Integration into grape API builder as Non-Rails usage

[nlsrchtr]

Hi @palkan,

thanks a lot for your awesome work on the gem and also with the community here! I'm about to integrate the gem into a Grape based API and was wondering if there was some integration work on non-rails app done, which doesn't force me to use something like the service object pattern - as shown in the documentation?

At the moment I'm working on something like this:

module API
  class AuthorizationCheck
    include ActionPolicy::Behaviour

    authorize :account

    attr_reader :account

    def initialize(account)
      @account = account
    end

    def call(object, action, params)
      authorize!(object, to: "#{action}?".to_sym))
    end
  end
end

which could be used in a before_action of grape:

module Portal
  class API < Grape::API
    before do
      ::API::AuthorizationCheck.new(current_account).call(current_account, action_name, params)
    end
end

This follows the documented example and is working in general. But I was looking for something like Pundit is offering:

class MyGrapeAPI < Grape::API
  helpers Pundit

  resources :users do
    desc "Retrieves information about given user"
    params do
      requires :id, type: String, desc: 'User ID'
    end
    get ':id' do
      user = User.find(params[:id])
      authorize(user, :show?)
      present user, with: Entities::User
    end
  end
end

When I try to build something like it with action_policy:

module Portal
  class API < Grape::API
    helpers do
      include ActionPolicy::Behaviour
    end

    get :hello do
      authorize!(current_account, to: :hello?)
      { hello: 'world' }
    end
  end
end

I get the error message undefined method authorization_targets for #<Class:. I was trying to overwrite the authorization_contextbut this feels like a bad idea.

So I was wondering if there is already some experience with integrating action_policy into Grape and if not, which of the approaches about would be "the preferred way"?

Thanks a lot for your feedback and opinion!

[palkan]

Hey! Thanks!

I've been using Grape for a while, but I think looking at our GraphQL integration might be useful. Especially this file: https://github.com/palkan/action_policy-graphql/blob/master/lib/action_policy/graphql/behaviour.rb

Note that we override #authorization_context (that's what leads to the error you see); so, you should probably do the same.

[th-ad]

I don't love this, but this was the only way I was able to get it to work.

module ActionPolicy
  module Grape
    module Helpers
      extend ActiveSupport::Concern

      included do
        include ActionPolicy::Behaviour
        include ActionPolicy::Behaviours::ThreadMemoized
        include ActionPolicy::Behaviours::Memoized
        include ActionPolicy::Behaviours::Namespaced

        authorize :user, through: :current_user
      end
    end
  end
end

module Grape
  class Endpoint
    include ActionPolicy::Grape::Helpers
  end
end

From the Grape documentation,

An Endpoint is the proxy scope in which all routing blocks are executed. In other words, any methods on the instance level of this class may be called from inside a get, post, etc.

Keeping authorization context as state on this class should work, since we'll always have access to that context within routes and before/after hooks.

The problem is that it doesn't give the flexibility to override contexts per endpoint, if that's desired.