Module: Reeve::Guard

Defined in:
lib/reeve/authorization/guard.rb

Overview

The tool-side surface: two macros and one helper. include Reeve::Guard in a tool class (the fast-mcp adapter does it for you) and declare which policy governs it.

class InvoiceSearchTool
include Reeve::Guard
guard_with InvoicePolicy
redact :customer_ssn

def call(query:)
  Invoice.where("number LIKE ?", "%#{query}%")
end
end

Defined Under Namespace

Modules: ClassMethods

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.included(base) ⇒ Object 



17
18
19
 
# File 'lib/reeve/authorization/guard.rb', line 17

def self.included(base)
  base.extend(ClassMethods)
end

Instance Method Details

#scoped(model_or_relation) ⇒ Object

The scoped relation for the invoking principal. This is how a guarded tool returns anything that is not a record: a count, a sum, a rendered summary. Computing from scoped(...) means the tool never held unscoped data, so the derived value is safe by construction rather than by promise (R4).

Raises:



90
91
92
93
94
95
 
# File 'lib/reeve/authorization/guard.rb', line 90

def scoped(model_or_relation)
  state = Authorization::Current.state
  raise Error, "scoped(...) may only be called inside a guarded invocation" if state.nil?

  Authorization::Scoper.scoped_relation(state, model_or_relation)
end