Awesome GitHub RepositoriesRuby Authorization Frameworks

Pundit is an authorization framework for Ruby applications that enforces permissions through plain Ruby policy objects. It maps controller actions to policy methods, automatically inferring which policy class and query method to call based on the action name, and raises a custom exception when access is denied. The framework distinguishes itself by using plain Ruby classes without external DSLs or configuration files, and by providing a development-time verification guard that raises an error if a controller action runs without an authorization call. It also supports namespace-based policy or

Pundit is a Ruby authorization framework that implements policy-based access control. It maps domain models to dedicated logic classes that determine whether a user is permitted to perform specific actions on data objects. The framework utilizes plain Ruby objects to decouple authorization logic from the model. It includes mechanisms for data query scoping to filter record collections based on user permissions, as well as attribute-level permission control to restrict which specific model fields a user can modify. The system provides tools for authorization coverage verification to ensure se

CanCanCan is an authorization library for Ruby on Rails that lets developers define user permissions in a single, centralized file using a readable domain-specific language. It enforces those permissions across controllers, views, and database queries, providing a unified approach to access control in Rails applications. The library works by evaluating a prioritized list of rules that combine actions, models, and conditions, supporting aliases, blocks, and conditional logic. It automatically authorizes controller actions through Rails' before_action lifecycle, raising exceptions on unauthoriz

Authority 是一个用于 Ruby on Rails 应用程序的授权框架，用于管理用户权限和访问控制策略。它提供了一个将复杂安全逻辑封装到专用类中的系统，将这些关注点与核心业务模型分离开来。 该库通过在控制器级别拦截 Web 请求并根据定义的策略验证操作来强制执行安全规则。它利用基于约定的映射自动将模型与其相应的授权类关联，支持针对特定资源的全局检查和实例感知验证。 除了控制器级别的强制执行，该框架还允许开发者直接在视图模板中检查授权状态，从而促进条件界面渲染。它包括中心化的异常处理机制，当发生未经授权的访问尝试时，能够实现一致的日志记录和自定义错误响应。