current_scope 0.5.0 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +20 -14
  3. data/lib/current_scope/version.rb +1 -1
  4. metadata +4 -4
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: e36971fa803dbe79c3e3171704f24cb69ccdca7ff8c3cf7ad04ea5c13409fc01
4
- data.tar.gz: 208ffd02340988fa901b03f1f3ccc6a22684b5bd37da1f58c4dbabceb0016ae6
3
+ metadata.gz: 29e366bbf804a47aa6df3b75e2ac41b199e4bb065051077d20fcff021e91ff00
4
+ data.tar.gz: fec4ad15ab164a35b5d49e359f45f2890d921aabddc0dc5c2c70a334f91c8405
5
5
  SHA512:
6
- metadata.gz: 68203296603381de42f71070d6650663e56eb9e0ec9d10511544a43583e4fc10b7511677a26a888ead593295b8558f993b92ee8cde9443e4b215581b7bab02d5
7
- data.tar.gz: dc93b8f64007cfc730b32453f968039d44eba0e04c9998957b1ee05c6bbf01de942f4a145eec02cb120b627f8b5d16896c8d676d626447934b23183d01899637
6
+ metadata.gz: 9d29339cfcf75cb4224b807f94207b5579d879214064171c2338902e4ed9733dde3dd847537cab0abcb557985bdd849532df4ca73d37e087654cd0e33fb1dcb1
7
+ data.tar.gz: 2dc30a104b5d7d004ae2cf7a7c0ee2e29d980097f6c90954705cf877809cba91bbebd5b6d7e603a50417fe81debfc8d9e06f9e429847a0ad61fe014d53aeaf69
data/README.md CHANGED
@@ -4,24 +4,30 @@
4
4
  [![CI](https://github.com/davidteren/current_scope/actions/workflows/ci.yml/badge.svg)](https://github.com/davidteren/current_scope/actions/workflows/ci.yml)
5
5
  [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](MIT-LICENSE)
6
6
  [![Website](https://img.shields.io/badge/website-davidteren.github.io%2Fcurrent__scope-4d7cfe)](https://davidteren.github.io/current_scope/)
7
- [![Status: not production-ready](https://img.shields.io/badge/status-not%20production--ready-e8590c)](https://github.com/davidteren/current_scope/issues)
7
+ [![Status: beta](https://img.shields.io/badge/status-beta-4d7cfe)](https://github.com/davidteren/current_scope/issues/116)
8
8
 
9
- > ## ⚠️ Not production-ready
9
+ > ## 🧪 Beta — usable, and we want your feedback
10
10
  >
11
- > There are some known issues which are currently being worked on. **This is not
12
- > production-ready**, but it is ready for experimentation and spiking, or
13
- > whatever people want to do with it — just not yet for production.
11
+ > The core is built and security-hardened: permissions derived from your routes,
12
+ > roles as editable data, per-record scoped grants, a separation-of-duties veto,
13
+ > impersonation, an append-only audit ledger, and a report-only rollout mode. The
14
+ > one published security defect in grant-id storage
15
+ > ([#151](https://github.com/davidteren/current_scope/issues/151)) is fixed and
16
+ > released in 0.5.0; the affected older versions are yanked.
14
17
  >
15
- > This is an **authorization** library, so the bar is different: a bug here is a
16
- > user seeing or doing something they shouldn't. The open work is tracked in the
17
- > [issue tracker](https://github.com/davidteren/current_scope/issues), and
18
- > several items are security-relevant — permission keys that can be dropped
19
- > silently, advisory checks that don't consult the catalog, and gaps in the
20
- > separation-of-duties veto. Each is being worked through with a written plan and
21
- > an adversarial review pass.
18
+ > It is **not yet certified for production**, for one honest reason: the last gate
19
+ > to general availability is a real-world bake — one real app running
20
+ > `config.enforcement = :report`, reading `bin/rails current_scope:report`, then
21
+ > flipping to `:enforce`. Until a real host has run it enforced, "production-ready"
22
+ > is a claim with nothing behind it. That gate is tracked in
23
+ > [#116](https://github.com/davidteren/current_scope/issues/116); **1.0 is when it
24
+ > closes.**
22
25
  >
23
- > Kick the tyres, build a spike, tell us what breaks. Don't put it in front of
24
- > real users yet.
26
+ > So please adopt it, run it in `:report` mode, and tell us what breaks — that
27
+ > feedback is exactly what gets it to 1.0. It is an **authorization** library, so
28
+ > mind the bar: a bug here is a user seeing or doing something they shouldn't.
29
+ > Anything you find goes on the
30
+ > [issue tracker](https://github.com/davidteren/current_scope/issues).
25
31
 
26
32
  **Website:** [davidteren.github.io/current_scope](https://davidteren.github.io/current_scope/) —
27
33
  overview, quickstart, the
data/lib/current_scope/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module CurrentScope
2
- VERSION = "0.5.0"
2
+ VERSION = "0.5.1"
3
3
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: current_scope
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.5.0
4
+ version: 0.5.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Teren
@@ -32,9 +32,9 @@ dependencies:
32
32
  description: 'A mountable Rails engine for authorization: permissions auto-derived
33
33
  from controller actions, roles as editable data, per-record scoped roles, a separation-of-duties
34
34
  veto, and an ambient authorization context that makes allowed_to? work identically
35
- in controllers, views, and components. NOT PRODUCTION-READY: pre-1.0 with known
36
- issues under active work — good for experimentation and spikes, not yet for real
37
- users. See the README and the issue tracker.'
35
+ in controllers, views, and components. BETA (pre-1.0): the core is built and security-hardened;
36
+ general availability is gated on one real-world enforce bake. Adopt it, run report
37
+ mode, and send feedback. See the README and the issue tracker (#116).'
38
38
  email:
39
39
  - dteren@gmail.com
40
40
  executables: []