decidim-dev 0.32.1 → 0.32.2

data/lib/decidim/dev/rubocop/cop/decidim/enforce_permission_to.rb

@@ -0,0 +1,459 @@
+# frozen_string_literal: true
+
+require "rubocop"
+
+module RuboCop
+  module Cop
+    module Decidim
+      # Flags controller actions that lack authorization checks.
+      #
+      # In Decidim admin controllers, every action must explicitly call
+      # `enforce_permission_to` or `action_authorized_to` to verify the
+      # current user has permission to perform that action. Missing
+      # authorization checks can allow unauthorized access to resources.
+      #
+      # This cop checks all public method definitions in admin controllers
+      # and flags any that do not contain an authorization call.
+      #
+      # Actions are exempt when the controller uses a `before_action` that
+      # performs authorization (either by referencing a method that calls
+      # `enforce_permission_to`, or by using a name containing
+      # "permission", "authorize", or "enforce"). When such `before_action`
+      # is restricted with `only:` or `except:`, only the actions it covers
+      # are exempt.
+      #
+      # Methods referenced by framework lifecycle callbacks (`before_action`
+      # and its variants, `around_action`, `after_action`, `helper_method`,
+      # `rescue_from`, ...) are treated as lifecycle/helper methods and are
+      # never flagged, as they themselves are not controller actions.
+      #
+      # Calls to methods starting with `enforce_permission_to_` or
+      # `action_authorized_to_` (authorization helper wrappers) are also
+      # accepted as authorization checks.
+      #
+      # @example
+      #   # bad
+      #   class Admin::ResourcesController < Admin::ApplicationController
+      #     def edit
+      #       @resource = Resource.find(params[:id])
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Admin::ResourcesController < Admin::ApplicationController
+      #     def edit
+      #       enforce_permission_to :update, :resource, resource:
+      #       @resource = Resource.find(params[:id])
+      #     end
+      #   end
+      #
+      #   # good - authorization via before_action
+      #   class Admin::ResourcesController < Admin::ApplicationController
+      #     before_action :ensure_permissions
+      #
+      #     def edit
+      #       @resource = Resource.find(params[:id])
+      #     end
+      #
+      #     private
+      #
+      #     def ensure_permissions
+      #       enforce_permission_to :update, :resource
+      #     end
+      #   end
+      class EnforcePermissionTo < RuboCop::Cop::Base
+        MSG = "Action `%{action}` is missing an authorization check. " \
+              "Add `enforce_permission_to` or `action_authorized_to` at the start of the action, " \
+              "or use `# rubocop:disable Decidim/EnforcePermissionTo` if authorization is handled elsewhere."
+
+        AUTHORIZATION_METHODS = [:enforce_permission_to, :action_authorized_to].freeze
+
+        # Prefixes accepted for authorization helper wrappers, such as
+        # `enforce_permission_to_update_resource`.
+        AUTHORIZATION_PREFIXES = %w(enforce_permission_to_ action_authorized_to_).freeze
+
+        BEFORE_ACTION_AUTH_KEYWORDS = %w(permission authorize enforce).freeze
+
+        # Visibility switch methods recognized when declared with no arguments.
+        VISIBILITY_METHODS = [:public, :protected, :private].freeze
+
+        # Framework declarations whose referenced methods are lifecycle or
+        # helper methods rather than controller actions.
+        CALLBACK_METHODS = [
+          :before_action, :prepend_before_action, :append_before_action, :skip_before_action,
+          :around_action, :prepend_around_action, :append_around_action, :skip_around_action,
+          :after_action, :prepend_after_action, :append_after_action, :skip_after_action,
+          :helper_method, :rescue_from
+        ].freeze
+
+        def on_new_investigation
+          @scope_callback_methods = {}
+          reset_scope_state
+        end
+
+        def on_class(node)
+          reset_scope_state
+          collect_callback_methods(node)
+          check_before_actions(node)
+          check_before_action_blocks(node)
+        end
+
+        def on_module(node)
+          reset_scope_state
+          collect_callback_methods(node)
+          check_before_actions(node)
+          check_before_action_blocks(node)
+        end
+
+        def on_def(node)
+          method_name = node.method_name
+
+          inline_visibility = @inline_visibility
+          @inline_visibility = nil
+
+          return if class_methods_block?(node)
+          return unless method_public?(node, method_name, inline_visibility)
+          return if action_exempted_by_before_action?(method_name)
+          return if callback_method?(node, method_name)
+          return if contains_authorization_check?(node)
+
+          action_name = method_name.to_s
+          add_offense(node, message: format(MSG, action: action_name))
+        end
+
+        def on_send(node)
+          return unless VISIBILITY_METHODS.include?(node.method_name)
+
+          if node.arguments.empty?
+            @in_private_section = node.method_name != :public
+          elsif visibility_def_argument?(node)
+            # `private def foo` only makes that single method private, it does
+            # not change the default visibility for the following methods.
+            @inline_visibility = node.method_name
+          end
+        end
+
+        private
+
+        # Resets the state that is scoped to a single class or module body.
+        # Callback methods are intentionally not part of this state: they are
+        # collected per scope in `collect_callback_methods`, so sibling scopes
+        # do not see each other's callbacks. A definition only inherits the
+        # callbacks of its own scope and of enclosing modules (never across a
+        # class boundary, as nested classes are not subclasses).
+        def reset_scope_state
+          @in_private_section = false
+          @inline_visibility = nil
+          @all_actions_auth = false
+          @only_actions = Set.new
+          @except_sets = []
+        end
+
+        # Definitions inside an `ActiveSupport::Concern` `class_methods do`
+        # block are class-level DSL methods, not controller actions, so they
+        # must never be flagged as missing an authorization check.
+        def class_methods_block?(node)
+          node.each_ancestor(:block).any? do |block|
+            block.send_node.method_name == :class_methods
+          end
+        end
+
+        def visibility_def_argument?(node)
+          node.arguments.any?(&:def_type?)
+        end
+
+        def method_public?(node, method_name, inline_visibility)
+          named_visibility = named_visibility_for(node, method_name)
+          return named_visibility == :public if named_visibility
+
+          visibility = inline_visibility || (@in_private_section ? :private : :public)
+          visibility == :public
+        end
+
+        # Resolves named visibility modifiers such as `public :publish` or
+        # `private :resource` that appear after the method definition. In Ruby
+        # these modifiers only apply to methods already defined, so a modifier
+        # placed before a later `def` does not change that definition's
+        # visibility. Among the applicable modifiers, the last one wins.
+        def named_visibility_for(node, method_name)
+          scope = node.each_ancestor(:class, :module).first
+          return nil unless scope
+
+          named_visibility_overrides(scope, node)[method_name]
+        end
+
+        def named_visibility_overrides(scope, node)
+          def_end = node.source_range.end_pos
+
+          scope.body&.each_child_node&.with_object({}) do |child, overrides|
+            next unless named_visibility_after?(child, def_end)
+
+            child.arguments.each do |arg|
+              covered_actions(arg).each do |name|
+                overrides[name] = child.method_name
+              end
+            end
+          end || {}
+        end
+
+        def named_visibility_after?(child, def_end)
+          named_visibility_modifier?(child) && child.source_range.begin_pos > def_end
+        end
+
+        def named_visibility_modifier?(node)
+          node.send_type? && VISIBILITY_METHODS.include?(node.method_name) &&
+            !node.arguments.empty? && !visibility_def_argument?(node)
+        end
+
+        # Collects the lifecycle/helper methods owned by a scope (a class or
+        # module). Only declarations and definitions belonging to the scope
+        # itself are considered; nested classes and modules are excluded so
+        # callbacks cannot leak between sibling scopes. The result is stored per
+        # scope so a definition can inherit the callbacks of its enclosing
+        # scopes without seeing those of its siblings.
+        def collect_callback_methods(node)
+          return unless node.body
+
+          definitions = own_scope_definitions(node)
+          declared = own_scope_callback_names(node)
+          @scope_callback_methods[node] = expand_callback_dependencies(declared, definitions)
+        end
+
+        # The methods referenced by callback declarations on the scope itself.
+        def own_scope_callback_names(node)
+          own_scope_nodes(node).each_with_object(Set.new) do |descendant, names|
+            next unless descendant.send_type?
+            next unless CALLBACK_METHODS.include?(descendant.method_name)
+
+            callback_method_names(descendant).each { |name| names << name }
+          end
+        end
+
+        # The method definitions belonging to the scope itself, indexed by name.
+        def own_scope_definitions(node)
+          own_scope_nodes(node).each_with_object({}) do |descendant, definitions|
+            next unless descendant.def_type?
+
+            definitions[descendant.method_name] ||= descendant
+          end
+        end
+
+        # Walks a scope body without descending into nested classes or modules,
+        # so each scope only sees its own declarations and definitions.
+        def own_scope_nodes(node)
+          nodes = []
+          queue = [node.body].compact
+
+          until queue.empty?
+            current = queue.shift
+            next if current.class_type? || current.module_type?
+
+            nodes << current
+            current.each_child_node { |child| queue << child }
+          end
+
+          nodes
+        end
+
+        # Methods called by a lifecycle callback are helper methods as well,
+        # e.g. a callback delegating to a public helper method.
+        def expand_callback_dependencies(declared, definitions)
+          names = Set.new(declared)
+          queue = declared.to_a
+
+          until queue.empty?
+            definition = definitions[queue.shift]
+            next unless definition&.body
+
+            sends = [definition.body]
+            sends.concat(definition.body.each_descendant(:send).to_a)
+
+            sends.each do |send_node|
+              next unless send_node.send_type?
+              next unless controller_call?(send_node)
+
+              callee = send_node.method_name
+              next unless definitions.has_key?(callee)
+              next unless names.add?(callee)
+
+              queue << callee
+            end
+          end
+
+          names
+        end
+
+        # Whether the method is a lifecycle/helper method of the def's own scope
+        # or of an enclosing module. Callbacks declared in a class are not
+        # inherited by definitions inside a nested class: Ruby does not treat a
+        # nested class as a subclass, so an outer controller's `helper_method`
+        # must not exempt an unrelated nested controller's action with the same
+        # name. Enclosing modules are still followed (a common concern pattern),
+        # but the walk stops at the first class boundary.
+        def callback_method?(node, method_name)
+          scopes = node.each_ancestor(:class, :module).to_a
+          return false if scopes.empty?
+
+          own_scope = scopes.shift
+          return true if scope_callback?(own_scope, method_name)
+
+          scopes.each do |scope|
+            break if scope.class_type?
+
+            return true if scope_callback?(scope, method_name)
+          end
+
+          false
+        end
+
+        def scope_callback?(scope, method_name)
+          @scope_callback_methods.fetch(scope, Set.new).include?(method_name)
+        end
+
+        # A call is made on the controller itself when the receiver is implicit
+        # or an explicit `self`. Calls with any other receiver, such as
+        # `Resource.find`, must not be followed because a same-named controller
+        # action could then be mistaken for a lifecycle/helper method, hiding a
+        # missing authorization check.
+        def controller_call?(send_node)
+          send_node.receiver.nil? || send_node.receiver.self_type?
+        end
+
+        def callback_method_names(send_node)
+          send_node.arguments.flat_map do |arg|
+            case arg.type
+            when :sym, :str
+              arg.value.to_sym
+            when :hash
+              rescue_handler_names(arg)
+            else
+              []
+            end
+          end
+        end
+
+        # `rescue_from SomeError, with: :handler` references the handler
+        # method through the `with:` option.
+        def rescue_handler_names(hash_node)
+          hash_node.pairs.filter_map do |pair|
+            next unless pair.key.sym_type? && pair.key.value == :with
+
+            value = pair.value
+            value.value.to_sym if value.sym_type? || value.str_type?
+          end
+        end
+
+        def check_before_actions(class_node)
+          class_node.body&.each_child_node(:send) do |send_node|
+            next unless send_node.method_name == :before_action
+
+            register_auth_before_action(send_node) if before_action_handles_auth?(send_node)
+          end
+        end
+
+        def check_before_action_blocks(class_node)
+          class_node.body&.each_descendant(:block) do |block_node|
+            next unless block_node.send_node.method_name == :before_action
+
+            register_auth_before_action(block_node.send_node) if block_contains_auth?(block_node)
+          end
+        end
+
+        def before_action_handles_auth?(node)
+          node.arguments.any? do |arg|
+            auth_symbol_argument?(arg)
+          end
+        end
+
+        def register_auth_before_action(node)
+          only, except = action_restrictions(node)
+
+          if only
+            only -= except if except
+            @only_actions.merge(only)
+          elsif except
+            @except_sets << except
+          else
+            @all_actions_auth = true
+          end
+        end
+
+        def action_exempted_by_before_action?(method_name)
+          return true if @all_actions_auth
+          return true if @only_actions.include?(method_name)
+          return true if @except_sets.any? { |actions| actions.none?(method_name) }
+
+          false
+        end
+
+        def action_restrictions(node)
+          only = nil
+          except = nil
+
+          node.arguments.each do |arg|
+            next unless arg.hash_type?
+
+            arg.pairs.each do |pair|
+              next unless pair.key.sym_type?
+
+              case pair.key.value
+              when :only
+                only = covered_actions(pair.value)
+              when :except
+                except = covered_actions(pair.value)
+              end
+            end
+          end
+
+          [only, except]
+        end
+
+        def covered_actions(value)
+          nodes = value.array_type? ? value.children : [value]
+
+          nodes.select { |node| node.sym_type? || node.str_type? }
+               .to_set { |node| node.value.to_sym }
+        end
+
+        def block_contains_auth?(block_node)
+          body = block_node.body
+          return false unless body
+
+          return true if authorization_call?(body)
+
+          body.each_descendant(:send).any? do |send_node|
+            authorization_call?(send_node)
+          end
+        end
+
+        def auth_symbol_argument?(arg)
+          return false unless arg.sym_type?
+
+          name = arg.value.to_s
+          BEFORE_ACTION_AUTH_KEYWORDS.any? { |keyword| name.include?(keyword) }
+        end
+
+        def contains_authorization_check?(node)
+          return false unless node.body
+
+          body = node.body
+
+          return true if authorization_call?(body)
+
+          body.each_descendant(:send).any? do |send_node|
+            authorization_call?(send_node)
+          end
+        end
+
+        def authorization_call?(send_node)
+          return false unless send_node.send_type?
+
+          return true if AUTHORIZATION_METHODS.include?(send_node.method_name)
+
+          method_name = send_node.method_name.to_s
+          AUTHORIZATION_PREFIXES.any? { |prefix| method_name.start_with?(prefix) }
+        end
+      end
+    end
+  end
+end

data/lib/decidim/dev/rubocop/cop/decidim/organization_scoped_finder.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+require "rubocop"
+
+module RuboCop
+  module Cop
+    module Decidim
+      # Flags unscoped ActiveRecord finder calls in controllers.
+      #
+      # In a multi-tenant Decidim deployment, loading a record without scoping
+      # it to the current organization can allow one tenant's users to access
+      # another tenant's resources. This cop promotes safe patterns such as
+      # `current_organization.templates.find_by(id: ...)` or using an already
+      # scoped `collection`.
+      #
+      # The cop targets chains that start with an ActiveRecord model constant
+      # and end with a terminal finder (`find`, `find_by`, `find_by!`, `first`,
+      # `take`, etc.) unless the chain includes a recognized scoping step.
+      class OrganizationScopedFinder < RuboCop::Cop::Base
+        MSG = "Unscoped ActiveRecord finder detected. Scope the query to the current organization, " \
+              "e.g. `current_organization.<relation>.find_by(id: params[:id])` or use an already-scoped `collection`."
+
+        FINDER_METHODS = [
+          :find, :find_by, :find_by!, :find_sole_by, :first, :first!, :last, :last!,
+          :sole, :sole!, :take, :take!,
+          :find_or_initialize_by, :find_or_create_by, :find_or_create_by!
+        ].freeze
+        RESTRICT_ON_SEND = [*FINDER_METHODS, :where].freeze
+
+        SCOPE_ROOT_METHODS = [:current_organization, :collection].freeze
+
+        SCOPED_WHERE_KEYS = [:current_organization, :current_component].freeze
+
+        ORGANIZATION_SCOPED_KEYS = [:decidim_organization_id, :organization_id].freeze
+
+        SCOPED_ASSOCIATION_KEYS = [:component, :organization, :participatory_space].freeze
+
+        SCOPED_HELPER_METHODS = [:current_organization, :current_component, :current_participatory_space].freeze
+
+        IGNORED_CONSTANT_PREFIXES = %w(Bundler ActiveRecord).freeze
+
+        def on_send(node)
+          return unless RESTRICT_ON_SEND.include?(node.method_name)
+          return if node.block_node
+          return if scoped_finder_arguments?(node)
+          return unless node.receiver
+          return if organization_scoped?(node.receiver)
+          return unless unscoped_model_class?(node.receiver)
+          return if constructed_scope_root?(node.receiver)
+
+          return if consumed_by_finder?(node)
+
+          add_offense(node)
+        end
+
+        private
+
+        def organization_scoped?(node)
+          return false unless node
+          return true if scoped_node?(node)
+          return organization_scoped?(node.receiver) if node.send_type?
+
+          false
+        end
+
+        def unscoped_model_class?(node)
+          return false unless node
+          return false if ignored_constant?(node)
+          return true if node.const_type?
+          return false unless node.send_type?
+
+          unscoped_model_class?(node.receiver)
+        end
+
+        def ignored_constant?(node)
+          node.const_type? &&
+            IGNORED_CONSTANT_PREFIXES.any? { |prefix| node.source.start_with?(prefix) }
+        end
+
+        def scoped_node?(node)
+          return false unless node.send_type?
+
+          scope_root?(node) || scoped_where?(node) || scoped_finder_arguments?(node)
+        end
+
+        def scope_root?(node)
+          return false unless SCOPE_ROOT_METHODS.include?(node.method_name)
+
+          node.receiver.nil? || node.receiver.self_type?
+        end
+
+        def scoped_finder_arguments?(node)
+          node.arguments.any? { |arg| scoped_argument?(arg) }
+        end
+
+        def scoped_where?(node)
+          return false unless node.method_name == :where
+
+          node.arguments.any? { |arg| scoped_argument?(arg) }
+        end
+
+        def scoped_argument?(node)
+          return false unless node.hash_type?
+
+          node.children.any? { |pair| scoped_pair?(pair) }
+        end
+
+        def scoped_pair?(pair_node)
+          return false unless pair_node.pair_type?
+
+          key = pair_node.children[0]
+          value = pair_node.children[1]
+
+          scoped_where_pair?(key, value) ||
+            scoped_association_pair?(key, value) ||
+            (value.hash_type? && value.children.any? { |inner| ownership_scoped_pair?(inner) })
+        end
+
+        def ownership_scoped_pair?(pair_node)
+          return false unless pair_node.pair_type?
+
+          key = pair_node.children[0]
+          value = pair_node.children[1]
+
+          scoped_association_pair?(key, value) ||
+            (value.hash_type? && value.children.any? { |inner| ownership_scoped_pair?(inner) })
+        end
+
+        def scoped_where_pair?(key, value)
+          return false unless key.sym_type?
+          return false unless scoped_where_key?(key)
+
+          scoped_trusted_value?(value)
+        end
+
+        def scoped_association_pair?(key, value)
+          return false unless key.sym_type?
+          return false unless SCOPED_ASSOCIATION_KEYS.include?(key.value)
+          return false unless value.send_type?
+          return false if value.receiver
+
+          value.method_name == :"current_#{key.value}"
+        end
+
+        def scoped_trusted_value?(node)
+          return false unless node
+
+          case node.type
+          when :send
+            scoped_helper_method?(node) || (node.receiver && scoped_trusted_value?(node.receiver))
+          when :hash
+            node.children.any? { |pair| scoped_pair?(pair) }
+          else
+            false
+          end
+        end
+
+        def scoped_helper_method?(node)
+          return false unless node.send_type?
+          return false if node.receiver
+
+          SCOPED_HELPER_METHODS.include?(node.method_name)
+        end
+
+        def scoped_where_key?(key)
+          key.sym_type? &&
+            (SCOPED_WHERE_KEYS.include?(key.value) ||
+             ORGANIZATION_SCOPED_KEYS.include?(key.value))
+        end
+
+        def constructed_scope_root?(node)
+          return false unless node.send_type?
+
+          if node.method_name == :new
+            return false unless node.receiver&.const_type?
+
+            return scoped_finder_arguments?(node)
+          end
+
+          constructed_scope_root?(node.receiver) if node.receiver
+        end
+
+        def consumed_by_finder?(node)
+          return false unless node.method_name == :where
+
+          ancestor = node.parent
+          while ancestor&.send_type?
+            break unless ancestor.receiver == node
+            return true if FINDER_METHODS.include?(ancestor.method_name)
+
+            node = ancestor
+            ancestor = node.parent
+          end
+
+          false
+        end
+      end
+    end
+  end
+end