Class: Reeve::Configuration

Inherits:
Object
  • Object
show all
Defined in:
lib/reeve/configuration.rb,
lib/reeve/authorization/adapter.rb

Overview

Reopened to answer one question the adapter layer owns: which adapter a policy will actually be served by. Kept here rather than in the kernel so configuration.rb stays free of any knowledge of policies.

Constant Summary collapse

UNGUARDED_TOOL_MODES = 
%i[deny allow_with_warning].freeze
AUDIT_FAILURE_MODES = 
%i[fail warn].freeze
POLICY_ADAPTERS = 
%i[auto pundit plain].freeze
DEFAULT_REDACTED_ARGUMENTS = 
%i[
  password password_confirmation passwd secret token access_token refresh_token
  api_key private_key authorization ssn credit_card card_number cvv pin
].freeze
DEFAULT_MAX_RECORDED_IDS = 
1000
SETTINGS = 
%i[
  principal_resolver unguarded_tools audit_failure_mode redact_arguments
  max_recorded_ids policy_adapter default_action audit_recorder logger
  compliance_principals
].freeze

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Configuration

Returns a new instance of Configuration.



32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/reeve/configuration.rb', line 32

def initialize
  @principal_resolver = nil
  @unguarded_tools    = :deny
  @audit_failure_mode = :fail
  @redact_arguments   = DEFAULT_REDACTED_ARGUMENTS.dup
  @max_recorded_ids   = DEFAULT_MAX_RECORDED_IDS
  @policy_adapter     = :auto
  @default_action     = :index
  @audit_recorder     = nil
  @logger             = nil
  @compliance_principals = nil
end

Instance Method Details

#audit_failure_mode=(mode) ⇒ Object 



62
63
64
 
# File 'lib/reeve/configuration.rb', line 62

def audit_failure_mode=(mode)
  @audit_failure_mode = require_one_of!(:audit_failure_mode, mode, AUDIT_FAILURE_MODES)
end

#audit_recorder=(recorder) ⇒ Object 



110
111
112
113
 
# File 'lib/reeve/configuration.rb', line 110

def audit_recorder=(recorder)
  @audit_recorder =
    recorder.nil? ? nil : require_protocol!(:audit_recorder, recorder, [:record])
end

#compliance_principals=(principals) ⇒ Object

Two fixture principals with disjoint records — the only host setup the compliance suite needs (contracts/testing-kit.md). A callable rather than a value, because in a Rails test suite the fixtures do not exist yet when the helper is loaded.



48
49
50
51
52
53
54
55
56
 
# File 'lib/reeve/configuration.rb', line 48

def compliance_principals=(principals)
  unless principals.nil? || principals.respond_to?(:call) || principals.is_a?(Array)
    raise ArgumentError,
          "compliance_principals must be an Array or a callable returning one, " \
          "got #{principals.inspect}"
  end

  @compliance_principals = principals
end

#default_action=(action) ⇒ Object 



101
102
103
104
105
106
107
108
 
# File 'lib/reeve/configuration.rb', line 101

def default_action=(action)
  if action.nil? || action.to_s.strip.empty?
    raise ArgumentError,
          "default_action must be a non-blank policy action, got #{action.inspect}"
  end

  @default_action = action.to_sym
end

#logger=(logger) ⇒ Object 



115
116
117
 
# File 'lib/reeve/configuration.rb', line 115

def logger=(logger)
  @logger = logger.nil? ? nil : require_protocol!(:logger, logger, [:warn])
end

#max_recorded_ids=(limit) ⇒ Object 



66
67
68
69
70
71
72
 
# File 'lib/reeve/configuration.rb', line 66

def max_recorded_ids=(limit)
  unless limit.is_a?(Integer) && limit.positive?
    raise ArgumentError, "max_recorded_ids must be a positive Integer, got #{limit.inspect}"
  end

  @max_recorded_ids = limit
end

#policy_adapter=(adapter) ⇒ Object 



84
85
86
87
88
89
90
91
 
# File 'lib/reeve/configuration.rb', line 84

def policy_adapter=(adapter)
  @policy_adapter =
    if adapter.is_a?(Symbol) || adapter.is_a?(String)
      require_one_of!(:policy_adapter, adapter, POLICY_ADAPTERS)
    else
      require_protocol!(:policy_adapter, adapter, %i[authorize scope])
    end
end

#principal_resolver=(resolver) ⇒ Object 



74
75
76
77
78
79
80
81
82
 
# File 'lib/reeve/configuration.rb', line 74

def principal_resolver=(resolver)
  unless resolver.nil? || resolver.respond_to?(:call)
    raise ArgumentError,
          "principal_resolver must respond to #call (it receives a Reeve::Context), " \
          "got #{resolver.inspect}"
  end

  @principal_resolver = resolver
end

#redact_arguments=(names) ⇒ Object 



93
94
95
96
97
98
99
 
# File 'lib/reeve/configuration.rb', line 93

def redact_arguments=(names)
  unless names.is_a?(Array)
    raise ArgumentError, "redact_arguments must be an Array of names, got #{names.inspect}"
  end

  @redact_arguments = names.map(&:to_sym)
end

#resolved_policy_adapter(policy = nil) ⇒ Object

Which adapter :auto actually chose. Documented in contracts/policy-adapter.md so the choice is never a mystery, and so the compliance suite can assert on it.



67
68
69
 
# File 'lib/reeve/authorization/adapter.rb', line 67

def resolved_policy_adapter(policy = nil)
  Authorization::Adapter.resolve_name(policy, policy_adapter)
end

#to_h ⇒ Object 



119
120
121
 
# File 'lib/reeve/configuration.rb', line 119

def to_h
  SETTINGS.to_h { |setting| [setting, public_send(setting)] }
end

#unguarded_tools=(mode) ⇒ Object 



58
59
60
 
# File 'lib/reeve/configuration.rb', line 58

def unguarded_tools=(mode)
  @unguarded_tools = require_one_of!(:unguarded_tools, mode, UNGUARDED_TOOL_MODES)
end