console1984 0.2.3 → 0.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bcb1c5436456f551d695a6b3ffdf284959846303adf6afaaee8fe0ff66ecb6e
-  data.tar.gz: 317f00e5e0c25b8f2e18876782872cc7288df2038c25139538c98c1e77dbeb85
+  metadata.gz: 315c8962dd29be4689059dfd02352fc55a0a30ad0d00de1267f033886156084f
+  data.tar.gz: 7f3ee9d6b9a3bebb3616d8ea1dadb7d2de40bea1141c2763a4f46fcffb89c532
 SHA512:
-  metadata.gz: 0a9fc5c6bb7c6c36580dfae29f4cfaadbc18930d11061a77609bbec85c9a3b44131e873bc347e04f7db2b8ce7dc2d239c9d18a74cedcde14dcb28858697e7c86
-  data.tar.gz: fb53e1d21f930e80b4d05a77a2e3b2eeed5eb7af22fd242874452cce10b141e65e4f4b7eda3a22a2d52335d7aeed923d22c6732905587f0890d1cfcb630cd78d
+  metadata.gz: d127676bd46058d5128a139509055f77561e1f4abbf56f8b52730cc5d2c9190e5dfe5ed1c6f6e91cafc1f8ef7b4b60b200e98f5969dbd2f2b374685d026274c7
+  data.tar.gz: 72213cf757e348f7e5b29ce5d515d38e5b0d4e0e5694491d02dcf120cab4596f434f0baef9c4850f7b010221b781cd47ad12c4813b26a370c1408059e45fefd8

data/README.md

@@ -60,6 +60,14 @@ Unnamed, why are you using this console today?
 > ...
 ```
 
+`rails query` doesn't prompt, so each query is recorded as its own session with the reason `rails query`, or `rails query (via <agent>)` when a known agent's environment variable is set, such as `rails query (via Claude Code)`. To record why a query was run, set `CONSOLE_REASON`, e.g. to the card, issue or support conversation that authorized it:
+
+```
+$ CONSOLE_REASON=https://app.basecamp.com/1/buckets/2/card_tables/cards/3 rails query 'Account.count'
+```
+
+The session is recorded with the reason `rails query: https://app.basecamp.com/…`. The value is flattened to one line of plain text and capped at 255 characters.
+
 ### Auditing sessions
 
 Check out [`audits1984`](https://github.com/basecamp/audits1984), a companion auditing tool prepared to work with `console1984` database session trails.

data/lib/console1984/command_validator/.command_parser.rb

@@ -1,7 +1,7 @@
 # Naming class with dot so that it doesn't get loaded eagerly by Zeitwerk. We want to load
-# only when a console session is started, when +parser+ is loaded.
-#
-# See +Console1984::Supervisor#require_dependencies+
+# only when a console session is started.
+Console1984.require_ruby_parser_dependencies
+
 class Console1984::CommandValidator::CommandParser < ::Parser::AST::Processor
   include AST::Processor::Mixin
   include Console1984::Freezeable
@@ -56,7 +56,7 @@ class Console1984::CommandValidator::CommandParser < ::Parser::AST::Processor
 
   def on_casgn(node)
     super
-    scope_node, name, value_node = *node
+    _, _, value_node = *node
     @constant_assignments.push(*extract_constants(value_node))
   end
 

data/lib/console1984/command_validator/parsed_command.rb

@@ -1,6 +1,4 @@
 # Parses a command string and exposes different constructs to be used by validations.
-#
-# Internally, it uses the {parser}[https://github.com/whitequark/parser] gem to perform the parsing.
 class Console1984::CommandValidator::ParsedCommand
   include Console1984::Freezeable
 
@@ -15,7 +13,7 @@ class Console1984::CommandValidator::ParsedCommand
   private
     def command_parser
       @command_parser ||= Console1984::CommandValidator::CommandParser.new.tap do |processor|
-        ast = Parser::CurrentRuby.parse(raw_command)
+        ast = Console1984.ruby_parser.parse(raw_command)
         processor.process(ast)
       rescue Parser::SyntaxError
         # Fail open with syntax errors

data/lib/console1984/engine.rb

@@ -24,5 +24,9 @@ module Console1984
         Console1984.supervisor.start
       end
     end
+
+    initializer "console1984.query_auditor" do
+      Console1984::QueryAuditor.install
+    end
   end
 end

data/lib/console1984/ext/active_record/protected_auditable_tables.rb

@@ -5,7 +5,7 @@ module Console1984::Ext::ActiveRecord::ProtectedAuditableTables
   %i[ execute exec_query exec_insert exec_delete exec_update exec_insert_all ].each do |method|
     define_method method do |*args, **kwargs|
       sql = args.first
-      if Console1984.command_executor.executing_user_command? && sql.b =~ auditable_tables_regexp
+      if Console1984.command_executor.executing_user_command? && auditable_sql(sql) =~ auditable_tables_regexp
         raise Console1984::Errors::ForbiddenCommandAttempted, "#{sql}"
       else
         super(*args, **kwargs)
@@ -14,6 +14,14 @@ module Console1984::Ext::ActiveRecord::ProtectedAuditableTables
   end
 
   private
+    # exec_insert_all receives an ActiveRecord::InsertAll, not a SQL string, so
+    # #b is undefined on it. Check its target table name instead, so insert_all
+    # and upsert_all don't blow up when run from the console.
+    def auditable_sql(sql)
+      string = sql.is_a?(String) ? sql : (sql.try(:model)&.table_name || sql.to_s)
+      string.b
+    end
+
     def auditable_tables_regexp
       @auditable_tables_regexp ||= Regexp.new("#{auditable_tables.join("|")}")
     end

data/lib/console1984/query_auditor.rb

@@ -0,0 +1,57 @@
+class Console1984::QueryAuditor
+  REASON_ENV_KEY = "CONSOLE_REASON"
+  REASON_LENGTH_LIMIT = 255
+
+  mattr_accessor :known_agents, default: {
+    "CLAUDECODE"      => "Claude Code",
+    "CODEX_THREAD_ID" => "Codex"
+  }
+
+  def self.install
+    ActiveSupport::Notifications.subscribe("query.rails", new)
+  end
+
+  def start(name, id, payload)
+    return unless Console1984.running_protected_environment?
+
+    Console1984.session_logger.start_session(resolved_username, session_reason)
+    Console1984.session_logger.before_executing([ payload[:expression].to_s ])
+  end
+
+  def finish(name, id, payload)
+    return unless Console1984.running_protected_environment?
+
+    Console1984.session_logger.finish_session
+  end
+
+  private
+    def resolved_username
+      Console1984.username_resolver.current.presence || "unknown"
+    end
+
+    def session_reason
+      [ default_reason, given_reason ].compact.join(": ")
+    end
+
+    def default_reason
+      if agent = detected_agent
+        "rails query (via #{agent})"
+      else
+        "rails query"
+      end
+    end
+
+    def detected_agent
+      known_agents.find { |var, _| ENV[var].present? }&.last
+    end
+
+    # The authorization link (card, issue, support conversation) for this query, from CONSOLE_REASON.
+    # It is shown in the audit UI, so keep it to one line of plain text: no control or format
+    # characters (newlines, bidi overrides), no markup brackets, and a bounded length.
+    def given_reason
+      ENV.fetch(REASON_ENV_KEY, "").dup.force_encoding(Encoding::UTF_8).scrub("")
+        .gsub(/[\p{Cc}\p{Cf}<>]/, " ").squish
+        .truncate(REASON_LENGTH_LIMIT, omission: "…")
+        .presence
+    end
+end

data/lib/console1984/refrigerator.rb

@@ -27,6 +27,6 @@ class Console1984::Refrigerator
 
     def external_modules_and_classes_to_freeze
       # Not using a constant because we want this to run lazily (console-dependant dependencies might not be loaded).
-      [Parser::CurrentRuby]
+      [Console1984.ruby_parser]
     end
 end

data/lib/console1984/supervisor.rb

@@ -41,13 +41,7 @@ class Console1984::Supervisor
 
   private
     def require_dependencies
-      Kernel.silence_warnings do
-        require 'parser/current'
-      end
       require 'rainbow'
-
-      # Explicit lazy loading because it depends on +parser+, which we want to only load
-      # in console sessions.
       require_relative "./command_validator/.command_parser"
 
       # This solves a weird class loading error where ActiveRecord dosn't resolve +Relation+ properly.

data/lib/console1984/version.rb

@@ -1,3 +1,3 @@
 module Console1984
-  VERSION = "0.2.3"
+  VERSION = "0.2.5"
 end

data/lib/console1984.rb

@@ -55,6 +55,28 @@ module Console1984
     def running_protected_environment?
       protected_environments.collect(&:to_sym).include?(Rails.env.to_sym)
     end
+
+    def require_ruby_parser_dependencies
+      if RUBY_VERSION >= "3.3"
+        require 'parser'
+        require 'prism'
+      else
+        Kernel.silence_warnings do
+          require 'parser/current'
+        end
+      end
+    end
+
+    # Returns the parser class used for parsing console commands.
+    # Uses Prism on Ruby >= 3.3 for forward-compatibility with Ruby 4.0+.
+    # Falls back to the parser gem on older Rubies.
+    def ruby_parser
+      if RUBY_VERSION >= "3.3"
+        Prism::Translation::ParserCurrent
+      else
+        Parser::CurrentRuby
+      end
+    end
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: console1984
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.5
 platform: ruby
 authors:
 - Jorge Manrubia
@@ -275,6 +275,7 @@ files:
 - lib/console1984/input_output.rb
 - lib/console1984/messages.rb
 - lib/console1984/protections_config.rb
+- lib/console1984/query_auditor.rb
 - lib/console1984/refrigerator.rb
 - lib/console1984/sessions_logger/database.rb
 - lib/console1984/shield.rb