granity 0.1.0 → 0.1.1

data/lib/granity/in_memory_cache.rb

@@ -0,0 +1,96 @@
+module Granity
+  # Simple in-memory cache with dependency tracking and TTL
+  class InMemoryCache
+    def initialize(max_size: 10_000, ttl: 600)
+      @data = {}
+      @dependencies = {}
+      @max_size = max_size
+      @default_ttl = ttl
+      @mutex = Mutex.new
+    end
+
+    # Read a value from cache
+    def read(key)
+      @mutex.synchronize do
+        entry = @data[key]
+        return nil unless entry
+
+        # Check if entry is expired
+        if entry[:expires_at] && entry[:expires_at] < Time.now
+          @data.delete(key)
+          return nil
+        end
+
+        entry[:value]
+      end
+    end
+
+    # Write a value to cache with dependencies
+    def write(key, value, dependencies: [], ttl: nil)
+      @mutex.synchronize do
+        # Set expiration time if ttl provided
+        expires_at = if ttl
+          Time.now + ttl
+        else
+          (@default_ttl ? Time.now + @default_ttl : nil)
+        end
+
+        # Store the value
+        @data[key] = {
+          value: value,
+          expires_at: expires_at
+        }
+
+        # Register dependencies
+        dependencies.each do |dependency|
+          @dependencies[dependency] ||= []
+          @dependencies[dependency] << key unless @dependencies[dependency].include?(key)
+        end
+
+        # Enforce max size by removing oldest entries if needed
+        if @data.size > @max_size
+          # Simple LRU - just remove oldest N/4 entries
+          keys_to_remove = @data.keys.take(@max_size / 4)
+          keys_to_remove.each { |k| @data.delete(k) }
+        end
+
+        value
+      end
+    end
+
+    # Invalidate cache entries by dependency key
+    def invalidate_dependencies(dependency_keys)
+      @mutex.synchronize do
+        keys_to_invalidate = []
+
+        dependency_keys.each do |dep_key|
+          # Get all cache keys dependent on this key
+          if @dependencies[dep_key]
+            keys_to_invalidate.concat(@dependencies[dep_key])
+            @dependencies.delete(dep_key)
+          end
+        end
+
+        # Remove the invalidated entries
+        keys_to_invalidate.uniq.each do |key|
+          @data.delete(key)
+        end
+
+        keys_to_invalidate.size
+      end
+    end
+
+    # Clear the entire cache
+    def clear
+      @mutex.synchronize do
+        @data.clear
+        @dependencies.clear
+      end
+    end
+
+    # Get current cache size
+    def size
+      @mutex.synchronize { @data.size }
+    end
+  end
+end

data/lib/granity/permission.rb

@@ -0,0 +1,37 @@
+module Granity
+  # Definition of a permission in the authorization schema
+  class Permission
+    attr_reader :name, :resource_type, :description, :rules
+
+    def initialize(name:, resource_type:, description: nil)
+      @name = name
+      @resource_type = resource_type
+      @description = description
+      @rules = []
+    end
+
+    # Include a relation in the permission
+    def include_relation(relation, from: nil)
+      @rules << Rules::Relation.new(relation: relation, from: from)
+    end
+
+    # Include another permission in this permission
+    def include_permission(permission, from: nil)
+      @rules << Rules::Permission.new(permission: permission, from: from)
+    end
+
+    # Define a set of rules where ANY must match
+    def include_any(&block)
+      rule = Rules::Any.new
+      rule.instance_eval(&block)
+      @rules << rule
+    end
+
+    # Define a set of rules where ALL must match
+    def include_all(&block)
+      rule = Rules::All.new
+      rule.instance_eval(&block)
+      @rules << rule
+    end
+  end
+end

data/lib/granity/permission_evaluator.rb

@@ -0,0 +1,290 @@
+module Granity
+  # Evaluates permissions based on the defined schema and relation tuples
+  class PermissionEvaluator
+    class << self
+      # Evaluate if a subject has a permission on a resource
+      def evaluate(subject_type:, subject_id:, permission:, resource_type:, resource_id:)
+        # Get the schema definition
+        schema = Granity::Schema.current
+        resource_type_def = schema.resource_types[resource_type.to_sym]
+
+        # If resource type doesn't exist, deny permission
+        return false unless resource_type_def
+
+        # Get the permission definition
+        permission_def = resource_type_def.permissions[permission.to_sym]
+
+        # If permission doesn't exist, deny permission
+        return false unless permission_def
+
+        # Evaluate the permission rules
+        evaluate_rules(
+          rules: permission_def.rules,
+          subject_type: subject_type,
+          subject_id: subject_id,
+          resource_type: resource_type,
+          resource_id: resource_id
+        )
+      end
+
+      # Find subjects with a permission on a resource
+      def find_subjects(resource_type:, resource_id:, permission:)
+        # Get the schema definition
+        schema = Granity::Schema.current
+        resource_type_def = schema.resource_types[resource_type.to_sym]
+
+        # If resource type doesn't exist, return empty array
+        return [] unless resource_type_def
+
+        # Get the permission definition
+        permission_def = resource_type_def.permissions[permission.to_sym]
+
+        # If permission doesn't exist, return empty array
+        return [] unless permission_def
+
+        # Get all relation tuples for this resource
+        collect_subjects_for_permission(
+          rules: permission_def.rules,
+          resource_type: resource_type,
+          resource_id: resource_id
+        )
+      end
+
+      private
+
+      # Evaluate rules recursively
+      def evaluate_rules(rules:, subject_type:, subject_id:, resource_type:, resource_id:, depth: 0)
+        # Prevent infinite recursion
+        max_depth = Granity.configuration.max_traversal_depth
+        if depth > max_depth
+          raise "Maximum permission evaluation depth (#{max_depth}) exceeded"
+        end
+
+        rules.each do |rule|
+          case rule
+          when Granity::Rules::Relation
+            # Check if relation tuple exists, handling the "from" case
+            if rule.from
+              # Relation traversal is needed
+              if check_relation_traversal(
+                subject_type: subject_type,
+                subject_id: subject_id,
+                relation: rule.relation,
+                from_relation: rule.from,
+                object_type: resource_type,
+                object_id: resource_id
+              )
+                return true
+              end
+            elsif check_relation(
+              subject_type: subject_type,
+              subject_id: subject_id,
+              relation: rule.relation,
+              object_type: resource_type,
+              object_id: resource_id
+            )
+              # Direct relation check
+              return true
+            end
+          when Granity::Rules::Permission
+            # Check referenced permission, handling "from" case
+            if rule.from
+              # Permission check with traversal - check permission on the "from" related objects
+              if check_permission_traversal(
+                subject_type: subject_type,
+                subject_id: subject_id,
+                permission: rule.permission,
+                from_relation: rule.from,
+                object_type: resource_type,
+                object_id: resource_id,
+                depth: depth + 1
+              )
+                return true
+              end
+            elsif evaluate(
+              subject_type: subject_type,
+              subject_id: subject_id,
+              permission: rule.permission,
+              resource_type: resource_type,
+              resource_id: resource_id
+            )
+              # Direct permission check on the same resource
+              return true
+            end
+          when Granity::Rules::Any
+            # Check if any of the subrules match
+            if rule.rules.any? do |subrule|
+              evaluate_rules(
+                rules: [subrule],
+                subject_type: subject_type,
+                subject_id: subject_id,
+                resource_type: resource_type,
+                resource_id: resource_id,
+                depth: depth + 1
+              )
+            end
+              return true
+            end
+          when Granity::Rules::All
+            # Check if all of the subrules match
+            if rule.rules.all? do |subrule|
+              evaluate_rules(
+                rules: [subrule],
+                subject_type: subject_type,
+                subject_id: subject_id,
+                resource_type: resource_type,
+                resource_id: resource_id,
+                depth: depth + 1
+              )
+            end
+              return true
+            end
+          end
+        end
+
+        false
+      end
+
+      # Check if a direct relation tuple exists
+      def check_relation(subject_type:, subject_id:, relation:, object_type:, object_id:)
+        Granity::RelationTuple.exists?(
+          subject_type: subject_type,
+          subject_id: subject_id,
+          relation: relation,
+          object_type: object_type,
+          object_id: object_id
+        )
+      end
+
+      # Check relation with traversal (the "from" case)
+      def check_relation_traversal(subject_type:, subject_id:, relation:, from_relation:, object_type:, object_id:)
+        # First, find all intermediary objects through the 'from' relation
+        intermediaries = Granity::RelationTuple.where(
+          object_type: object_type,
+          object_id: object_id,
+          relation: from_relation
+        )
+
+        # For each intermediary, check if the subject has the relation to it
+        intermediaries.any? do |tuple|
+          Granity::RelationTuple.exists?(
+            subject_type: subject_type,
+            subject_id: subject_id,
+            relation: relation,
+            object_type: tuple.subject_type,
+            object_id: tuple.subject_id
+          )
+        end
+      end
+
+      # Check permission with traversal (the "from" case)
+      def check_permission_traversal(subject_type:, subject_id:, permission:, from_relation:, object_type:, object_id:, depth:)
+        # First, find all intermediary objects through the 'from' relation
+        intermediaries = Granity::RelationTuple.where(
+          object_type: object_type,
+          object_id: object_id,
+          relation: from_relation
+        )
+
+        # For each intermediary, check if the subject has the permission on it
+        intermediaries.any? do |tuple|
+          evaluate(
+            subject_type: subject_type,
+            subject_id: subject_id,
+            permission: permission,
+            resource_type: tuple.subject_type,
+            resource_id: tuple.subject_id
+          )
+        end
+      end
+
+      # Collect subjects that have a permission on a resource
+      def collect_subjects_for_permission(rules:, resource_type:, resource_id:)
+        subjects = []
+
+        rules.each do |rule|
+          case rule
+          when Granity::Rules::Relation
+            if rule.from
+              # Handle relation traversal for finding subjects
+              intermediaries = Granity::RelationTuple.where(
+                object_type: resource_type,
+                object_id: resource_id,
+                relation: rule.from
+              )
+
+              intermediaries.each do |tuple|
+                # For each intermediary, find subjects with the relation
+                relations = Granity::RelationTuple.where(
+                  object_type: tuple.subject_type,
+                  object_id: tuple.subject_id,
+                  relation: rule.relation
+                )
+
+                relations.each do |rel|
+                  subjects << {type: rel.subject_type, id: rel.subject_id}
+                end
+              end
+            else
+              # Direct relation - find all subjects with this relation
+              tuples = Granity::RelationTuple.where(
+                object_type: resource_type,
+                object_id: resource_id,
+                relation: rule.relation
+              )
+
+              tuples.each do |tuple|
+                subjects << {type: tuple.subject_type, id: tuple.subject_id}
+              end
+            end
+          when Granity::Rules::Permission
+            # Find subjects with referenced permission
+            if rule.from
+              # Permission with traversal - we would need to traverse the "from" relation
+              # and then find subjects with the permission on those objects
+              # This is a simplification - in a real implementation we would handle this more efficiently
+              intermediaries = Granity::RelationTuple.where(
+                object_type: resource_type,
+                object_id: resource_id,
+                relation: rule.from
+              )
+
+              intermediaries.each do |tuple|
+                perm_subjects = find_subjects(
+                  resource_type: tuple.subject_type,
+                  resource_id: tuple.subject_id,
+                  permission: rule.permission
+                )
+
+                subjects.concat(perm_subjects)
+              end
+            else
+              # Direct permission check
+              referenced_subjects = find_subjects(
+                resource_type: resource_type,
+                resource_id: resource_id,
+                permission: rule.permission
+              )
+
+              subjects.concat(referenced_subjects)
+            end
+          when Granity::Rules::Any, Granity::Rules::All
+            # Recursively collect subjects for each subrule
+            rule.rules.each do |subrule|
+              subrule_subjects = collect_subjects_for_permission(
+                rules: [subrule],
+                resource_type: resource_type,
+                resource_id: resource_id
+              )
+
+              subjects.concat(subrule_subjects)
+            end
+          end
+        end
+
+        # Remove duplicates
+        subjects.uniq { |s| "#{s[:type]}:#{s[:id]}" }
+      end
+    end
+  end
+end

data/lib/granity/relation.rb

@@ -0,0 +1,13 @@
+module Granity
+  # Definition of a relation between resources
+  class Relation
+    attr_reader :name, :resource_type, :target_type, :description
+
+    def initialize(name:, resource_type:, target_type:, description: nil)
+      @name = name
+      @resource_type = resource_type
+      @target_type = target_type
+      @description = description
+    end
+  end
+end

data/lib/granity/resource_type.rb

@@ -0,0 +1,34 @@
+module Granity
+  # Definition of a resource type in the authorization schema
+  class ResourceType
+    attr_reader :name, :relations, :permissions
+
+    def initialize(name)
+      @name = name.to_sym
+      @relations = {}
+      @permissions = {}
+    end
+
+    # DSL method to define a relation
+    def relation(name, type:, description: nil)
+      @relations[name.to_sym] = Relation.new(
+        name: name.to_sym,
+        resource_type: @name,
+        target_type: type.to_sym,
+        description: description
+      )
+    end
+
+    # DSL method to define a permission
+    def permission(name, description: nil, &block)
+      permission = Permission.new(
+        name: name.to_sym,
+        resource_type: @name,
+        description: description
+      )
+
+      permission.instance_eval(&block) if block_given?
+      @permissions[name.to_sym] = permission
+    end
+  end
+end

data/lib/granity/rules.rb

@@ -0,0 +1,89 @@
+module Granity
+  # Rules namespace for permission evaluation rules
+  module Rules
+    # Base class for all rules
+    class Base
+      def initialize
+        # Base initialization
+      end
+    end
+
+    # Rule for checking relation existence
+    class Relation < Base
+      attr_reader :relation, :from
+
+      def initialize(relation:, from: nil)
+        @relation = relation.to_sym
+        @from = from.to_sym if from
+      end
+    end
+
+    # Rule for checking another permission
+    class Permission < Base
+      attr_reader :permission, :from
+
+      def initialize(permission:, from: nil)
+        @permission = permission.to_sym
+        @from = from.to_sym if from
+      end
+    end
+
+    # Rule container where ANY rule must match
+    class Any < Base
+      attr_reader :rules
+
+      def initialize
+        @rules = []
+      end
+
+      def include_relation(relation, from: nil)
+        @rules << Relation.new(relation: relation, from: from)
+      end
+
+      def include_permission(permission, from: nil)
+        @rules << Permission.new(permission: permission, from: from)
+      end
+
+      def include_any(&block)
+        rule = Any.new
+        rule.instance_eval(&block)
+        @rules << rule
+      end
+
+      def include_all(&block)
+        rule = All.new
+        rule.instance_eval(&block)
+        @rules << rule
+      end
+    end
+
+    # Rule container where ALL rules must match
+    class All < Base
+      attr_reader :rules
+
+      def initialize
+        @rules = []
+      end
+
+      def include_relation(relation, from: nil)
+        @rules << Relation.new(relation: relation, from: from)
+      end
+
+      def include_permission(permission, from: nil)
+        @rules << Permission.new(permission: permission, from: from)
+      end
+
+      def include_any(&block)
+        rule = Any.new
+        rule.instance_eval(&block)
+        @rules << rule
+      end
+
+      def include_all(&block)
+        rule = All.new
+        rule.instance_eval(&block)
+        @rules << rule
+      end
+    end
+  end
+end

data/lib/granity/schema.rb

@@ -0,0 +1,46 @@
+module Granity
+  # Schema definition for Granity authorization model
+  class Schema
+    attr_reader :resource_types
+
+    class << self
+      # DSL entry point for defining schema
+      def define(&block)
+        @current = new
+        @current.instance_eval(&block)
+        @current
+      end
+
+      # Get current schema
+      def current
+        @current ||= new
+      end
+    end
+
+    def initialize
+      @resource_types = {}
+    end
+
+    # DSL method to define a resource type
+    def resource_type(name, &block)
+      resource_type = ResourceType.new(name)
+      resource_type.instance_eval(&block) if block_given?
+      @resource_types[name] = resource_type
+    end
+
+    def validate_schema
+      # Validate that all relation types reference valid resource types
+      @resource_types.each do |name, resource_type|
+        resource_type.relations.each do |relation_name, relation|
+          unless @resource_types.key?(relation.type.to_sym)
+            raise SchemaError, "Resource type '#{name}' has relation '#{relation_name}' with invalid type '#{relation.type}'"
+          end
+        end
+      end
+
+      # More validations could be added here
+    end
+  end
+
+  class SchemaError < StandardError; end
+end

data/lib/granity/version.rb

@@ -1,3 +1,3 @@
 module Granity
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/lib/granity.rb

@@ -1,6 +1,76 @@
 require "granity/version"
-require "granity/engine"
+require "granity/configuration"
+require "granity/schema"
+require "granity/resource_type"
+require "granity/relation"
+require "granity/permission"
+require "granity/rules"
+require "granity/in_memory_cache"
+require "granity/dependency_analyzer"
+require "granity/permission_evaluator"
+require "granity/authorization_engine"
+# Rails engine is loaded at the end
+require "granity/engine" if defined?(Rails)
 
 module Granity
-  # Your code goes here...
+  class Error < StandardError; end
+
+  class << self
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    # Entry point for DSL schema definition
+    def define(&block)
+      Schema.define(&block)
+    end
+
+    # Configuration setup
+    def configure
+      yield(configuration) if block_given?
+      configuration
+    end
+
+    # Public API to check permissions
+    def check_permission(subject_type:, subject_id:, permission:, resource_type:, resource_id:)
+      AuthorizationEngine.check_permission(
+        subject_type: subject_type,
+        subject_id: subject_id,
+        permission: permission,
+        resource_type: resource_type,
+        resource_id: resource_id
+      )
+    end
+
+    # Public API to find subjects with a permission
+    def find_subjects(resource_type:, resource_id:, permission:)
+      AuthorizationEngine.find_subjects(
+        resource_type: resource_type,
+        resource_id: resource_id,
+        permission: permission
+      )
+    end
+
+    # Public API to create relation tuples
+    def create_relation(object_type:, object_id:, relation:, subject_type:, subject_id:)
+      AuthorizationEngine.create_relation(
+        object_type: object_type,
+        object_id: object_id,
+        relation: relation,
+        subject_type: subject_type,
+        subject_id: subject_id
+      )
+    end
+
+    # Public API to delete relation tuples
+    def delete_relation(object_type:, object_id:, relation:, subject_type:, subject_id:)
+      AuthorizationEngine.delete_relation(
+        object_type: object_type,
+        object_id: object_id,
+        relation: relation,
+        subject_type: subject_type,
+        subject_id: subject_id
+      )
+    end
+  end
 end