verifier behaviour change

[loulin]

If global “deny” or “allow” defined but not passed, and there isn’t any
activity validator followed, just go to notAuthorized.

[mxriverlynn]

thanks for splitting this in to a separate pull request!

can you explain the scenario again? i want to make sure i completely understand the purpose of this change

[loulin]

We don't need to define all activity validators especially when there are too many activities with the same logic. We can use global deny or allow, but if they are not passed, we can just return notAuthorized if no individual validator defined.

config.activities(function (activities) {
  activities.allow(function (identity, activity, cb) {
    // permissions may be loaded from database by identity.user
    var permissions = ['users.add', 'users.read', 'users.edit', 'users.destroy'];
    cb(null, permissions.indexOf(activity) !== -1);
  });

  // individual validator example
  activities.can("users.edit", function (identity, params, cb) {
    cb(null, identity.user.id === params.user_id);
  });

  /* 
  // If global "allow" is not passed, I don't want to define all validators like this, 
  // but now it throws ActivityNotFoundException.
  activities.can("users.add", function (identity, params, cb) {
    cb(null, false);
  });

  activities.can("users.read", function (identity, params, cb) {
    cb(null, false);
  });

  activities.can("users.destroy", function (identity, params, cb) {
    cb(null, false);
  });
  */
});