Class: Omen::Narrowing

Inherits:
Object
  • Object
show all
Defined in:
lib/omen/narrowing.rb

Overview

What one audience of a reading may read: the role its statement runs as, the rows each table admits it, and the tables it reads whole because nothing in them is anybody's.

Constant Summary collapse

EVERYBODY =

The policy every role holds, so that turning row level security on takes nothing away from whoever could already read -- a role made after this ran included. The narrowed role is held back by the restrictive policy beside it, which is ANDed with this one and applies to nobody else.

'omen_everybody'

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(role:, by:, own:, whole: [], except: nil) ⇒ Narrowing

Returns a new instance of Narrowing.

Parameters:

  • role (String) —

    the Postgres role a reading of this audience runs as.

  • by (Symbol) —

    the column of the reading that says whose rows these are.

  • own (Hash) —

    every table it reads rows of, to what makes a row its own. A table is named either way, since a host writing one of these writes symbols or strings by habit.

  • whole (Array<String>) (defaults to: []) —

    the tables it reads whole, nobody's in particular.

  • except (Regexp, nil) (defaults to: nil) —

    the columns of those it may not read, a counter over everybody being the case this exists for: it counts every owner rather than this one.



24
25
26
27
28
29
30
 
# File 'lib/omen/narrowing.rb', line 24

def initialize(role:, by:, own:, whole: [], except: nil)
  @role = role
  @by = by
  @own = own.transform_keys(&:to_s)
  @whole = whole.map(&:to_s)
  @except = except
end

Instance Attribute Details

#by ⇒ Symbol (readonly)

Returns the column of the reading that says whose rows these are.

Returns:

  • (Symbol) —

    the column of the reading that says whose rows these are.



15
16
17
 
# File 'lib/omen/narrowing.rb', line 15

def by
  @by
end

#role ⇒ String (readonly)

Returns the Postgres role a reading of this audience runs as.

Returns:

  • (String) —

    the Postgres role a reading of this audience runs as.



12
13
14
 
# File 'lib/omen/narrowing.rb', line 12

def role
  @role
end

Instance Method Details

#setting ⇒ String

Returns the setting a policy reads to know whose rows it is looking at.

Returns:

  • (String) —

    the setting a policy reads to know whose rows it is looking at.



33
 
# File 'lib/omen/narrowing.rb', line 33

def setting = "omen.#{@by}"

#statements(connection, members) ⇒ Array<Array<String>>

Returns the statements, grouped: what arrives together is applied together, so no table is left with row level security on and no policy under it.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    a writing one.

  • members (Array<String>) —

    the roles that may enter this one.

Returns:

  • (Array<Array<String>>) —

    the statements, grouped: what arrives together is applied together, so no table is left with row level security on and no policy under it.



39
40
41
42
43
44
 
# File 'lib/omen/narrowing.rb', line 39

def statements(connection, members)
  [ Grants.made(connection, @role),
    Grants.narrowed(connection, @role, members),
    *@whole.map { |table| granted connection, table },
    *@own.map { |table, own| narrowed connection, table, own }, ]
end

#widening(connection) ⇒ Array<Array<String>>

Returns the statements that take it back off, table by table.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    a writing one.

Returns:

  • (Array<Array<String>>) —

    the statements that take it back off, table by table.



48
49
50
 
# File 'lib/omen/narrowing.rb', line 48

def widening(connection)
  @own.keys.map { |table| widened connection, table }
end