Module: Reeve::Guard::ClassMethods

Defined in:
lib/reeve/authorization/guard.rb

Overview

Class-level DSL. See contracts/tool-dsl.md.

Instance Method Summary collapse

Instance Method Details

#guard_with(policy, action: nil) ⇒ Object

Declares which policy governs this tool. Absence is not neutral: a tool with no declaration is denied by the envelope (FR-002, FR-004).



25
26
27
28
29
30
31
32
33
34
 
# File 'lib/reeve/authorization/guard.rb', line 25

def guard_with(policy, action: nil)
  Authorization::Adapter.validate!(policy)

  @reeve_guard = Reeve.registry.register(
    tool_class: self,
    policy: policy,
    action: action,
    redacted_arguments: pending_redactions + inherited_redactions
  )
end

#guarded? ⇒ Boolean

Returns:

  • (Boolean) 


56
57
58
 
# File 'lib/reeve/authorization/guard.rb', line 56

def guarded?
  !reeve_guard.nil?
end

#inherited(subclass) ⇒ Object

A subclass of a guarded tool is itself guarded, and is registered under its own name so the envelope — which only ever has a name — can find it.



62
63
64
65
66
67
68
69
70
 
# File 'lib/reeve/authorization/guard.rb', line 62

def inherited(subclass)
  super
  declaration = reeve_guard
  # An anonymous subclass has no name to be looked up by; it still inherits the
  # declaration through the ancestry walk in Registry#for_class.
  return if declaration.nil? || subclass.name.nil?

  Reeve.registry.add(declaration.for_subclass(subclass))
end

#pending_redactions ⇒ Object 



72
73
74
 
# File 'lib/reeve/authorization/guard.rb', line 72

def pending_redactions
  @pending_redactions ||= []
end

#redact(*names) ⇒ Object

Argument names this tool never writes to the ledger in the clear, on top of the process-wide list (FR-011).



38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/reeve/authorization/guard.rb', line 38

def redact(*names)
  symbols = names.flatten.map(&:to_sym)
  @pending_redactions = pending_redactions | symbols

  declaration = reeve_guard
  return symbols if declaration.nil?

  @reeve_guard = Reeve.registry.add(
    declaration.with(redacted_arguments: declaration.redacted_arguments | symbols)
  )
  symbols
end

#reeve_guard ⇒ Object

This tool's declaration, inherited from a superclass when it has none of its own.



52
53
54
 
# File 'lib/reeve/authorization/guard.rb', line 52

def reeve_guard
  Reeve.registry.for_class(self)
end