Class: CurrentScope::Engine

Inherits:

Rails::Engine

• Object
• Rails::Engine
• CurrentScope::Engine

Defined in:

lib/current_scope/engine.rb

Class Method Summary

• .validate_subject_key! ⇒ Object

  #151.

Class Method Details

.validate_subject_key! ⇒ Object

#151. subject_id/resource_id are string columns now, so an integer key and a UUID both store whole and there is nothing left to scan stored rows for. What a config value CAN still name is a subject class whose primary key is not one value — composite, or absent — which no grant could ever identify. Cheap early warning; the write validations are the guarantee.

Silent when it cannot introspect (no connection, no table, unresolved class): "unknown" must not become "broken", or rails db:create on a fresh checkout would raise.

# File 'lib/current_scope/engine.rb', line 179

def self.validate_subject_key!
  # Skip during database tasks, exactly as SchemaGuard does. This runs from
  # to_prepare, which also fires during `rails db:migrate`; a composite or
  # absent subject key would otherwise raise BEFORE the host can run the very
  # migration that fixes it. The write-path validation stays the fail-closed
  # guarantee, so skipping the early diagnostic here loses nothing.
  return if CurrentScope::SchemaGuard.running_a_database_task?

  klass = CurrentScope.config.subject_class
  klass = klass.to_s.safe_constantize if klass.is_a?(String) || klass.is_a?(Symbol)
  return unless klass.respond_to?(:primary_key)
  return if CurrentScope.storable_key?(klass)

  raise ConfigurationError, CurrentScope.unstorable_key_error(klass, role: "subject")
rescue ActiveRecord::ActiveRecordError
  # This rescue is scoped to THIS check on purpose. It exists to keep an
  # unknown subject class quiet; the schema guard must never share it, or a
  # transient database error at boot would read as "all clear" and the host
  # would serve with the escalation live — a security guard failing open.
  Rails.logger&.warn("[CurrentScope] subject key check skipped — could not introspect the database (#151).")
  nil
end