activerecord-tenanted 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96309750320bfc1e4e183b299c46a3ac8e925ae71ae58726146a3823747c48c2
-  data.tar.gz: 59324d68cac1e4c1669d1b7c797f21eff549acfed7ffb54ec053057aea1a69ae
+  metadata.gz: 92b0d3851167bdcfb0abd394b770ad1d13474c3cf9716caed9f0bf3b9a49a226
+  data.tar.gz: 5cb5eee41c5e6723042c536fe04db854519a076e2223ac60bd5df862185978c5
 SHA512:
-  metadata.gz: ac643449dfda377954739d2210b2f011e832cffed4599dca4c0aa8a5fe692a87dffca7ed2e719667dd911ddbc52523ac9dae3e4bccd419282d186366ae7cf42e
-  data.tar.gz: 36f29134a66ed8619e26e6f12b04e497ec2e2ec1e8db350dfe6c505630394dbddd2a896ce6b11e1ba1956f0d34309bfda4d2951813ac2c7c1f9db622c403f6d2
+  metadata.gz: 42beaf7932556597872dc01cff858c4f934f1f545e114f3fa0e48890d06d962847a34ec40ac81dab6fa8d3bde253a62ffa41b1645d3a5fe2f07aa2c0f6e670fd
+  data.tar.gz: 1a117271fc26dfc6950669a6a2ccf2adac1d017ae00a30d206e540fce3325ff80d5822902b9cc8f35f85359349cb7e5c66dc061397c43ef610c30f3e56b5e7e3

data/lib/active_record/tenanted/associations.rb

@@ -11,7 +11,7 @@ module ActiveRecord
     module Associations # :nodoc:
       # Every query built on behalf of an association funnels through here, including the ones
       # issued by a collection proxy that has outlived the tenant context it was created in.
-      def scope
+      def scope(...)
         ensure_owner_tenant_context_safety
         super
       end

data/lib/active_record/tenanted/database_adapters/base.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Tenanted
+    module DatabaseAdapters # :nodoc:
+      class Base
+        attr_reader :db_config
+
+        def initialize(db_config)
+          @db_config = db_config
+        end
+
+        # The Active Storage disk service interpolates the tenant name into a filesystem path, so a
+        # valid name must be a single, safe path segment whatever the database allows.
+        def valid_tenant_name?(tenant_name)
+          raise "#{self.class} must implement #{__method__}"
+        end
+
+        def validate_tenant_name(tenant_name)
+          unless valid_tenant_name?(tenant_name)
+            raise BadTenantNameError, "Invalid tenant name: #{tenant_name.inspect}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/tenanted/database_adapters/sqlite.rb

@@ -6,7 +6,7 @@ module ActiveRecord
       #
       #  TODO: This still feels to me like it's not _quite_ right. I think we could further refactor this by:
       #
-      #  1. Moving tenant_databases and validate_tenant_name to BaseConfig, and subclassing it for
+      #  1. Moving tenant_databases and valid_tenant_name? to BaseConfig, and subclassing it for
       #     each database
       #  2. Moving create_database, drop_database, database_exist?, database_ready?,
       #     acquire_ready_lock, ensure_database_directory_exists, and database_path to the SQLite
@@ -14,30 +14,41 @@ module ActiveRecord
       #  3. Moving test_workerize and path_for to be SQLite connection adapter class methods,
       #     possibly into Rails
       #
-      class SQLite
-        attr_reader :db_config
-
-        def initialize(db_config)
-          @db_config = db_config
-        end
+      class SQLite < Base
+        # A tenant name is interpolated into the database path as a single path segment, and that
+        # path may be a URI (see #path_for), so a name is limited to the RFC 3986 unreserved
+        # characters and may not begin with a dot or a tilde. A leading dot either traverses out of
+        # the tenant directory or hides the database from the glob in #tenant_databases; a leading
+        # tilde is expanded by File.expand_path when the name begins a relative path; "%" is
+        # percent-decoded by SQLite when it opens a URI filename; "?" and "#" truncate the path; and
+        # other punctuation is either reserved in a URI or makes URI.parse raise.
+        TENANT_NAME_PATTERN = /\A[A-Za-z0-9_-][A-Za-z0-9._~-]*\z/
 
         def tenant_databases
-          glob = path_for(db_config.database_for("*"))
-          scanner = Regexp.new(path_for(db_config.database_for("(.+)")))
+          glob = path_for(db_config.database_pattern_for("*"))
+          scanner = Regexp.new(path_for(db_config.database_pattern_for("(.+)")))
 
           Dir.glob(glob).filter_map do |path|
             result = path.scan(scanner).flatten.first
+
             if result.nil?
               Rails.logger.warn "ActiveRecord::Tenanted: Cannot parse tenant name from filename #{path.inspect}"
+              next
             end
+
+            unless valid_tenant_name?(result)
+              Rails.logger.warn "ActiveRecord::Tenanted: Skipping database with an invalid tenant name #{result.inspect} in #{path.inspect}"
+              next
+            end
+
             result
           end
         end
 
-        def validate_tenant_name(tenant_name)
-          if tenant_name.match?(%r{[/'"`]})
-            raise BadTenantNameError, "Tenant name contains an invalid character: #{tenant_name.inspect}"
-          end
+        def valid_tenant_name?(tenant_name)
+          tenant_name.encoding.ascii_compatible? &&
+            tenant_name.valid_encoding? &&
+            TENANT_NAME_PATTERN.match?(tenant_name)
         end
 
         def create_database

data/lib/active_record/tenanted/database_configurations/base_config.rb

@@ -27,7 +27,13 @@ module ActiveRecord
 
           config_adapter.validate_tenant_name(tenant_name)
 
-          db = sprintf(database, tenant: tenant_name)
+          database_pattern_for(tenant_name)
+        end
+
+        # Interpolates a glob or a regular expression into the database path. The pattern is not a
+        # tenant name and is not validated as one.
+        def database_pattern_for(pattern) # :nodoc:
+          db = sprintf(database, tenant: pattern)
 
           if test_worker_id
             db = config_adapter.test_workerize(db, test_worker_id)
@@ -41,10 +47,12 @@ module ActiveRecord
         end
 
         def new_tenant_config(tenant_name)
+          database = database_for(tenant_name) # validates the tenant name before it is used below
+
           config_name = "#{name}_#{tenant_name}"
           config_hash = configuration_hash.dup.tap do |hash|
             hash[:tenant] = tenant_name
-            hash[:database] = database_for(tenant_name)
+            hash[:database] = database
             hash[:tenanted_config_name] = name
           end
           Tenanted::DatabaseConfigurations::TenantConfig.new(env_name, config_name, config_hash)

data/lib/active_record/tenanted/storage.rb

@@ -10,6 +10,12 @@ module ActiveRecord
               raise NoTenantError, "Cannot access Active Storage Disk service without a tenant"
             end
 
+            # The tenant is read from the connection context, which Rails' own `connected_to` can
+            # set without going through this gem's tenant API, so the name is checked here too. A
+            # shard set that way may be a Symbol or an Integer.
+            tenant = tenant.to_s
+            klass.tenanted_root_config.config_adapter.validate_tenant_name(tenant)
+
             sprintf(@root, tenant: tenant)
           else
             super

data/lib/active_record/tenanted/tenant.rb

@@ -205,7 +205,7 @@ module ActiveRecord
           when UNTENANTED_SENTINEL
             # no-op
           else
-            tenant_name = tenant_name.to_s
+            tenant_name = validated_tenant_name(tenant_name)
           end
 
           run_callbacks :set_current_tenant do
@@ -214,11 +214,14 @@ module ActiveRecord
         end
 
         def tenant_exist?(tenant_name)
-          tenanted_root_config.new_tenant_config(tenant_name).config_adapter.database_ready?
+          root_config = tenanted_root_config
+          return false unless root_config.config_adapter.valid_tenant_name?(tenant_name.to_s)
+
+          root_config.new_tenant_config(tenant_name).config_adapter.database_ready?
         end
 
         def with_tenant(tenant_name, prohibit_shard_swapping: true, &block)
-          tenant_name = tenant_name.to_s unless tenant_name == UNTENANTED_SENTINEL
+          tenant_name = validated_tenant_name(tenant_name) unless tenant_name == UNTENANTED_SENTINEL
 
           if tenant_name == current_tenant
             run_callbacks :with_tenant, &block
@@ -262,6 +265,8 @@ module ActiveRecord
         end
 
         def destroy_tenant(tenant_name)
+          tenant_name = validated_tenant_name(tenant_name)
+
           ActiveRecord::Base.logger.info "  DESTROY [tenant=#{tenant_name}] Destroying tenant database"
 
           with_tenant(tenant_name, prohibit_shard_swapping: false) do
@@ -336,6 +341,15 @@ module ActiveRecord
         end
 
         private
+          # A tenant name reaches the filesystem through the Active Storage disk service as well as
+          # through the database path, and the disk service reads it from the tenant context rather
+          # than from a database configuration. Validate it as the context is set.
+          def validated_tenant_name(tenant_name)
+            tenant_name = tenant_name.to_s
+            tenanted_root_config.config_adapter.validate_tenant_name(tenant_name)
+            tenant_name
+          end
+
           def retrieve_connection_pool(strict:)
             role = current_role
             shard = current_tenant

data/lib/active_record/tenanted/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveRecord
   module Tenanted
-    VERSION = "0.8.0"
+    VERSION = "0.9.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activerecord-tenanted
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -75,6 +75,7 @@ files:
 - lib/active_record/tenanted/connection_adapter.rb
 - lib/active_record/tenanted/console.rb
 - lib/active_record/tenanted/database_adapter.rb
+- lib/active_record/tenanted/database_adapters/base.rb
 - lib/active_record/tenanted/database_adapters/sqlite.rb
 - lib/active_record/tenanted/database_configurations.rb
 - lib/active_record/tenanted/database_configurations/base_config.rb