Exception: Reeve::DeniedError

Inherits:
Error
  • Object
show all
Defined in:
lib/reeve/errors.rb

Overview

Raised when a guarded invocation is denied.

The message names the tool, the principal and the rule, because the first question a developer asks is "which rule stopped this, and for whom?" (Constitution VI). It deliberately never names a record: see .out_of_scope.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(tool_name:, principal_id:, rule:, detail: nil) ⇒ DeniedError

Returns a new instance of DeniedError.



43
44
45
46
47
48
49
 
# File 'lib/reeve/errors.rb', line 43

def initialize(tool_name:, principal_id:, rule:, detail: nil)
  @tool_name    = tool_name&.to_s
  @principal_id = principal_id&.to_s
  @rule         = rule.to_s
  @detail       = detail&.to_s
  super(build_message)
end

Instance Attribute Details

#detail ⇒ Object (readonly)

Returns the value of attribute detail.



16
17
18
 
# File 'lib/reeve/errors.rb', line 16

def detail
  @detail
end

#principal_id ⇒ Object (readonly)

Returns the value of attribute principal_id.



16
17
18
 
# File 'lib/reeve/errors.rb', line 16

def principal_id
  @principal_id
end

#rule ⇒ Object (readonly)

Returns the value of attribute rule.



16
17
18
 
# File 'lib/reeve/errors.rb', line 16

def rule
  @rule
end

#tool_name ⇒ Object (readonly)

Returns the value of attribute tool_name.



16
17
18
 
# File 'lib/reeve/errors.rb', line 16

def tool_name
  @tool_name
end

Class Method Details

.from(decision, tool_name:, principal_id:) ⇒ Object 



18
19
20
21
22
23
24
25
26
27
28
29
 
# File 'lib/reeve/errors.rb', line 18

def self.from(decision, tool_name:, principal_id:)
  unless decision.denied?
    raise ArgumentError, "cannot build a DeniedError from an allow decision (#{decision})"
  end

  new(
    tool_name: tool_name,
    principal_id: principal_id,
    rule: decision.rule,
    detail: decision.detail
  )
end

.out_of_scope(tool_name:, principal_id:) ⇒ Object

FR-006. Fetching a record outside the principal's scope must be indistinguishable from fetching one that does not exist, so this builder accepts no record at all — there is nothing to leak, by construction rather than by discipline.



34
35
36
37
38
39
40
41
 
# File 'lib/reeve/errors.rb', line 34

def self.out_of_scope(tool_name:, principal_id:)
  new(
    tool_name: tool_name,
    principal_id: principal_id,
    rule: Decision::OUT_OF_SCOPE_RECORD,
    detail: "the requested record is not within this principal's scope"
  )
end