gem 'allowy'

class PageAccess
  include Allowy::AccessControl

  # This will allow you to ask: `can? :view, page`
  # The truthy result of this function will grant access, otherwise not.
  def view?(page)
    page and page.published?
  end

  def edit?(page)
    page and page.wiki?
  end
end

# Then, in rails controller/view, you would use it:
can? :view, page
cannot? :edit, page
authorize! :view, page # raises Allowy::AccessDenied if can?(:view, page) returns false
can? :love_people, page # Will raise NoMethodError because `love_people` is not defined on the Access Control class

class PageAccess
  include Allowy::AccessControl

  def view?(page)
    return true if context.params[:hidden_hack_for_admin]
    context.user_signed_in? and page.published?
  end
end

class CmsContext < Hash
  include Allowy::Context
end

class PagesController < ApplicationController
  def allowy_context
    CmsContext.new {realy: 'anything', can_be: 'here', even: params}
  end
end

# This will just work provided there's a PageAccess class
class PageDecorator < Draper::Decorator
end

class PageViewModel < SimpleDelegator
  # This will allow using PageViewModel as it would be just Page
  def self.source_class
    Page
  end
end

class ApplicationController < ActionController::Base
  def current_allowy
    @current_allowy ||= ::Allowy::Registry.new(allowy_context, access_suffix: 'Permission')
  end
end

class PageAccess < DefaultAccess
  def view?(page)
    deny!(:no_user) unless current_user
    page and page.published? and domain_name =~ /^www\./i
  end
end

class PageAccess < DefaultAccess
  def view?(page)
    return false unless current_user
    page and page.published? and domain_name =~ /^www\./i
  end
end

class DefaultAccess
  include Allowy::AccessControl
  delegate :current_user,    :to => :context
  delegate :current_company, :to => :context

  def domain_name
    context.request.host
  end
end

class PageAccess < DefaultAccess
  # can? :view, page
  def view?(page)
    page and page.published? and domain_name =~ /^www\./i
  end

  # can? :edit, page
  def edit?(page)
    view?(page) and page.wiki? # Notice how we can reuse other definitions!
  end

  # can? :create, WikiPage
  def create?(page_class)
    # We can do something with WikiPage here if we need to
    return false if page_class.count >= 2 # only 2 wiki pages allowed
    # but can just ignore it and authorize based on current context only
    current_user and current_user.admin?
  end

  # can? :search, Page, 'Ruby rocks!'
  def search?(clazz, phrase)
    # Apart from context, we can require to pass additional parameters
    create?(Page) and (phrase || '').match /rocks/i
  end
end

class PagesController < ApplicationController
  def show
    @page = Page.find(params[:id])
    authorize! :view, @page # It will raise if declined
    # can?, cannot? can be used too
  end

  # Add this to the ApplicationController to handle it globally
  rescue_from Allowy::AccessDenied do |exception|
    logger.debug "Access denied on #{exception.action} #{exception.subject.inspect}"
    redirect_to new_user_session_url if no_access.payload == :no_user
    render('shared/no_permission', message: exception.message)
  end
end

# spec/models/page_access.rb
# Example spec for the PageAccess
describe PageAccess do
  subject     { PageAccess.new double(current_user: User.new.or_whatever) }
  let(:page)  { Page.new }

  describe "#view" do
    it { should_not be_able_to :view, page }

    # Or without the matcher
    it "should not allow" do
      subject.view?(page).should be_false
    end

    context "I prefer RSpec contexts" do
      subject { PageAccess.new(stub(:current_user: user)).view?(page) }

      context "when logged in" do
        let(:user) { stub 'User' }
        context "and page is wiki" do
          before { page.stub(wiki?: true) }
          it { should be_true }
        end
        context "and page is not wiki" do
          before { page.stub(wiki?: false) }
          it { should be_false }
        end
      end

      context "when anonim" do
        let(:user) { nil }
        it { should be_false }
      end
    end

  end
end


# Example of a controller spec
describe PagesController do
  # This will always grant access, so you don't have to create too many objects
  # But make sure you test PageAccess separately as in the example above
  ignore_authorization! 

  it "will always allow no matter what" do
    post(:create).should be_success
  end

  it "checks the authorisation" do
    should_authorize_for(:create, page)
    post(:create)
  end

  it "checks the authorisation with plain RSpec if you don't like the macro" do
    allowy.should_receive(:authorize!).with(:create, page)
    post(:create)
  end
end