Police

appointment_policy.js

'use strict';

var subclass = require('../util/subclass'),
    Policy   = require('./policy'),
    Client   = require('../models/client'),
    Stylist  = require('../models/stylist'),
    AppointmentPolicy = subclass(Policy);
    
AppointmentPolicy.can('request', function (user, model) {
    return user instanceof Client;
});
    
AppointmentPolicy.can('accept', function (user, model) {
    return user instanceof Stylist;
});

appointments.js

'use strict';

var Resource     = require('../lib/resources/resource'),
    subclass     = require('../lib/util/subclass'),
    Appointment  = require('../models/appointment'),
    AppointmentPolicy = require('../policies/appointment_policy'),
    Appointments = subclass(Resource),
    appointments = new Appointments(Appointment);

module.exports = appointments;

Appointments.before('accept', function (context) {
    var allowed = yield (new AppointmentPolicy).can(context.user, 'accept', context.appointment);
    if (!allowed) {
        throw new Error('permission denied');
    }
});

nested_policy.js

'use strict';

var subclass = require('../util/subclass'),
    Policy   = require('./policy'),
    NestedPolicy;

NestedPolicy = subclass(Policy, function (user, model, parent) {
    this.parent = parent;
});

module.exports = NestedPolicy;

NestedPolicy.can('read', function () {
    if (this['delegated?']()) {
        return this.parent['read?']();
    }
    else {
        return NestedPolicy._super['read?'].call(this);
    }
});

NestedPolicy.can('write', function () {
    if (this['delegated?']()) {
        return this.parent['write?']();
    }
    else {
        return NestedPolicy._super['write?'].call(this);
    }
});

NestedPolicy.isnt('delegated');

policy.js

'use strict';

var Policy = function () {};

module.exports = Policy;

var util    = require('core-util-is'),
    Promise = require('bluebird'),
    _       = require('lodash'),
    slice   = Array.prototype.slice;

Policy.allow = Policy.can = Policy.is = function (actions, permission, fn) {
    return this.permit(actions, permission, true, fn);
};

Policy.deny = Policy.cannot = Policy.cant = Policy.isnt = function (actions, permission, fn) {
    return this.permit(actions, permission, false, fn);
};

Policy.permit = function (actions, permission, condition, fn) {
    if (fn == null) {
        if (permission == null || permission === true) {
            fn = function () {
                return Promise.resolve(true);
            };
        }
        else if (permission === false) {
            fn = function () {
                return Promise.resolve(false);
            };
        }
        else if (util.isString(permission)) {
            fn = Promise.method(function () {
                return this[permission + '?']();
            });
        }
        else if (util.isFunction(permission)) {
            fn = Promise.method(permission);
        }
        else {
            throw 'Invalid permission provided';
        }
    }
    if (condition === false) {
        fn = Promise.method(fn);
        fn = function () {
            return fn().then(function (value) { return !value; });
        });
    }
    actions = [].concat(actions);
    _.each(actions, function (action) {
        this.prototype[action + '?'] = fn;
    }, this);
};

Policy.can('read');

Policy.can('write', function () {
    return this.is('class').then(function (is) { return is || this.is('owner'); });
});

Policy.can('index', 'list');

Policy.can(['list', 'show'], 'read');

Policy.can(['create', 'update', 'destroy'], 'write');

Policy.can('new', 'create');

Policy.can('edit', 'update');

Policy.is('class', function (model) {
    return util.isFunction(model);
});

Policy.is('owner', function (user, model, object) {
    if (object == null) {
        object = model;
    }
    return object === user;
});

Policy.prototype.authorize =
Policy.prototype.can       =
Policy.prototype.is        =
Policy.prototype.has       = function (user, action) {
    var argsArray = slice.call(arguments, 2).unshift(user);
    return this[action + '?'].apply(this, argsArray).bind(this);
};

Policy.prototype.cannot = Policy.prototype.cant = Policy.prototype.isnt = function () {
    return !this.can.apply(this, arguments);
};

Policy.prototype.index = function () {
    return this.all.apply(this, arguments);
};

Policy.prototype.all = function (Model) {
    var argsArray = slice.call(arguments, 1);
    return Model.fetchAll.apply(Model, argsArray).bind(this);
};

Policy.prototype.find = function (Model) {
    var argsArray = slice.call(arguments, 1);
    return Model.find.apply(Model, argsArray).bind(this);
};