console1984 0.1.0 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 985b93be5f065f2f12ec2e121a84d1951aa8d2d0f4e8bf628dccd4680a3581d1
-  data.tar.gz: e5e40eadddc7f44e25e1384c948897058b8fd2ddacafb6f4b2ef3f63e7cc20e8
+  metadata.gz: 39d8147e2b8b8fa0a20c6aec1422a28633afe80567bac0ac0c98a7d6096ae430
+  data.tar.gz: 760d761d4ced82752b89aa7bd1de44416d545a75bdb0f4266165718100d8a7a5
 SHA512:
-  metadata.gz: b6d2d32d9210d20a082e7844d873e514ba61ec9e18546d4d8e353ed8a1360685c0bcde0406140c635a79b2fb34519148c988e7e5ff1a3579afb97120f5930330
-  data.tar.gz: 7b32ac9d5cd80e4f7840d12c803122ddc521f5256028e03f6f0cd401081c12dee755934393cb005d26ebe5a30a24dfc79b934acb2ee1a6d44dfa9c978137f833
+  metadata.gz: 3eedbf3cc3436469edd615b397af1c5ad03195f7f1eebfcc1ed6da859a90e0fc213327f8d487841640ddec8c4d39ed1562239e9dda10360a622f59aa809b6f9a
+  data.tar.gz: bdd11a8580f29fd700c954c486e01dc1f8189e452565f37b281d9ee96b78bd375c2f02728df3c4ce405c047fc9fe52b5eac8b5b90a62519bfeaff4aa1465a5d9

data/README.md

@@ -1,95 +1,151 @@
+![example workflow](https://github.com/basecamp/console1984/actions/workflows/build.yml/badge.svg)
+
 # Console1984
 
-A Rails Console that audits commands and protects users privacy.
+A Rails console extension that protects sensitive accesses and makes them auditable.
 
 > “If you want to keep a secret, you must also hide it from yourself.”
-> 
+>
 > ― George Orwell, 1984
 
-## Usage
+If you are looking for the auditing tool, check [`audits1984`](https://github.com/basecamp/audits1984).
+
+![console-session-reason](docs/images/console-session-reason.png)
 
-Add this line to your application's Gemfile:
+## Installation
+
+Add it to your `Gemfile`:
 
 ```ruby
 gem 'console1984'
 ```
 
-By default, `console1984` will only work in `production`. [You can configure other environments](#protected-environments). 
-
-## Features
-
-### Auditing
-
-The console will ask for a reason for the console session, identifying the user via the environment
-variable `CONSOLE_USER`.
-
-After that, every command the user types will be captured and logged. `console1984` uses
-[`rails-structured-logggin`](https://github.com/basecamp/rails-structured-logging) to form
-a JSON entry that looks like this:
-
-```json
-{
-  "@timestamp": "2020-05-15T15:05:45.845642+02:00",
-  "ecs": {
-    "version": "1.2.0"
-  },
-  "event": {
-    "action": "console.audit_trail",
-    "duration": {
-      "ms": 0.01
-    }
-  },
-  "console": {
-    "user": "Jorge",
-    "reason": "fix something",
-    "commands": "Account.first\n"
-  },
-  "rails": {
-    "application": "haystack",
-    "env": "beta"
-  },
-  "ruby": {
-    "allocations": {
-      "count": 0
-    }
-  },
-  "process": {
-    "pid": 8539,
-    "name": "rails_console",
-    "working_directory": "/Users/jorge/Work/basecamp/haystack"
-  },
-  "performance": {
-    "time": {
-      "cpu": {
-        "ms": 0.01
-      },
-      "idle": {
-        "ms": 0.0
-      }
-    }
-  },
-  "original": "  Account Load (1.0ms)  SELECT `accounts`.* FROM `accounts` ORDER BY `accounts`.`id` ASC LIMIT 1\n"
-}
+Create tables to store console activity in the database:
+
+```ruby
+rails console1984:install:migrations
+rails db:migrate
 ```
 
-## Configuration
+By default, console1984 is only enabled in `production`. You can configure the target environments in your `application.rb`:
+
+```ruby
+config.console1984.protected_environments = %i[ production staging ]
+```
+
+## How it works
+
+### Session activity logging
+
+When starting a console session, it will ask for a reason. Internally, it will use this reason to document the console session and record all the commands executed in it.
+
+```
+$ rails c
+
+You have access to production data here. That's a big deal. As part of our promise to keep customer data safe and private, we audit the commands you type here. Let's get started!
 
-### Protected environments
 
-<a name="protected-environments"></a>
 
-By default, `console1984` will only be enabled in `production`. You can configure the target environments with
-`config.console1984.protected_environments`:
+Commands:
+
+* decrypt!: enter unprotected mode with access to encrypted information
+
+Unnamed, why are you using this console today?
+
+> ...
+```
+
+### Auditing sessions
+
+Check out [`audits1984`](https://github.com/basecamp/audits1984), a companion auditing tool prepared to work with `console1984` database session trails.
+
+### Access to encrypted data
+
+By default, `console1984` won't decrypt data encrypted with [Active Record encryption](https://edgeguides.rubyonrails.org/active_record_encryption.html). Users will just see the ciphertexts.
+
+To decrypt data, enter the command `decrypt!`. It will ask for a justification, and these accesses will be flagged internally as sensitive.
 
 ```ruby
-config.console1984.protected_environments = %i[ staging production ]
+irb(main)> Topic.last.name
+  Topic Load (1.4ms)  SELECT `topics`.* FROM `topics` ORDER BY `topics`.`id` DESC LIMIT 1
+=> "{\"p\":\"iu6+LfnNlurC6sL++JyOIDvedjNSz/AvnZQ=\",\"h\":{\"iv\":\"BYa86+JNM/LdkC18\",\"at\":\"r4sQNoSyIlAjJdZEKHVMow==\",\"k\":{\"p\":\"7L1l/5UiYsFQqqo4jfMZtLwp90KqcrIgS7HqgteVjuM=\",\"h\":{\"iv\":\"ItwRYxZAerKIoSZ8\",\"at\":\"ZUSNVfvtm4wAYWLBKRAx/g==\",\"e\":\"QVNDSUktOEJJVA==\"}},\"i\":\"OTdiOQ==\"}}"
+irb(main):002:0> decrypt!
+```
+
 ```
+Before you can access personal information, you need to ask for and get explicit consent from the user(s). Unnamed, where can we find this consent (a URL would be great)?
 
-### Audit logger
+> ...
 
-By default, the console will output JSON entries for audit trails to STDOUT. You can configure the
-used logger with `config.console1984.audit_logger`: 
+Ok! You have access to encrypted information now. We pay extra close attention to any commands entered while you have this access. You can go back to protected mode with 'encrypt!'
+
+WARNING: Make sure you don`t save objects that were loaded while in protected mode, as this can result in saving the encrypted texts.
+```
 
 ```ruby
-config.console1984.audit_logger = ActiveSupport::Logger.new("log/console.txt")
+irb(main)> Topic.last.name
+  Topic Load (1.2ms)  SELECT `topics`.* FROM `topics` ORDER BY `topics`.`id` DESC LIMIT 1
+=> "Thanks for the inspiration"
 ```
+
+You can type `encrypt!` to go back to protected mode again.
+
+```ruby
+irb(main):004:0> encrypt!
+```
+
+```
+Great! You are back in protected mode. When we audit, we may reach out for a conversation about the commands you entered. What went well? Did you solve the problem without accessing personal data?
+```
+
+```ruby
+irb(main)> Topic.last.name
+  Topic Load (1.4ms)  SELECT `topics`.* FROM `topics` ORDER BY `topics`.`id` DESC LIMIT 1
+=> "{\"p\":\"iu6+LfnNlurC6sL++JyOIDvedjNSz/AvnZQ=\",\"h\":{\"iv\":\"BYa86+JNM/LdkC18\",\"at\":\"r4sQNoSyIlAjJdZEKHVMow==\",\"k\":{\"p\":\"7L1l/5UiYsFQqqo4jfMZtLwp90KqcrIgS7HqgteVjuM=\",\"h\":{\"iv\":\"ItwRYxZAerKIoSZ8\",\"at\":\"ZUSNVfvtm4wAYWLBKRAx/g==\",\"e\":\"QVNDSUktOEJJVA==\"}},\"i\":\"OTdiOQ==\"}}"
+```
+
+While in protected mode, you can't modify encrypted data, but can save unencrypted attributes normally. If you try to modify an encrypted column it will raise an error:
+
+```ruby
+irb(main)> Rails.cache.read("some key") # raises Console1984::Errors::ProtectedConnection
+```
+
+### Access to external systems
+
+While Active Record encryption can protect personal information in the database, are other systems can contain very sensitive information. For example: Elasticsearch indexing user information or Redis caching template fragments.
+
+To protect the access to such systems, you can add their URLs to `config.console1984.protected_urls` in the corresponding environment config file (e.g: `production.rb`):
+
+```ruby
+config.console1984.protected_urls = [ "https://my-app-us-east-1-whatever.us-east-1.es.amazonaws.com", "redis://my-app-cache-1.whatever.cache.amazonaws.com:6379" ]
+```
+
+As with encryption data, running `decrypt!` will let you access these systems normally. The system will ask for a justfication and will flag those accesses as sensitive.
+
+This will work for systems that use Ruby sockets as the underlying communication mechanism.
+
+### Automatic scheduled incineration for sessions
+
+By default, sessions will be incinerated with a job 30 days after they are created. You can configure this period by setting `config.console1984.incinerate_after = 1.year` and you can disable incineration completely by setting `config.console1984.incinerate = false`.
+
+## Configuration
+
+These config options are namespaced in `config.console1984`:
+
+| Name                                        | Description                                                  |
+| ------------------------------------------- | ------------------------------------------------------------ |
+| `protected_environments`                    | The list of environments where `console1984` will act on. Defaults to `%i[ production ]`. |
+| `protected_urls`                            | The list of URLs corresponding with external systems to protect. |
+| `session_logger`                            | The system used to record session data. The default logger is `Console1984::SessionsLogger::Database`. |
+| `username_resolver`                         | Configure an object responsible of resolving the current database username. The default is `Console1984::Username::EnvResolver.new("CONSOLE_USER")`, which returns the value of the environment variable `CONSOLE_USER`. |
+| `production_data_warning`                   | The text to show when a console session starts.              |
+| `enter_unprotected_encryption_mode_warning` | The text to show when user enters into unprotected mode.     |
+| `enter_protected_mode_warning`              | The text to show when user go backs to protected mode.       |
+| `incinerate`                                | Whether incinerate sessions automatically after a period of time or not. Default to `true`. |
+| `incinerate_after`                          | The period to keep sessions around before incinerate them. Default `30.days`. |
+| `incineration_queue`                        | The name of the queue for session incineration jobs. Default `console1984_incineration`. |
+
+## About built-in protection mechanisms
+
+`console1984` uses Ruby to add several protection mechanisms. However, because Ruby is highly dynamic, it's technically possible to circumvent most of these controls if you know what you are doing. We have made an effort to prevent such attempts, but if your organization needs bullet-proof protection against malicious actors using the console, you should consider additional security measures.
+

data/lib/console1984.rb

@@ -7,36 +7,14 @@ loader.setup
 module Console1984
   include Messages
 
-  mattr_accessor :supervisor
-  mattr_accessor :session_logger
-  mattr_accessor :username_resolver
-
-  mattr_accessor :protected_environments
-  mattr_reader :protected_urls, default: []
-
-  mattr_reader :production_data_warning, default: DEFAULT_PRODUCTION_DATA_WARNING
-  mattr_reader :enter_unprotected_encryption_mode_warning, default: DEFAULT_ENTER_UNPROTECTED_ENCRYPTION_MODE_WARNING
-  mattr_reader :enter_protected_mode_warning, default: DEFAULT_ENTER_PROTECTED_MODE_WARNING
-
-  mattr_accessor :incinerate, default: true
-  mattr_accessor :incinerate_after, default: 30.days
-  mattr_accessor :incineration_queue, default: "console1984_incineration"
-
-  mattr_accessor :debug, default: false
+  mattr_reader :supervisor, default: Supervisor.new
+  mattr_reader :config, default: Config.new
 
   thread_mattr_accessor :currently_protected_urls, default: []
 
   class << self
-    def install_support(config)
-      self.protected_environments ||= config.protected_environments
-      self.protected_urls.push(*config.protected_urls)
-      self.session_logger = config.session_logger || Console1984::SessionsLogger::Database.new
-      self.username_resolver = config.username_resolver || Console1984::Username::EnvResolver.new("CONSOLE_USER")
-
-      self.supervisor = Supervisor.new
-      self.protected_urls.freeze
-
-      extend_protected_systems
+    Config::PROPERTIES.each do |property|
+      delegate property, to: :config
     end
 
     def running_protected_environment?
@@ -50,31 +28,6 @@ module Console1984
     end
 
     private
-      def extend_protected_systems
-        extend_active_record
-        extend_socket_classes
-      end
-
-      def extend_active_record
-        %w[ActiveRecord::ConnectionAdapters::Mysql2Adapter ActiveRecord::ConnectionAdapters::PostgreSQLAdapter ActiveRecord::ConnectionAdapters::SQLite3Adapter].each do |class_string|
-          if Object.const_defined?(class_string)
-            klass = class_string.constantize
-            klass.prepend(Console1984::ProtectedAuditableTables)
-          end
-        end
-      end
-
-      def extend_socket_classes
-        socket_classes = [TCPSocket, OpenSSL::SSL::SSLSocket]
-        if defined?(Redis::Connection)
-          socket_classes.push(*[Redis::Connection::TCPSocket, Redis::Connection::SSLSocket])
-        end
-
-        socket_classes.compact.each do |socket_klass|
-          socket_klass.prepend Console1984::ProtectedTcpSocket
-        end
-      end
-
       def protecting_connections
         old_currently_protected_urls = self.currently_protected_urls
         self.currently_protected_urls = protected_urls

data/lib/console1984/commands.rb

@@ -11,4 +11,6 @@ module Console1984::Commands
     def supervisor
       Console1984.supervisor
     end
+
+    include Console1984::FrozenMethods
 end

data/lib/console1984/config.rb

@@ -0,0 +1,49 @@
+# Container for config options.
+class Console1984::Config
+  include Console1984::Messages
+
+  PROPERTIES = %i[
+    session_logger username_resolver
+    protected_environments protected_urls
+    production_data_warning enter_unprotected_encryption_mode_warning enter_protected_mode_warning
+    incinerate incinerate_after incineration_queue
+    debug freeze_config
+  ]
+
+  attr_accessor(*PROPERTIES)
+
+  def initialize
+    set_defaults
+  end
+
+  def set_from(properties)
+    properties.each do |key, value|
+      public_send("#{key}=", value) if value.present?
+    end
+  end
+
+  def freeze
+    super if freeze_config
+    protected_urls.freeze
+  end
+
+  private
+    def set_defaults
+      self.protected_environments = []
+      self.protected_urls = []
+
+      self.session_logger = Console1984::SessionsLogger::Database.new
+      self.username_resolver = Console1984::Username::EnvResolver.new("CONSOLE_USER")
+
+      self.production_data_warning = DEFAULT_PRODUCTION_DATA_WARNING
+      self.enter_unprotected_encryption_mode_warning = DEFAULT_ENTER_UNPROTECTED_ENCRYPTION_MODE_WARNING
+      self.enter_protected_mode_warning = DEFAULT_ENTER_PROTECTED_MODE_WARNING
+
+      self.incinerate = true
+      self.incinerate_after = 30.days
+      self.incineration_queue = "console1984_incineration"
+
+      self.debug = false
+      self.freeze_config = true
+    end
+end

data/lib/console1984/engine.rb

@@ -10,12 +10,13 @@ module Console1984
 
     initializer "console1984.config" do
       config.console1984.each do |key, value|
-        Console1984.send("#{key}=", value) unless %i[ protected_urls protected_environments ].include?(key.to_sym)
+        Console1984.config.send("#{key}=", value) unless %i[ protected_urls protected_environments ].include?(key.to_sym)
       end
     end
 
     console do
-      Console1984.install_support(config.console1984)
+      Console1984.config.set_from(config.console1984)
+
       Console1984.supervisor.start if Console1984.running_protected_environment?
 
       class OpenSSL::SSL::SSLSocket

data/lib/console1984/errors.rb

@@ -9,5 +9,6 @@ module Console1984
 
     class ForbiddenCommand < StandardError; end
     class ForbiddenIncineration < StandardError; end
+    class ForbiddenClassManipulation < StandardError; end
   end
 end

data/lib/console1984/frozen_methods.rb

@@ -0,0 +1,17 @@
+# Prevents adding new methods to classes.
+#
+# This prevents manipulating certain Console1984 classes
+# during a console session.
+module Console1984::FrozenMethods
+  extend ActiveSupport::Concern
+
+  module ClassMethods
+    def method_added(method_name)
+      raise Console1984::Errors::ForbiddenClassManipulation, "Can't override #{name}##{method_name}"
+    end
+
+    def singleton_method_added(method_name)
+      raise Console1984::Errors::ForbiddenClassManipulation, "Can't override #{name}.#{method_name}"
+    end
+  end
+end

data/lib/console1984/messages.rb

@@ -17,8 +17,7 @@ module Console1984::Messages
   TXT
 
   COMMANDS = {
-      "decrypt!": "enter unprotected mode with access to encrypted information",
-      "log '<reason>'": "provide further information about what you are going to do in the middle of a console session"
+      "decrypt!": "enter unprotected mode with access to encrypted information"
   }
 
   COMMANDS_HELP = <<~TXT

data/lib/console1984/protected_auditable_tables.rb

@@ -1,4 +1,5 @@
 module Console1984
+  # Prevents accessing trail model tables when executing console commands.
   module ProtectedAuditableTables
     %i[ execute exec_query exec_insert exec_delete exec_update exec_insert_all ].each do |method|
       define_method method do |*args|
@@ -23,4 +24,6 @@ module Console1984
         @auditable_tables ||= AUDITABLE_MODELS.collect(&:table_name)
       end
   end
+
+  include Console1984::FrozenMethods
 end

data/lib/console1984/protected_context.rb

@@ -1,15 +1,18 @@
 module Console1984::ProtectedContext
-  # Protect the code to show inspected objects too. This method is invoked
-  # for showing returned objects in the console
+  # This method is invoked for showing returned objects in the console
+  # Overridden to make sure their evaluation is supervised.
   def inspect_last_value
     Console1984.supervisor.execute do
       super
     end
   end
 
+  #
   def evaluate(line, line_no, exception: nil)
     Console1984.supervisor.execute_supervised(Array(line)) do
       super
     end
   end
+
+  include Console1984::FrozenMethods
 end

data/lib/console1984/protected_tcp_socket.rb

@@ -1,3 +1,4 @@
+# Wraps socket methods to execute supervised.
 module Console1984::ProtectedTcpSocket
   def write(*args)
     protecting do
@@ -53,4 +54,6 @@ module Console1984::ProtectedTcpSocket
         super(addrinfo.ip_address, addrinfo.ip_port)
       end
     end
+
+    include Console1984::FrozenMethods
 end

data/lib/console1984/sessions_logger/database.rb

@@ -1,9 +1,10 @@
+# A session logger that saves audit trails in the database.
 class Console1984::SessionsLogger::Database
   attr_reader :current_session, :current_sensitive_access
 
   def start_session(username, reason)
     silence_logging do
-      user = Console1984::User.create_or_find_by!(username: username)
+      user = Console1984::User.find_or_create_by!(username: username)
       @current_session = user.sessions.create! reason: reason
     end
   end

data/lib/console1984/supervisor.rb

@@ -1,48 +1,47 @@
 require 'colorized_string'
 require 'rails/console/app'
 
+# Protects console sessions and executes code in supervised mode.
 class Console1984::Supervisor
-  include Accesses, InputOutput, Executor
-
-  attr_reader :session_id
-  delegate :session_logger, :username_resolver, to: Console1984
-
-  def initialize
-    disable_access_to_encrypted_content(silent: true)
-  end
+  include Accesses, InputOutput, Executor, Protector
 
+  # Starts a console session extending IRB and several systems to inject
+  # the protection logic, and notifies the session logger to record the
+  # session.
   def start
-    show_production_data_warning
-    show_commands
+    Console1984.config.freeze
+    extend_protected_systems
+    disable_access_to_encrypted_content(silent: true)
 
-    extend_irb
+    show_welcome_message
 
-    session_logger.start_session current_username, ask_for_session_reason
+    start_session
   end
 
   def stop
-    session_logger.finish_session
+    stop_session
   end
 
   private
-    def current_username
-      username_resolver.current
+    def start_session
+      session_logger.start_session current_username, ask_for_session_reason
     end
 
-    def show_production_data_warning
-      show_warning Console1984.production_data_warning
+    def stop_session
+      session_logger.finish_session
     end
 
-    def extend_irb
-      IRB::Context.prepend(Console1984::ProtectedContext)
-      Rails::ConsoleMethods.include(Console1984::Commands)
+    def session_logger
+      Console1984.session_logger
     end
 
-    def ask_for_session_reason
-      ask_for_value("#{current_username}, why are you using this console today?")
+    def current_username
+      Console1984.username_resolver.current
     end
 
-    def show_commands
-      puts COMMANDS_HELP
+    def username_resolver
+      Console1984.username_resolver
     end
+
+    include Console1984::FrozenMethods
 end

data/lib/console1984/supervisor/executor.rb

@@ -4,7 +4,7 @@ module Console1984::Supervisor::Executor
   def execute_supervised(commands, &block)
     run_system_command { session_logger.before_executing commands }
     execute(&block)
-  rescue Console1984::Errors::ForbiddenCommand
+  rescue Console1984::Errors::ForbiddenCommand, Console1984::Errors::ForbiddenClassManipulation
     puts "Forbidden command attempted: #{commands.join("\n")}"
     run_system_command { session_logger.suspicious_commands_attempted commands }
     nil

data/lib/console1984/supervisor/input_output.rb

@@ -1,11 +1,31 @@
 module Console1984::Supervisor::InputOutput
-  def show_warning(message)
-    puts ColorizedString.new("\n#{message}\n").yellow
-  end
-
-  def ask_for_value(message)
-    puts ColorizedString.new("#{message}").green
-    reason = $stdin.gets.strip until reason.present?
-    reason
-  end
+  include Console1984::Messages
+
+  private
+    def show_welcome_message
+      show_production_data_warning
+      show_commands
+    end
+
+    def show_production_data_warning
+      show_warning Console1984.production_data_warning
+    end
+
+    def ask_for_session_reason
+      ask_for_value("#{current_username}, why are you using this console today?")
+    end
+
+    def show_commands
+      puts COMMANDS_HELP
+    end
+
+    def show_warning(message)
+      puts ColorizedString.new("\n#{message}\n").yellow
+    end
+
+    def ask_for_value(message)
+      puts ColorizedString.new("#{message}").green
+      reason = $stdin.gets.strip until reason.present?
+      reason
+    end
 end

data/lib/console1984/supervisor/protector.rb

@@ -0,0 +1,37 @@
+module Console1984::Supervisor::Protector
+  extend ActiveSupport::Concern
+
+  private
+    def extend_protected_systems
+      extend_irb
+      extend_active_record
+      extend_socket_classes
+    end
+
+    def extend_irb
+      IRB::Context.prepend(Console1984::ProtectedContext)
+      Rails::ConsoleMethods.include(Console1984::Commands)
+    end
+
+    ACTIVE_RECORD_CONNECTION_ADAPTERS = %w[ActiveRecord::ConnectionAdapters::Mysql2Adapter ActiveRecord::ConnectionAdapters::PostgreSQLAdapter ActiveRecord::ConnectionAdapters::SQLite3Adapter]
+
+    def extend_active_record
+      ACTIVE_RECORD_CONNECTION_ADAPTERS.each do |class_string|
+        if Object.const_defined?(class_string)
+          klass = class_string.constantize
+          klass.prepend(Console1984::ProtectedAuditableTables)
+        end
+      end
+    end
+
+    def extend_socket_classes
+      socket_classes = [TCPSocket, OpenSSL::SSL::SSLSocket]
+      if defined?(Redis::Connection)
+        socket_classes.push(*[Redis::Connection::TCPSocket, Redis::Connection::SSLSocket])
+      end
+
+      socket_classes.compact.each do |socket_klass|
+        socket_klass.prepend Console1984::ProtectedTcpSocket
+      end
+    end
+end

data/lib/console1984/username/env_resolver.rb

@@ -1,3 +1,5 @@
+# A username resolver that returns the value of a given
+# environment variable.
 class Console1984::Username::EnvResolver
   def initialize(key)
     @key = key

data/lib/console1984/version.rb

@@ -1,3 +1,3 @@
 module Console1984
-  VERSION = '0.1.0'
+  VERSION = '0.1.4'
 end

data/test/fixtures/console1984/commands.yml

@@ -0,0 +1,26 @@
+arithmetic_1:
+  session: arithmetic
+  statements: 1+1
+arithmetic_2:
+  session: arithmetic
+  statements: 2+2
+arithmetic_3:
+  session: arithmetic
+  statements: 3+3
+
+sensitive_1:
+  session: sensitive_printing
+  statements: "puts 'so sensitive 1'"
+  sensitive_access: sensitive_printing
+sensitive_2:
+  session: sensitive_printing
+  statements: "puts 'so sensitive 2'"
+  sensitive_access: sensitive_printing
+sensitive_3:
+  session: sensitive_printing
+  statements: "puts 'so sensitive 3'"
+  sensitive_access: sensitive_printing
+
+
+
+

data/test/fixtures/console1984/sensitive_accesses.yml

@@ -0,0 +1,3 @@
+sensitive_printing:
+  session: sensitive_printing
+  justification: I got consent from customer

data/test/fixtures/console1984/sessions.yml

@@ -0,0 +1,9 @@
+arithmetic:
+  user: jorge
+  reason: Arithmetic operations
+  created_at: <%= 1.day.ago %>
+
+sensitive_printing:
+  user: jorge
+  reason: Sensitive printing
+  created_at: <%= 2.days.ago %>

data/test/fixtures/console1984/users.yml

@@ -0,0 +1,2 @@
+jorge:
+  username: jorge

data/test/fixtures/people.yml

@@ -0,0 +1,6 @@
+jorge:
+  name: jorge
+  email: jorge@hey.com
+julia:
+  name: julia
+  email: julia@hey.com

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: console1984
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.4
 platform: ruby
 authors:
 - Jorge Manrubia
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-08-18 00:00:00.000000000 Z
+date: 2021-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize
@@ -94,6 +94,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rubocop-minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rubocop-rails
   requirement: !ruby/object:Gem::Requirement
@@ -143,9 +157,10 @@ files:
 - db/migrate/20210517203931_create_console1984_tables.rb
 - lib/console1984.rb
 - lib/console1984/commands.rb
+- lib/console1984/config.rb
 - lib/console1984/engine.rb
-- lib/console1984/env_variable_username.rb
 - lib/console1984/errors.rb
+- lib/console1984/frozen_methods.rb
 - lib/console1984/messages.rb
 - lib/console1984/protected_auditable_tables.rb
 - lib/console1984/protected_context.rb
@@ -157,8 +172,14 @@ files:
 - lib/console1984/supervisor/accesses/unprotected.rb
 - lib/console1984/supervisor/executor.rb
 - lib/console1984/supervisor/input_output.rb
+- lib/console1984/supervisor/protector.rb
 - lib/console1984/username/env_resolver.rb
 - lib/console1984/version.rb
+- test/fixtures/console1984/commands.yml
+- test/fixtures/console1984/sensitive_accesses.yml
+- test/fixtures/console1984/sessions.yml
+- test/fixtures/console1984/users.yml
+- test/fixtures/people.yml
 homepage: http://github.com/basecamp/console1984
 licenses:
 - MIT

data/lib/console1984/env_variable_username.rb

@@ -1,9 +0,0 @@
-class Console1984::EnvVariableUsername
-  def initialize(key)
-    @username = ENV[key]
-  end
-
-  def current_user_name
-    @username
-  end
-end