-Authorization",
"EXE_FILES" => [],
"LICENSE" => "perl",
"NAME" => "Mojolicious::Plugin::Authorization",
"PREREQ_PM" => {
"Mojo::Base" => 0
},
"VERSION" => "1.0301",
"test" => {
"TESTS" => "t/*.t"
}
);
unless ( eval { ExtUtils::MakeMaker->VERSION(6.56) } ) {
my $br = delete $WriteMakefileArgs{BUILD_REQUIRES};
my $pp = $WriteMakefileArgs{PREREQ_PM};
for my $mod ( keys %$br ) {
if ( exists $pp->{$mod} ) {
$pp->{$mod} = $br->{$mod} if $br->{$mod} > $pp->{$mod};
}
else {
$pp->{$mod} = $br->{$mod};
}
}
}
delete $WriteMakefileArgs{CONFIGURE_REQUIRES}
unless eval { ExtUtils::MakeMaker->VERSION(6.52) };
WriteMakefile(%WriteMakefileArgs);
Mojolicious-Plugin-Authorization-1.0301/MANIFEST0000644000175100017510000000045112070313714021203 0ustar scolesjscolesjBuild.PL
Changes
LICENSE
MANIFEST
META.json
META.yml
Makefile.PL
README
README.pod
dist.ini
example/miniauthorfile.pm
example/miniauthorfile.txt
example/showoff-authorization.pl
lib/Mojolicious/Plugin/Authorization.pm
t/00-load.t
t/01-functional.t
t/manifest.t
t/release-cpan-changes.t
weaver.ini