activerecord-tenanted 0.6.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62c3b9d7f37db44de60c7559e4b10e1407171ab29aa874e2687853e8acc38bb1
-  data.tar.gz: 27b2ee871ff4ce67b60480e83694cf6a2aeac504b3ab39f96ea0eb243b5f3a47
+  metadata.gz: 96309750320bfc1e4e183b299c46a3ac8e925ae71ae58726146a3823747c48c2
+  data.tar.gz: 59324d68cac1e4c1669d1b7c797f21eff549acfed7ffb54ec053057aea1a69ae
 SHA512:
-  metadata.gz: 7eff54730cbc865dd8ecb1169e146194b0edceaed0527059ed110537aedd57901a5a5af5b85c522bfebcf50714c468984f91ac4f5c8e40077b2e737497eac550
-  data.tar.gz: fafa6f206173a7057e090407f5cf6698bd7f1d34885509793568f1e76baedbe61b7eeea980493b5af0df30c3f5bd20400c799eebecf62785f458e925afbee57f
+  metadata.gz: ac643449dfda377954739d2210b2f011e832cffed4599dca4c0aa8a5fe692a87dffca7ed2e719667dd911ddbc52523ac9dae3e4bccd419282d186366ae7cf42e
+  data.tar.gz: 36f29134a66ed8619e26e6f12b04e497ec2e2ec1e8db350dfe6c505630394dbddd2a896ce6b11e1ba1956f0d34309bfda4d2951813ac2c7c1f9db622c403f6d2

data/lib/active_record/tenanted/associations.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Tenanted
+    # Tenant context is checked when an association reads or writes the database, and not when the
+    # Association object is created. Serializers create associations to dump and restore their
+    # targets without ever going near a connection, and must not be tripped up by the check.
+    #
+    # `klass` is resolved at both of these seams, so a polymorphic association is checked against
+    # the class it actually points at rather than being presumed tenanted.
+    module Associations # :nodoc:
+      # Every query built on behalf of an association funnels through here, including the ones
+      # issued by a collection proxy that has outlived the tenant context it was created in.
+      def scope
+        ensure_owner_tenant_context_safety
+        super
+      end
+
+      private
+        # Called by the collection and singular association readers, so that the exception is
+        # raised at the call site that made the mistake and not at the eventual query.
+        def ensure_klass_exists!
+          super
+          ensure_owner_tenant_context_safety
+        end
+
+        def ensure_owner_tenant_context_safety
+          owner.ensure_tenant_context_safety if owner.class.tenanted? && klass&.tenanted?
+        end
+    end
+  end
+end

data/lib/active_record/tenanted/global_id.rb

@@ -9,10 +9,15 @@ module ActiveRecord
         params && params[:tenant]
       end
 
-      class Locator
+      class Locator < ::GlobalID::Locator::UnscopedLocator
         def locate(gid, options = {})
           ensure_tenant_context_safety(gid)
-          gid.model_class.find(gid.model_id)
+          super
+        end
+
+        def locate_many(gids, options = {})
+          gids.each { |gid| ensure_tenant_context_safety(gid) }
+          super
         end
 
         private

data/lib/active_record/tenanted/message_pack.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Tenanted
+    module MessagePack # :nodoc:
+      # This patch sees every record in a payload, unlike the Marshal, YAML, and JSON hooks, which
+      # are methods on the record and so only ever run for tenanted models.
+      module Decoder
+        def build_record(entry)
+          class_name, attributes_hash, * = entry
+
+          if ActiveSupport::MessagePack::Extensions.load_class(class_name).tenanted?
+            has_tenant = attributes_hash.key?("tenant")
+            tenant_name = attributes_hash.delete("tenant")
+
+            super.tap do |record|
+              record.instance_variable_set(:@tenant, tenant_name) if has_tenant
+            end
+          else
+            super
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/tenanted/patches.rb

@@ -24,8 +24,6 @@ module ActiveRecord
           end
       end
 
-      # TODO: This monkey patch shouldn't be necessary after 8.1 lands and the need for a
-      # connection is removed. For details see https://github.com/rails/rails/pull/54348
       module Attributes
         extend ActiveSupport::Concern
 
@@ -44,6 +42,18 @@ module ActiveRecord
             end
           end
         end
+
+        class << self
+          # This monkey patch isn't necessary after 8.1 removed the need for a connection.
+          # For details see https://github.com/rails/rails/pull/54348
+          def needs_patch?
+            Gem::Requirement.new("~> 8.1.0").satisfied_by?(Gem::Version.new(Rails::VERSION::STRING))
+          end
+
+          def apply_patch
+            ActiveRecord::Base.prepend(self) if needs_patch?
+          end
+        end
       end
     end
   end

data/lib/active_record/tenanted/railtie.rb

@@ -75,6 +75,7 @@ module ActiveRecord
         ActiveSupport.on_load(:active_record) do
           prepend ActiveRecord::Tenanted::Base
           ActiveRecord::Relation.prepend ActiveRecord::Tenanted::Relation
+          ActiveRecord::Associations::Association.prepend ActiveRecord::Tenanted::Associations
         end
       end
 
@@ -93,9 +94,16 @@ module ActiveRecord
         config.active_record.check_schema_cache_dump_version = false
       end
 
+      initializer "active_record_tenanted.message_pack" do
+        ActiveSupport.on_load(:message_pack) do
+          require "active_record/message_pack"
+          ActiveRecord::MessagePack::Decoder.prepend ActiveRecord::Tenanted::MessagePack::Decoder
+        end
+      end
+
       initializer "active_record_tenanted.monkey_patches" do
         ActiveSupport.on_load(:active_record) do
-          prepend ActiveRecord::Tenanted::Patches::Attributes
+          ActiveRecord::Tenanted::Patches::Attributes.apply_patch
           ActiveRecord::Tasks::DatabaseTasks.prepend ActiveRecord::Tenanted::Patches::DatabaseTasks
         end
       end

data/lib/active_record/tenanted/storage.rb

@@ -17,16 +17,31 @@ module ActiveRecord
         end
 
         def path_for(key)
-          if ActiveRecord::Tenanted.connection_class
-            # TODO: this is brittle if the key isn't tenanted ... errors in folder_for:
-            #
-            #   NoMethodError undefined method '[]' for nil (NoMethodError) [ key[0..1], key[2..3] ].join("/")
-            #
-            tenant, key = key.split("/", 2)
-            File.join(root, tenant, folder_for(key), key)
-          else
-            super
+          return super unless ActiveRecord::Tenanted.connection_class && key.include?("/")
+
+          if key.split("/").intersect?(%w[. ..])
+            raise ActiveStorage::InvalidKeyError, "key has path traversal segments"
+          end
+
+          tenant, key = key.split("/", 2)
+
+          if tenant.blank? || key.blank?
+            raise ActiveStorage::InvalidKeyError, "key has a blank segment"
           end
+
+          begin
+            path = File.expand_path(File.join(root, tenant, folder_for(key), key))
+          rescue ArgumentError
+            raise ActiveStorage::InvalidKeyError, "key is an invalid string"
+          end
+
+          unless path.start_with?(File.expand_path(root) + "/")
+            raise ActiveStorage::InvalidKeyError, "key is outside of disk service root"
+          end
+
+          path
+        rescue Encoding::CompatibilityError
+          raise ActiveStorage::InvalidKeyError, "key has incompatible encoding"
         end
       end
 

data/lib/active_record/tenanted/tenant.rb

@@ -9,13 +9,24 @@ module ActiveRecord
       prepended do
         attr_reader :tenant
 
-        before_save :ensure_tenant_context_safety
+        before_save :ensure_belongs_to_tenant_safety, prepend: true
+        before_save :ensure_tenant_context_safety, prepend: true
+        before_destroy :ensure_tenant_context_safety, prepend: true
       end
 
       def cache_key
         tenant ? "#{tenant}/#{super}" : super
       end
 
+      def ==(other)
+        super && tenant == other.tenant
+      end
+      alias eql? ==
+
+      def hash
+        [ super, tenant ].hash
+      end
+
       def inspect
         return super unless tenant
 
@@ -30,14 +41,114 @@ module ActiveRecord
         super(options.merge(tenant: tenant))
       end
 
-      def association(name)
-        super.tap do |assoc|
-          if assoc.reflection.polymorphic? || assoc.reflection.klass.tenanted?
-            ensure_tenant_context_safety
+      def reload(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      def valid?(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      def delete
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      # #update_column delegates here
+      def update_columns(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      def touch(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      # #decrement! delegates here
+      def increment!(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      # A belongs_to writes its foreign key onto this record, so nothing else notices when the
+      # target came from another tenant's database.
+      def ensure_belongs_to_tenant_safety
+        self.class.reflect_on_all_associations(:belongs_to).each do |reflection|
+          # Avoid creating the Association object for a belongs_to that was never touched
+          next unless association_cached?(reflection.name)
+
+          target = association(reflection.name).target
+
+          if target && target.class.tenanted? && target.tenant != tenant
+            raise WrongTenantError,
+                  "#{self.class} model belongs to tenant #{tenant.inspect}, but its " \
+                  "#{reflection.name} association belongs to tenant #{target.tenant.inspect}"
           end
         end
       end
 
+      def ensure_tenant_context_safety
+        self_tenant = self.tenant
+        current_tenant = self.class.current_tenant
+
+        if current_tenant.nil?
+          raise NoTenantError, "Cannot connect to a tenanted database while untenanted (#{self.class})"
+        elsif self_tenant != current_tenant
+          raise WrongTenantError,
+                "#{self.class} model belongs to tenant #{self_tenant.inspect}, " \
+                "but current tenant is #{current_tenant.inspect}"
+        end
+      end
+
+      # The tenant is an ordinary attribute in serialized snapshots of the record, the same way Job
+      # and GlobalId serialize the tenant. Rails's only callers of this method are the serializers
+      # (Marshal 7.1 format and MessagePack); it does not feed the persistence write path.
+      def attributes_for_database
+        super.merge!("tenant" => tenant)
+      end
+
+      def encode_with(coder)
+        super
+        coder["tenant"] = tenant
+      end
+
+      def init_with(coder, &block)
+        super
+
+        # Psych::Coder does not implement #key?, but exposes the underlying hash as #map
+        @tenant = coder.map["tenant"] if coder.map.key?("tenant")
+
+        self
+      end
+
+      def from_json(json, include_root = include_root_in_json)
+        hash = ActiveSupport::JSON.decode(json)
+        hash = hash.values.first if include_root
+
+        @tenant = hash.delete("tenant") if hash.key?("tenant")
+
+        self.attributes = hash
+        self
+      end
+
+      def marshal_load(state)
+        has_tenant = state[0].key?("tenant")
+        tenant_name = state[0].delete("tenant")
+
+        super
+
+        @tenant = tenant_name if has_tenant
+      end
+
       alias to_gid to_global_id
       alias to_sgid to_signed_global_id
 
@@ -50,17 +161,10 @@ module ActiveRecord
           super
         end
 
-        def ensure_tenant_context_safety
-          self_tenant = self.tenant
-          current_tenant = self.class.current_tenant
-
-          if current_tenant.nil?
-            raise NoTenantError, "Cannot connect to a tenanted database while untenanted (#{self.class})"
-          elsif self_tenant != current_tenant
-            raise WrongTenantError,
-                  "#{self.class} model belongs to tenant #{self_tenant.inspect}, " \
-                  "but current tenant is #{current_tenant.inspect}"
-          end
+        # Presenting the tenant as one more serializable attribute lets ActiveModel apply the
+        # `only:` and `except:` options to it, and read it back through the `tenant` reader.
+        def attribute_names_for_serialization
+          super + [ "tenant" ]
         end
     end
 
@@ -95,9 +199,18 @@ module ActiveRecord
         end
 
         def current_tenant=(tenant_name)
-          tenant_name = tenant_name.to_s unless tenant_name == UNTENANTED_SENTINEL
+          case tenant_name
+          when nil
+            tenant_name = UNTENANTED_SENTINEL
+          when UNTENANTED_SENTINEL
+            # no-op
+          else
+            tenant_name = tenant_name.to_s
+          end
 
-          connection_class_for_self.connecting_to(shard: tenant_name, role: ActiveRecord.writing_role)
+          run_callbacks :set_current_tenant do
+            connection_class_for_self.connecting_to(shard: tenant_name, role: ActiveRecord.writing_role)
+          end
         end
 
         def tenant_exist?(tenant_name)
@@ -108,11 +221,13 @@ module ActiveRecord
           tenant_name = tenant_name.to_s unless tenant_name == UNTENANTED_SENTINEL
 
           if tenant_name == current_tenant
-            yield
+            run_callbacks :with_tenant, &block
           else
             connection_class_for_self.connected_to(shard: tenant_name, role: ActiveRecord.writing_role) do
-              prohibit_shard_swapping(prohibit_shard_swapping) do
-                log_tenant_tag(tenant_name, &block)
+              run_callbacks :with_tenant do
+                prohibit_shard_swapping(prohibit_shard_swapping) do
+                  log_tenant_tag(tenant_name, &block)
+                end
               end
             end
           end
@@ -255,9 +370,13 @@ module ActiveRecord
         self.default_shard = ActiveRecord::Tenanted::Tenant::UNTENANTED_SENTINEL
 
         prepend TenantCommon
+        extend ActiveSupport::Callbacks
 
         cattr_accessor :tenanted_config_name
         cattr_accessor(:tenanted_connection_pools) { LRU.new }
+
+        define_callbacks :with_tenant
+        define_callbacks :set_current_tenant
       end
 
       def tenanted?

data/lib/active_record/tenanted/untenanted_connection_pool.rb

@@ -32,6 +32,9 @@ module ActiveRecord
         db_config.max_connections
       end
 
+      def clear_query_cache
+      end
+
       def lease_connection(...)
         raise Tenanted::NoTenantError, "Cannot connect to a tenanted database while untenanted (#{@model})."
       end

data/lib/active_record/tenanted/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveRecord
   module Tenanted
-    VERSION = "0.6.0"
+    VERSION = "0.8.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activerecord-tenanted
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 8.1.beta
+        version: 8.1.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 8.1.beta
+        version: 8.1.2.1
 - !ruby/object:Gem::Dependency
   name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 8.1.beta
+        version: 8.1.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 8.1.beta
+        version: 8.1.2.1
 - !ruby/object:Gem::Dependency
   name: zeitwerk
   requirement: !ruby/object:Gem::Requirement
@@ -69,6 +69,7 @@ files:
 - README.md
 - Rakefile
 - lib/active_record/tenanted.rb
+- lib/active_record/tenanted/associations.rb
 - lib/active_record/tenanted/base.rb
 - lib/active_record/tenanted/cable_connection.rb
 - lib/active_record/tenanted/connection_adapter.rb
@@ -83,6 +84,7 @@ files:
 - lib/active_record/tenanted/job.rb
 - lib/active_record/tenanted/lru.rb
 - lib/active_record/tenanted/mailer.rb
+- lib/active_record/tenanted/message_pack.rb
 - lib/active_record/tenanted/mutex.rb
 - lib/active_record/tenanted/patches.rb
 - lib/active_record/tenanted/railtie.rb