Module: Omen::Bound

Defined in:
lib/omen/bound.rb

Overview

Which roles a restrictive policy really holds back. A role that inherits the privileges of a narrowed one is narrowed along with it, so a page can go empty for somebody nobody meant to narrow -- silently, since an empty answer raises nothing.

Constant Summary collapse

ROLES =

A policy is written for one role and named after it, so a binding anybody asked for is one whose policy name ends in the name of the role it turned up for.

<<~SQL
  SELECT p.tablename, p.policyname, r.rolname FROM pg_policies p
    CROSS JOIN LATERAL unnest(p.roles) AS named(rolname)
    JOIN pg_roles r ON pg_has_role(r.oid, named.rolname::regrole::oid, 'USAGE')
   WHERE p.permissive = 'RESTRICTIVE' AND p.schemaname = 'public' AND NOT r.rolsuper
   ORDER BY p.tablename, p.policyname, r.rolname
SQL

Class Method Summary collapse

Class Method Details

.roles(connection) ⇒ Array<Array<String>>

Returns the table, the policy and the role it holds back.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    any one.

Returns:

  • (Array<Array<String>>) —

    the table, the policy and the role it holds back.



18
 
# File 'lib/omen/bound.rb', line 18

def self.roles(connection) = connection.select_rows ROLES

.surprises(connection) ⇒ Array<Array<String>>

Returns the ones a host did not ask for.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    any one.

Returns:

  • (Array<Array<String>>) —

    the ones a host did not ask for.



22
23
24
 
# File 'lib/omen/bound.rb', line 22

def self.surprises(connection)
  roles(connection).reject { |_table, policy, role| policy.end_with? role }
end