Module: Apartment::Privileges

Defined in:
lib/apartment/privileges.rb,
lib/apartment/privileges/context.rb

Overview

Prebuilt tenant privilege policies. Apartment issues no grants of its own; a policy runs only because an adopter configured one.

Defined Under Namespace

Classes: Context

Class Method Summary collapse

Class Method Details

.standard(grant_to:, include_functions: true) ⇒ Proc

A policy granting an app role the privileges a routed tenant normally needs.

Returns a callable rather than executing, so it can be assigned directly to config.tenant_privilege_policy and so it owns its own phase mapping. As an immediate call it would have forced every adopter to re-derive which statements belong before the schema import and which after; that mapping is exactly the knowledge this helper exists to carry.

c.tenant_privilege_policy = Apartment::Privileges.standard(grant_to: 'app_user')

Composable, because it is just a callable:

standard = Apartment::Privileges.standard(grant_to: 'app_user')
c.tenant_privilege_policy = lambda { |ctx|
standard.call(ctx)
ctx.connection.execute('...') if ctx.after_schema_load?
}

Parameters:

  • grant_to (String, Array<String>) —

    role names, or MySQL accounts

  • include_functions (Boolean) (defaults to: true) —

    PostgreSQL only; the EXECUTE ON FUNCTIONS default-privileges rule. MySQL has no equivalent and ignores it.

Returns:

  • (Proc) —

    takes one Privileges::Context, returns the statements executed



31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'lib/apartment/privileges.rb', line 31

def standard(grant_to:, include_functions: true)
  roles = Array(grant_to)
  if roles.empty? || !roles.all?(String)
    raise(Apartment::ConfigurationError,
          "grant_to must be a String or a non-empty Array of Strings, got: #{grant_to.inspect}")
  end

  lambda do |ctx|
    statements = Apartment.adapter.standard_privilege_statements(
      ctx, grant_to: roles, include_functions: include_functions
    )
    statements.each { |sql| ctx.connection.execute(sql) }
  end
end