graphql-armory 0.1.0.pre → 0.1.0.pre2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9bb288f28bfb93054aa3ff328b791ff7936dfb546d289671650bd19182b56177
-  data.tar.gz: 44d9b064622b91a9691499d48df611f4b544950fbbbdf8a49d470c7563c41a03
+  metadata.gz: 17454310f4c6b683fac81e5fc5e4ea5f810a645319eb083841e42910e7f881b3
+  data.tar.gz: cea12c9b171113f1cb3d6df4658676508056bab51335f8e937adabba18e28817
 SHA512:
-  metadata.gz: 4bc8f032f4f5305cfe298542ab63a7f0fac65118abb9011ee4af5fc48f7ddf66886b8cb11ac2ae300a296d0facd3a033e20e06daf23462b667bc9017d3dbea51
-  data.tar.gz: 87c9adeafec6dd55dcb8f3cc597e941afff6bab620d6e38ebcc4a4a9880bdfc8200c9fd926c36f67badfa1520dd61f416f86563a68fc164217e19c218105729e
+  metadata.gz: 915b3068e7fecaee1f409b24cbc0b24832053322da848e7a242302c701479ae293d5b735d9d4ab49784b7f950fbfedb909034f07ea90bf877cb815471926e660
+  data.tar.gz: 9d4809e01699f91be71abc2b2ac4209417ca5d5b39484f91ba492fc9c3bdc24a2d048b1c83c9c9e2aaf6238e193bdd9d17f4b14bdae5ed6c31ae0de4b1977250

data/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+## 0.1.0.pre2 (2026-10-29)
+
+Closes the known gaps of the authorization module.
+
+- `loads:` inside input objects: `include GraphQL::Armory::Authorization::Base` in the base input object loads them through
+  the user's scope; the audit reports input objects whose `loads:` skip it.
+
+- Audit of interfaces: an interface field is reported once, on the interface that declares it; `authorize: true` on an
+  interface field and interface fields whose field class lacks `Base` (such as Relay `Node.id`) on a bypassed implementer
+  are reported.
+
+- Global IDs in `loads:`: when the schema defines `object_from_id`, the id is decoded with it, a record of another model is
+  refused, and the record is looked up again inside the user's scope.
+
+## 0.1.0.pre (2026-10-29)
+
+First prerelease on RubyGems: Pundit and CanCanCan adapters, deny-by-default coverage, scoped lists and lookups, schema audit,
+visibility, argument rules, mutations and resolvers, interfaces and unions. The entries below describe it.
+
 - Interfaces and unions: an interface field with no rule is denied when an implementing type is a bypass, and the audit
   reports it; `include Base` in an interface or union is refused with a pointer to the possible types.
 

data/README.md

@@ -18,7 +18,7 @@ The first module is **authorization**. It plugs [Pundit](https://github.com/varv
 ## Install
 
 ```ruby
-gem "graphql-armory"
+gem "graphql-armory", "~> 0.1.0.pre2"  # a prerelease: `gem install graphql-armory --pre`
 gem "pundit"      # or "cancancan", whichever you use
 ```
 
@@ -97,7 +97,9 @@ field :invoice_via_ref, InvoiceType, authorize: :none, reason: "loaded through t
 end
 ```
 
-`find_by:` and `loads:` look the record up **inside the user's scope**, so another tenant's ID answers exactly like a missing one. Opt out of the scope for a `loads:` only on purpose, with `load_through_scope: false`; the audit lists it.
+`find_by:` and `loads:` (also inside input objects whose base class includes `Base`) look the record up **inside the user's scope**, so another tenant's ID answers exactly like a missing one. Opt out of the scope for a field's `loads:` only on purpose, with `load_through_scope: false`; the audit lists it. On `Execution::Next` the opt-out also reaches `loads:` nested in that field's input objects (the interpreter keeps those scoped), and the audit lists them too (`Query.field(filter.invoice_id)`). An input object that overrides `object_from_id` or defines `load_<argument>` itself is honoured on the interpreter and not seen by the audit.
+
+**Global IDs.** When your schema defines `object_from_id` (Relay global IDs), `loads:` decodes the id with it, refuses a record of another model, and looks the record up again inside the scope (one extra query per load). Without `object_from_id`, the id is the primary key. `object_from_id` must return the record itself, not a lazy value: a lazy value is denied. A decoder that raises `ActiveRecord::RecordNotFound` (like `GlobalID.find`) or `ArgumentError` (a malformed id) is answered like a missing record; other errors propagate. `loads:` of an interface or union (for example `Types::Node`) raises `ConfigurationError`: load a concrete type. Composite primary keys are not supported.
 
 ## The audit
 
@@ -224,7 +226,7 @@ end
 - An unknown `on_denied:` raises `ArgumentError`; a mutation with a rule but no model raises `ConfigurationError`.
 - **Class-level answers are weak.** With no loaded record of the model (no `loads:`, an empty `loads: [ID]`, or a `loads:` of another type) the rule is asked about the model's class: CanCan answers true for anyone holding the right, and a Pundit policy that reads `record` attributes raises. Load the record you are authorizing.
 - **`ready?` runs before authorization** (and, on the interpreter, before a failing `loads:`). Keep it free of side effects.
-- **`loads:` works on top-level arguments only.** Inside an input object it is not scoped, and the engines disagree (the interpreter raises, `Execution::Next` yields nil).
+- **`loads:` inside an input object** goes through the scope only when your base input object includes `Base` (`class Types::BaseInputObject < GraphQL::Schema::InputObject; include GraphQL::Armory::Authorization::Base; end`); otherwise the audit reports it as `:unscoped_load`.
 - **Do not put `authorize:` on a mutation field or on payload fields**; the mutation's own rule is the one that counts. A subclass that redeclares `authorize :none` is open to everyone, on purpose.
 
 ## Interfaces and unions
@@ -235,8 +237,9 @@ What an interface adds is its fields, declared once and resolved on many types:
 
 - A field with no rule is **covered** by the rule of the Base types that implement the interface (a plain implementer runs no check at all), unless one of them is a bypass (`authorize :none`). Then the field is **denied for every implementer**, because it cannot tell which type it runs on, and the audit reports it (`:field_without_rule`, for example `Document.number`). Declare it (`authorize: :none, reason:` or an action) to fix it.
 - `visible_when:` is not supported on an interface field; put it on the concrete types' fields.
-- `authorize: true` is not valid on an interface field: it is always denied, and the audit does not flag it. Use an action or `:none`.
-- An interface whose field class does not include `Base`, such as graphql-ruby's built-in Relay `Node`, runs no field check, so its `id` stays readable on a bypassed implementer. Give your own `Node` interface a Base field class if that matters.
+- `authorize: true` is not valid on an interface field: it is always denied, and the audit reports it. Use an action or `:none`.
+- An interface whose field class does not include `Base`, such as graphql-ruby's built-in Relay `Node`, runs no field check, so its `id` stays readable on a bypassed implementer. The audit reports it (`:unprotected`, `Node.id`); give your own `Node` interface a Base field class if that matters.
+- The audit reports an interface field once, on the interface that declares it, not again on each implementer.
 
 ## Telemetry
 
@@ -246,7 +249,7 @@ Pass `sinks: [->(signal, data) {}]`. Signals are `:allowed`, `:denied`, `:bypass
 
 Covered by the black-box suite in `spec/security`, on both engines: user A cannot read user B's objects by root field, nested association or `loads:`; lists never contain foreign objects; uncovered types fail closed and show in the audit; a field hidden with `visible?` is absent from introspection and error suggestions (that is graphql-ruby's behaviour, pinned by a test).
 
-Not covered yet: decoding global IDs in `loads:`. Policies must return `true`/`false`/`nil`; anything else raises `AdapterError`. Do not use `dataloader.request` inside policies; use `dataloader.with(...).load`.
+Policies must return `true`/`false`/`nil`; anything else raises `AdapterError`. Do not use `dataloader.request` inside policies; use `dataloader.with(...).load`.
 
 ## Engines
 
@@ -279,13 +282,23 @@ GRAPHQL_ARMORY_ENGINE=next docker compose run --rm test         # full suite, Ex
 GRAPHQL_VERSION="~> 2.4.0" docker compose run --rm test         # another graphql version
 ```
 
+### Releasing
+
+Releases are published from GitHub Actions with RubyGems Trusted Publishing (`.github/workflows/release.yml`): no API key is stored and no OTP is asked. Bump `GraphQL::Armory::VERSION` and the CHANGELOG on `main`, then push the matching tag:
+
+```
+git tag v0.1.0.pre2 && git push origin v0.1.0.pre2
+```
+
+The workflow checks that the tag matches the version, runs the specs and pushes the gem. It only publishes a tag on a commit of `main`. The `release` environment can require a maintainer's approval first (on a public repository, or a private one on a paid GitHub plan).
+
 ## Roadmap
 
 Status: ✅ done, 🚧 in progress, ⬜ not started. Update this table in the same PR that changes a module.
 
 | Order | Module | Status | Current limits |
 |---|---|---|---|
-| 1 | Authorization (Pundit, CanCanCan) | 🚧 | Pundit and CanCanCan done (the audit checks less with CanCanCan). Not covered yet: decoding global IDs in `loads:`. `Execution::Next` needs graphql >= 2.6.2. Unreleased. |
+| 1 | Authorization (Pundit, CanCanCan) | ✅ | Released in 0.1.0.pre2 (prerelease). Pundit and CanCanCan (the audit checks less with CanCanCan). Global IDs in `loads:` decoded through `object_from_id`; `loads:` inside input objects scoped with `include Base`. `Execution::Next` needs graphql >= 2.6.2. |
 | 2 | Encrypted, versioned IDs and cursors | ⬜ | Research not started. |
 | 3 | Persisted queries / operation whitelisting | ⬜ | Research not started. |
 | 4 | Rate limiting | ⬜ | Research not started. |

data/lib/graphql/armory/authorization/audit.rb

@@ -38,6 +38,7 @@ module GraphQL
 
           audited_types(schema).each { |type| audit_type(type, findings) }
           schema.types.each_value { |type| audit_interface(type, schema, findings) if type.kind.interface? && !type.introspection? }
+          schema.types.each_value { |type| audit_input_loads(type, findings) if type.kind.input_object? && !type.introspection? }
           findings.report
         end
 
@@ -72,18 +73,32 @@ module GraphQL
           end
         end
 
-        # An interface field with no rule is denied when any implementer is a bypass; the fix is to declare it.
+        # Interface fields are reported once, on the interface that declares them, not on every implementer.
+        # Undeclared ones are denied when an implementer is a bypass; ones whose field class lacks Base are
+        # never checked, so on a bypassed implementer they are open; `authorize: true` names no action.
         def audit_interface(interface, schema, findings)
-          return unless Integration.bypassed_implementer?(interface, schema)
-
-          interface.fields.each_value do |field|
-            next unless field.respond_to?(:armory_declared) && field.armory_declared.nil?
+          bypassed = Integration.bypassed_implementer?(interface, schema)
+          interface.own_fields.each_value do |field|
+            path = "#{interface.graphql_name}.#{field.original_name}"
+            unless field.respond_to?(:armory_declared)
+              findings.problem(:unprotected, path, "its field class does not include Base, so it is not checked on a bypassed implementer") if bypassed
+              next
+            end
 
-            findings.problem(:field_without_rule, "#{interface.graphql_name}.#{field.original_name}",
-                             "declares no rule and an implementing type is bypassed, so it is denied")
+            case field.armory_declared
+            when true
+              findings.problem(:field_without_rule, path, "uses authorize: true, but an interface has no action of its own, so it is always denied")
+            when nil
+              findings.problem(:field_without_rule, path, "declares no rule and an implementing type is bypassed, so it is denied") if bypassed
+            end
           end
         end
 
+        # A field an implementer inherits from an interface is reported on the interface.
+        def interface_field?(field)
+          field.owner.respond_to?(:kind) && field.owner.kind.interface?
+        end
+
         def model_of(type, path, findings)
           type.armory_model
         rescue ConfigurationError => error
@@ -101,11 +116,13 @@ module GraphQL
         def audit_fields(type, findings, model:, bypassed:, reported:)
           type.all_field_definitions.each do |field|
             path = "#{type.graphql_name}.#{field.original_name}"
-            next findings.problem(:field_without_rule, path, "its field class does not include Base, so it is denied") if bypassed && !field.respond_to?(:armory_declared)
+            # An inherited interface field is reported as uncovered on its interface; every other check still runs here.
+            inherited = bypassed && interface_field?(field)
+            next findings.problem(:field_without_rule, path, "its field class does not include Base, so it is denied") if bypassed && !inherited && !field.respond_to?(:armory_declared)
             next unless field.respond_to?(:armory_declared)
             next audit_resolver(field, path, findings) if field.resolver.respond_to?(:armory_rule)
 
-            audit_declaration(field, path, findings, model: model, bypassed: bypassed, reported: reported)
+            audit_declaration(field, path, findings, model: model, bypassed: bypassed && !inherited, reported: reported)
             audit_visibility(field, path, findings, model: model, reported: reported)
             audit_loads(field, path, findings)
             audit_arguments(field, path, findings, reported: reported)
@@ -170,12 +187,37 @@ module GraphQL
         def audit_loads(field, path, findings)
           return if field.armory_load_through_scope?
 
-          field.all_argument_definitions.select(&:loads).each do |argument|
-            name = GraphQL::Schema::Member::BuildType.underscore(argument.graphql_name)
+          opted_out_loads(field.all_argument_definitions, Set.new).each do |name|
             findings.problem(:unscoped_load, "#{path}(#{name})", "loads through the app's object_from_id, not through the user's scope")
           end
         end
 
+        # Execution::Next loads `loads:` nested in input objects with the field's loader, so a field's opt-out
+        # reaches them too: list them as `filter.invoice_id`. `seen` stops recursive input types.
+        def opted_out_loads(arguments, seen, prefix = nil)
+          arguments.flat_map do |argument|
+            name = [prefix, GraphQL::Schema::Member::BuildType.underscore(argument.graphql_name)].compact.join(".")
+            next [name] if argument.loads
+
+            input = argument.type.unwrap
+            next [] unless input.kind.input_object? && seen.add?(input)
+
+            opted_out_loads(input.all_argument_definitions, seen, name)
+          end
+        end
+
+        # An input object loads its own `loads:` arguments; without Base they skip the user's scope.
+        def audit_input_loads(input, findings)
+          return if input.respond_to?(:armory_scoped_loads?)
+
+          # A mutation's generated input (`from_resolver`) is loaded, scoped, by the mutation itself.
+          input.all_argument_definitions.select(&:loads).reject(&:from_resolver?).each do |argument|
+            name = GraphQL::Schema::Member::BuildType.underscore(argument.graphql_name)
+            findings.problem(:unscoped_load, "#{input.graphql_name}(#{name})",
+                             "its input object class does not include Base, so it loads through the app's object_from_id, not the user's scope")
+          end
+        end
+
         # Collects what one audit finds.
         class Findings
           def initialize

data/lib/graphql/armory/authorization/integration/base.rb

@@ -21,11 +21,13 @@ module GraphQL
           elsif base <= GraphQL::Schema::Resolver
             base.extend(Integration::ResolverClass)
             base.include(Integration::Resolver)
+          elsif base <= GraphQL::Schema::InputObject
+            base.extend(Integration::InputObject)
           elsif base <= GraphQL::Schema::Argument
             base.include(Integration::Argument)
           else
             raise ArgumentError,
-                  "GraphQL::Armory::Authorization::Base can only be included in a GraphQL object, field, argument, resolver or mutation class, not #{base}. Interfaces and unions are not authorized themselves: declare the rule on their possible types"
+                  "GraphQL::Armory::Authorization::Base can only be included in a GraphQL object, field, argument, input object, resolver or mutation class, not #{base}. Interfaces and unions are not authorized themselves: declare the rule on their possible types"
           end
         end
       end

data/lib/graphql/armory/authorization/integration/field.rb

@@ -38,7 +38,7 @@ module GraphQL
           def object_from_id(type, id, context)
             return super unless @armory_load_through_scope
 
-            Integration.find(type, nil, id, context)
+            Integration.load(type, id, context)
           end
 
           # A `loads:` id that is not found is answered like a denial, so the client cannot tell the two apart.

data/lib/graphql/armory/authorization/integration/input_object.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module Armory
+    module Authorization
+      module Integration
+        # Extended into an input object class by `include GraphQL::Armory::Authorization::Base`.
+        # graphql-ruby loads an input object's `loads:` arguments with the class's own loader, not the
+        # field's, so the scoped lookup has to live here too.
+        #
+        #   class Types::BaseInputObject < GraphQL::Schema::InputObject
+        #     include GraphQL::Armory::Authorization::Base
+        #   end
+        module InputObject
+          def armory_scoped_loads?
+            true
+          end
+
+          def object_from_id(type, id, context)
+            Integration.load(type, id, context)
+          end
+
+          # A `loads:` id that is not found is answered like a denial, so the client cannot tell the two apart.
+          def load_application_object_failed(error)
+            raise GraphQL::UnauthorizedError.new(object: nil, type: error.argument.loads, context: error.context)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/armory/authorization/integration/resolver.rb

@@ -55,7 +55,7 @@ module GraphQL
 
           # `loads:` arguments are looked up inside the user's scope, so a foreign id answers like a missing one.
           def object_from_id(type, id, context)
-            Integration.find(type, nil, id, context)
+            Integration.load(type, id, context)
           end
 
           def load_application_object_failed(error)

data/lib/graphql/armory/authorization/integration.rb

@@ -6,6 +6,7 @@ require "graphql/armory/authorization/integration/find_by"
 require "graphql/armory/authorization/integration/field"
 require "graphql/armory/authorization/integration/argument"
 require "graphql/armory/authorization/integration/resolver"
+require "graphql/armory/authorization/integration/input_object"
 require "graphql/armory/authorization/integration/base"
 
 module GraphQL
@@ -62,6 +63,36 @@ module GraphQL
           record if record && allowed?(record, rule, context)
         end
 
+        # Loads a `loads:` argument inside the user's scope. When the schema defines `object_from_id` (global
+        # IDs), it decodes the id; the record must be of the type's model, and is then looked up again
+        # through the scope, so a foreign id still looks like a missing one. Otherwise the id is the primary key.
+        def self.load(type, id, context)
+          schema = context.schema
+          return find(type, nil, id, context) unless decodes_ids?(schema) && type.respond_to?(:armory_model)
+
+          model = type.armory_model
+          record = decode(schema, id, context)
+          return nil unless record.is_a?(model)
+
+          find(type, nil, record.public_send(model.primary_key), context)
+        end
+
+        # `GlobalID.find`, graphql-ruby's documented `object_from_id`, raises for a missing record, and a
+        # decoder may raise for a malformed id. Both must answer like a record out of scope: nil.
+        def self.decode(schema, id, context)
+          schema.object_from_id(id, context)
+        rescue StandardError => error
+          raise unless error.is_a?(ArgumentError) || error.class.name == "ActiveRecord::RecordNotFound"
+
+          nil
+        end
+        private_class_method :decode
+
+        # graphql-ruby's default `object_from_id` only raises, so an override is the app decoding its IDs.
+        def self.decodes_ids?(schema)
+          schema.method(:object_from_id).owner != GraphQL::Schema.singleton_class
+        end
+
         # An interface field with no rule of its own cannot name the type it is resolved on, so it is only
         # covered when no implementer is a bypass: a field on a bypassed type is denied, and so is this one.
         def self.bypassed_implementer?(interface, schema)

data/lib/graphql/armory/version.rb

@@ -2,6 +2,6 @@
 
 module GraphQL
   module Armory
-    VERSION = "0.1.0.pre"
+    VERSION = "0.1.0.pre2"
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: graphql-armory
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre
+  version: 0.1.0.pre2
 platform: ruby
 authors:
 - Israel
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: graphql
@@ -34,7 +33,6 @@ description: 'Open-source extensions for graphql-ruby built on its public extens
   points. The first module is authorization: deny-by-default coverage, scoped lists
   and connections, IDOR-safe lookups, mutations, interfaces and unions, visibility
   driven by the policy, and a schema audit for CI.'
-email:
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -65,6 +63,7 @@ files:
 - lib/graphql/armory/authorization/integration/base.rb
 - lib/graphql/armory/authorization/integration/field.rb
 - lib/graphql/armory/authorization/integration/find_by.rb
+- lib/graphql/armory/authorization/integration/input_object.rb
 - lib/graphql/armory/authorization/integration/object.rb
 - lib/graphql/armory/authorization/integration/resolver.rb
 - lib/graphql/armory/authorization/integration/schema.rb
@@ -84,7 +83,6 @@ metadata:
   changelog_uri: https://github.com/israelb/graphql-armory/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/israelb/graphql-armory/issues
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -95,12 +93,11 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
-rubygems_version: 3.4.19
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: 'Authorization for graphql-ruby: Pundit and CanCanCan, deny-by-default, with
   a schema audit.'