palkan/action_policy
Action Policy
Action Policy is a Ruby authorization framework designed to manage user access and permissions by encapsulating security logic into dedicated policy classes. It provides a structured system for defining access rules that evaluate user actions against specific application resources, ensuring that security logic remains decoupled from the primary application code.
The framework distinguishes itself through its ability to handle complex authorization requirements across diverse interfaces, including web controllers and various API formats. It supports dynamic permission evaluation by utilizing a shared context object that incorporates user identity and request metadata. Furthermore, it includes built-in mechanisms for database record scoping, which automatically filters collections to ensure users only access data they are authorized to see.
To maintain application performance, the framework incorporates a caching layer that stores the results of expensive permission evaluations and handles automatic invalidation when underlying data changes. It also provides comprehensive observability tools, including execution tracing and debugging utilities, to help developers inspect and verify the logic behind specific access decisions.
The project includes command-line utilities for scaffolding policy structures and testing access rules against various conditions. It is designed for integration within Ruby on Rails applications, offering middleware to validate permissions during request handling and programmatic interfaces for manual authorization checks.
Features
- Ruby on Rails Frameworks - Provides a structured authorization framework specifically designed for Ruby on Rails applications.
- Authorization Scope Classes - Uses policy-defined scope classes to automatically filter database queries to records the current user is permitted to see.
- Authorized Record Filtering - Filters database queries and collections automatically based on user permissions to ensure data security.
- Access Policies - Encapsulates security logic into dedicated policy classes that evaluate user permissions against application resources.
- Access Control - Enforces access control during request handling by automatically raising errors for unauthorized actions.
- Policy-Based Access Control - Encapsulates complex permission logic into standalone classes that evaluate user actions against resources.
- Ruby Authorization Frameworks - Provides a comprehensive library for defining and enforcing access control policies within Ruby applications.
- Context-Aware Policy Engines - Injects runtime user identity and request metadata into authorization decisions for dynamic, context-aware rule evaluation.
- Business Logic Encapsulations - Isolates access control logic into dedicated policy classes to keep application code maintainable and decoupled.
- Authorization Result Caches - Optimizes application performance by caching the results of expensive permission checks.
- Evaluation Result Caches - Caches expensive permission evaluations with automatic invalidation to improve application response times.
- Action Integrity Validation - Ensures users can only perform authorized state changes on their own data by validating actions against records.
- API Access Control - Enforces consistent security policies across diverse API formats like GraphQL and JSON API.
- Authorization Middleware - Validates user permissions during request handling via middleware to enforce access control.
- Custom Authorization Logic - Supports passing custom user or environment data into authorization checks for dynamic permission logic.
- Object Action Authorization - Allows developers to manually verify if a user is permitted to perform a specific action on an object instance.
- Fine-Grained Permission Checking - Provides high-performance evaluation of whether a user is authorized to perform specific actions on resources.
- Policy Logic Testing - Provides utilities to verify policy rules against various conditions to ensure logical correctness.
- Integration Adapters - Decouples authorization logic from the transport layer using architectural abstraction layers to support diverse interfaces.
- Rule Evaluators - Offers debugging tools to inspect and trace the evaluation logic of authorization rules.
- Authorization Execution Tracing - Captures and logs step-by-step execution paths of authorization rules to provide visibility into access decisions.
