Module: Parse::Access

Defined in:
lib/parse/access.rb

Overview

Local, evidence-aware inspection of Parse Server object permissions.

This is a policy preflight, not an authorization boundary: sessions can be revoked and Cloud Code or custom adapters can add rules the SDK cannot see. The actual Parse Server request remains authoritative. Boolean convenience predicates accept only :allowed; both :denied and :unknown fail closed.

Defined Under Namespace

Classes: Decision

Constant Summary collapse

OPERATIONS = 
%i[read write delete].freeze
CLP_OPERATIONS = 
{ read: :get, write: :update, delete: :delete }.freeze
SUPPORTED_SYSTEM_CLASSES = 
%w[_User _Role].freeze

Class Method Summary collapse

Class Method Details

.check(principal:, object:, operation:, client: nil, authenticated: nil, max_role_depth: 10) ⇒ Decision

Inspect one operation. authenticated: true is an assertion by the caller; it does not validate a session token. When omitted for a user, an attached session token is accepted as local evidence. An id-only user is not treated as authenticated. A role represents a hypothetical authenticated member, but cannot satisfy user/pointer-specific rules.

Parameters:

  • principal (Parse::User, Parse::Role)
  • object (Parse::Object)
  • operation (Symbol) —

    :read, :write, or :delete.

  • client (Parse::Client, nil) (defaults to: nil) —

    application whose CLP and role graph should be inspected. Defaults to the principal's configured client.

  • authenticated (Boolean, nil) (defaults to: nil) —

    explicit authentication evidence.

  • max_role_depth (Integer) (defaults to: 10) —

    maximum inherited-role traversal depth.

Returns:



67
68
69
70
71
72
73
74
75
76
 
# File 'lib/parse/access.rb', line 67

def check(principal:, object:, operation:, client: nil, authenticated: nil,
          max_role_depth: 10)
  Checker.new(
    principal: principal,
    object: object,
    client: client,
    authenticated: authenticated,
    max_role_depth: max_role_depth,
  ).check(operation)
end

.check_all(principal:, object:, operations: OPERATIONS, client: nil, authenticated: nil, max_role_depth: 10) ⇒ Hash<Symbol, Decision>

Inspect multiple operations while sharing one role-closure lookup.

Returns:



80
81
82
83
84
85
86
87
88
89
90
91
92
93
 
# File 'lib/parse/access.rb', line 80

def check_all(principal:, object:, operations: OPERATIONS, client: nil,
              authenticated: nil, max_role_depth: 10)
  checker = Checker.new(
    principal: principal,
    object: object,
    client: client,
    authenticated: authenticated,
    max_role_depth: max_role_depth,
  )
  Array(operations).each_with_object({}) do |operation, decisions|
    op = operation.to_sym
    decisions[op] = checker.check(op)
  end.freeze
end