Module: Sequel::Privacy::Enforcer

Extended by:
T::Sig
Defined in:
lib/sequel/privacy/enforcer.rb

Constant Summary collapse

EVAL_KEY =

Thread-local flag set while a policy chain is being evaluated. Implicit :view enforcement (Model.call, field readers, association readers) checks this flag and returns raw data when set, so policies can traverse protected fields and associations without recursive filtering. Explicit ‘allow?` calls always run regardless.

:sequel_privacy_in_policy_eval

Class Method Summary collapse

Class Method Details

.compute_cache_key(policy, subject, actor, viewer_context, direct_object) ⇒ Object 



90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
 
# File 'lib/sequel/privacy/enforcer.rb', line 90

def self.compute_cache_key(policy, subject, actor, viewer_context, direct_object)
  if (keys = policy.cache_by)
    parts = T.let([policy, viewer_context], T::Array[T.untyped])
    keys.each do |k|
      parts << case k
               when :actor then actor
               when :subject then subject
               when :direct_object then direct_object
               end
    end
    return parts.hash
  end

  case policy.arity
  when 0
    [policy, viewer_context].hash
  when 1
    [policy, actor, viewer_context].hash
  when 2
    [policy, actor, subject, viewer_context].hash
  else
    [policy, actor, subject, direct_object, viewer_context].hash
  end
end

.enforce(policies, subject, viewer_context, direct_object = nil) ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/sequel/privacy/enforcer.rb', line 40

def self.enforce(policies, subject, viewer_context, direct_object = nil)
  saved = Thread.current[EVAL_KEY]
  Thread.current[EVAL_KEY] = true

  begin
    if viewer_context.is_a?(AllPowerfulVC)
      logger&.warn('BYPASS: All-powerful viewer context bypasses all privacy rules.')
      return true
    end

    if viewer_context.is_a?(OmniscientVC)
      logger&.debug { "BYPASS: Omniscient viewer context (#{viewer_context.reason})" }
      return true
    end

    actor = viewer_context.is_a?(ActorVC) ? viewer_context.actor : nil

    if policies.empty?
      logger&.error { "No policies for #{subject.class}[#{subject_id(subject)}]. Denying by default." }
      policies = [BuiltInPolicies::AlwaysDeny]
    end

    # Fail-secure: every chain ends with AlwaysDeny.
    unless policies.last == BuiltInPolicies::AlwaysDeny
      logger&.warn { 'Policy chain should end with AlwaysDeny. Appending it.' }
      policies = policies.dup << BuiltInPolicies::AlwaysDeny
    end

    policies.each do |uncasted_policy|
      result = policy_result(uncasted_policy, subject, actor, viewer_context, direct_object)
      return true if result == :allow
      return false if result == :deny
    end

    false
  ensure
    Thread.current[EVAL_KEY] = saved
  end
end

.evaluate_child_policies(child_policies, subject, actor, viewer_context, direct_object) ⇒ Object 



131
132
133
134
135
136
137
138
139
140
141
142
 
# File 'lib/sequel/privacy/enforcer.rb', line 131

def self.evaluate_child_policies(child_policies, subject, actor, viewer_context, direct_object)
  Kernel.raise 'Policy combinator contains non-policy members' unless child_policies.all? { |c| c.is_a?(Proc) }

  results = child_policies.map do |child_policy|
    policy_result(child_policy, subject, actor, viewer_context, direct_object)
  end

  return :deny if results.include?(:deny)
  return :allow if results.all? { |r| r == :allow }

  :pass
end

.execute_policy(policy, subject, actor, direct_object) ⇒ Object 



202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
 
# File 'lib/sequel/privacy/enforcer.rb', line 202

def self.execute_policy(policy, subject, actor, direct_object)
  # Arity ≥ 1 policies expect an actor as the first arg; an
  # anonymous viewer auto-denies unless the policy opts in with
  # `allow_anonymous: true` (for subject-only state gates).
  return :deny if !actor && policy.arity >= 1 && !policy.allow_anonymous?

  case policy.arity
  when 0
    Actions.evaluate(&policy)
  when 1
    Actions.evaluate(actor, &policy)
  when 2
    Actions.evaluate(actor, subject, &policy)
  else
    Actions.evaluate(actor, subject, direct_object, &policy)
  end
end

.in_policy_eval? ⇒ Boolean

Returns:

  • (Boolean) 


26
27
28
 
# File 'lib/sequel/privacy/enforcer.rb', line 26

def self.in_policy_eval?
  Thread.current[EVAL_KEY] == true
end

.log_result(policy, result, actor, subject, from_cache, skipped) ⇒ Object 



230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
 
# File 'lib/sequel/privacy/enforcer.rb', line 230

def self.log_result(policy, result, actor, subject, from_cache, skipped)
  return unless logger

  actor_id = actor ? actor.id : 'anonymous'
  logger.debug do
    msg = "#{result.to_s.upcase}: #{policy.policy_name || 'anonymous'} for actor[#{actor_id}] on #{subject.class}[#{subject_id(subject)}]"
    msg += ' (cached)' if from_cache
    msg += ' (skipped: single_match)' if skipped
    msg
  end

  return unless policy.comment && %i[deny allow].include?(result)

  logger.debug { " ⮑  #{policy.comment}" }
end

.logger ⇒ Object 



20
21
22
 
# File 'lib/sequel/privacy/enforcer.rb', line 20

def logger
  Sequel::Privacy.logger
end

.policy_result(uncasted_policy, subject, actor, viewer_context, direct_object) ⇒ Object 



153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
 
# File 'lib/sequel/privacy/enforcer.rb', line 153

def self.policy_result(uncasted_policy, subject, actor, viewer_context, direct_object)
  from_cache = false
  skipped_from_single_match = false

  policy = T.cast(uncasted_policy, TPolicy, checked: false)

  if policy.single_match?
    match_key = [policy, actor, viewer_context].hash
    if (matched = Sequel::Privacy.single_matches[match_key]) && matched != subject.hash
      skipped_from_single_match = true
      result = :pass
    end
  end

  cache_key = compute_cache_key(policy, subject, actor, viewer_context, direct_object)
  if !skipped_from_single_match && policy.cacheable? && Sequel::Privacy.cache.key?(cache_key)
    from_cache = true
    result = Sequel::Privacy.cache[cache_key]
    Kernel.raise InvalidPolicyOutcomeError unless result && valid_outcome?(result)
  end

  result ||= execute_policy(policy, subject, actor, direct_object)
  result ||= :pass

  result = evaluate_child_policies(result, subject, actor, viewer_context, direct_object) if result.is_a?(Array)

  Sequel::Privacy.cache[cache_key] = result if policy.cacheable? && !from_cache

  log_result(policy, result, actor, subject, from_cache, skipped_from_single_match)

  if policy.single_match? && result == :allow
    Sequel::Privacy.single_matches[[policy, actor, viewer_context].hash] = subject.hash
  end

  unless valid_outcome?(result)
    Kernel.raise InvalidPolicyOutcomeError, "Policy returned #{result.inspect}, expected :allow, :deny, or :pass"
  end

  result
end

.subject_id(subject) ⇒ Object 



247
248
249
 
# File 'lib/sequel/privacy/enforcer.rb', line 247

def self.subject_id(subject)
  subject.respond_to?(:pk) ? subject.pk : subject.object_id
end

.valid_outcome?(outcome) ⇒ Boolean

Returns:

  • (Boolean) 


116
117
118
 
# File 'lib/sequel/privacy/enforcer.rb', line 116

def self.valid_outcome?(outcome)
  %i[allow pass deny].include?(outcome)
end