Module: Sequel::Privacy::Enforcer

Extended by:
T::Sig
Defined in:
lib/sequel/privacy/enforcer.rb

Constant Summary collapse

EVAL_KEY =

Thread-local flag set while a policy chain is being evaluated. Implicit :view enforcement (Model.call, field readers, association readers) checks this flag and returns raw data when set, so policies can traverse protected fields and associations without recursive filtering. Explicit ‘allow?` calls always run regardless.

:sequel_privacy_in_policy_eval

Class Method Summary collapse

Class Method Details

.compute_cache_key(policy, subject, actor, viewer_context, direct_object) ⇒ Object 



97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'lib/sequel/privacy/enforcer.rb', line 97

def self.compute_cache_key(policy, subject, actor, viewer_context, direct_object)
  if (keys = policy.cache_by)
    parts = T.let([policy, viewer_context], T::Array[T.untyped])
    keys.each do |k|
      parts << case k
               when :actor then actor
               when :subject then subject
               when :direct_object then direct_object
               end
    end
    return parts.hash
  end

  case policy.arity
  when 0
    [policy, viewer_context].hash
  when 1
    [policy, actor, viewer_context].hash
  when 2
    [policy, actor, subject, viewer_context].hash
  else
    [policy, actor, subject, direct_object, viewer_context].hash
  end
end

.enforce(policies, subject, viewer_context, direct_object = nil) ⇒ Object 



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
 
# File 'lib/sequel/privacy/enforcer.rb', line 46

def self.enforce(policies, subject, viewer_context, direct_object = nil)
  saved = Thread.current[EVAL_KEY]
  Thread.current[EVAL_KEY] = true

  begin
    # All-powerful and omniscient contexts bypass all checks
    if viewer_context.is_a?(AllPowerfulVC)
      logger&.warn('BYPASS: All-powerful viewer context bypasses all privacy rules.')
      return true
    end

    if viewer_context.is_a?(OmniscientVC)
      logger&.debug { "BYPASS: Omniscient viewer context (#{viewer_context.reason})" }
      return true
    end

    actor = viewer_context.is_a?(ActorVC) ? viewer_context.actor : nil

    if policies.empty?
      logger&.error { "No policies for #{subject.class}[#{subject_id(subject)}]. Denying by default." }
      policies = [BuiltInPolicies::AlwaysDeny]
    end

    # Ensure policy chain ends with AlwaysDeny (fail-secure)
    unless policies.last == BuiltInPolicies::AlwaysDeny
      logger&.warn { 'Policy chain should end with AlwaysDeny. Appending it.' }
      policies = policies.dup << BuiltInPolicies::AlwaysDeny
    end

    policies.each do |uncasted_policy|
      result = policy_result(uncasted_policy, subject, actor, viewer_context, direct_object)
      return true if result == :allow
      return false if result == :deny
    end

    false
  ensure
    Thread.current[EVAL_KEY] = saved
  end
end

.evaluate_child_policies(child_policies, subject, actor, viewer_context, direct_object) ⇒ Object 



138
139
140
141
142
143
144
145
146
147
148
149
 
# File 'lib/sequel/privacy/enforcer.rb', line 138

def self.evaluate_child_policies(child_policies, subject, actor, viewer_context, direct_object)
  Kernel.raise 'Policy combinator contains non-policy members' unless child_policies.all? { |c| c.is_a?(Proc) }

  results = child_policies.map do |child_policy|
    policy_result(child_policy, subject, actor, viewer_context, direct_object)
  end

  return :deny if results.include?(:deny)
  return :allow if results.all? { |r| r == :allow }

  :pass
end

.execute_policy(policy, subject, actor, direct_object) ⇒ Object 



217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
 
# File 'lib/sequel/privacy/enforcer.rb', line 217

def self.execute_policy(policy, subject, actor, direct_object)
  # Policies with arity >= 1 expect an actor as the first arg.
  # Anonymous viewers (no actor) auto-deny unless the policy opts in
  # with allow_anonymous: true (for state-gate policies that examine
  # only the subject).
  return :deny if !actor && policy.arity >= 1 && !policy.allow_anonymous?

  case policy.arity
  when 0
    Actions.evaluate(&policy)
  when 1
    Actions.evaluate(actor, &policy)
  when 2
    Actions.evaluate(actor, subject, &policy)
  else
    Actions.evaluate(actor, subject, direct_object, &policy)
  end
end

.in_policy_eval? ⇒ Boolean

Returns:

  • (Boolean) 


27
28
29
 
# File 'lib/sequel/privacy/enforcer.rb', line 27

def self.in_policy_eval?
  Thread.current[EVAL_KEY] == true
end

.log_result(policy, result, actor, subject, from_cache, skipped) ⇒ Object 



246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
 
# File 'lib/sequel/privacy/enforcer.rb', line 246

def self.log_result(policy, result, actor, subject, from_cache, skipped)
  return unless logger

  actor_id = actor ? actor.id : 'anonymous'
  logger.debug do
    msg = "#{result.to_s.upcase}: #{policy.policy_name || 'anonymous'} for actor[#{actor_id}] on #{subject.class}[#{subject_id(subject)}]"
    msg += ' (cached)' if from_cache
    msg += ' (skipped: single_match)' if skipped
    msg
  end

  return unless policy.comment && %i[deny allow].include?(result)

  logger.debug { " ⮑  #{policy.comment}" }
end

.logger ⇒ Object 



21
22
23
 
# File 'lib/sequel/privacy/enforcer.rb', line 21

def logger
  Sequel::Privacy.logger
end

.policy_result(uncasted_policy, subject, actor, viewer_context, direct_object) ⇒ Object 



161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
 
# File 'lib/sequel/privacy/enforcer.rb', line 161

def self.policy_result(uncasted_policy, subject, actor, viewer_context, direct_object)
  from_cache = false
  skipped_from_single_match = false

  policy = T.cast(uncasted_policy, TPolicy, checked: false)

  # Single-match optimization
  if policy.single_match?
    match_key = [policy, actor, viewer_context].hash
    if (matched = Sequel::Privacy.single_matches[match_key]) && matched != subject.hash
      skipped_from_single_match = true
      result = :pass
    end
  end

  # Check cache
  cache_key = compute_cache_key(policy, subject, actor, viewer_context, direct_object)
  if !skipped_from_single_match && policy.cacheable? && Sequel::Privacy.cache.key?(cache_key)
    from_cache = true
    result = Sequel::Privacy.cache[cache_key]
    Kernel.raise InvalidPolicyOutcomeError unless result && valid_outcome?(result)
  end

  # Execute policy if not cached
  result ||= execute_policy(policy, subject, actor, direct_object)
  result ||= :pass

  # Handle combinator results
  result = evaluate_child_policies(result, subject, actor, viewer_context, direct_object) if result.is_a?(Array)

  # Cache result
  Sequel::Privacy.cache[cache_key] = result if policy.cacheable? && !from_cache

  # Log result
  log_result(policy, result, actor, subject, from_cache, skipped_from_single_match)

  # Record single-match
  if policy.single_match? && result == :allow
    Sequel::Privacy.single_matches[[policy, actor, viewer_context].hash] = subject.hash
  end

  unless valid_outcome?(result)
    Kernel.raise InvalidPolicyOutcomeError, "Policy returned #{result.inspect}, expected :allow, :deny, or :pass"
  end

  result
end

.subject_id(subject) ⇒ Object 



263
264
265
 
# File 'lib/sequel/privacy/enforcer.rb', line 263

def self.subject_id(subject)
  subject.respond_to?(:pk) ? subject.pk : subject.object_id
end

.valid_outcome?(outcome) ⇒ Boolean

Returns:

  • (Boolean) 


123
124
125
 
# File 'lib/sequel/privacy/enforcer.rb', line 123

def self.valid_outcome?(outcome)
  %i[allow pass deny].include?(outcome)
end