Something I’ve come across a few times when building plugins is the need to modify the outcome of Guardian can_* checks. I’ve come across it again in the ActivityPub Plugin: https://github.com/discourse/discourse-activity-pub/blob/main/extensions/discourse_activity_pub_guardian_extension.rb I’ve just raised a draft PR that adds a new server-side plugin api method that allows you to register before and after checks to guardian can_* methods, affording the ability to change the outcome of the method. For example add_guardian_check(:before, :edit_post) do |guardian, result, post| !post.activity_pub_remote? end https://github.com/discourse/discourse/pull/26936 Curious to get feedback on both the approach and the execution before publishing it for review.

Just bumping this one back up for whomever is relevant. cc @pmusaraj

Thanks, Angus! I don’t see any issues with the before_* register. The after_* register is a little trickier. Security-wise, the after_* register means plugins can override core in ways that may be unsafe. Obviously plugins can do this in all sorts of ways, but the plugin API shouldn’t facilitate it even further. Also, what happens if multiple plugins consume the after_* hook? Which one wins?

[image] Penar Musaraj: Security-wise, the after_* register means plugins can override core in ways that may be unsafe. Obviously plugins can do this in all sorts of ways, but the plugin API shouldn’t facilitate it even further. Yeah, I understand what you mean. [image] Penar Musaraj: Also, what happens if multiple plugins consume the after_* hook? Which one wins? The checks accept a priority argument. See this spec it "respects check priority" do plugin.add_guardian_check(:after, :edit_post, 2) { false } plugin.add_guardian_check(:after, :edit_post, 0) { true } plugin.add_guardian_check(:after, :edit_post, 1) { false } expect(Guardian.new(user).can_edit_post?(post)).to be_truthy end How about I limit this PR to just before checks? That would serve the immediate needs and reduce the variables in play a bit here.

Guardian before and after checks api

Development

pmusaraj (Penar Musaraj) July 29, 2024, 2:20pm 5

Yes, sure, let’s start with just the before checks. Thanks!

Topic		Replies	Views
How to customize / override topic guardian through a plugin Development	4	861	February 15, 2021
Change topic timestamp results in 403 (Forbidden) Development	10	1472	November 6, 2016
Overriding user_guardian.rb in a plugin (no fork necessary!) Development	22	3531	January 4, 2021
Allow specifiy user different from guardian.user in chat services such as Chat::CreateMessage Feature chat	3	708	December 4, 2023
How can I write a plugin to allow TL1 to ignore users? Development	2	1366	February 15, 2021

Guardian before and after checks api

Related topics