2 class PermissionsController < ApiController
3 before_action :check_api_readable
5 authorize_resource :class => false
7 before_action :setup_user_auth
8 before_action :set_request_formats
9 around_action :api_call_handle_error, :api_call_timeout
11 # External apps that use the api are able to query which permissions
12 # they have. This currently returns a list of permissions granted to the current user:
13 # * if authenticated via OAuth, this list will contain all permissions granted by the user to the access_token.
14 # * if authenticated via basic auth all permissions are granted, so the list will contain all permissions.
15 # * unauthenticated users have no permissions, so the list will be empty.
17 @permissions = if doorkeeper_token.present?
18 doorkeeper_token.scopes.map { |s| :"allow_#{s}" }
19 elsif current_token.present?
20 ClientApplication.all_permissions.select { |p| current_token.read_attribute(p) }
22 ClientApplication.all_permissions
27 respond_to do |format|