activerecord-tenanted 0.7.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1981c6ea91e6ef43e674e0f6d3bba9eebe8b1852f0745df774cf571c03d3c54
-  data.tar.gz: 4f8d4c87cdb079ec884aa3391384cae1134f025204aacbe2c4ad22a6ae204f7b
+  metadata.gz: 92b0d3851167bdcfb0abd394b770ad1d13474c3cf9716caed9f0bf3b9a49a226
+  data.tar.gz: 5cb5eee41c5e6723042c536fe04db854519a076e2223ac60bd5df862185978c5
 SHA512:
-  metadata.gz: c3258b8a167dd07e0f8f63ce0307429cd626761b4e26bb6ef3279063c119b595660613498667eafbcf5ea3eedc2f0d5603d395f14e8ec05ab1fdf9300bf2c5dc
-  data.tar.gz: 11e72266e807ae48685454eadbed040b586d1ddc6bc284954ae36267afc2c2ef0ae3d19dbc67408bb7d3705fb352319d2a4e8268cdf520e02910725c742f41c4
+  metadata.gz: 42beaf7932556597872dc01cff858c4f934f1f545e114f3fa0e48890d06d962847a34ec40ac81dab6fa8d3bde253a62ffa41b1645d3a5fe2f07aa2c0f6e670fd
+  data.tar.gz: 1a117271fc26dfc6950669a6a2ccf2adac1d017ae00a30d206e540fce3325ff80d5822902b9cc8f35f85359349cb7e5c66dc061397c43ef610c30f3e56b5e7e3

data/lib/active_record/tenanted/associations.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Tenanted
+    # Tenant context is checked when an association reads or writes the database, and not when the
+    # Association object is created. Serializers create associations to dump and restore their
+    # targets without ever going near a connection, and must not be tripped up by the check.
+    #
+    # `klass` is resolved at both of these seams, so a polymorphic association is checked against
+    # the class it actually points at rather than being presumed tenanted.
+    module Associations # :nodoc:
+      # Every query built on behalf of an association funnels through here, including the ones
+      # issued by a collection proxy that has outlived the tenant context it was created in.
+      def scope(...)
+        ensure_owner_tenant_context_safety
+        super
+      end
+
+      private
+        # Called by the collection and singular association readers, so that the exception is
+        # raised at the call site that made the mistake and not at the eventual query.
+        def ensure_klass_exists!
+          super
+          ensure_owner_tenant_context_safety
+        end
+
+        def ensure_owner_tenant_context_safety
+          owner.ensure_tenant_context_safety if owner.class.tenanted? && klass&.tenanted?
+        end
+    end
+  end
+end

data/lib/active_record/tenanted/database_adapters/base.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Tenanted
+    module DatabaseAdapters # :nodoc:
+      class Base
+        attr_reader :db_config
+
+        def initialize(db_config)
+          @db_config = db_config
+        end
+
+        # The Active Storage disk service interpolates the tenant name into a filesystem path, so a
+        # valid name must be a single, safe path segment whatever the database allows.
+        def valid_tenant_name?(tenant_name)
+          raise "#{self.class} must implement #{__method__}"
+        end
+
+        def validate_tenant_name(tenant_name)
+          unless valid_tenant_name?(tenant_name)
+            raise BadTenantNameError, "Invalid tenant name: #{tenant_name.inspect}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/tenanted/database_adapters/sqlite.rb

@@ -6,7 +6,7 @@ module ActiveRecord
       #
       #  TODO: This still feels to me like it's not _quite_ right. I think we could further refactor this by:
       #
-      #  1. Moving tenant_databases and validate_tenant_name to BaseConfig, and subclassing it for
+      #  1. Moving tenant_databases and valid_tenant_name? to BaseConfig, and subclassing it for
       #     each database
       #  2. Moving create_database, drop_database, database_exist?, database_ready?,
       #     acquire_ready_lock, ensure_database_directory_exists, and database_path to the SQLite
@@ -14,30 +14,41 @@ module ActiveRecord
       #  3. Moving test_workerize and path_for to be SQLite connection adapter class methods,
       #     possibly into Rails
       #
-      class SQLite
-        attr_reader :db_config
-
-        def initialize(db_config)
-          @db_config = db_config
-        end
+      class SQLite < Base
+        # A tenant name is interpolated into the database path as a single path segment, and that
+        # path may be a URI (see #path_for), so a name is limited to the RFC 3986 unreserved
+        # characters and may not begin with a dot or a tilde. A leading dot either traverses out of
+        # the tenant directory or hides the database from the glob in #tenant_databases; a leading
+        # tilde is expanded by File.expand_path when the name begins a relative path; "%" is
+        # percent-decoded by SQLite when it opens a URI filename; "?" and "#" truncate the path; and
+        # other punctuation is either reserved in a URI or makes URI.parse raise.
+        TENANT_NAME_PATTERN = /\A[A-Za-z0-9_-][A-Za-z0-9._~-]*\z/
 
         def tenant_databases
-          glob = path_for(db_config.database_for("*"))
-          scanner = Regexp.new(path_for(db_config.database_for("(.+)")))
+          glob = path_for(db_config.database_pattern_for("*"))
+          scanner = Regexp.new(path_for(db_config.database_pattern_for("(.+)")))
 
           Dir.glob(glob).filter_map do |path|
             result = path.scan(scanner).flatten.first
+
             if result.nil?
               Rails.logger.warn "ActiveRecord::Tenanted: Cannot parse tenant name from filename #{path.inspect}"
+              next
             end
+
+            unless valid_tenant_name?(result)
+              Rails.logger.warn "ActiveRecord::Tenanted: Skipping database with an invalid tenant name #{result.inspect} in #{path.inspect}"
+              next
+            end
+
             result
           end
         end
 
-        def validate_tenant_name(tenant_name)
-          if tenant_name.match?(%r{[/'"`]})
-            raise BadTenantNameError, "Tenant name contains an invalid character: #{tenant_name.inspect}"
-          end
+        def valid_tenant_name?(tenant_name)
+          tenant_name.encoding.ascii_compatible? &&
+            tenant_name.valid_encoding? &&
+            TENANT_NAME_PATTERN.match?(tenant_name)
         end
 
         def create_database

data/lib/active_record/tenanted/database_configurations/base_config.rb

@@ -27,7 +27,13 @@ module ActiveRecord
 
           config_adapter.validate_tenant_name(tenant_name)
 
-          db = sprintf(database, tenant: tenant_name)
+          database_pattern_for(tenant_name)
+        end
+
+        # Interpolates a glob or a regular expression into the database path. The pattern is not a
+        # tenant name and is not validated as one.
+        def database_pattern_for(pattern) # :nodoc:
+          db = sprintf(database, tenant: pattern)
 
           if test_worker_id
             db = config_adapter.test_workerize(db, test_worker_id)
@@ -41,10 +47,12 @@ module ActiveRecord
         end
 
         def new_tenant_config(tenant_name)
+          database = database_for(tenant_name) # validates the tenant name before it is used below
+
           config_name = "#{name}_#{tenant_name}"
           config_hash = configuration_hash.dup.tap do |hash|
             hash[:tenant] = tenant_name
-            hash[:database] = database_for(tenant_name)
+            hash[:database] = database
             hash[:tenanted_config_name] = name
           end
           Tenanted::DatabaseConfigurations::TenantConfig.new(env_name, config_name, config_hash)

data/lib/active_record/tenanted/global_id.rb

@@ -9,10 +9,15 @@ module ActiveRecord
         params && params[:tenant]
       end
 
-      class Locator
+      class Locator < ::GlobalID::Locator::UnscopedLocator
         def locate(gid, options = {})
           ensure_tenant_context_safety(gid)
-          gid.model_class.find(gid.model_id)
+          super
+        end
+
+        def locate_many(gids, options = {})
+          gids.each { |gid| ensure_tenant_context_safety(gid) }
+          super
         end
 
         private

data/lib/active_record/tenanted/message_pack.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Tenanted
+    module MessagePack # :nodoc:
+      # This patch sees every record in a payload, unlike the Marshal, YAML, and JSON hooks, which
+      # are methods on the record and so only ever run for tenanted models.
+      module Decoder
+        def build_record(entry)
+          class_name, attributes_hash, * = entry
+
+          if ActiveSupport::MessagePack::Extensions.load_class(class_name).tenanted?
+            has_tenant = attributes_hash.key?("tenant")
+            tenant_name = attributes_hash.delete("tenant")
+
+            super.tap do |record|
+              record.instance_variable_set(:@tenant, tenant_name) if has_tenant
+            end
+          else
+            super
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/tenanted/railtie.rb

@@ -75,6 +75,7 @@ module ActiveRecord
         ActiveSupport.on_load(:active_record) do
           prepend ActiveRecord::Tenanted::Base
           ActiveRecord::Relation.prepend ActiveRecord::Tenanted::Relation
+          ActiveRecord::Associations::Association.prepend ActiveRecord::Tenanted::Associations
         end
       end
 
@@ -93,6 +94,13 @@ module ActiveRecord
         config.active_record.check_schema_cache_dump_version = false
       end
 
+      initializer "active_record_tenanted.message_pack" do
+        ActiveSupport.on_load(:message_pack) do
+          require "active_record/message_pack"
+          ActiveRecord::MessagePack::Decoder.prepend ActiveRecord::Tenanted::MessagePack::Decoder
+        end
+      end
+
       initializer "active_record_tenanted.monkey_patches" do
         ActiveSupport.on_load(:active_record) do
           ActiveRecord::Tenanted::Patches::Attributes.apply_patch

data/lib/active_record/tenanted/storage.rb

@@ -10,6 +10,12 @@ module ActiveRecord
               raise NoTenantError, "Cannot access Active Storage Disk service without a tenant"
             end
 
+            # The tenant is read from the connection context, which Rails' own `connected_to` can
+            # set without going through this gem's tenant API, so the name is checked here too. A
+            # shard set that way may be a Symbol or an Integer.
+            tenant = tenant.to_s
+            klass.tenanted_root_config.config_adapter.validate_tenant_name(tenant)
+
             sprintf(@root, tenant: tenant)
           else
             super

data/lib/active_record/tenanted/tenant.rb

@@ -9,13 +9,24 @@ module ActiveRecord
       prepended do
         attr_reader :tenant
 
-        before_save :ensure_tenant_context_safety
+        before_save :ensure_belongs_to_tenant_safety, prepend: true
+        before_save :ensure_tenant_context_safety, prepend: true
+        before_destroy :ensure_tenant_context_safety, prepend: true
       end
 
       def cache_key
         tenant ? "#{tenant}/#{super}" : super
       end
 
+      def ==(other)
+        super && tenant == other.tenant
+      end
+      alias eql? ==
+
+      def hash
+        [ super, tenant ].hash
+      end
+
       def inspect
         return super unless tenant
 
@@ -30,14 +41,114 @@ module ActiveRecord
         super(options.merge(tenant: tenant))
       end
 
-      def association(name)
-        super.tap do |assoc|
-          if assoc.reflection.polymorphic? || assoc.reflection.klass.tenanted?
-            ensure_tenant_context_safety
+      def reload(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      def valid?(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      def delete
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      # #update_column delegates here
+      def update_columns(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      def touch(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      # #decrement! delegates here
+      def increment!(...)
+        ensure_tenant_context_safety
+
+        super
+      end
+
+      # A belongs_to writes its foreign key onto this record, so nothing else notices when the
+      # target came from another tenant's database.
+      def ensure_belongs_to_tenant_safety
+        self.class.reflect_on_all_associations(:belongs_to).each do |reflection|
+          # Avoid creating the Association object for a belongs_to that was never touched
+          next unless association_cached?(reflection.name)
+
+          target = association(reflection.name).target
+
+          if target && target.class.tenanted? && target.tenant != tenant
+            raise WrongTenantError,
+                  "#{self.class} model belongs to tenant #{tenant.inspect}, but its " \
+                  "#{reflection.name} association belongs to tenant #{target.tenant.inspect}"
           end
         end
       end
 
+      def ensure_tenant_context_safety
+        self_tenant = self.tenant
+        current_tenant = self.class.current_tenant
+
+        if current_tenant.nil?
+          raise NoTenantError, "Cannot connect to a tenanted database while untenanted (#{self.class})"
+        elsif self_tenant != current_tenant
+          raise WrongTenantError,
+                "#{self.class} model belongs to tenant #{self_tenant.inspect}, " \
+                "but current tenant is #{current_tenant.inspect}"
+        end
+      end
+
+      # The tenant is an ordinary attribute in serialized snapshots of the record, the same way Job
+      # and GlobalId serialize the tenant. Rails's only callers of this method are the serializers
+      # (Marshal 7.1 format and MessagePack); it does not feed the persistence write path.
+      def attributes_for_database
+        super.merge!("tenant" => tenant)
+      end
+
+      def encode_with(coder)
+        super
+        coder["tenant"] = tenant
+      end
+
+      def init_with(coder, &block)
+        super
+
+        # Psych::Coder does not implement #key?, but exposes the underlying hash as #map
+        @tenant = coder.map["tenant"] if coder.map.key?("tenant")
+
+        self
+      end
+
+      def from_json(json, include_root = include_root_in_json)
+        hash = ActiveSupport::JSON.decode(json)
+        hash = hash.values.first if include_root
+
+        @tenant = hash.delete("tenant") if hash.key?("tenant")
+
+        self.attributes = hash
+        self
+      end
+
+      def marshal_load(state)
+        has_tenant = state[0].key?("tenant")
+        tenant_name = state[0].delete("tenant")
+
+        super
+
+        @tenant = tenant_name if has_tenant
+      end
+
       alias to_gid to_global_id
       alias to_sgid to_signed_global_id
 
@@ -50,17 +161,10 @@ module ActiveRecord
           super
         end
 
-        def ensure_tenant_context_safety
-          self_tenant = self.tenant
-          current_tenant = self.class.current_tenant
-
-          if current_tenant.nil?
-            raise NoTenantError, "Cannot connect to a tenanted database while untenanted (#{self.class})"
-          elsif self_tenant != current_tenant
-            raise WrongTenantError,
-                  "#{self.class} model belongs to tenant #{self_tenant.inspect}, " \
-                  "but current tenant is #{current_tenant.inspect}"
-          end
+        # Presenting the tenant as one more serializable attribute lets ActiveModel apply the
+        # `only:` and `except:` options to it, and read it back through the `tenant` reader.
+        def attribute_names_for_serialization
+          super + [ "tenant" ]
         end
     end
 
@@ -101,7 +205,7 @@ module ActiveRecord
           when UNTENANTED_SENTINEL
             # no-op
           else
-            tenant_name = tenant_name.to_s
+            tenant_name = validated_tenant_name(tenant_name)
           end
 
           run_callbacks :set_current_tenant do
@@ -110,11 +214,14 @@ module ActiveRecord
         end
 
         def tenant_exist?(tenant_name)
-          tenanted_root_config.new_tenant_config(tenant_name).config_adapter.database_ready?
+          root_config = tenanted_root_config
+          return false unless root_config.config_adapter.valid_tenant_name?(tenant_name.to_s)
+
+          root_config.new_tenant_config(tenant_name).config_adapter.database_ready?
         end
 
         def with_tenant(tenant_name, prohibit_shard_swapping: true, &block)
-          tenant_name = tenant_name.to_s unless tenant_name == UNTENANTED_SENTINEL
+          tenant_name = validated_tenant_name(tenant_name) unless tenant_name == UNTENANTED_SENTINEL
 
           if tenant_name == current_tenant
             run_callbacks :with_tenant, &block
@@ -158,6 +265,8 @@ module ActiveRecord
         end
 
         def destroy_tenant(tenant_name)
+          tenant_name = validated_tenant_name(tenant_name)
+
           ActiveRecord::Base.logger.info "  DESTROY [tenant=#{tenant_name}] Destroying tenant database"
 
           with_tenant(tenant_name, prohibit_shard_swapping: false) do
@@ -232,6 +341,15 @@ module ActiveRecord
         end
 
         private
+          # A tenant name reaches the filesystem through the Active Storage disk service as well as
+          # through the database path, and the disk service reads it from the tenant context rather
+          # than from a database configuration. Validate it as the context is set.
+          def validated_tenant_name(tenant_name)
+            tenant_name = tenant_name.to_s
+            tenanted_root_config.config_adapter.validate_tenant_name(tenant_name)
+            tenant_name
+          end
+
           def retrieve_connection_pool(strict:)
             role = current_role
             shard = current_tenant

data/lib/active_record/tenanted/untenanted_connection_pool.rb

@@ -32,6 +32,9 @@ module ActiveRecord
         db_config.max_connections
       end
 
+      def clear_query_cache
+      end
+
       def lease_connection(...)
         raise Tenanted::NoTenantError, "Cannot connect to a tenanted database while untenanted (#{@model})."
       end

data/lib/active_record/tenanted/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveRecord
   module Tenanted
-    VERSION = "0.7.0"
+    VERSION = "0.9.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activerecord-tenanted
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -69,11 +69,13 @@ files:
 - README.md
 - Rakefile
 - lib/active_record/tenanted.rb
+- lib/active_record/tenanted/associations.rb
 - lib/active_record/tenanted/base.rb
 - lib/active_record/tenanted/cable_connection.rb
 - lib/active_record/tenanted/connection_adapter.rb
 - lib/active_record/tenanted/console.rb
 - lib/active_record/tenanted/database_adapter.rb
+- lib/active_record/tenanted/database_adapters/base.rb
 - lib/active_record/tenanted/database_adapters/sqlite.rb
 - lib/active_record/tenanted/database_configurations.rb
 - lib/active_record/tenanted/database_configurations/base_config.rb
@@ -83,6 +85,7 @@ files:
 - lib/active_record/tenanted/job.rb
 - lib/active_record/tenanted/lru.rb
 - lib/active_record/tenanted/mailer.rb
+- lib/active_record/tenanted/message_pack.rb
 - lib/active_record/tenanted/mutex.rb
 - lib/active_record/tenanted/patches.rb
 - lib/active_record/tenanted/railtie.rb