forest_admin_agent 1.12.16 → 1.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef78c2e321cc6bf9f5c08237f9f3cee7b47844047b81fd23d0ecf6e19bc96dd5
-  data.tar.gz: f96dcb145c4622164c8ec9d49a79d0fcd97aa1b898c8e48b1034fd3f65aa498b
+  metadata.gz: 8c39283afe40df8a320768b4a276328bae86668d1f7a38f8b2c606f3654e1c76
+  data.tar.gz: 508d9bb55d8a4abd92c47198843a46badec11c79426fd1c4842aef180cdd4b61
 SHA512:
-  metadata.gz: b8a6a19c4068913b44af6dd8c9c94d2474f874314b604b2960431f7200510fa82ef8d114cf17eb29ed964cae0b75e899e800cf4f7c04d0cad88897de1d6d7fcc
-  data.tar.gz: 6998491c62ee7a225f73c9fb96e52c00245e60d4cd21e2f9c08b7b2a10db5f3b6adef68c755c82eb848c6ccbd54483b7582c8bbe1ffe43c6a06c93b68005af70
+  metadata.gz: b25852adba8a2ba5a50da76f72baeac8c95a90d5894bf24f836ecf264bb61d836965e2116e33159669cd76e595b98c23c70d0cec88bd9a7117b9e3be6347fc8d
+  data.tar.gz: cb4d1985d20c4897f67d8388c4491475d048b25bc26f7eadb8165745bfed4b9323895c3636ae2d39f5e4a678e889bdd853b5f92a9d3be14f4b532d7fc6150ae3

data/lib/forest_admin_agent/services/permissions.rb

@@ -41,16 +41,13 @@ module ForestAdminAgent
         user_data = get_user_data(caller.id)
         collections_data = get_collections_permissions_data(force_fetch: allow_fetch)
 
-        # First check
         is_allowed = permission_allowed?(collections_data, collection, action, user_data)
 
-        # Refetch if not allowed
         unless is_allowed
           collections_data = get_collections_permissions_data(force_fetch: true)
           is_allowed = permission_allowed?(collections_data, collection, action, user_data)
         end
 
-        # still not allowed - throw forbidden message
         raise ForbiddenError, "You don't have permission to #{action} this collection." unless is_allowed
 
         is_allowed
@@ -61,10 +58,8 @@ module ForestAdminAgent
         hash_request = "#{attributes[:type]}:#{array_hash(attributes)}"
         is_allowed = get_chart_data(caller.rendering_id).include?(hash_request)
 
-        # Refetch
         is_allowed ||= get_chart_data(caller.rendering_id, force_fetch: true).include?(hash_request)
 
-        # still not allowed - throw forbidden message
         unless is_allowed
           ForestAdminAgent::Facades::Container.logger.log(
             'Debug',
@@ -82,13 +77,24 @@ module ForestAdminAgent
       end
 
       def can_execute_query_segment?(collection, query, connection_name)
-        hash_request = array_hash({ query: query, connectionName: connection_name })
-        is_allowed = get_segments(collection).include?(hash_request)
+        user_data = get_user_data(caller.id)
+        if %w[admin developer editor].include?(user_data&.dig(:permissionLevel))
+          ForestAdminAgent::Facades::Container.logger.log(
+            'Debug',
+            "User #{caller.id} can retrieve SQL segment on rendering #{caller.rendering_id}"
+          )
+          return true
+        end
 
-        # Refetch
-        is_allowed ||= get_segments(collection, force_fetch: true).include?(hash_request)
+        collection_permissions = get_collection_rendering_permissions(collection, force_fetch: false)
+
+        is_allowed = segment_permissions_valid?(collection_permissions, query, connection_name)
+
+        unless is_allowed
+          collection_permissions = get_collection_rendering_permissions(collection, force_fetch: true)
+          is_allowed = segment_permissions_valid?(collection_permissions, query, connection_name)
+        end
 
-        # still not allowed - throw forbidden message
         unless is_allowed
           ForestAdminAgent::Facades::Container.logger.log(
             'Debug',
@@ -216,7 +222,6 @@ module ForestAdminAgent
         parameters.delete(:collection)
         parameters.delete(:contextVariables)
         parameters.delete(:record_id)
-        # rails
         parameters.delete(:route_alias)
         parameters.delete(:controller)
         parameters.delete(:action)
@@ -242,6 +247,7 @@ module ForestAdminAgent
           data[:team] = response[:team]
           data[:segments] = decode_segment_permissions(response[:collections])
           data[:charts] = decode_charts_permissions(response[:stats])
+          data[:liveQuerySegments] = decode_live_query_segments_permissions(response[:collections])
 
           data
         end
@@ -269,7 +275,6 @@ module ForestAdminAgent
       end
 
       def decode_crud_permissions(collection)
-        # Validate structure exists
         unless collection.is_a?(Hash) && collection.key?(:collection)
           ForestAdminAgent::Facades::Container.logger.log(
             'Error',
@@ -297,8 +302,6 @@ module ForestAdminAgent
           )
         end
 
-        # Use dig to safely extract roles, allowing for missing permissions
-        # Missing permissions will result in nil values which are handled by permission_allowed?
         {
           browse: collection_data.dig(:browseEnabled, :roles),
           read: collection_data.dig(:readEnabled, :roles),
@@ -356,6 +359,17 @@ module ForestAdminAgent
         segments
       end
 
+      def decode_live_query_segments_permissions(raw_permissions)
+        collections = {}
+        raw_permissions.each do |collection_name, value|
+          collections[collection_name] = {
+            liveQuerySegments: value[:liveQuerySegments] || []
+          }
+        end
+
+        collections
+      end
+
       def fetch(url)
         response = forest_api.get(url)
 
@@ -463,6 +477,15 @@ module ForestAdminAgent
 
         collection_actions
       end
+
+      def get_collection_rendering_permissions(collection, force_fetch: false)
+        rendering_data = get_rendering_data(caller.rendering_id, force_fetch: force_fetch)
+        rendering_data[:liveQuerySegments][collection.name.to_sym]
+      end
+
+      def segment_permissions_valid?(collection_permissions, query, connection_name)
+        IsSegmentQueryAllowedOnConnection.allowed?(collection_permissions, query, connection_name)
+      end
     end
   end
 end

data/lib/forest_admin_agent/utils/is_segment_query_allowed_on_connection.rb

@@ -0,0 +1,28 @@
+module ForestAdminAgent
+  module Utils
+    module IsSegmentQueryAllowedOnConnection
+      # Check if a segment query is allowed on a specific connection
+      # This handles both single queries and UNION queries for multi-segment operations
+      def self.allowed?(collection_permissions, segment_query, connection_name)
+        return false if connection_name.nil? || connection_name.empty?
+
+        # Get all queries for the specified connection
+        queries = collection_permissions[:liveQuerySegments]
+                  .select { |segment| segment[:connectionName] == connection_name }
+                  .map { |segment| segment[:query] }
+
+        # Handle UNION queries made by the FRONT to display available actions
+        # Smart Actions restricted to segment when a Smart Action is available on multiple SQL segments
+        union_queries = segment_query.split('/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION ')
+
+        if union_queries.length > 1
+          authorized_queries = queries.to_set { |query| query.gsub(/;\s*\z/i, '').strip }
+
+          return union_queries.all? { |union_query| authorized_queries.include?(union_query.strip) }
+        end
+
+        queries.any?(segment_query)
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -6,7 +6,7 @@ module ForestAdminAgent
     module Schema
       class SchemaEmitter
         LIANA_NAME = "agent-ruby"
-        LIANA_VERSION = "1.12.16"
+        LIANA_VERSION = "1.13.0"
 
         def self.generate(datasource)
           datasource.collections

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.12.16"
+  VERSION = "1.13.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.12.16
+  version: 1.13.0
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-10-30 00:00:00.000000000 Z
+date: 2025-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -349,6 +349,7 @@ files:
 - lib/forest_admin_agent/utils/csv_generator_stream.rb
 - lib/forest_admin_agent/utils/error_messages.rb
 - lib/forest_admin_agent/utils/id.rb
+- lib/forest_admin_agent/utils/is_segment_query_allowed_on_connection.rb
 - lib/forest_admin_agent/utils/query_string_parser.rb
 - lib/forest_admin_agent/utils/query_validator.rb
 - lib/forest_admin_agent/utils/schema/action_fields.rb