E1915 Authorization Utilities

E1915. Authorization Utilities

This page provides a description of an Expertiza OSS project.

About Expertiza

Expertiza is an open source project based on Ruby on Rails framework. Expertiza allows the instructor to create new assignments and customize new or existing assignments. It also allows the instructor to create a list of topics the students can sign up for. Students can form teams in Expertiza to work on various projects and assignments. Students can also peer review other students' submissions. Expertiza supports submission across various document types, including the URLs and wiki pages.

Problem Statement

The following tasks were accomplished in this project:

Centralize user authentication logic to support the DRY principle
Improve user authentication logic in cases where it was clearly flawed
Support this work with RSpec unit tests

Current Implementation

Functionality

Most controllers contain an action_allowed? method which determines which users are allowed to perform which actions
This logic is in most cases correct, but is often repeated between controllers (un-DRY)
This logic is in some cases slightly incorrect
The Roles model provides a helpful method hasAllPrivilegesOf, which could be used to simplify authorization logic

Drawbacks and Solutions

The problems listed below are examples of the three main classes of problems we encountered with Expertiza authorization. This is not an exhaustive list of problems, but is a good representation of the classes of problems addressed.

Problem 1: Much of the authorization logic is repeated (un-DRY). For example, multiple controllers contain the following exact code.

  ['Super-Administrator',
  'Administrator',
  'Instructor',
  'Teaching Assistant'].include? current_role_name

Solution 1: Use one of the helper methods from the new authorization_helper.rb to allow TAs *and above* (instructors, admins, super-admins) to perform this work.

  current_user_has_ta_privileges?

Problem 2: Some logic is slightly incorrect. For example, some places call for a specific user type, when users "above" this type should also be allowed to perform the work. In the following example (advertise_for_partner_controller.rb), only Students may advertise for partners. However per Dr. Gehringer, "There are no cases I am aware of where a particular type of user can do something that more-privileged users cannot do".

  current_user.role.name.eql?("Student")

Solution 2: Use one of the helper methods from the new authorization_helper.rb to allow Students *and above* (TAs, instructors, admins, super-admins) to perform this work.

  current_user_has_student_privileges?

Problem 3: Some logic is DRY and correct, but places too much logic in the controller. This makes the controller more difficult to read, and scatters authorization logic, when it would be easier to understand if it were all in one place.

  def action_allowed?
    if %w[edit update list_submissions].include? params[:action]
      assignment = Assignment.find(params[:id])
      (%w[Super-Administrator Administrator].include? current_role_name) ||
      (assignment.instructor_id == current_user.try(:id)) ||
      TaMapping.exists?(ta_id: current_user.try(:id), course_id: assignment.course_id) ||
      (assignment.course_id && Course.find(assignment.course_id).instructor_id == current_user.try(:id))
    else
      ['Super-Administrator',
       'Administrator',
       'Instructor',
       'Teaching Assistant'].include? current_role_name
    end
  end

Solution 3: Establish helper methods in the new authorization_helper.rb to centralize as much authorization logic as possible. In this way, a developer with questions about authorization knows just where to look to find answers - authorization_helper.rb

  def action_allowed?
    if %w[edit update list_submissions].include? params[:action]
      current_user_has_admin_privileges? || current_user_teaching_staff_of_assignment?(params[:id])
    else
      current_user_has_ta_privileges?
    end
  end

New Implementation

We make use of the existing role.rb model method hasAllPrivileges of. This logic defines a hierarchy of users, allowing us to easily determine if the current user has role X "or above".

  def hasAllPrivilegesOf(target_role)

    privileges = {}
    privileges["Student"] = 1
    privileges["Teaching Assistant"] = 2
    privileges["Instructor"] = 3
    privileges["Administrator"] = 4
    privileges["Super-Administrator"] = 5

    privileges[self.name] >= privileges[target_role.name]

  end

We establish several methods in authorization_helper.rb to expose easy-to-read method names for use in conrollers.

  def current_user_has_super_admin_privileges?
  ...
  def current_user_has_admin_privileges?
  ...
  def current_user_has_instructor_privileges?
  ...
  def current_user_has_ta_privileges?
  ...
  def current_user_has_student_privileges?
  ...

We establish a method in authorization_helper.rb to expose an easy-to-read method for determining if the current user "is a" [particular user role]. This is used in a minority of cases, because most logic cares if the current user "is a" [particular role] "or above".

  def current_user_is_a?(role_name)
  ...

We establish several methods in authorization_helper.rb to centralize more complex authorization logic so that it is not scattered among controllers, but rather is kept in the same helper file as other authorization logic. Only a few of these methods are shown below.

  def current_user_is_assignment_participant?(assignment_team_id)
  ...
  def current_user_teaching_staff_of_assignment?(assignment_id)
  ...
  def current_user_created_bookmark_id?(bookmark_id)
  ...

Code improvements

TODO: add bulleted list of code improvements that are not already discussed above

Automated Testing using RSPEC

TODO: describe our strategy for RSPEC testing

  # TODO add terminal command and result for running RSPEC testing on our new code

E1915 Authorization Utilities