Class: Protege::AccessRule

Inherits:
ApplicationRecord show all
Defined in:
app/models/protege/access_rule.rb

Overview

One runtime allow/deny rule for a single agent — the dashboard-editable layer of the inbound access-control guardrail. Each record carries a kind (+allow+/+deny+) and an address pattern (an exact address or a * wildcard such as *@company.co); together an agent's rules fold into a Gateway::AccessPolicy via AccessRule.policy_for.

This is the narrowing layer: AccessControl intersects it with the committed global policy (+Protege.configuration.inbound_access+), so an agent's rules can only further restrict who may reach that agent — never widen past the org-wide ceiling. An agent with no rules imposes no constraint of its own.

Class Method Summary collapse

Class Method Details

.policy_for(agent) ⇒ Protege::Gateway::AccessPolicy

Fold one agent's rules into a single Gateway::AccessPolicy.

Groups the agent's +allow+/+deny+ patterns into the policy's lists; the policy then derives its own default (an allow-list implies default-deny). An agent with no rules yields a bare Gateway::AccessPolicy, which permits everyone and so drops out of the AccessControl intersection.

Parameters:

Returns:



40
41
42
43
44
45
46
47
 
# File 'app/models/protege/access_rule.rb', line 40

def policy_for(agent)
  grouped = where(agent:).group_by(&:kind)

  Gateway.build_access_policy(
    allow: Array(grouped['allow']).map(&:pattern),
    deny:  Array(grouped['deny']).map(&:pattern)
  )
end