console1984 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44d77add0193cc1bb27955cb70d0d3e58153a17524e6d3b93a15179700322c58
-  data.tar.gz: b36e25eb75d6b1d113ae3653118115da747122e10af23d38ea00ebd72f3427cc
+  metadata.gz: 0a76f26ca8567b7261e2062a9360216ebca2c230ffb48e4ecb5e5a9970339e99
+  data.tar.gz: 6a892b894d3274e9567a4fd763d9121690b889b89e7a2e7a2b9f919825e51144
 SHA512:
-  metadata.gz: 07d029ed6dcd845cbc30c035ccdb2a9879983f1660c028530dfc8873673d212f9230ffc9ad8870b1806a981317dad06d48c95b53cdebe728a37bc585bd182e29
-  data.tar.gz: c9dfd6cd41b27c000b0f37a22ee9b1d4fbbdd32081b22735636d90c62175c2cb8f55b3ef94f90c9ac706a72838b67e8a8130e813943fe908f3860bf631365c8f
+  metadata.gz: 125c2457aca08f4f1476db595f465a85c1b2d9dfa22634502b398456aeb0816436563372a42a1c2182a731a87b7c8552bb4429b775bd2b6f320fbc86bd74d5b3
+  data.tar.gz: bd3ed3832febd22d4f6038ee8e3bf2db7471f9bbc62a77bb8934ee0904681050b072b67c12d8bccac3b2eebc8e52c8f06f06c32cf0407be6fb9f0008248f0834

data/README.md

@@ -14,6 +14,8 @@ If you are looking for the auditing tool, check [`audits1984`](https://github.co
 
 ## Installation
 
+**Important:** `console1984` depends on [Active Record encryption](https://edgeguides.rubyonrails.org/active_record_encryption.html) which is a Rails 7 feature. Since no gem for Rails 7 has been released yet, you need to run Rails edge in your project (point the gem to latest `main` in the [repo](https://github.com/rails/rails)).
+
 Add it to your `Gemfile`:
 
 ```ruby
@@ -112,7 +114,7 @@ irb(main)> Rails.cache.read("some key") # raises Console1984::Errors::ProtectedC
 
 ### Access to external systems
 
-While Active Record encryption can protect personal information in the database, are other systems can contain very sensitive information. For example: Elasticsearch indexing user information or Redis caching template fragments.
+While Active Record encryption can protect personal information in the database, there are other systems can contain very sensitive information. For example: Elasticsearch indexing user information or Redis caching template fragments.
 
 To protect the access to such systems, you can add their URLs to `config.console1984.protected_urls` in the corresponding environment config file (e.g: `production.rb`):
 
@@ -141,7 +143,7 @@ These config options are namespaced in `config.console1984`:
 | `protected_environments`                    | The list of environments where `console1984` will act on. Defaults to `%i[ production ]`. |
 | `protected_urls`                            | The list of URLs corresponding with external systems to protect. |
 | `session_logger`                            | The system used to record session data. The default logger is `Console1984::SessionsLogger::Database`. |
-| `username_resolver`                         | Configure an object responsible of resolving the current database username. The default is `Console1984::Username::EnvResolver.new("CONSOLE_USER")`, which returns the value of the environment variable `CONSOLE_USER`. |
+| `username_resolver`                         | Configure how the current user is determined for a given console session. The default is `Console1984::Username::EnvResolver.new("CONSOLE_USER")`, which returns the value of the environment variable `CONSOLE_USER`. |
 | `production_data_warning`                   | The text to show when a console session starts.              |
 | `enter_unprotected_encryption_mode_warning` | The text to show when user enters into unprotected mode.     |
 | `enter_protected_mode_warning`              | The text to show when user go backs to protected mode.       |
@@ -153,3 +155,4 @@ These config options are namespaced in `config.console1984`:
 
 `console1984` uses Ruby to add several protection mechanisms. However, because Ruby is highly dynamic, it's technically possible to circumvent most of these controls if you know what you are doing. We have made an effort to prevent such attempts, but if your organization needs bullet-proof protection against malicious actors using the console, you should consider additional security measures.
 
+The current version includes protection mechanisms to avoid tampering the tables that store console sessions. A definitive mechanism to do this would be using a read only connection when user commands are evaluated. Implementing such scheme is possible by writing a custom session logger and leveraging Rails' multi-database support. We would like that future versions of `console1984` supported this scheme directly as a configuration option.

data/lib/console1984/protected_auditable_tables.rb

@@ -3,12 +3,12 @@ module Console1984::ProtectedAuditableTables
   include Console1984::Freezeable
 
   %i[ execute exec_query exec_insert exec_delete exec_update exec_insert_all ].each do |method|
-    define_method method do |*args|
+    define_method method do |*args, **kwargs|
       sql = args.first
       if Console1984.supervisor.executing_user_command? && sql =~ auditable_tables_regexp
         raise Console1984::Errors::ForbiddenCommand, "#{sql}"
       else
-        super(*args)
+        super(*args, **kwargs)
       end
     end
   end

data/lib/console1984/version.rb

@@ -1,3 +1,3 @@
 module Console1984
-  VERSION = '0.1.5'
+  VERSION = '0.1.6'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: console1984
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Jorge Manrubia
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-08-28 00:00:00.000000000 Z
+date: 2021-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize