elabs/pundit
Pundit
Pundit is a Ruby authorization framework that implements policy-based access control. It maps domain models to dedicated logic classes that determine whether a user is permitted to perform specific actions on data objects.
The framework utilizes plain Ruby objects to decouple authorization logic from the model. It includes mechanisms for data query scoping to filter record collections based on user permissions, as well as attribute-level permission control to restrict which specific model fields a user can modify.
The system provides tools for authorization coverage verification to ensure security checks are executed during a request. It also includes a descriptive testing suite for verifying that authorization rules correctly permit or forbid specific user actions.
Features
- Authorization Policies - Implements a policy-based authorization system that maps domain models to dedicated logic classes for access control.
- Query Scopes - Provides specialized scope classes to filter database record collections based on the requesting user's permissions.
- Access Policies - Provides a system for mapping data objects to logic classes that define if a user is permitted to perform specific actions.
- Policy-Based Access Control - Implements a system that maps domain models to logic classes to determine user permissions for specific actions.
- Ruby Authorization Frameworks - Provides a complete Ruby-based framework for defining and enforcing access policies on data objects.
- Record-Level Filtering - Implements security scopes to filter database record collections based on user permissions.
- Authorization Testing - Provides a descriptive testing suite to verify that authorization policies correctly permit or forbid user actions.
- Field-Level Access Controls - Restricts which specific model fields a user can update based on their assigned permission level and role.
- Field-Level Update Restrictions - Provides validation logic to determine if a user is authorized to modify specific fields during update operations.
- Field-Level Permissions - Provides a mechanism to restrict which specific model fields a user can update based on defined policy classes.
- Authorization Check Tracking - Tracks whether a security check was performed during a web request to ensure no action bypasses authorization.
- Authorization Coverage Auditing - Confirms security checks were executed during a request to prevent accidental data exposure.
- Web Security Auditing - Ensures every request undergoes an authorization check to prevent accidental data exposure.
- Plain Old Ruby Objects - Implements authorization logic using standard Ruby objects to keep security rules decoupled from the data models.
- Ruby Frameworks and Tools - Authorization library for Ruby.
- Authorization - Object-oriented authorization using standard Ruby classes.
