compliance_engine 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbedee4752b0b7fd84e25194dd8fca02ce5bcf95fe9e36cadae328d82914da63
-  data.tar.gz: 53536b5e5f5d53ba4d6d7a7679bee7f1b4256e57d7877562f2a336c53588d3ba
+  metadata.gz: fce58aedae595351e68af63ff5af15c884bb0b8449c3ec4e2ebb71ebbad873d9
+  data.tar.gz: cf5c54d0cde492c74df83bfd7701779c8db1a79a289ca34825f868faacffab03
 SHA512:
-  metadata.gz: 15a7b6c0d11717ff5b0da2f89fd14207bda9f6a245a0e424a63f0693f8add5aa48e7798911b1058071f024ce45cebc5ce24266302c3dd22c4db402fb7dece58e
-  data.tar.gz: 9b4354ce4d0bc54fd2284f6c9ff082eb135d1e342e6889673341ff1f66965ad60de504d53638abb05bd4cf7b09d23649e6cf56024da4639068a5f1e3e0b64065
+  metadata.gz: 35511b511226cdd62a750d3d39e8f40cc9edece3fc72cc310356b05da62679b6ca241ee4d60f88eef731e4ce252627436288414b95f32f3125ce2918f9d9a61b
+  data.tar.gz: fef7c63498f348f9d92d2c61e35d00e59822a59cfad779244d948b10c744a026eb304a23ff40da90d26142a710a775f0370697755e790563f6ba8736cf218ec3

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+### 0.2.2 / 2026-03-02
+* Ensure that cloned/duped objects get independent collection instances
+
 ### 0.2.1 / 2026-02-12
 * Turn off debugging in compliance_engine::enforcement function
 

data/lib/compliance_engine/collection.rb

@@ -32,6 +32,27 @@ class ComplianceEngine::Collection
     nil
   end
 
+  # Ensure that cloned/duped objects get independent component instances.
+  #
+  # Ruby's default clone/dup is a shallow copy, so @collection would be
+  # shared between the source and the copy, and every Component inside it
+  # would be the same object.  Calling invalidate_cache on one copy would
+  # then propagate its facts into those shared components, silently
+  # affecting the other copy's view of the data.
+  #
+  # Duping each Component (which triggers Component#initialize_copy) gives
+  # every copy of the Collection its own independent components.  Any
+  # derived caches on the Collection itself (e.g. @by_oval_id in Ces) are
+  # cleared so each copy rebuilds them from its own component set.
+  #
+  # @return [NilClass]
+  def initialize_copy(_source)
+    super
+    @collection = @collection.transform_values(&:dup)
+    (instance_variables - (context_variables + [:@collection])).each { |var| instance_variable_set(var, nil) }
+    nil
+  end
+
   # Converts the object to a hash representation
   #
   # @return [Hash] the hash representation of the object

data/lib/compliance_engine/component.rb

@@ -26,6 +26,29 @@ class ComplianceEngine::Component
     nil
   end
 
+  # Ensure that cloned/duped objects get independent fragment stores.
+  #
+  # Ruby's default clone/dup is a shallow copy, so @component (and the
+  # fragments hash nested within it) would be shared between the source
+  # and the copy.  Calling add on either would write into the same
+  # fragments hash, making new fragments visible on both objects.
+  # Pre-computed @element and @fragments caches would also be shared,
+  # returning stale fact-filtered results on the copy even after facts
+  # are changed.
+  #
+  # Duping @component and its inner fragments hash ensures each copy has
+  # an independent fragment store.  Cache variables are cleared so each
+  # copy rebuilds them lazily from its own fragments on first access.
+  #
+  # @return [NilClass]
+  def initialize_copy(_source)
+    super
+    @component = @component.dup
+    @component[:fragments] = @component[:fragments].transform_values { |fragment| Marshal.load(Marshal.dump(fragment)) }
+    cache_variables.each { |var| instance_variable_set(var, nil) }
+    nil
+  end
+
   # Adds a value to the fragments array of the component.
   #
   # @param value [Object] The value to be added to the fragments array.
@@ -250,7 +273,7 @@ class ComplianceEngine::Component
     @element = {}
 
     fragments.each_value do |fragment|
-      @element = DeepMerge.deep_merge!(fragment, @element)
+      @element = DeepMerge.deep_merge!(Marshal.load(Marshal.dump(fragment)), @element)
     end
 
     @element

data/lib/compliance_engine/data.rb

@@ -88,6 +88,42 @@ class ComplianceEngine::Data
     (instance_variables - (data_variables + context_variables)).each { |var| instance_variable_set(var, nil) }
   end
 
+  # Ensure that cloned/duped objects get independent collection instances.
+  #
+  # Ruby's default clone/dup is a shallow copy, so the collection instance
+  # variables (@ces, @profiles, @checks, @controls) would otherwise point to
+  # the same objects as the source.  When facts= is later called on either the
+  # source or the clone, invalidate_cache propagates facts into the shared
+  # collection, causing the other object to silently adopt the wrong facts.
+  #
+  # Nilling the collection variables here forces each clone to lazily rebuild
+  # its own collections the first time they are accessed, using its own context
+  # (facts, enforcement_tolerance, etc.).  Cache variables that depend on those
+  # collections are cleared for the same reason.
+  #
+  # @return [NilClass]
+  def initialize_copy(_source)
+    super
+    # Give each clone its own outer @data hash and its own per-file inner
+    # hashes so that new files opened on one clone (via open/update) are not
+    # visible to other clones or the source, and so that a loader refresh on
+    # the source (which mutates the inner hash in-place via Data#update) does
+    # not silently affect a clone that has not yet built its lazy collections.
+    # The inner per-file content values (read-only parsed data) stay shared.
+    #
+    # :loader is additionally cleared (set to nil) so the copy does not hold
+    # a reference to the source's DataLoader object.  If it did, the copy
+    # calling update(key_string) for an already-known file would invoke
+    # loader.refresh, which notifies the source (the registered Observable
+    # observer) and overwrites source.data[key][:content] while the copy's
+    # inner hash stays stale.  With :loader nil the copy creates its own
+    # independent loader (and registers itself as observer) on next access.
+    @data = @data.transform_values { |entry| entry.merge(loader: nil) }
+    collection_variables.each { |var| instance_variable_set(var, nil) }
+    cache_variables.each { |var| instance_variable_set(var, nil) }
+    nil
+  end
+
   # Scan a Puppet environment from a zip file
   # @param path [String] The Puppet environment archive file
   # @return [NilClass]
@@ -191,8 +227,13 @@ class ComplianceEngine::Data
     else
       data[filename.key] ||= {}
 
-      # Assume filename is a loader object
-      unless data[filename.key]&.key?(:loader)
+      # Register as an observer only when no loader is currently attached.
+      # Checking the :loader value (rather than key presence) is important
+      # after clone/dup: initialize_copy sets :loader to nil so the copy does
+      # not share the source's loader, but the key still exists.  Checking
+      # key presence would see the nil as "already registered" and skip
+      # add_observer, leaving the copy deaf to future loader refreshes.
+      unless data[filename.key][:loader]
         data[filename.key][:loader] = filename
         data[filename.key][:loader].add_observer(self, :update)
       end

data/lib/compliance_engine/data_loader.rb

@@ -20,13 +20,17 @@ class ComplianceEngine::DataLoader
 
   # Set the data for the data loader
   #
-  # @param value [Hash] The new value for the data loader
+  # The hash and all nested hashes, arrays, and strings within it are
+  # deep-frozen so that parsed compliance data is treated as read-only
+  # once loaded.  Callers must not retain a mutable reference to the
+  # hash after calling this method.
   #
+  # @param value [Hash] The new value for the data loader
   # @raise [ComplianceEngine::Error] If the value is not a Hash
   def data=(value)
     raise ComplianceEngine::Error, 'Data must be a hash' unless value.is_a?(Hash)
 
-    @data = value
+    @data = deep_freeze(value)
     changed
     notify_observers(self)
   end
@@ -43,4 +47,24 @@ class ComplianceEngine::DataLoader
     require 'securerandom'
     @key = "#{data.class}:#{SecureRandom.uuid}"
   end
+
+  private
+
+  # Recursively freezes a Hash or Array and all nested objects.
+  #
+  # Parsed compliance data is read-only once loaded; deep-freezing it makes
+  # that invariant explicit and surfaces any accidental in-place mutation
+  # immediately as a FrozenError rather than silent data corruption.
+  #
+  # @param obj [Object] the object to freeze
+  # @return [Object] the frozen object (modified in-place)
+  def deep_freeze(obj)
+    case obj
+    when Hash
+      obj.each_value { |v| deep_freeze(v) }
+    when Array
+      obj.each { |v| deep_freeze(v) }
+    end
+    obj.freeze
+  end
 end

data/lib/compliance_engine/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module ComplianceEngine
-  VERSION = '0.2.1'
+  VERSION = '0.2.2'
 
   # Handle supported compliance data versions
   class Version

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: compliance_engine
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Steven Pritchard
@@ -153,7 +153,7 @@ licenses:
 metadata:
   homepage_uri: https://simp-project.com/docs/sce/
   source_code_uri: https://github.com/simp/rubygem-simp-compliance_engine
-  changelog_uri: https://github.com/simp/rubygem-simp-compliance_engine/releases/tag/0.2.1
+  changelog_uri: https://github.com/simp/rubygem-simp-compliance_engine/releases/tag/0.2.2
   bug_tracker_uri: https://github.com/simp/rubygem-simp-compliance_engine/issues
 rdoc_options: []
 require_paths: