APT-1935: Use SpiceDB for lease-related auth checks #42
Conversation
|
Jira Issue: https://appfolio.atlassian.net/browse/APT-1935 |
|
Does this gem support prereleases so that we don't actually have to merge this PR but can still use it in our property branch? |
dannyeldridge
force-pushed
the
apt-1935-spicedbBackendChecks-AuthGem-PrototypeOnly
branch
from
d77ec46 to
7335a62
Compare
dannyeldridge
force-pushed
the
apt-1935-spicedbBackendChecks-AuthGem-PrototypeOnly
branch
from
758a57d to
4dac361
Compare
![fargo-app[bot]](https://avatars.githubusercontent.com/u/115119?s=60&v=4){kind=small}
dannyeldridge
force-pushed
the
apt-1935-spicedbBackendChecks-AuthGem-PrototypeOnly
branch
2 times, most recently
from
fee5ff2 to
ff3942a
Compare
|
The latest commit adds a check for the Each rule has zero or more attributes that get evaluated. |
|
|
||
| if condition_type == :id_in_scope && condition_proc.is_a?(Proc) | ||
| puts " Checking Occupancy ID in scope condition" | ||
| user_has_access_to_occupancy = attribute.validate?(attr_validator) |
There was a problem hiding this comment.
When calling attribute.validate method, the condition_proc is executed, which returns a list of Occupancy ids the user has access to. This logic exists in the visible_by_conditions method here
| condition_matched = false | ||
| current_attribute_matched = true |
There was a problem hiding this comment.
Same note here about defaulting to the negative until the condition is met.
There was a problem hiding this comment.
For posterity: Danny and I talked a little about this beyond the POC scope. I think we agreed that weaving spiceDB into this gem directly would not be the right track, but we will need a way to override certain behavior and logic - which might look like adding a plugin-type feature or configuration values for decl auth where you can supply classes that will be used in place of the default validators. Something like that.
dannyeldridge
force-pushed
the
apt-1935-spicedbBackendChecks-AuthGem-PrototypeOnly
branch
from
ff3942a to
777b4b9
Compare
This PR integrates SpiceDB for lease-related authorization checks. Any action requiring a permission that starts with
leases__orlease_renewals__will be affected.For this proof of concept (POC), we are utilizing the rules array here.
Long-term, we aim to move away from using property data as the source of truth for determining which privilege symbols (role + permission) a UserRole has. Several potential approaches could address this, which we can discuss if we proceed further.
3/14/25
Latest commit for CR: ff3942a