NOTE: If you're concerned by the fact that this repository has no activity
lately and hasn't had a release since v1.0.0
, don't be. The functionality
this package provides is very simple, it has no dependencies, and the Elixir
language hasn't changed in any way that would break it. It still works just as
well as when I first wrote it. 😃
Canada provides a friendly interface for making easy use of Elixir's excellent pattern matching to create readable declarative permission rules.
If you're looking for something that fills more of what CanCan would provide you in a Rails application you should have a look at Canary which adds Ecto/Plug support.
Add it to your deps list in your mix.exs
. You want the latest release?
defp deps do
[{:canada, "~> 1.0.0"}]
end
You want the latest master?
defp deps do
[{:canada, github: "jarednorman/canada"}]
end
Becoming Canadian is easy. Presumably you have some kind of resource like a user, and probably some kind of resource that belongs to users. Let's call that hypothetical resource a "post". Let's say they're structs.
defmodule User do
defstruct id: nil, name: nil, admin: false
end
defmodule Post do
defstruct user_id: nil, content: nil
end
To make use of Canada, you need to implement the Canada.Can
protocol
(defining whatever rules you need) for the "subject" resource (your User struct
in this case).
defimpl Canada.Can, for: User do
def can?(%User{id: user_id}, action, %Post{user_id: user_id})
when action in [:update, :read, :destroy, :touch], do: true
def can?(%User{admin: admin}, action, _)
when action in [:update, :read, :destroy, :touch], do: admin
def can?(%User{}, :create, Post), do: true
end
With this in place, you're good to start testing permissions wherever you need to, just remember to import the can? macro.
import Canada, [can?: 2]
if some_user |> can? read(some_post) do
# render the post
else
# raise a 403 or something
end
This is very much what happened when I said to myself, "I want the thing I had in Ruby, but in Elixir." I would be entirely unsurprised if myself or someone else comes up with a more "functional" solution. That said, permissions are necessarily a matter that governs conditional logic, so I currently see this as a reasonable solution.