Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Gotanda.rb#46 権限管理のつらみとPundit

Avatar for Hiroki Tanaka Hiroki Tanaka
September 29, 2020

Gotanda.rb#46 権限管理のつらみとPundit

2020/09/29のGotanda.rb#46LT発表した『権限管理のつらみとPundit』です。

Avatar for Hiroki Tanaka

Hiroki Tanaka

September 29, 2020
Tweet

More Decks by Hiroki Tanaka

Other Decks in Programming

Transcript

  1. ·ͱΊ 1. ΞϓϦέʔγϣϯ͕ݖݶͷ৚݅෼ذίʔυͰԚΕΔ໰୊ - PunditͷಋೖͰ֤ϦιʔεຖͷݖݶϩδοΫΛҰՕॴʹ·ͱΊ Δ͜ͱ͕ग़དྷΔͷͰController΍View͕৚݅෼ذίʔυͰԚΕ Δ໰୊͸ղܾग़དྷΔɻ 2. `admin`ͱ͍͏ݴ༿ͷࢦ͍ͯ͠Δݖݶ͕Α͘Θ͔Βͳ͘ͳΔ໰୊ -

    `admin`ͱ͍͏ᐆດͳ໾ׂΛͳ͘͠ɺ֤Ϧιʔεຖʹ໌֬ͳ໾ ׂ(role)ΛϢʔβʹׂΓ౰ͯɺPunditͰActionຖʹ࣮ߦ੍ޚ͢Δ ͜ͱͰᐆດ͞Λճආ͢Δ͜ͱ͸Մೳɻ - ͨͩɺ`admin`ͱ͍͏ݖݶ͸࡞Ζ͏ͱࢥ͑͹࡞ΕΔͷͰɺࠜຊ తͳ཈੍͸ग़དྷͳ͍ɻ
  2. ͓·͚1ɿPunditɾCanCanCanͷൺֱ Pundit CanCanCan ಋೖ GemΛΠϯετʔϧ͠ɺBaseContoller౳ͰPunditΛ include͢Ε͹࢖༻Մೳɻ GemΛΠϯετʔϧ͠ɺAbilityΫϥεΛ࡞Ε͹࢖༻Մ ೳɻControllerͰͷinclude͸ෆཁɻ ݖݶઃఆ ֤ModelʹରԠͨ͠PolicyΫϥεΛ࡞੒͠ɺݖݶຖͷઃ

    ఆΛهड़͢Δɻ 1ͭͷAbilityΫϥεʹϩʔϧຖͷ֤Ϟσϧʹର͢Δશͯͷ ݖݶΛهࡌ͍ͯ͘͠ɻ ControllerͰͷೝՄ authorizeϝιουΛݺͼग़͢͜ͱͰϞσϧʹରԠ͢Δ PolicyΫϥε͕ࣗಈతʹࢀর͞ΕΔɻControllerͷΞΫ γϣϯ໊ͱϚονͨ͠PolicyΫϥεͷϝιου͕ݺ͹ Εɺ࣮ߦՄೳ͔൑ఆ͢Δɻ authorize!ϝιουͰݖݶͷೝՄ͕Ͱ͖ɺAbilityΫϥεʹ ఆٛͨ͠ݖݶઃఆΛࢀর͠ɺ࣮ߦՄೳ͔൑ఆ͢Δɻ ViewͰͷೝՄ policyϝιουΛ࢖༻͢Δ͜ͱͰ൑ఆͰ͖Δɻ can?΍cannot?ϝιουͰ൑ఆͰ͖Δɻ Ϩίʔυ΁ͷ੍໿ scopeͱ͍͏ػೳΛ༻͍ͯɺPolicyϑΝΠϧ಺ʹΠϯφ ʔΫϥεͱͯ͠ScopeΫϥεΛఆٛ͢Δ͜ͱͰϢʔβ ͷϨίʔυ΁ͷΞΫηεΛ੍ݶͰ͖Δɻ policy_scopeϝιουͰݺͼग़͠Մೳɻ Hash of Conditionsͱ͍͏ػೳΛ༻͍ͯɺ৚݅Λ౉͢ͱऔ ಘ͢ΔϨίʔυΛ੍ݶग़དྷΔɻ accessible_byϝιουͰݺͼग़͠Մೳɻ ૯߹ ֤ϞσϧຖʹରԠͨ͠PolicyϑΝΠϧΛఆٛ͢Δɻ σʔλϞσϧ͕ଟ͍৔߹Ͱ΋ɺPolicyϑΝΠϧ͸γϯ ϓϧʹอͯΔ͕ɺݸʑͷPolicyϑΝΠϧʹݖݶ͕ݸผ ࣮૷͞Ε͍ͯΔͷͰશମͷݟ௨͕͠ѱ͍ɻ 1ͭͷAbilityΫϥε಺ʹ֤ϩʔϧͷ֤Ϟσϧ΁ͷݖݶΛఆ ٛ͢Δɻ1ϑΝΠϧ಺ʹશͯͷݖݶ৘ใ͕ू·ΔͷͰݟ௨ ͠͸ྑ͍͕ɺΞϓϦέʔγϣϯͷ֦େͱڞʹංେԽͷҰ ్ΛḷΔɻ