merging master into 2.0

lib/cancan.rb

@@ -10,4 +10,4 @@ require 'cancan/model_adapters/abstract_adapter'
 require 'cancan/model_adapters/default_adapter'
 require 'cancan/model_adapters/active_record_adapter' if defined? ActiveRecord
 require 'cancan/model_adapters/data_mapper_adapter' if defined? DataMapper
-require 'cancan/model_adapters/mongoid_adapter' if defined? Mongoid
+require 'cancan/model_adapters/mongoid_adapter' if defined?(Mongoid) && defined?(Mongoid::Document)

lib/cancan/controller_additions.rb

@@ -290,7 +290,7 @@ module CanCan
 
     def self.included(base)
       base.extend ClassMethods
-      base.helper_method :can?, :cannot?
+      base.helper_method :can?, :cannot?, :current_ability
     end
 
     # Raises a CanCan::Unauthorized exception if the current_ability cannot

lib/cancan/controller_resource.rb

@@ -165,7 +165,7 @@ module CanCan
         elsif @options[:shallow]
           resource_class
         else
-          raise Unauthorized # maybe this should be a record not found error instead?
+          raise Unauthorized.new(nil, authorization_action, @params[:controller].to_sym) # maybe this should be a record not found error instead?
         end
       else
         resource_class
@@ -184,7 +184,7 @@ module CanCan
     def fetch_parent(name)
       if @controller.instance_variable_defined? "@#{name}"
         @controller.instance_variable_get("@#{name}")
-      elsif @controller.respond_to? name
+      elsif @controller.respond_to?(name, true)
         @controller.send(name)
       end
     end

lib/cancan/model_adapters/active_record_adapter.rb

@@ -87,7 +87,7 @@ module CanCan
 
       def database_records
         if override_scope
-          override_scope
+          @model_class.scoped.merge(override_scope)
         elsif @model_class.respond_to?(:where) && @model_class.respond_to?(:joins)
           @model_class.where(conditions).joins(joins)
         else

lib/cancan/model_adapters/data_mapper_adapter.rb

@@ -10,23 +10,22 @@ module CanCan
       end
 
       def self.matches_conditions_hash?(subject, conditions)
-        subject.class.all(:conditions => conditions).include?(subject) # TODO don't use a database query here for performance and other instances
+        collection = DataMapper::Collection.new(subject.query, [ subject ])
+        !!collection.first(conditions)
       end
 
       def database_records
-        scope = @model_class.all(:conditions => ["0=1"])
-        conditions.each do |condition|
-          scope += @model_class.all(:conditions => condition)
-        end
+        scope = @model_class.all(:conditions => ["0 = 1"])
+        cans, cannots = @rules.partition { |r| r.base_behavior }
+        return scope if cans.empty?
+        # apply unions first, then differences. this mean cannot overrides can
+        cans.each    { |r| scope += @model_class.all(:conditions => r.conditions) }
+        cannots.each { |r| scope -= @model_class.all(:conditions => r.conditions) }
         scope
       end
-
-      def conditions
-        @rules.map(&:conditions)
-      end
-    end
-  end
-end
+    end # class DataMapper
+  end # module ModelAdapters
+end # module CanCan
 
 DataMapper::Model.class_eval do
   include CanCan::ModelAdditions::ClassMethods

lib/cancan/model_adapters/mongoid_adapter.rb

@@ -6,7 +6,14 @@ module CanCan
       end
 
       def self.override_conditions_hash_matching?(subject, conditions)
-        conditions.any? { |k,v| !k.kind_of?(Symbol) }
+        conditions.any? do |k,v|
+          key_is_not_symbol = lambda { !k.kind_of?(Symbol) }
+          subject_value_is_array = lambda do
+            subject.respond_to?(k) && subject.send(k).is_a?(Array)
+          end
+
+          key_is_not_symbol.call || subject_value_is_array.call
+        end
       end
 
       def self.matches_conditions_hash?(subject, conditions)
@@ -16,16 +23,22 @@ module CanCan
       end
 
       def database_records
-        if @rules.size == 0  
+        if @rules.size == 0
           @model_class.where(:_id => {'$exists' => false, '$type' => 7}) # return no records in Mongoid
+        elsif @rules.size == 1 && @rules[0].conditions.is_a?(Mongoid::Criteria)
+          @rules[0].conditions
         else
-          @rules.inject(@model_class.all) do |records, rule|
-            if rule.conditions.empty?
-              records
-            elsif rule.base_behavior
-              records.or(rule.conditions)
+          # we only need to process can rules if
+          # there are no rules with empty conditions
+          rules = @rules.reject { |rule| rule.conditions.empty? }
+          process_can_rules = @rules.count == rules.count
+          rules.inject(@model_class.all) do |records, rule|
+            if process_can_rules && rule.base_behavior
+              records.or rule.conditions
+            elsif !rule.base_behavior
+              records.excludes rule.conditions
             else
-              records.excludes(rule.conditions)
+              records
             end
           end
         end
@@ -37,4 +50,4 @@ end
 # simplest way to add `accessible_by` to all Mongoid Documents
 module Mongoid::Document::ClassMethods
   include CanCan::ModelAdditions::ClassMethods
-end
+end

lib/cancan/rule.rb

@@ -125,7 +125,7 @@ module CanCan
                 if attribute.kind_of? Array
                   attribute.any? { |element| matches_conditions_hash? element, value }
                 else
-                  matches_conditions_hash? attribute, value
+                  attribute && matches_conditions_hash?(attribute, value)
                 end
               elsif value.kind_of?(Array) || value.kind_of?(Range)
                 value.include? attribute