Something I’ve come across a few times when building plugins is the need to modify the outcome of Guardian can_* checks. I’ve come across it again in the ActivityPub Plugin: https://github.com/discourse/discourse-activity-pub/blob/main/extensions/discourse_activity_pub_guardian_extension.rb I’ve just raised a draft PR that adds a new server-side plugin api method that allows you to register before and after checks to guardian can_* methods, affording the ability to change the outcome of the method. For example add_guardian_check(:before, :edit_post) do |guardian, result, post| !post.activity_pub_remote? end https://github.com/discourse/discourse/pull/26936 Curious to get feedback on both the approach and the execution before publishing it for review.

Just bumping this one back up for whomever is relevant. cc @pmusaraj

Thanks, Angus! I don’t see any issues with the before_* register. The after_* register is a little trickier. Security-wise, the after_* register means plugins can override core in ways that may be unsafe. Obviously plugins can do this in all sorts of ways, but the plugin API shouldn’t facilitate it even further. Also, what happens if multiple plugins consume the after_* hook? Which one wins?

[תמונה] Penar Musaraj: Security-wise, the after_* register means plugins can override core in ways that may be unsafe. Obviously plugins can do this in all sorts of ways, but the plugin API shouldn’t facilitate it even further. Yeah, I understand what you mean. [תמונה] Penar Musaraj: Also, what happens if multiple plugins consume the after_* hook? Which one wins? The checks accept a priority argument. See this spec it "respects check priority" do plugin.add_guardian_check(:after, :edit_post, 2) { false } plugin.add_guardian_check(:after, :edit_post, 0) { true } plugin.add_guardian_check(:after, :edit_post, 1) { false } expect(Guardian.new(user).can_edit_post?(post)).to be_truthy end How about I limit this PR to just before checks? That would serve the immediate needs and reduce the variables in play a bit here.

בדיקת API לפני ואחרי Guardian

מפתח

pmusaraj (Penar Musaraj) 29 ביולי,‏ 2024,‏ 2:20pm 5

Yes, sure, let’s start with just the before checks. Thanks!

נושא		תגובות	צפיות
How to customize / override topic guardian through a plugin Development	4	869	15 בפברואר,‏ 2021
Change topic timestamp results in 403 (Forbidden) Development	10	1486	6 בנובמבר,‏ 2016
Overriding user_guardian.rb in a plugin (no fork necessary!) Development	22	3585	4 בינואר,‏ 2021
Allow specifiy user different from guardian.user in chat services such as Chat::CreateMessage Feature chat	3	710	4 בדצמבר,‏ 2023
How can I write a plugin to allow TL1 to ignore users? Development	2	1372	15 בפברואר,‏ 2021

בדיקת API לפני ואחרי Guardian

נושאים קשורים