Module: Sequel::Privacy::Enforcer

Extended by:
T::Sig
Defined in:
lib/sequel/privacy/enforcer.rb

Overview

The Enforcer evaluates policy chains to determine if an action is allowed. It handles caching, single-match optimization, and policy combinators.

Constant Summary collapse

EVAL_KEY =

Thread-local flag set while a policy chain is being evaluated. Implicit :view enforcement (Model.call, field readers, association readers) checks this flag and returns raw data when set, so policies can traverse protected fields and associations without recursive filtering. Explicit ‘allow?` calls always run regardless.

:sequel_privacy_in_policy_eval

Class Method Summary collapse

Class Method Details

.compute_cache_key(policy, subject, actor, viewer_context, direct_object) ⇒ Object 



99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'lib/sequel/privacy/enforcer.rb', line 99

def self.compute_cache_key(policy, subject, actor, viewer_context, direct_object)
  case policy.arity
  when 0
    [policy, viewer_context].hash
  when 1
    [policy, subject, viewer_context].hash
  when 2
    [policy, subject, actor, viewer_context].hash
  else
    [policy, subject, actor, direct_object, viewer_context].hash
  end
end

.enforce(policies, subject, viewer_context, direct_object = nil) ⇒ Object 



48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
 
# File 'lib/sequel/privacy/enforcer.rb', line 48

def self.enforce(policies, subject, viewer_context, direct_object = nil)
  saved = Thread.current[EVAL_KEY]
  Thread.current[EVAL_KEY] = true

  begin
    # All-powerful and omniscient contexts bypass all checks
    if viewer_context.is_a?(AllPowerfulVC)
      logger&.warn('BYPASS: All-powerful viewer context bypasses all privacy rules.')
      return true
    end

    if viewer_context.is_a?(OmniscientVC)
      logger&.debug { "BYPASS: Omniscient viewer context (#{viewer_context.reason})" }
      return true
    end

    actor = viewer_context.is_a?(ActorVC) ? viewer_context.actor : nil

    if policies.empty?
      logger&.error { "No policies for #{subject.class}[#{subject_id(subject)}]. Denying by default." }
      policies = [BuiltInPolicies::AlwaysDeny]
    end

    # Ensure policy chain ends with AlwaysDeny (fail-secure)
    unless policies.last == BuiltInPolicies::AlwaysDeny
      logger&.warn { 'Policy chain should end with AlwaysDeny. Appending it.' }
      policies = policies.dup << BuiltInPolicies::AlwaysDeny
    end

    policies.each do |uncasted_policy|
      result = policy_result(uncasted_policy, subject, actor, viewer_context, direct_object)
      return true if result == :allow
      return false if result == :deny
    end

    false
  ensure
    Thread.current[EVAL_KEY] = saved
  end
end

.evaluate_child_policies(child_policies, subject, actor, viewer_context, direct_object) ⇒ Object 



128
129
130
131
132
133
134
135
136
137
138
139
140
141
 
# File 'lib/sequel/privacy/enforcer.rb', line 128

def self.evaluate_child_policies(child_policies, subject, actor, viewer_context, direct_object)
  unless child_policies.all? { |c| c.is_a?(Proc) }
    Kernel.raise "Policy combinator contains non-policy members"
  end

  results = child_policies.map do |child_policy|
    policy_result(child_policy, subject, actor, viewer_context, direct_object)
  end

  return :deny if results.include?(:deny)
  return :allow if results.all? { |r| r == :allow }

  :pass
end

.execute_policy(policy, subject, actor, direct_object) ⇒ Object 



213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
 
# File 'lib/sequel/privacy/enforcer.rb', line 213

def self.execute_policy(policy, subject, actor, direct_object)
  # 2+ arity policies require actor - auto-deny for anonymous
  if !actor && policy.arity >= 2
    return :deny
  end

  case policy.arity
  when 0
    Actions.evaluate(&policy)
  when 1
    Actions.evaluate(subject, &policy)
  when 2
    Actions.evaluate(subject, T.must(actor), &policy)
  else
    Actions.evaluate(subject, T.must(actor), direct_object, &policy)
  end
end

.in_policy_eval? ⇒ Boolean

Returns:

  • (Boolean) 


29
30
31
 
# File 'lib/sequel/privacy/enforcer.rb', line 29

def self.in_policy_eval?
  Thread.current[EVAL_KEY] == true
end

.log_result(policy, result, actor, subject, from_cache, skipped) ⇒ Object 



241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
 
# File 'lib/sequel/privacy/enforcer.rb', line 241

def self.log_result(policy, result, actor, subject, from_cache, skipped)
  return unless logger

  actor_id = actor ? actor.id : 'anonymous'
  logger.debug do
    msg = "#{result.to_s.upcase}: #{policy.policy_name || 'anonymous'} for actor[#{actor_id}] on #{subject.class}[#{subject_id(subject)}]"
    msg += " (cached)" if from_cache
    msg += " (skipped: single_match)" if skipped
    msg
  end

  if policy.comment && %i[deny allow].include?(result)
    logger.debug { " ⮑  #{policy.comment}" }
  end
end

.logger ⇒ Object 



23
24
25
 
# File 'lib/sequel/privacy/enforcer.rb', line 23

def logger
  Sequel::Privacy.logger
end

.policy_result(uncasted_policy, subject, actor, viewer_context, direct_object) ⇒ Object 



153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
 
# File 'lib/sequel/privacy/enforcer.rb', line 153

def self.policy_result(uncasted_policy, subject, actor, viewer_context, direct_object)
  from_cache = false
  skipped_from_single_match = false

  policy = T.cast(uncasted_policy, TPolicy, checked: false)

  # Single-match optimization
  if policy.single_match?
    match_key = [policy, actor, viewer_context].hash
    if (matched = Sequel::Privacy.single_matches[match_key]) && matched != subject.hash
      skipped_from_single_match = true
      result = :pass
    end
  end

  # Check cache
  cache_key = compute_cache_key(policy, subject, actor, viewer_context, direct_object)
  if !skipped_from_single_match && policy.cacheable? && Sequel::Privacy.cache.key?(cache_key)
    from_cache = true
    result = Sequel::Privacy.cache[cache_key]
    Kernel.raise InvalidPolicyOutcomeError unless result && valid_outcome?(result)
  end

  # Execute policy if not cached
  result ||= execute_policy(policy, subject, actor, direct_object)
  result ||= :pass

  # Handle combinator results
  if result.is_a?(Array)
    result = evaluate_child_policies(result, subject, actor, viewer_context, direct_object)
  end

  # Cache result
  if policy.cacheable? && !from_cache
    Sequel::Privacy.cache[cache_key] = result
  end

  # Log result
  log_result(policy, result, actor, subject, from_cache, skipped_from_single_match)

  # Record single-match
  if policy.single_match? && result == :allow
    Sequel::Privacy.single_matches[[policy, actor, viewer_context].hash] = subject.hash
  end

  unless valid_outcome?(result)
    Kernel.raise InvalidPolicyOutcomeError, "Policy returned #{result.inspect}, expected :allow, :deny, or :pass"
  end

  result
end

.subject_id(subject) ⇒ Object 



258
259
260
 
# File 'lib/sequel/privacy/enforcer.rb', line 258

def self.subject_id(subject)
  subject.respond_to?(:pk) ? subject.pk : subject.object_id
end

.valid_outcome?(outcome) ⇒ Boolean

Returns:

  • (Boolean) 


113
114
115
 
# File 'lib/sequel/privacy/enforcer.rb', line 113

def self.valid_outcome?(outcome)
  %i[allow pass deny].include?(outcome)
end