codesnips

authorization

erb 
<%# private stream: turbo signs the serialized record name %>
<%= turbo_stream_from current_user %>

<section class="notifications">
  <h1>Notifications</h1>

Turbo Streams + authorization: signed per-user stream name

rails turbo hotwire
by codesnips 3 tabs
ruby 
class Document < ApplicationRecord
  belongs_to :owner, class_name: "User"
  has_many :visibilities, class_name: "DocumentVisibility", dependent: :delete_all

  scope :public_documents, -> { where(is_public: true) }

Polymorphic “Visible To” Scope with Arel

rails activerecord arel
by codesnips 3 tabs
ruby 
# app/policies/post_policy.rb
class PostPolicy < ApplicationPolicy
  class Scope < Scope
    def resolve
      if user.admin?
        scope.all

Pundit for authorization and policy objects

ruby rails pundit
by Sarah Mitchell 2 tabs
java 
package com.example.security;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

Method-Level Role Authorization with a Custom @RequireRole Annotation and Spring AOP

spring spring-boot aop
by codesnips 4 tabs
ruby 
class Comment < ApplicationRecord
  belongs_to :account
  belongs_to :author, class_name: "User"

  validates :body, presence: true

Per-account stream scoping to prevent “cross-tenant” updates

rails hotwire turbo-streams
by codesnips 4 tabs
java 
package com.shop.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;

Guard a Checkout Endpoint with @PreAuthorize and a Custom PermissionEvaluator in Spring Boot

spring-boot spring-security authorization
by codesnips 3 tabs
php 
<?php

namespace App\Feature;

use Symfony\Component\HttpFoundation\RequestStack;
use Symfony\Contracts\Service\ResetInterface;

Request-Scoped Feature Flags in Symfony with a Twig Extension and Controller Gate

symfony feature-flags twig
by codesnips 4 tabs
php 
<?php

use App\Http\Controllers\CommentController;
use Illuminate\Support\Facades\Route;

// The ->scoped() call forces {comment} to resolve through $post->comments,

Scoped Route-Model Binding for Nested Resources in Laravel

laravel routing route-model-binding
by codesnips 3 tabs
ruby 
module DangerousAction
  extend ActiveSupport::Concern

  FRESH_WINDOW = 10.minutes

  class ConfirmationMismatch < StandardError; end

Guard Rails for Dangerous Admin Actions

rails admin security
by codesnips 3 tabs
ruby 
class ApplicationPolicy
  attr_reader :user, :record

  def initialize(user, record)
    @user = user
    @record = record

Authorizing Controller Actions with Pundit Policy Objects in Rails

rails pundit authorization
by codesnips 3 tabs
ruby 
module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user

ActionCable channel that streams Turbo updates safely

rails hotwire turbo
by codesnips 4 tabs
javascript 
const jwt = require('jsonwebtoken');

const SECRET = process.env.JWT_SECRET;
const ALGORITHM = 'HS256';
const ACCESS_TTL = '15m';

JWT Authentication Middleware in Express That Populates req.user

express jwt authentication
by codesnips 3 tabs