aserto 0.0.2 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 265e22aba2a89ca1da3792a7648725d785686d045cc9740eae205f4c89992c76
-  data.tar.gz: e5425ba2adb3b23f341757d9cb7babeaebf9773c5bba7e40aa506143f4506a63
+  metadata.gz: e68ebb38114ba76d726e65f348946433c1ab94a18fcc20a3b41c00d07bf4b738
+  data.tar.gz: 9ed57062704dcc6a3b220dcb53140b8c474794b6af887ea2f5bbbc1611b04baf
 SHA512:
-  metadata.gz: 0cbe00e79be969233b42f548b260a763dbb06ec5d10180bdbafe5346f25c26929f3e1d16dc5a27e44e03ffea9feee1575eac05324a955b39a1876781b81856da
-  data.tar.gz: f688ba5bfc91bb5dd4d1d8a19096e4aa1e5b78a51d00d384cd288d2638b04e9eafc72d624983f06c5d2acde48ba3228ec4a8a018e57459e21876d5a5a220fd5d
+  metadata.gz: '03397de5e0773e962c6503ac01e9f8e312e2ab16d9e2642cbdc10965167e1bbb21500a17cede64fabc16757e3b890abaaaf229154b5059292a3fea5eb950747b'
+  data.tar.gz: 91f2df019a74bf1eb58e37580efc70c4479f38eb31a01762fe7fc5c70373444ea5525d8656dfa14a7d8cf789d417789597ff75a0ab54fa4bbd98dc273bb6216c

data/VERSION

@@ -1 +1 @@
-0.0.2
+0.0.5

data/lib/aserto/auth_client.rb

@@ -29,31 +29,53 @@ module Aserto
     end
 
     def is
-      is_request = Aserto::Authorizer::Authorizer::V1::IsRequest.new(
-        {
-          policy_context: policy_context,
-          identity_context: identity_context,
-          resource_context: resource_context
-        }
-      )
+      exec_is(config.decision)
+    end
+
+    def allowed?
+      exec_is("allowed")
+    end
+
+    def visible?
+      exec_is("visible")
+    end
+
+    def enabled?
+      exec_is("enabled")
+    end
 
+    private
+
+    def exec_is(decision)
       begin
         response = client.is(
-          is_request, { metadata: {
+          request_is(decision), { metadata: {
             "aserto-tenant-id": config.tenant_id,
             authorization: "basic #{config.authorizer_api_key}"
           } }
         )
       rescue GRPC::BadStatus => e
         Aserto.logger.error(e.inspect)
-        false
+        return false
       end
-      response.to_h.dig(:decisions, 0, :is) || false
+
+      decision = response.decisions.find { |el| el.decision == decision }
+      return false unless decision
+
+      decision.is
     end
 
-    private
+    def request_is(decision)
+      Aserto::Authorizer::Authorizer::V1::IsRequest.new(
+        {
+          policy_context: policy_context(decision),
+          identity_context: identity_context,
+          resource_context: resource_context
+        }
+      )
+    end
 
-    def policy_context
+    def policy_context(decision)
       path = Aserto::PolicyPathMapper.execute(config.policy_root, request)
       Aserto.logger.debug "aserto authorizing: #{path}"
 
@@ -61,7 +83,7 @@ module Aserto
         {
           id: config.policy_id,
           path: path,
-          decisions: [config.decision]
+          decisions: [decision]
         }
       )
     end

data/lib/aserto/authorization.rb

@@ -16,13 +16,14 @@ module Aserto
       allowed = if enabled?(request)
                   Aserto.logger.debug("Aserto authorization enabled")
                   client = Aserto::AuthClient.new(request)
-                  client.is
+                  res = client.is
+                  Aserto.logger.debug("Aserto authorization result -> allowed: #{res}")
+                  res
                 else
                   Aserto.logger.debug("Aserto authorization not enabled")
                   true
                 end
 
-      Aserto.logger.debug("Aserto authorization result -> allowed: #{allowed}")
       return @app.call env if allowed
 
       config.on_unauthorized.call(env)

data/lib/aserto/errors.rb

@@ -2,6 +2,7 @@
 
 module Aserto
   class Error < StandardError; end
+  class InvalidResourceMapping < Error; end
 
   class AccessDenied < Error
     attr_reader :action, :conditions

data/lib/aserto.rb

@@ -51,7 +51,17 @@ module Aserto
     def with_resource_mapper
       Aserto::ResourceMapper.class_eval do |klass|
         klass.define_singleton_method(:execute) do |request|
-          yield(request) if block_given?
+          if block_given?
+            result = yield(request)
+            unless result.is_a?(Hash)
+              raise Aserto::InvalidResourceMapping, "block must return a hash, got: #{result.class}"
+            end
+
+            require "google/protobuf/well_known_types"
+
+            result.transform_keys!(&:to_s)
+            Google::Protobuf::Struct.from_hash(result)
+          end
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aserto
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.5
 platform: ruby
 authors:
 - Aserto
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-07-21 00:00:00.000000000 Z
+date: 2022-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aserto-grpc-authz