forest_admin_agent 1.0.0.pre.beta.21 → 1.0.0.pre.beta.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a86f151f54daa3a9a8f46251c380448eed7c0fdf90ff82818a37fa213a868557
-  data.tar.gz: 2af48bff7f6a6691f2fe495509dba2669ec64d9197886167a1de316c24846263
+  metadata.gz: b5714273d6e7144f00eb531b7a93d0e908698bd1dac7984dc47affd15a7514f6
+  data.tar.gz: 3b47af0daae4bc4e02b944f0d21be13aa18fe5e7abb9bfcfa03f2ea3272028bd
 SHA512:
-  metadata.gz: 006cdc9ffa0c0afcb5ae7efb9a401b5964d379834bbf416d9f5cd7400de8425c83867ae2e0a83cd5a6f7d9de4043c018c3f2a650cab00383a576baf364ebaf22
-  data.tar.gz: 3d04663fff62e53935d54c3a9312d5c575ff5b78ce7bd5fc2be1e73021f7dbda7ac43fe5f30dc141f07f6d9fb98cb23f54c093be65b2c8cb866daabfd8f97fcf
+  metadata.gz: 93044527fdfb1a06f49408044479258b1cccb6af15c8025cf26310f01c684ae6b5c4657bd25496eb69d911eaa77daae83ec82ec551469bd15cacea61a3b46687
+  data.tar.gz: f93863c6d28342854e2e453795bca3c3892c6a09c0d91a44fcb42fae57b107c17f6daa3e9694d04e0862bb46e1f95ff2d14f04c199ab0c2a5436434ca5090ca4

data/forest_admin_agent.gemspec

@@ -36,10 +36,11 @@ admin work on any Ruby application."
   spec.add_dependency "activesupport", ">= 6.1"
   spec.add_dependency "dry-container", "~> 0.11"
   spec.add_dependency "faraday", "~> 2.7"
+  spec.add_dependency "filecache", "~> 1.0"
   spec.add_dependency "ipaddress", "~> 0.8.3"
   spec.add_dependency "jsonapi-serializers", "~> 1.0"
   spec.add_dependency "jwt", "~> 2.7"
-  spec.add_dependency "lightly", "~> 0.4.0"
+  spec.add_dependency "ld-eventsource", "~> 2.2"
   spec.add_dependency "mono_logger", "~> 1.1"
   spec.add_dependency "openid_connect", "~> 2.2"
   spec.add_dependency "rake", "~> 13.0"

data/lib/forest_admin_agent/auth/oauth2/forest_provider.rb

@@ -8,7 +8,7 @@ module ForestAdminAgent
         attr_reader :rendering_id
 
         def initialize(rendering_id, attributes = {})
-          super attributes
+          super(attributes)
           @rendering_id = rendering_id
           @authorization_endpoint = '/oidc/auth'
           @token_endpoint = '/oidc/token'

data/lib/forest_admin_agent/auth/oidc_client_manager.rb

@@ -1,3 +1,4 @@
+require 'filecache'
 require 'openid_connect'
 require_relative 'oauth2/oidc_config'
 require_relative 'oauth2/forest_provider'
@@ -18,8 +19,8 @@ module ForestAdminAgent
       private
 
       def setup_cache(env_secret, config_agent)
-        lightly = Lightly.new(life: TTL, dir: "#{config_agent[:cache_dir]}/issuer")
-        lightly.get env_secret do
+        cache = FileCache.new('auth_issuer', (config_agent[:cache_dir]).to_s, TTL)
+        cache.get_or_set env_secret do
           oidc_config = retrieve_config(config_agent[:forest_server_url])
           credentials = register(
             config_agent[:env_secret],

data/lib/forest_admin_agent/builder/agent_factory.rb

@@ -1,5 +1,5 @@
 require 'dry-container'
-require 'lightly'
+require 'filecache'
 
 module ForestAdminAgent
   module Builder
@@ -21,7 +21,7 @@ module ForestAdminAgent
       end
 
       def add_datasource(datasource)
-        datasource.collections.each { |_name, collection| @customizer.add_collection(collection) }
+        datasource.collections.each_value { |collection| @customizer.add_collection(collection) }
         self
       end
 
@@ -40,9 +40,9 @@ module ForestAdminAgent
         if !schema_is_know || force
           #   Logger::log('Info', 'schema was updated, sending new version');
           client = ForestAdminAgent::Http::ForestAdminApiRequester.new
-          client.post('/forest/apimaps', schema)
-          schema_file_hash_cache = Lightly.new(life: TTL_SCHEMA, dir: @options[:cache_dir].to_s)
-          schema_file_hash_cache.get 'value' do
+          client.post('/forest/apimaps', schema.to_json)
+          schema_file_hash_cache = FileCache.new('app', @options[:cache_dir].to_s, TTL_SCHEMA)
+          schema_file_hash_cache.get_or_set 'value' do
             schema[:meta][:schemaFileHash]
           end
           @container.register(:schema_file_hash, schema_file_hash_cache)
@@ -59,11 +59,11 @@ module ForestAdminAgent
       end
 
       def build_cache
-        @container.register(:cache, Lightly.new(life: TTL_CONFIG, dir: @options[:cache_dir].to_s))
+        @container.register(:cache, FileCache.new('app', @options[:cache_dir].to_s, TTL_SCHEMA))
         return unless @has_env_secret
 
         cache = @container.resolve(:cache)
-        cache.get 'config' do
+        cache.get_or_set 'config' do
           @options.to_h
         end
       end

data/lib/forest_admin_agent/http/Exceptions/authentication_open_id_client.rb

@@ -5,7 +5,7 @@ module ForestAdminAgent
         attr_reader :error, :error_description, :state
 
         def initialize(error, error_description, state)
-          super error, 401, error_description
+          super(error, 401, error_description)
           @error = error
           @error_description = error_description
           @state = state

data/lib/forest_admin_agent/http/Exceptions/conflict_error.rb

@@ -0,0 +1,14 @@
+module ForestAdminAgent
+  module Http
+    module Exceptions
+      class ConflictError < HttpException
+        attr_reader :name
+
+        def initialize(message, name = 'ConflictError')
+          @name = name
+          super(429, 'Conflict', message)
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/http/Exceptions/forbidden_error.rb

@@ -0,0 +1,14 @@
+module ForestAdminAgent
+  module Http
+    module Exceptions
+      class ForbiddenError < HttpException
+        attr_reader :name
+
+        def initialize(message, name = 'ForbiddenError')
+          @name = name
+          super(403, 'Forbidden', message)
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/http/Exceptions/not_found_error.rb

@@ -5,7 +5,7 @@ module ForestAdminAgent
         attr_reader :name, :status
 
         def initialize(msg, name = 'NotFoundError')
-          super msg
+          super(msg)
           @name = name
           @status = 404
         end

data/lib/forest_admin_agent/http/Exceptions/require_approval.rb

@@ -0,0 +1,15 @@
+module ForestAdminAgent
+  module Http
+    module Exceptions
+      class RequireApproval < HttpException
+        attr_reader :name, :data
+
+        def initialize(message, name = 'RequireApproval', data = [])
+          @name = name
+          @data = data
+          super(403, 'Forbidden', message)
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/http/forest_admin_api_requester.rb

@@ -3,6 +3,8 @@ require 'faraday'
 module ForestAdminAgent
   module Http
     class ForestAdminApiRequester
+      include ForestAdminDatasourceToolkit::Exceptions
+
       def initialize
         @headers = {
           'Content-Type' => 'application/json',
@@ -16,12 +18,38 @@ module ForestAdminAgent
         )
       end
 
-      def get(url, params)
-        @client.get(url, params.to_json)
+      def get(url, params = nil)
+        @client.get(url, params)
+      end
+
+      def post(url, params = nil)
+        @client.post(url, params)
       end
 
-      def post(url, params)
-        @client.post(url, params.to_json)
+      def handle_response_error(error)
+        raise error if error.is_a?(ForestException)
+
+        if error.response[:message]&.include?('certificate')
+          raise ForestException,
+                'ForestAdmin server TLS certificate cannot be verified. Please check that your system time is set properly.'
+        end
+
+        if error.response[:status].zero? || error.response[:status] == 502
+          raise ForestException, 'Failed to reach ForestAdmin server. Are you online?'
+        end
+
+        if error.response[:status] == 404
+          raise ForestException,
+                'ForestAdmin server failed to find the project related to the envSecret you configured. Can you check that you copied it properly in the Forest initialization?'
+        end
+
+        if error.response[:status] == 503
+          raise ForestException,
+                'Forest is in maintenance for a few minutes. We are upgrading your experience in the forest. We just need a few more minutes to get it right.'
+        end
+
+        raise ForestException,
+              'An unexpected error occurred while contacting the ForestAdmin server. Please contact support@forestadmin.com for further investigations.'
       end
     end
   end

data/lib/forest_admin_agent/routes/abstract_authenticated_route.rb

@@ -6,6 +6,7 @@ module ForestAdminAgent
           Facades::Whitelist.check_ip(args[:headers]['action_dispatch.remote_ip'].to_s)
         end
         @caller = Utils::QueryStringParser.parse_caller(args)
+        @permissions = ForestAdminAgent::Services::Permissions.new(@caller)
         super
       end
 

data/lib/forest_admin_agent/routes/resources/count.rb

@@ -3,8 +3,9 @@ require 'jsonapi-serializers'
 module ForestAdminAgent
   module Routes
     module Resources
-      class Count < AbstractRoute
+      class Count < AbstractAuthenticatedRoute
         include ForestAdminAgent::Builder
+        include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
         def setup_routes
           add_route('forest_count', 'get', '/:collection_name/count', ->(args) { handle_request(args) })
 
@@ -13,12 +14,14 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           build(args)
+          @permissions.can?(:browse, @collection)
 
           if @collection.is_countable?
-            caller = ForestAdminAgent::Utils::QueryStringParser.parse_caller(args)
-            filter = ForestAdminDatasourceToolkit::Components::Query::Filter.new
+            filter = ForestAdminDatasourceToolkit::Components::Query::Filter.new(
+              condition_tree: @permissions.get_scope(@collection)
+            )
             aggregation = ForestAdminDatasourceToolkit::Components::Query::Aggregation.new(operation: 'Count')
-            result = @collection.aggregate(caller, filter, aggregation)
+            result = @collection.aggregate(@caller, filter, aggregation)
 
             return {
               name: args[:params]['collection_name'],

data/lib/forest_admin_agent/routes/resources/delete.rb

@@ -7,6 +7,7 @@ module ForestAdminAgent
       class Delete < AbstractAuthenticatedRoute
         include ForestAdminAgent::Builder
         include ForestAdminDatasourceToolkit::Components::Query
+        include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
 
         def setup_routes
           add_route('forest_delete_bulk', 'delete', '/:collection_name', ->(args) { handle_request_bulk(args) })
@@ -17,6 +18,7 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           build(args)
+          @permissions.can?(:delete, @collection)
           id = Utils::Id.unpack_id(@collection, args[:params]['id'], with_key: true)
           delete_records(args, { ids: [id], are_excluded: false })
 
@@ -25,6 +27,7 @@ module ForestAdminAgent
 
         def handle_request_bulk(args = {})
           build(args)
+          @permissions.can?(:delete, @collection)
           selection_ids = Utils::Id.parse_selection_ids(@collection, args[:params], with_key: true)
           delete_records(args, selection_ids)
 
@@ -38,7 +41,8 @@ module ForestAdminAgent
             condition_tree: ConditionTree::ConditionTreeFactory.intersect(
               [
                 Utils::QueryStringParser.parse_condition_tree(@collection, args),
-                condition_tree_ids
+                condition_tree_ids,
+                @permissions.get_scope(@collection)
               ]
             )
           )

data/lib/forest_admin_agent/routes/resources/list.rb

@@ -5,6 +5,7 @@ module ForestAdminAgent
     module Resources
       class List < AbstractAuthenticatedRoute
         include ForestAdminAgent::Builder
+        include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
         def setup_routes
           add_route('forest_list', 'get', '/:collection_name', ->(args) { handle_request(args) })
 
@@ -13,14 +14,19 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           build(args)
-          caller = ForestAdminAgent::Utils::QueryStringParser.parse_caller(args)
+          @permissions.can?(:browse, @collection)
 
           filter = ForestAdminDatasourceToolkit::Components::Query::Filter.new(
-            condition_tree: ForestAdminAgent::Utils::QueryStringParser.parse_condition_tree(@collection, args),
+            condition_tree: ConditionTreeFactory.intersect([
+                                                             @permissions.get_scope(@collection),
+                                                             ForestAdminAgent::Utils::QueryStringParser.parse_condition_tree(
+                                                               @collection, args
+                                                             )
+                                                           ]),
             page: ForestAdminAgent::Utils::QueryStringParser.parse_pagination(args)
           )
           projection = ForestAdminAgent::Utils::QueryStringParser.parse_projection_with_pks(@collection, args)
-          records = @collection.list(caller, filter, projection)
+          records = @collection.list(@caller, filter, projection)
 
           {
             name: args[:params]['collection_name'],

data/lib/forest_admin_agent/routes/resources/related/associate_related.rb

@@ -8,6 +8,7 @@ module ForestAdminAgent
           include ForestAdminAgent::Builder
           include ForestAdminDatasourceToolkit::Utils
           include ForestAdminDatasourceToolkit::Components::Query
+
           def setup_routes
             add_route(
               'forest_related_associate',
@@ -21,6 +22,7 @@ module ForestAdminAgent
 
           def handle_request(args = {})
             build(args)
+            @permissions.can?(:edit, @collection)
 
             parent_id = Utils::Id.unpack_id(@collection, args[:params]['id'], with_key: true)
             target_relation_id = Utils::Id.unpack_id(@child_collection, args[:params]['data'][0]['id'], with_key: true)
@@ -40,7 +42,14 @@ module ForestAdminAgent
           def associate_one_to_many(relation, parent_id, target_relation_id)
             id = Schema.primary_keys(@child_collection)[0]
             value = Collection.get_value(@child_collection, @caller, target_relation_id, id)
-            filter = Filter.new(condition_tree: ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value))
+            filter = Filter.new(
+              condition_tree: ConditionTree::ConditionTreeFactory.intersect(
+                [
+                  ConditionTree::Nodes::ConditionTreeLeaf.new(id, 'Equal', value),
+                  @permissions.get_scope(@collection)
+                ]
+              )
+            )
             value = Collection.get_value(@collection, @caller, parent_id, relation.origin_key_target)
 
             @child_collection.update(@caller, filter, { relation.origin_key => value })

data/lib/forest_admin_agent/routes/resources/related/count_related.rb

@@ -21,9 +21,10 @@ module ForestAdminAgent
 
           def handle_request(args = {})
             build(args)
+            @permissions.can?(:browse, @collection)
 
             if @child_collection.is_countable?
-              filter = Filter.new
+              filter = Filter.new(condition_tree: @permissions.get_scope(@collection))
               id = Utils::Id.unpack_id(@collection, args[:params]['id'], with_key: true)
               result = Collection.aggregate_relation(
                 @collection,

data/lib/forest_admin_agent/routes/resources/related/dissociate_related.rb

@@ -21,6 +21,7 @@ module ForestAdminAgent
 
           def handle_request(args = {})
             build(args)
+            @permissions.can?(:delete, @collection)
 
             parent_id = Utils::Id.unpack_id(@collection, args[:params]['id'], with_key: true)
             is_delete_mode = !args.dig(:params, :delete).nil?
@@ -84,6 +85,7 @@ module ForestAdminAgent
             Filter.new(
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
+                  @permissions.get_scope(@child_collection),
                   Utils::QueryStringParser.parse_condition_tree(@child_collection, args),
                   selected_ids
                 ]

data/lib/forest_admin_agent/routes/resources/related/list_related.rb

@@ -7,6 +7,8 @@ module ForestAdminAgent
         class ListRelated < AbstractRelatedRoute
           include ForestAdminAgent::Builder
           include ForestAdminDatasourceToolkit::Utils
+          include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
+
           def setup_routes
             add_route(
               'forest_related_list',
@@ -20,10 +22,16 @@ module ForestAdminAgent
 
           def handle_request(args = {})
             build(args)
+            @permissions.can?(:browse, @collection)
             # TODO: add csv behaviour
 
             filter = ForestAdminDatasourceToolkit::Components::Query::Filter.new(
-              condition_tree: ForestAdminAgent::Utils::QueryStringParser.parse_condition_tree(@child_collection, args),
+              condition_tree: ConditionTreeFactory.intersect(
+                [
+                  @permissions.get_scope(@collection),
+                  ForestAdminAgent::Utils::QueryStringParser.parse_condition_tree(@child_collection, args)
+                ]
+              ),
               page: ForestAdminAgent::Utils::QueryStringParser.parse_pagination(args)
             )
             projection = ForestAdminAgent::Utils::QueryStringParser.parse_projection_with_pks(@child_collection, args)

data/lib/forest_admin_agent/routes/resources/related/update_related.rb

@@ -21,6 +21,7 @@ module ForestAdminAgent
 
           def handle_request(args = {})
             build(args)
+            @permissions.can?(:edit, @collection)
 
             relation = @collection.fields[args[:params]['relation_name']]
             parent_id = Utils::Id.unpack_id(@collection, args[:params]['id'])
@@ -61,6 +62,7 @@ module ForestAdminAgent
             old_fk_owner_filter = Filter.new(
               condition_tree: ConditionTree::ConditionTreeFactory.intersect(
                 [
+                  @permissions.get_scope(@collection),
                   ConditionTree::Nodes::ConditionTreeLeaf.new(
                     relation.origin_key,
                     ConditionTree::Operators::EQUAL,
@@ -91,7 +93,12 @@ module ForestAdminAgent
 
             @child_collection.update(
               @caller,
-              Filter.new(condition_tree: new_fk_owner),
+              Filter.new(condition_tree: ConditionTree::ConditionTreeFactory.intersect(
+                [
+                  @permissions.get_scope(@collection),
+                  new_fk_owner
+                ]
+              )),
               { relation.origin_key => origin_value }
             )
           end

data/lib/forest_admin_agent/routes/resources/show.rb

@@ -15,16 +15,18 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           build(args)
+          @permissions.can?(:read, @collection)
+          scope = @permissions.get_scope(@collection)
           id = Utils::Id.unpack_id(@collection, args[:params]['id'], with_key: true)
-          caller = ForestAdminAgent::Utils::QueryStringParser.parse_caller(args)
           condition_tree = ConditionTree::ConditionTreeFactory.match_records(@collection, [id])
           filter = ForestAdminDatasourceToolkit::Components::Query::Filter.new(
-            condition_tree: condition_tree,
+            condition_tree: ConditionTree::ConditionTreeFactory.intersect([condition_tree, scope]),
             page: ForestAdminAgent::Utils::QueryStringParser.parse_pagination(args)
           )
+
           projection = ProjectionFactory.all(@collection)
 
-          records = @collection.list(caller, filter, projection)
+          records = @collection.list(@caller, filter, projection)
 
           raise Http::Exceptions::NotFoundError, 'Record does not exists' unless records.size.positive?
 

data/lib/forest_admin_agent/routes/resources/store.rb

@@ -15,6 +15,7 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           build(args)
+          @permissions.can?(:add, @collection)
           data = format_attributes(args)
           record = @collection.create(@caller, data)
           link_one_to_one_relations(args, record)

data/lib/forest_admin_agent/routes/resources/update.rb

@@ -16,16 +16,17 @@ module ForestAdminAgent
 
         def handle_request(args = {})
           build(args)
+          @permissions.can?(:edit, @collection)
+          scope = @permissions.get_scope(@collection)
           id = Utils::Id.unpack_id(@collection, args[:params]['id'], with_key: true)
-          caller = ForestAdminAgent::Utils::QueryStringParser.parse_caller(args)
           condition_tree = ConditionTree::ConditionTreeFactory.match_records(@collection, [id])
           filter = ForestAdminDatasourceToolkit::Components::Query::Filter.new(
-            condition_tree: condition_tree,
+            condition_tree: ConditionTree::ConditionTreeFactory.intersect([condition_tree, scope]),
             page: ForestAdminAgent::Utils::QueryStringParser.parse_pagination(args)
           )
           data = format_attributes(args)
           @collection.update(@caller, filter, data)
-          records = @collection.list(caller, filter, ProjectionFactory.all(@collection))
+          records = @collection.list(@caller, filter, ProjectionFactory.all(@collection))
 
           {
             name: args[:params]['collection_name'],

data/lib/forest_admin_agent/services/permissions.rb

@@ -0,0 +1,264 @@
+require 'filecache'
+
+module ForestAdminAgent
+  module Services
+    class Permissions
+      include ForestAdminAgent::Http::Exceptions
+      include ForestAdminAgent::Utils
+      include ForestAdminDatasourceToolkit::Exceptions
+      include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
+
+      attr_reader :caller, :forest_api, :cache
+
+      def initialize(caller)
+        @caller = caller
+        @forest_api = ForestAdminAgent::Http::ForestAdminApiRequester.new
+        @cache = FileCache.new(
+          'permissions',
+          Facades::Container.config_from_cache[:cache_dir].to_s,
+          Facades::Container.config_from_cache[:permission_expiration]
+        )
+      end
+
+      def self.invalidate_cache(id_cache = nil)
+        cache = FileCache.new(
+          'permissions',
+          Facades::Container.config_from_cache[:cache_dir].to_s,
+          Facades::Container.config_from_cache[:permission_expiration]
+        )
+
+        cache.clear if id_cache.nil?
+
+        cache.delete(id_cache) unless cache.get(id_cache).nil?
+
+        # TODO: HANDLE LOGGER
+        # logger.debug("Invalidating #{id_cache} cache..")
+      end
+
+      def can?(action, collection, allow_fetch: false)
+        return true unless permission_system?
+
+        user_data = get_user_data(caller.id)
+        collections_data = get_collections_permissions_data(force_fetch: allow_fetch)
+
+        is_allowed = collections_data.key?(collection.name.to_sym) && collections_data[collection.name.to_sym][action].include?(user_data[:roleId])
+
+        # Refetch
+        unless is_allowed
+          collections_data = get_collections_permissions_data(force_fetch: true)
+          is_allowed = collections_data[collection.name.to_sym][action].include?(user_data[:roleId])
+        end
+
+        # still not allowed - throw forbidden message
+        raise ForbiddenError, "You don't have permission to #{action} this collection." unless is_allowed
+
+        is_allowed
+      end
+
+      def can_chart?(parameters)
+        attributes = sanitize_chart_parameters(parameters)
+        hash_request = "#{attributes[:type]}:#{array_hash(attributes)}"
+        is_allowed = get_chart_data(caller.rendering_id).include?(hash_request)
+
+        # Refetch
+        is_allowed ||= get_chart_data(caller.rendering_id, force_fetch: true).include?(hash_request)
+
+        # still not allowed - throw forbidden message
+        unless is_allowed
+          # TODO: HANDLE LOGGER
+          # logger.debug("User #{caller.id} cannot retrieve chart on rendering #{caller.rendering_id}")
+          raise ForbiddenError, "You don't have permission to access this collection."
+        end
+
+        # TODO: HANDLE LOGGER
+        # logger.debug("User #{caller.id} can retrieve chart on rendering #{caller.rendering_id}")
+
+        is_allowed
+      end
+
+      def can_smart_action?(request, collection, filter, allow_fetch: true)
+        return true unless permission_system?
+
+        user_data = get_user_data(caller.id)
+        collections_data = get_collections_permissions_data(force_fetch: allow_fetch)
+        action = find_action_from_endpoint(collection.name, request[:headers]['REQUEST_PATH'], request[:headers]['REQUEST_METHOD'])
+        smart_action_approval = SmartActionChecker.new(
+          request[:params],
+          collection,
+          collections_data[collection.name.to_sym][:actions][action[:name]],
+          caller,
+          user_data[:roleId],
+          filter
+        )
+
+        smart_action_approval.can_execute?
+        # TODO: HANDLE LOGGER
+        # logger.debug("User #{user_data[:roleId]} is #{is_allowed ? '' : 'not'} allowed to perform #{action['name']}")
+      end
+
+      def get_scope(collection)
+        permissions = get_scope_and_team_data(caller.rendering_id)
+        scope = permissions[:scopes][collection.name.to_sym]
+        team = permissions[:team]
+        user = get_user_data(caller.id)
+
+        return nil if scope.nil?
+
+        context_variables = ContextVariables.new(team, user)
+
+        ContextVariablesInjector.inject_context_in_filter(scope, context_variables)
+      end
+
+      def get_user_data(user_id)
+        cache.get_or_set('forest.users') do
+          response = fetch('/liana/v4/permissions/users')
+          users = {}
+
+          response.each do |user|
+            users[user[:id].to_s] = user
+          end
+
+          # TODO: HANDLE LOGGER
+          # logger.debug('Refreshing user permissions cache')
+
+          users
+        end[user_id.to_s]
+      end
+
+      def get_team(rendering_id)
+        permissions = get_scope_and_team_data(rendering_id)
+
+        permissions[:team]
+      end
+
+      private
+
+      def get_collections_permissions_data(force_fetch: false)
+        self.class.invalidate_cache('forest.collections') if force_fetch == true
+
+        cache.get_or_set('forest.collections') do
+          response = fetch('/liana/v4/permissions/environment')
+          collections = {}
+
+          response[:collections].each do |name, collection|
+            collections[name] = decode_crud_permissions(collection).merge(decode_action_permissions(collection))
+          end
+
+          # TODO: HANDLE LOGGER
+          # logger.debug('Fetching environment permissions')
+
+          collections
+        end
+      end
+
+      def get_chart_data(rendering_id, force_fetch: false)
+        self.class.invalidate_cache('forest.stats') if force_fetch == true
+
+        cache.get_or_set('forest.stats') do
+          response = fetch("/liana/v4/permissions/renderings/#{rendering_id}")
+          stat_hash = []
+          response[:stats].each do |stat|
+            stat = stat.select { |_, value| !value.nil? && value != '' }
+            stat_hash << "#{stat[:type]}:#{array_hash(stat)}"
+          end
+
+          # TODO: HANDLE LOGGER
+          # logger.debug("Loading rendering permissions for rendering #{rendering_id}")
+
+          stat_hash
+        end
+      end
+
+      def sanitize_chart_parameters(parameters)
+        # parameters = parameters.to_h
+        parameters.delete(:timezone)
+        parameters.delete(:collection)
+        parameters.delete(:contextVariables)
+
+        parameters.select { |_, value| !value.nil? && value != '' }
+      end
+
+      def array_hash(data)
+        Digest::SHA1.hexdigest(data.sort.to_h.to_s)
+      end
+
+      def get_scope_and_team_data(rendering_id)
+        cache.get_or_set('forest.scopes') do
+          data = {}
+          response = fetch("/liana/v4/permissions/renderings/#{rendering_id}")
+
+          data[:scopes] = decode_scope_permissions(response[:collections])
+          data[:team] = response[:team]
+
+          data
+        end
+      end
+
+      def permission_system?
+        cache.get_or_set('forest.has_permission') do
+          response = fetch('/liana/v4/permissions/environment')
+          { enable: !response.nil? }
+        end[:enable]
+      end
+
+      def find_action_from_endpoint(collection_name, endpoint, http_method)
+        schema_file = JSON.parse(File.read(Facades::Container.config_from_cache[:schema_path]))
+        actions = schema_file['collections']&.select { |collection| collection['name'] == collection_name }&.first&.dig('actions')
+
+        return nil if actions.nil? || actions.empty?
+
+        action = actions.find { |a| a['endpoint'] == endpoint && a['http_method'].casecmp(http_method).zero? }
+
+        raise ForestException, "The collection #{collection_name} does not have this smart action" if action.nil?
+
+        action
+      end
+
+      def decode_crud_permissions(collection)
+        {
+          browse: collection[:collection][:browseEnabled][:roles],
+          read: collection[:collection][:readEnabled][:roles],
+          edit: collection[:collection][:editEnabled][:roles],
+          add: collection[:collection][:addEnabled][:roles],
+          delete: collection[:collection][:deleteEnabled][:roles],
+          export: collection[:collection][:exportEnabled][:roles]
+        }
+      end
+
+      def decode_action_permissions(collection)
+        actions = {}
+        actions[:actions] = {}
+        collection[:actions].each do |id, action|
+          actions[:actions][id] = {
+            triggerEnabled: action[:triggerEnabled][:roles],
+            triggerConditions: action[:triggerConditions],
+            approvalRequired: action[:approvalRequired][:roles],
+            approvalRequiredConditions: action[:approvalRequiredConditions],
+            userApprovalEnabled: action[:userApprovalEnabled][:roles],
+            userApprovalConditions: action[:userApprovalConditions],
+            selfApprovalEnabled: action[:selfApprovalEnabled][:roles]
+          }
+        end
+
+        actions
+      end
+
+      def decode_scope_permissions(raw_permissions)
+        scopes = {}
+        raw_permissions.each do |collection_name, value|
+          scopes[collection_name] = ConditionTreeFactory.from_plain_object(value[:scope]) unless value[:scope].nil?
+        end
+
+        scopes
+      end
+
+      def fetch(url)
+        response = forest_api.get(url)
+
+        JSON.parse(response.body, symbolize_names: true)
+      rescue StandardError => e
+        forest_api.handle_response_error(e)
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/services/smart_action_checker.rb

@@ -0,0 +1,95 @@
+module ForestAdminAgent
+  module Services
+    class SmartActionChecker
+      include ForestAdminAgent::Http::Exceptions
+      include ForestAdminAgent::Utils
+      include ForestAdminDatasourceToolkit::Utils
+      include ForestAdminDatasourceToolkit::Components::Query
+      include ForestAdminDatasourceToolkit::Components::Query::ConditionTree
+
+      attr_reader :parameters, :collection, :smart_action, :caller, :role_id, :filter, :attributes
+
+      TRIGGER_FORBIDDEN_ERROR = 'CustomActionTriggerForbiddenError'.freeze
+
+      REQUIRE_APPROVAL_ERROR = 'CustomActionRequiresApprovalError'.freeze
+
+      INVALID_ACTION_CONDITION_ERROR = 'InvalidActionConditionError'.freeze
+
+      def initialize(parameters, collection, smart_action, caller, role_id, filter)
+        @parameters = parameters
+        @collection = collection
+        @smart_action = smart_action
+        @caller = caller
+        @role_id = role_id
+        @filter = filter
+        @attributes = parameters[:data][:attributes]
+      end
+
+      def can_execute?
+        if attributes[:signed_approval_request].nil?
+          can_trigger?
+        else
+          can_approve?
+        end
+      end
+
+      private
+
+      def can_approve?
+        if smart_action[:userApprovalEnabled].include?(role_id) &&
+           (smart_action[:userApprovalConditions].empty? || match_conditions(:userApprovalConditions)) &&
+           (attributes[:requester_id] != caller.id || smart_action[:selfApprovalEnabled].include?(role_id))
+          return true
+        end
+
+        raise ForbiddenError.new('You don\'t have the permission to trigger this action.', TRIGGER_FORBIDDEN_ERROR)
+      end
+
+      def can_trigger?
+        if smart_action[:triggerEnabled].include?(role_id) && !smart_action[:approvalRequired].include?(role_id)
+          return true if smart_action[:triggerConditions].empty? || match_conditions(:triggerConditions)
+        elsif smart_action[:approvalRequired].include?(role_id) && smart_action[:triggerEnabled].include?(role_id)
+          if smart_action[:approvalRequiredConditions].empty? || match_conditions(:approvalRequiredConditions)
+            raise RequireApproval.new(
+              'This action requires to be approved.',
+              REQUIRE_APPROVAL_ERROR,
+              smart_action[:userApprovalEnabled]
+            )
+          elsif smart_action[:triggerConditions].empty? || match_conditions(:triggerConditions)
+            return true
+          end
+        end
+
+        raise ForbiddenError.new('You don\'t have the permission to trigger this action.', TRIGGER_FORBIDDEN_ERROR)
+      end
+
+      def match_conditions(condition_name)
+        pk = Schema.primary_keys(collection)[0]
+        condition_filter = if attributes[:all_records]
+                             Nodes::ConditionTreeLeaf.new(pk, 'NOT_EQUAL', attributes[:all_records_ids_excluded])
+                           else
+                             Nodes::ConditionTreeLeaf.new(pk, 'IN', attributes[:ids])
+                           end
+
+        condition = smart_action[condition_name][0]['filter']
+        conditional_filter = filter.override(
+          condition_tree: ConditionTreeFactory.intersect(
+            [
+              ConditionTreeParser.from_plain_object(collection, condition),
+              filter.condition_tree,
+              condition_filter
+            ]
+          )
+        )
+        rows = collection.aggregate(caller, conditional_filter, Aggregation.new(operation: 'Count'))
+
+        (rows[0]['value'] || 0) == attributes[:ids].count
+      rescue StandardError
+        raise ConflictError.new(
+          'The conditions to trigger this action cannot be verified. Please contact an administrator.',
+          INVALID_ACTION_CONDITION_ERROR
+        )
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/services/sse_cache_invalidation.rb

@@ -0,0 +1,45 @@
+require 'ld-eventsource'
+
+module ForestAdminAgent
+  module Services
+    class SSECacheInvalidation
+      include ForestAdminDatasourceToolkit::Exceptions
+
+      MESSAGE_CACHE_KEYS = {
+        'refresh-users': %w[forest.users],
+        'refresh-roles': %w[forest.collections],
+        'refresh-renderings': %w[forest.collections forest.stats forest.scopes]
+        # TODO: add one for ip whitelist when server implement it
+      }.freeze
+
+      def self.run
+        uri = "#{Facades::Container.config_from_cache[:forest_server_url]}/liana/v4/subscribe-to-events"
+        headers = {
+          'forest-secret-key' => Facades::Container.config_from_cache[:env_secret],
+          'Accept' => 'text/event-stream'
+        }
+
+        begin
+          SSE::Client.new(uri, headers: headers) do |client|
+            client.on_event do |event|
+              next if event.type == :heartbeat
+
+              MESSAGE_CACHE_KEYS[event.type]&.each do |cache_key|
+                Permissions.invalidate_cache(cache_key)
+                # TODO: HANDLE LOGGER
+                # "info","invalidate cache {MESSAGE_CACHE_KEYS[event.type]} for event {event.type}"
+              end
+              # TODO: HANDLE LOGGER add else
+              # "info", "SSECacheInvalidation: unhandled message from server: {event.type}"
+            end
+          end
+        rescue StandardError
+          raise ForestException, 'Failed to reach SSE data from ForestAdmin server.'
+          # TODO: HANDLE LOGGER
+          # "debug", "SSE connection to forestadmin server due to ..."
+          # "warning", "SSE connection to forestadmin server closed unexpectedly, retrying."
+        end
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/utils/context_variables.rb

@@ -0,0 +1,39 @@
+module ForestAdminAgent
+  module Utils
+    class ContextVariables
+      attr_reader :team, :user, :request_context_variables
+
+      USER_VALUE_PREFIX = 'currentUser.'.freeze
+
+      USER_VALUE_TAG_PREFIX = 'currentUser.tags.'.freeze
+
+      USER_VALUE_TEAM_PREFIX = 'currentUser.team.'.freeze
+
+      def initialize(team, user, request_context_variables = nil)
+        @team = team.transform_keys(&:to_sym)
+        @user = user.transform_keys(&:to_sym)
+        @request_context_variables = request_context_variables
+      end
+
+      def get_value(context_variable_key)
+        return get_current_user_data(context_variable_key) if context_variable_key.start_with?(USER_VALUE_PREFIX)
+
+        request_context_variables[context_variable_key]
+      end
+
+      private
+
+      def get_current_user_data(context_variable_key)
+        if context_variable_key.start_with?(USER_VALUE_TEAM_PREFIX)
+          return team[context_variable_key[USER_VALUE_TEAM_PREFIX.length..].to_sym]
+        end
+
+        if context_variable_key.start_with?(USER_VALUE_TAG_PREFIX)
+          return user[:tags][context_variable_key[USER_VALUE_TAG_PREFIX.length..]]
+        end
+
+        user[context_variable_key[USER_VALUE_PREFIX.length..].to_sym]
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/utils/context_variables_injector.rb

@@ -0,0 +1,53 @@
+module ForestAdminAgent
+  module Utils
+    class ContextVariablesInjector
+      include ForestAdminDatasourceToolkit::Components::Query::ConditionTree::Nodes
+
+      def self.inject_context_in_value(value, context_variables)
+        inject_context_in_value_custom(value) do |context_variable_key|
+          context_variables.get_value(context_variable_key).to_s
+        end
+      end
+
+      def self.inject_context_in_value_custom(value)
+        return value unless value.is_a?(String)
+
+        value_with_context_variables_injected = value
+        regex = /{{([^}]+)}}/
+        encountered_variables = []
+
+        while (match = regex.match(value_with_context_variables_injected))
+          context_variable_key = match[1]
+
+          unless encountered_variables.include?(context_variable_key)
+            value_with_context_variables_injected.gsub!(
+              /{{#{context_variable_key}}}/,
+              yield(context_variable_key)
+            )
+          end
+
+          encountered_variables.push(context_variable_key)
+        end
+
+        value_with_context_variables_injected
+      end
+
+      def self.inject_context_in_filter(filter, context_variables)
+        return nil unless filter
+
+        if filter.is_a?(ConditionTreeBranch)
+          return ConditionTreeBranch.new(
+            filter.aggregator,
+            filter.conditions.map { |condition| inject_context_in_filter(condition, context_variables) }
+          )
+        end
+
+        ConditionTreeLeaf.new(
+          filter.field,
+          filter.operator,
+          inject_context_in_value(filter.value, context_variables)
+        )
+      end
+    end
+  end
+end

data/lib/forest_admin_agent/utils/schema/schema_emitter.rb

@@ -7,7 +7,7 @@ module ForestAdminAgent
       class SchemaEmitter
         LIANA_NAME = "forest-rails"
 
-        LIANA_VERSION = "1.0.0-beta.21"
+        LIANA_VERSION = "1.0.0-beta.22"
 
         def self.get_serialized_schema(datasource)
           schema_path = Facades::Container.cache(:schema_path)

data/lib/forest_admin_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminAgent
-  VERSION = "1.0.0-beta.21"
+  VERSION = "1.0.0-beta.22"
 end

data/lib/forest_admin_agent.rb

@@ -3,6 +3,7 @@ require 'zeitwerk'
 
 loader = Zeitwerk::Loader.for_gem
 loader.inflector.inflect('oauth2' => 'OAuth2')
+loader.inflector.inflect('sse_cache_invalidation' => 'SSECacheInvalidation')
 loader.setup
 
 module ForestAdminAgent

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_agent
 version: !ruby/object:Gem::Version
-  version: 1.0.0.pre.beta.21
+  version: 1.0.0.pre.beta.22
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-11-20 00:00:00.000000000 Z
+date: 2023-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -53,6 +53,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.7'
+- !ruby/object:Gem::Dependency
+  name: filecache
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: ipaddress
   requirement: !ruby/object:Gem::Requirement
@@ -96,19 +110,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.7'
 - !ruby/object:Gem::Dependency
-  name: lightly
+  name: ld-eventsource
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: '2.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.4.0
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: mono_logger
   requirement: !ruby/object:Gem::Requirement
@@ -205,8 +219,11 @@ files:
 - lib/forest_admin_agent/facades/container.rb
 - lib/forest_admin_agent/facades/whitelist.rb
 - lib/forest_admin_agent/http/Exceptions/authentication_open_id_client.rb
+- lib/forest_admin_agent/http/Exceptions/conflict_error.rb
+- lib/forest_admin_agent/http/Exceptions/forbidden_error.rb
 - lib/forest_admin_agent/http/Exceptions/http_exception.rb
 - lib/forest_admin_agent/http/Exceptions/not_found_error.rb
+- lib/forest_admin_agent/http/Exceptions/require_approval.rb
 - lib/forest_admin_agent/http/forest_admin_api_requester.rb
 - lib/forest_admin_agent/http/router.rb
 - lib/forest_admin_agent/routes/abstract_authenticated_route.rb
@@ -229,7 +246,12 @@ files:
 - lib/forest_admin_agent/serializer/forest_serializer_override.rb
 - lib/forest_admin_agent/services/ip_whitelist.rb
 - lib/forest_admin_agent/services/logger_service.rb
+- lib/forest_admin_agent/services/permissions.rb
+- lib/forest_admin_agent/services/smart_action_checker.rb
+- lib/forest_admin_agent/services/sse_cache_invalidation.rb
 - lib/forest_admin_agent/utils/condition_tree_parser.rb
+- lib/forest_admin_agent/utils/context_variables.rb
+- lib/forest_admin_agent/utils/context_variables_injector.rb
 - lib/forest_admin_agent/utils/error_messages.rb
 - lib/forest_admin_agent/utils/id.rb
 - lib/forest_admin_agent/utils/query_string_parser.rb