lib/seek/permissions/policy_based_authorization.rb
#returns the authorised items from the array of the same class items for a given action and optionally a user. If user is nil, the items authorised for an
#anonymous user are returned. All assets must be of the same type and match the asset class this method was called on
# if filter_by_permissions is true, then as well as the authorization the state based permissions will also be applied
returns the authorised items from the array of the same class items for a given action and optionally a user. If user is nil, the items authorised for an
anonymous user are returned. All assets must be of the same type and match the asset class this method was called on
if filter_by_permissions is true, then as well as the authorization the state based permissions will also be applied
returns the authorised items from the array of the same class items for a given action and optionally a user . If user is nil the items authorised for an anonymous user are returned . All assets must be of the same type and match the asset class this method was called on if filter_by_permissions is true then as well as the authorization the state based permissions will also be applied
def authorize_asset_collection assets, action, user=User.current_user,filter_by_permissions=true
          return assets if assets.empty?
          user_id = user.nil? ? 0 : user.id
          if Seek::Config.auth_lookup_enabled && self.lookup_table_consistent?(user_id)
            ids=assets.collect{|asset| asset.id}
            clause = "asset_id IN (#{ids.join(',')})"
            sql =  "SELECT asset_id from #{lookup_table_name} WHERE user_id = #{user_id} AND (#{clause}) AND can_#{action}=#{ActiveRecord::Base.connection.quoted_true}"
            ids = ActiveRecord::Base.connection.select_all(sql).collect{|k| k["asset_id"].to_s}
            assets = assets.select{|asset| ids.include?(asset.id.to_s)}
          else
            assets = assets.select{|a| a.send("authorized_for_#{action}?",user)}
          end
          if filter_by_permissions
            assets = assets.select{|a| a.send("state_allows_#{action}?",user)}
          end
          assets
        end
def authorize_asset_collection assets , action , user = User . current_user , filter_by_permissions = true return assets if assets . empty? user_id = user . nil? ? 0 : user . id if Seek :: Config . auth_lookup_enabled && self . lookup_table_consistent? ( user_id ) ids = assets . collect { | asset | asset . id } clause = "asset_id IN (#{ids.join(',')})" sql = "SELECT asset_id from #{lookup_table_name} WHERE user_id = #{user_id} AND (#{clause}) AND can_#{action}=#{ActiveRecord::Base.connection.quoted_true}" ids = ActiveRecord :: Base . connection . select_all ( sql ) . collect { | k | k [ "asset_id" ] . to_s } assets = assets . select { | asset | ids . include? ( asset . id . to_s ) } else assets = assets . select { | a | a . send ( "authorized_for_#{action}?" , user ) } end if filter_by_permissions assets = assets . select { | a | a . send ( "state_allows_#{action}?" , user ) } end assets end
returns the authorised items from the array of the same class items for a given action and optionally a user.
returns the authorised items from the array of the same class items for a given action and optionally a user .
assets
action
user
current_user
filter_by_permissions