forest_liana 9.22.17 → 9.22.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10b9f231f7625702c1c63e6c2c2133360ccf2e9eaa6a68069a206669d902e93b
-  data.tar.gz: 73c495fa6e0e02428eff8147b57387a640a244c91a4f745e7b0db7ac0d12d146
+  metadata.gz: d2876bbcc3a687f4bbb73e23af6d9ca98e91ebce886c749afdcca20eb2fc0bed
+  data.tar.gz: 2c2fcda6f31a2a176caab533e30e89fbea88f3dd8fbc9e870ffe9a29019e2284
 SHA512:
-  metadata.gz: c3b01f5f3f3c4572fbad83d6b39436bb2eb12bd266fa61ac7048e0172d5922493b1cb1e0afeb0f6af0f07fe24ef45ac79804c298af2ee826a8221f542b850eb8
-  data.tar.gz: 9f699625865575db5ebf7f7104b9004ecf8d091feb2401e490091b3eed83ef049eac4ebda850eeee565c04a80d52a5c7e4273b7c119643718be13d8c28c4e825
+  metadata.gz: 7ddfedbe5559ec9b55d869fec7e56e61f9e0560d574fd66d035180bb98e39bae8351739346f86d4faf720e07530c21d858660c0cfc8ae9a054d6ab3780d7088f
+  data.tar.gz: 12be328781a0a455c042c23668e3f3ca6946b437832f620398d97e7bc4bbd29d65733ff3f28b87dc7596e82e35539ed0eaff6f6a82efbb06015c7a7f82f39b1d

data/app/services/forest_liana/resources_getter.rb

@@ -231,6 +231,8 @@ module ForestLiana
     end
 
     def apply_live_query_segment
+      ScopeManager.assert_can_execute_segment_query!(@user, @collection_name, @params[:segmentQuery])
+
       LiveQueryChecker.new(@params[:segmentQuery], 'Live Query Segment').validate
 
       begin

data/app/services/forest_liana/scope_manager.rb

@@ -2,6 +2,7 @@ module ForestLiana
   class ScopeManager
     # 5 minutes expiration cache
     @@scope_cache_expiration_delta = 300
+    SEGMENT_UNION_SEPARATOR = '/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION '
 
     def self.apply_scopes_on_records(records, user, collection_name, timezone)
       scope_filters = get_scope(collection_name, user)
@@ -65,25 +66,69 @@ module ForestLiana
     end
 
     def self.invalidate_scope_cache(rendering_id)
-      Rails.cache.delete('forest.scopes.' + rendering_id.to_s)
-      RequestCache.delete("forest.scopes.#{rendering_id}")
-    end
-
-    def self.fetch_scopes(rendering_id)
-      RequestCache.fetch("forest.scopes.#{rendering_id}") do
-        Rails.cache.fetch("forest.scopes.#{rendering_id}", expires_in: @@scope_cache_expiration_delta) do
-          response = ForestLiana::ForestApiRequester.get("/liana/v4/permissions/renderings/#{rendering_id}")
-          raise 'Unable to fetch scopes' unless response.is_a?(Net::HTTPOK)
-          parsed_response = JSON.parse(response.body)
-
-          {
-            'scopes' => decode_scope(parsed_response['collections']),
-            'team' => parsed_response['team']
-          }
-        end
+      Rails.cache.delete(scope_cache_key(rendering_id))
+      RequestCache.delete(scope_cache_key(rendering_id))
+    end
+
+    def self.assert_can_execute_segment_query!(user, collection_name, query)
+      return if Ability::ALLOWED_PERMISSION_LEVELS.include?(user['permission_level'])
+      raise Ability::Exceptions::AccessDenied.new unless query.is_a?(String)
+      return if segment_query_allowed?(segment_scopes(user['rendering_id']), collection_name, query)
+      return if segment_query_allowed?(segment_scopes(user['rendering_id'], force_fetch: true), collection_name, query)
+
+      raise Ability::Exceptions::AccessDenied.new
+    end
+
+    def self.segment_query_allowed?(scopes, collection_name, query)
+      allowed_queries = (scopes['segments'] || {})[collection_name]
+      return false if allowed_queries.nil?
+
+      allowed_set = allowed_queries.map { |allowed| normalize_segment_query(allowed) }
+      return true if allowed_set.include?(normalize_segment_query(query))
+
+      parts = query.split(SEGMENT_UNION_SEPARATOR)
+      parts.any? && parts.all? { |part| allowed_set.include?(normalize_segment_query(part)) }
+    end
+
+    def self.normalize_segment_query(query)
+      query.sub(/[\s;]+\z/, '').strip
+    end
+
+    def self.fetch_scopes(rendering_id, force_fetch: false)
+      key = scope_cache_key(rendering_id)
+      return RequestCache.write(key, cached_scopes(key, rendering_id, force_fetch)) if force_fetch
+
+      RequestCache.fetch(key) { cached_scopes(key, rendering_id, force_fetch) }
+    end
+
+    def self.segment_scopes(rendering_id, force_fetch: false)
+      fetch_scopes(rendering_id, force_fetch: force_fetch)
+    rescue StandardError
+      raise Errors::PermissionsUnavailableError.new
+    end
+
+    def self.cached_scopes(key, rendering_id, force_fetch)
+      Rails.cache.fetch(key, expires_in: @@scope_cache_expiration_delta, force: force_fetch) do
+        load_scopes(rendering_id)
       end
     end
 
+    def self.load_scopes(rendering_id)
+      response = ForestLiana::ForestApiRequester.get("/liana/v4/permissions/renderings/#{rendering_id}")
+      raise 'Unable to fetch scopes' unless response.is_a?(Net::HTTPOK)
+      parsed_response = JSON.parse(response.body)
+
+      {
+        'scopes' => decode_scope(parsed_response['collections']),
+        'segments' => decode_segments(parsed_response['collections']),
+        'team' => parsed_response['team']
+      }
+    end
+
+    def self.scope_cache_key(rendering_id)
+      "forest.scopes.#{rendering_id}"
+    end
+
     def self.decode_scope(raw_scopes)
       scopes = {}
       raw_scopes.each do |collection_name, value|
@@ -92,5 +137,14 @@ module ForestLiana
 
       scopes
     end
+
+    def self.decode_segments(raw_collections)
+      raw_collections.each_with_object({}) do |(collection_name, value), segments|
+        segments[collection_name] = value['segments'] unless value['segments'].nil?
+      end
+    end
+
+    private_class_method :segment_query_allowed?, :normalize_segment_query, :segment_scopes, :cached_scopes,
+                         :load_scopes, :scope_cache_key
   end
 end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.17"
+  VERSION = "9.22.18"
 end

data/spec/requests/resources_spec.rb

@@ -635,6 +635,89 @@ describe 'Requesting Tree resources', :type => :request  do
     end
   end
 
+  describe 'live query segment permission' do
+    let(:listed_segment_query) { 'SELECT id FROM trees WHERE name IS NOT NULL' }
+    let(:unlisted_segment_query) { 'SELECT id FROM trees WHERE 1 = 0' }
+
+    restricted_token = JWT.encode({
+      id: 1,
+      email: 'michael.kelso@that70.show',
+      first_name: 'Michael',
+      last_name: 'Kelso',
+      team: 'Operations',
+      rendering_id: 16,
+      exp: Time.now.to_i + 2.weeks.to_i,
+      permission_level: 'user'
+    }, ForestLiana.auth_secret, 'HS256')
+
+    restricted_headers = headers.merge('Authorization' => "Bearer #{restricted_token}")
+
+    let(:list_params) {
+      {
+        fields: { 'Tree' => 'id,name' },
+        page: { 'number' => '1', 'size' => '10' },
+        searchExtended: '0',
+        sort: '-id',
+        timezone: 'Europe/Paris'
+      }
+    }
+
+    it 'refuses a listing whose segment query is not one of the team segments' do
+      get '/forest/Tree', params: list_params.merge(segmentQuery: unlisted_segment_query), headers: restricted_headers
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'][0]['name']).to eq('AccessDenied')
+    end
+
+    it 'serves the listing when the rendering lists that exact segment query' do
+      allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return(
+        'scopes' => {},
+        'segments' => { 'Tree' => [listed_segment_query] },
+        'team' => { 'id' => '1', 'name' => 'Operations' }
+      )
+
+      get '/forest/Tree', params: list_params.merge(segmentQuery: listed_segment_query), headers: restricted_headers
+
+      expect(response.status).to eq(200)
+      expect(JSON.parse(response.body)['data'][0]['attributes']['name']).to eq('Lemon Tree')
+    end
+
+    it 'refuses the count the same way' do
+      get '/forest/Tree/count', params: { segmentQuery: unlisted_segment_query, timezone: 'Europe/Paris' }, headers: restricted_headers
+
+      expect(response.status).to eq(403)
+    end
+
+    it 'refuses the csv export the same way' do
+      get '/forest/Tree.csv', params: { segmentQuery: unlisted_segment_query, header: 'id,name' }, headers: restricted_headers
+
+      expect(response.status).to eq(403)
+    end
+
+    it 'refuses a select-all bulk delete without deleting anything' do
+      params = {
+        data: {
+          attributes: {
+            collection_name: 'Tree',
+            all_records: true,
+            all_records_subset_query: { segmentQuery: unlisted_segment_query }
+          }
+        }
+      }
+
+      delete '/forest/Tree', params: JSON.dump(params), headers: restricted_headers
+
+      expect(response.status).to eq(403)
+      expect(Tree.count).to eq(1)
+    end
+
+    it 'still serves an admin an unlisted segment query' do
+      get '/forest/Tree', params: list_params.merge(segmentQuery: unlisted_segment_query), headers: headers
+
+      expect(response.status).to eq(200)
+    end
+  end
+
   describe 'csv' do
     it 'should return CSV with correct headers and data' do
       params = {

data/spec/services/forest_liana/ability/permission/smart_action_checker_spec.rb

@@ -305,6 +305,55 @@ module ForestLiana
           )
         end
 
+        describe 'with a live query segment on the "select all" selection' do
+          let(:segment_query) { "SELECT id FROM isle WHERE name = 'foo'" }
+
+          before do
+            Rails.cache.write('forest.has_permission', false)
+          end
+
+          def select_all_parameters_with_segment
+            select_all_params = params.deep_dup
+            select_all_params['data']['attributes'][:all_records] = true
+            select_all_params['data']['attributes'][:ids] = []
+            select_all_params['data']['attributes'][:all_records_subset_query] =
+              select_all_params['data']['attributes'][:all_records_subset_query].merge('segmentQuery' => segment_query)
+            ActionController::Parameters.new(select_all_params).permit!
+          end
+
+          it 'refuses with AccessDenied when the query is not one of the requester\'s segments' do
+            allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return(
+              'scopes' => {}, 'segments' => {}, 'team' => {'id' => '1', 'name' => 'Operations'}
+            )
+            action['approvalRequired'] = [1]
+            action['userApprovalEnabled'] = [7]
+            smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(
+              select_all_parameters_with_segment, Island, action, user, nil, forest_user
+            )
+
+            expect { smart_action_checker.can_execute? }
+              .to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+          end
+
+          it 'resolves the record ids when the query is one of the requester\'s segments' do
+            allow(ForestLiana::ScopeManager).to receive(:fetch_scopes).and_return(
+              'scopes' => {},
+              'segments' => { 'Island' => [segment_query] },
+              'team' => {'id' => '1', 'name' => 'Operations'}
+            )
+            action['approvalRequired'] = [1]
+            action['userApprovalEnabled'] = [7]
+            smart_action_checker = ForestLiana::Ability::Permission::SmartActionChecker.new(
+              select_all_parameters_with_segment, Island, action, user, nil, forest_user
+            )
+
+            expect { smart_action_checker.can_execute? }
+              .to raise_error(ForestLiana::Ability::Exceptions::RequireApproval) do |error|
+                expect(error.data[:recordIds]).to eq(['1'])
+              end
+          end
+        end
+
         it 'should raise RequireApproval error if match approvalRequiredConditions' do
           parameters = ActionController::Parameters.new(params).permit!
           action['approvalRequired'] = [1]

data/spec/services/forest_liana/resources_getter_spec.rb

@@ -153,6 +153,13 @@ module ForestLiana
 
     describe 'when a live query segment uses a context variable' do
       let(:user) { { 'id' => '1', 'name' => 'Michel', 'rendering_id' => rendering_id } }
+      let(:scopes) {
+        {
+          'scopes' => {},
+          'segments' => { 'User' => ["SELECT id FROM users WHERE name = '{{currentUser.name}}'"] },
+          'team' => {'id' => '1', 'name' => 'Operations'}
+        }
+      }
       let(:getter) do
         described_class.new(resource, {
           page: { size: pageSize, number: pageNumber },
@@ -209,6 +216,30 @@ module ForestLiana
       end
     end
 
+    describe 'when the live query segment is not one of the user\'s rendering segments' do
+      let(:getter) do
+        described_class.new(resource, {
+          page: { size: pageSize, number: pageNumber },
+          fields: { 'User' => 'id,name' },
+          segmentQuery: 'SELECT id FROM users WHERE name IS NOT NULL',
+        }, user)
+      end
+
+      it 'raises AccessDenied from the constructor, before any SQL runs' do
+        queries = []
+        subscriber = ActiveSupport::Notifications.subscribe('sql.active_record') do |*, payload|
+          queries << payload[:sql] unless payload[:name] == 'SCHEMA' || payload[:cached]
+        end
+        begin
+          expect { getter }.to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+        ensure
+          ActiveSupport::Notifications.unsubscribe(subscriber)
+        end
+
+        expect(queries).to be_empty
+      end
+    end
+
     describe 'when there are more records than the page size' do
       describe 'when asking for the 1st page and 15 records' do
         let(:pageSize) { 15 }

data/spec/services/forest_liana/scope_manager_spec.rb

@@ -70,6 +70,7 @@ module ForestLiana
           expect(Rails.cache.read('forest.scopes.' + rendering_id.to_s)).to eq(
             {
               'scopes' => {'User' => {'aggregator' => 'and', 'conditions'=>[{'field' => 'id', 'operator' => 'greater_than', 'value' => '1'}]}},
+              'segments' => {'User' => []},
               'team' => {'id' => '1', 'name' => 'Operations'},
             })
         end
@@ -120,6 +121,7 @@ module ForestLiana
           expect(Rails.cache.read('forest.scopes.' + rendering_id.to_s)).to eq(
             {
               'scopes' => {'User' => {'aggregator' => 'and', 'conditions'=>[{'field' => 'email', 'operator' => 'equal', 'value' => '{{currentUser.email}}'}]}},
+              'segments' => {'User' => []},
               'team' => {'id' => '1', 'name' => 'Operations'},
             }
           )
@@ -165,6 +167,7 @@ module ForestLiana
           expect(Rails.cache.read('forest.scopes.' + rendering_id.to_s)).to eq(
                                                                               {
                                                                                 'scopes' => {},
+                                                                                'segments' => {'User' => []},
                                                                                 'team' => {'id' => '1', 'name' => 'Operations'},
                                                                               }
                                                                             )
@@ -172,6 +175,165 @@ module ForestLiana
       end
     end
 
+    describe '.assert_can_execute_segment_query!' do
+      let(:segment_query) { 'SELECT id FROM users WHERE name IS NOT NULL' }
+      let(:other_segment_query) { 'SELECT id FROM users WHERE id > 10;' }
+      let(:scopes_body) {
+        {
+          'collections' => {
+            'User' => { 'scope' => nil, 'segments' => [segment_query, other_segment_query] }
+          },
+          'team' => {'id' => '1', 'name' => 'Operations'}
+        }
+      }
+
+      let(:rendering_path) { "/liana/v4/permissions/renderings/#{rendering_id}" }
+
+      def api_response(body)
+        body = JSON.generate(body)
+        response = Net::HTTPOK.new({}, 200, body)
+        allow(response).to receive(:body).and_return(body)
+        response
+      end
+
+      before do
+        allow(ForestLiana::ForestApiRequester).to receive(:get).and_return(api_response(scopes_body))
+      end
+
+      it 'accepts a query the rendering lists for the collection' do
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, segment_query)
+        }.not_to raise_error
+      end
+
+      it 'refuses a query the rendering does not list' do
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, 'SELECT id FROM users WHERE 1 = 0')
+        }.to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+      end
+
+      it 'refuses a collection the rendering payload carries no segments for' do
+        expect {
+          described_class.assert_can_execute_segment_query!(user, 'Island', segment_query)
+        }.to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+      end
+
+      it 'accepts a UNION of configured segments, ignoring their trailing semicolons' do
+        union = "#{segment_query}/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT id FROM users WHERE id > 10"
+
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, union)
+        }.not_to raise_error
+      end
+
+      it 'refuses a UNION holding one unconfigured segment' do
+        union = "#{segment_query}/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT id FROM users WHERE 1 = 0"
+
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, union)
+        }.to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+      end
+
+      it 'accepts a configured query sent without its trailing semicolon' do
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, 'SELECT id FROM users WHERE id > 10')
+        }.not_to raise_error
+      end
+
+      it 'accepts a configured segment that itself holds the union separator' do
+        union_segment = "#{segment_query}/*MULTI-SEGMENTS-QUERIES-UNION*/ UNION SELECT id FROM users WHERE id = 1"
+        scopes_body['collections']['User']['segments'] = [union_segment]
+        allow(ForestLiana::ForestApiRequester).to receive(:get).and_return(api_response(scopes_body))
+
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, union_segment)
+        }.not_to raise_error
+      end
+
+      it 'answers 503 when the rendering cannot be fetched on a cold cache' do
+        allow(ForestLiana::ForestApiRequester).to receive(:get)
+          .and_return(Net::HTTPServiceUnavailable.new({}, 503, ''))
+
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, segment_query)
+        }.to raise_error(ForestLiana::Errors::PermissionsUnavailableError)
+      end
+
+      it 'refuses an empty query' do
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, '')
+        }.to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+      end
+
+      it 'refuses a query that is not a string, without fetching the rendering' do
+        expect {
+          described_class.assert_can_execute_segment_query!(user, collection_name, [segment_query])
+        }.to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+        expect(ForestLiana::ForestApiRequester).not_to have_received(:get)
+      end
+
+      %w[admin editor developer].each do |permission_level|
+        it "lets a #{permission_level} run any query, without fetching the rendering" do
+          expect {
+            described_class.assert_can_execute_segment_query!(
+              user.merge('permission_level' => permission_level), collection_name, 'SELECT id FROM users WHERE 1 = 0'
+            )
+          }.not_to raise_error
+
+          expect(ForestLiana::ForestApiRequester).not_to have_received(:get)
+        end
+      end
+
+      describe 'when the cached rendering may be stale' do
+        let(:scopes_without_the_segment) {
+          body = scopes_body.deep_dup
+          body['collections']['User']['segments'] = []
+          body
+        }
+
+        it 'refetches the rendering once before refusing a fresher rendering could allow' do
+          allow(ForestLiana::ForestApiRequester).to receive(:get)
+            .and_return(api_response(scopes_without_the_segment), api_response(scopes_body))
+
+          expect {
+            described_class.assert_can_execute_segment_query!(user, collection_name, segment_query)
+          }.not_to raise_error
+          expect(ForestLiana::ForestApiRequester).to have_received(:get).with(rendering_path).exactly(2).times
+        end
+
+        it 'still refuses when the refetched rendering denies it too' do
+          allow(ForestLiana::ForestApiRequester).to receive(:get)
+            .and_return(api_response(scopes_without_the_segment))
+
+          expect {
+            described_class.assert_can_execute_segment_query!(user, collection_name, segment_query)
+          }.to raise_error(ForestLiana::Ability::Exceptions::AccessDenied)
+          expect(ForestLiana::ForestApiRequester).to have_received(:get).with(rendering_path).exactly(2).times
+        end
+
+        it 'keeps the cached rendering and answers 503 when the refetch fails' do
+          unavailable = Net::HTTPServiceUnavailable.new({}, 503, '')
+          allow(ForestLiana::ForestApiRequester).to receive(:get)
+            .and_return(api_response(scopes_without_the_segment), unavailable)
+
+          expect {
+            described_class.assert_can_execute_segment_query!(user, collection_name, segment_query)
+          }.to raise_error(ForestLiana::Errors::PermissionsUnavailableError)
+          expect(Rails.cache.read("forest.scopes.#{rendering_id}")['segments']).to eq('User' => [])
+        end
+
+        it 'refetches a cache entry from before segments were cached, before deciding' do
+          Rails.cache.write("forest.scopes.#{rendering_id}", {'scopes' => {}, 'team' => {}})
+          allow(ForestLiana::ForestApiRequester).to receive(:get).and_return(api_response(scopes_body))
+
+          expect {
+            described_class.assert_can_execute_segment_query!(user, collection_name, segment_query)
+          }.not_to raise_error
+          expect(ForestLiana::ForestApiRequester).to have_received(:get).with(rendering_path).once
+        end
+      end
+    end
+
     describe '#append_scope_for_user' do
       let(:filters) { described_class.append_scope_for_user(existing_filter, user, collection_name) }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.17
+  version: 9.22.18
 platform: ruby
 authors:
 - Sandro Munda