has_helpers 5.0.2

data/app/lib/has_helpers/search/search_utils.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module Search
+    module SearchUtils
+      class << self
+        DEFAULT_QUERY_OPTIONS = { page: 1, per_page: 15 }.freeze
+
+        def resources(user, application, resources)
+          result = Array(resources).map(&:strip)
+
+          if result.empty?
+            global_resources(user, application).map(&:name)
+          else
+            resource_indexes = []
+            resources.each do |resource|
+              resource_indexes << resource
+            end
+            resource_indexes
+          end
+        end
+
+        def global_resources(_user, application)
+          application.resources.
+            select { |r| r.resource_type == ::HasHelpers::ResourceType::BASE }.
+            select do |r|
+            r.klass.search_index rescue nil
+          end
+        end
+
+        def provider
+          if ::HasHelpers::Feature.active?(:sql_search)
+            ::HasHelpers::Query::Sql
+          else
+            ::HasHelpers::Query::Elasticsearch
+          end
+        end
+
+        def base_query_options(kwarg_options, user)
+          DEFAULT_QUERY_OPTIONS.merge(
+            kwarg_options.slice(:with)
+          ).
+            tap do |options|
+            # `with` may come from the GraphQL JSON scalar with string keys —
+            # symbolize them so the organization_id sanitization below sees them.
+            options[:with] = (kwarg_options[:with] || {}).symbolize_keys
+
+            if options[:with].has_key?(:organization_id)
+              given_org_id = options[:with][:organization_id].to_i
+              options[:with].delete(:organization_id) unless given_org_id == 0 || given_org_id == user.organization_id
+            end
+
+            unless options[:with][:organization_id]
+              options[:with][:organization_id] = user.organization_id
+            end
+          end
+        end
+
+        def valid_resource?(resource, application)
+          application.resources.any? { |r| r.name == resource }
+        end
+
+        def validate_resource!(resource, application)
+          resource = resource.sub(/^::/, "")
+          unless valid_resource?(resource, application) || valid_resource?(resource.safe_constantize, application)
+            {
+              status: 400 # BAD_REQUEST
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/app/lib/has_helpers/search/sql_search.rb

@@ -0,0 +1,219 @@
+# frozen_string_literal: true
+
+class HasHelpers::Search::SqlSearch
+  prepend ::SearchExtensions::ProviderExtensions
+  include ::HasHelpers::Search::Provider
+
+  def search_options(prefix, screen = prefix, query)
+    super.merge(organization_id: current_user.organization_id)
+  end
+
+  def exec_query(resource:, query:, options:, filter:)
+    resource_klasses = Array(resource).map { |r| normalize_resource_to_class(r) }.compact.uniq
+
+    base_limit = Integer(options.dig(:with, :limit)) rescue Rails.application.config.x.search_default_limit
+    limit = base_limit * resource_klasses.size
+
+    intermediate_results = resource_klasses.map do |klass|
+      # Is the class have a custom search
+      if klass.respond_to?(:search)
+        sql_results = klass.search(query, sql_search_options(options))
+
+        # NOTE: Previously pagination was required.
+        if defined?(ActiveRecord::Relation) && sql_results.is_a?(ActiveRecord::Relation)
+          scoped = apply_org_scope_relation(sql_results, options)
+          scoped = apply_filters_relation(scoped, filter)
+          scoped.limit(limit)
+        else
+          # If the search already return the response (e.g. an Array, Hash).
+          sql_results
+        end
+      else
+        resource_relation_name, owner_relation_name, owner_relation = owner_relation_from_scope(klass)
+
+        # If an owner relation exists then search on its name and sub_item columns.
+        # Otherwise fallback to searching the name column for the base relation.
+        if owner_relation
+          scope = owner_relation
+          search_vector = "CONCAT_WS(' ', #{ owner_relation_name }.name, #{ owner_relation_name }.sub_item)"
+        else
+          scope = klass
+          search_vector = "#{ resource_relation_name }.name"
+        end
+
+        table_name = owner_relation ? owner_relation_name : resource_relation_name
+        scoped = apply_org_scope_table(scope, table_name, options)
+        scoped = apply_filters_relation(scoped, filter)
+        scoped.where(::HasHelpers::Query::Sql.sql(search_vector, query)).limit(limit)
+      end
+    end
+
+    { results: intermediate_results.flatten }
+  end
+
+  private
+
+  def sql_search_options(options)
+    options.tap do |opts|
+      if opts[:with] && opts[:with][:organization_id]
+        # TODO: deprecate the :organization option in favor of with: { organization_id: } •
+        options.merge!(organization_id: opts[:with][:organization_id])
+      end
+    end
+  end
+
+  # Accepts a scope which may be either an ActiveRecord model class or an ActiveRecord::Relation
+  # object. Owner views are joined into the scope if possible. If no owner view is detected then
+  # nil is returned.
+  def join_owner_info(scope, options = {})
+    scope = scope.all # Ensure that scope is an ActiveRecord::Relation.
+
+    _, owner_relation_name, owner_relation = owner_relation_from_scope(scope)
+
+    if owner_relation
+      # Detect column names for the owner relation.
+      owner_relation_columns = scope.klass.instance_eval do
+        @owner_column_names ||= Class.new(::ActiveRecord::Base) do
+          self.table_name = owner_relation_name
+        end.column_names
+      end
+
+      # Add select clauses for owner columns.
+      owner_relation_columns.each do |owner_column|
+        owner_relation.select_values << "#{ owner_relation_name }.#{ owner_column } AS #{ owner_column }"
+      end
+
+      # Paginate results - preserve the pagination from the paginated_collection option or the original scope.
+      # This is done by first evaluating the `owner_relation` by calling `#to_a` on it, then paginating the
+      # results to get a paginated collection (i.e. WillPaginate::Collection instance). Then assign the pagination
+      # info to the collection.
+      paginated_collection = options[:paginated_collection] || scope
+      owner_relation.to_a.paginate(page: 1, per_page: owner_relation.size).tap do |paginated_results|
+        # Just get a paginated collection for the results
+        PAGINATION_ATTRS.each do |attr|
+          # Copy pagination data to the search results.
+          # E.g., @total_entries = 321
+          paginated_results.instance_variable_set("@#{ attr }", paginated_collection.send(attr))
+        end
+      end
+    end
+  end
+
+  # wrapper around the class method
+  def owner_relation_from_scope(scope)
+    ::HasHelpers::Query::Provider.owner_relation_from_scope(scope)
+  end
+
+  def apply_org_scope_relation(rel, options)
+    org_id = options.dig(:with, :organization_id)
+    return rel unless org_id
+    return rel unless rel.respond_to?(:klass) && rel.klass.respond_to?(:column_names)
+    return rel unless rel.klass.column_names.include?("organization_id")
+    rel.where("#{rel.klass.table_name}.organization_id = ?", org_id)
+  end
+
+  def apply_org_scope_table(scope, table_name, options)
+    org_id = options.dig(:with, :organization_id)
+    return scope unless org_id
+
+    conn = ActiveRecord::Base.connection
+    return scope unless table_name.present? &&
+                        conn.data_source_exists?(table_name) &&
+                        conn.column_exists?(table_name, :organization_id)
+
+    scope.where("#{table_name}.organization_id = ?", org_id)
+  end
+
+  # Example:
+  #
+  # filters = [
+  #   { field: "name", op: "EQ", value: "Jose" },
+  #   { "field" => "age", "op" => "IN", "values" => [18, 21] }
+  # ]
+  #
+  # normalize_filters(filters)
+  # => [
+  #      { "field"=>"user_name", "op"=>"eq", "value"=>"Jose" },
+  #      { "field"=>"age", "op"=>"in", "value"=>[18, 21] }
+  #    ]
+  def normalize_filters(filter)
+    return [] if filter.nil?
+
+    list = filter.is_a?(Array) ? filter : [filter]
+
+    list.compact.map do |h|
+      next nil unless h.is_a?(Hash)
+
+      field = (h[:field] || h["field"]).to_s
+      field = field.underscore if field.respond_to?(:underscore)
+      op = (h[:op] || h["op"]).to_s.downcase
+      value = h[:value] || h["value"]
+      values = h[:values] || h["values"] || value
+
+      { "field" => field, "op" => op, "value" => values }
+    end.compact
+  end
+
+  # Example usage:
+  #
+  # filters = [
+  #   { field: "age", op: "greater_than", value: 18 },
+  #   { field: "id", op: "in", values: [1, 2, 3] }
+  # ]
+  # rel = User.all
+  # scoped = apply_filters_relation(rel, filters)
+  #
+  # # Produces:
+  # # SELECT "users".* FROM "users"
+  # # WHERE "users"."age" > 18
+  # #   AND "users"."id" IN (1, 2, 3)
+  def apply_filters_relation(rel, filter)
+    filters = normalize_filters(filter)
+    return rel if filters.empty?
+
+    table = rel.klass.table_name
+    columns = rel.klass.column_names.map(&:to_s)
+
+    filters.reduce(rel) do |scope, f|
+      field = f["field"]
+      next scope unless columns.include?(field)
+
+      op = f["op"]
+      val = f["value"]
+
+      case op
+      when "equal"
+        scope.where("#{table}.#{field} = ?", val)
+      when "not_equal"
+        scope.where.not("#{table}.#{field} = ?", val)
+      when "in"
+        arr = Array(val).compact
+        arr.empty? ? scope.none : scope.where("#{table}.#{field} IN (?)", arr)
+      when "not_in"
+        arr = Array(val).compact
+        arr.empty? ? scope : scope.where.not("#{table}.#{field} IN (?)", arr)
+      when "greater_than"
+        scope.where("#{table}.#{field} > ?", val)
+      when "less_than"
+        scope.where("#{table}.#{field} < ?", val)
+      else
+        scope
+      end
+    end
+  end
+
+  def normalize_resource_to_class(r)
+    return r.base_class if r.is_a?(Class)
+
+    name = r.to_s
+    begin
+      name = ::HasHelpers::ApplicationHelper.translate_klass_name(name)
+    rescue
+      # ignore
+    end
+
+    name = name.to_s
+    name = name.camelize
+    name.safe_constantize&.base_class
+  end
+end

data/app/lib/has_helpers/search.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module Search
+    def self.search(user, application, resources:, query:, options:)
+      validate_resources!(resources, application)
+
+      resources = ::HasHelpers::Search::SearchUtils.resources(user, application, resources)
+
+      base_query_options = ::HasHelpers::Search::SearchUtils.base_query_options(options.to_h, user)
+
+      search_results =
+        if resources.present?
+          ::HasHelpers::Search::SearchUtils.provider.search(resource: resources, query: query, options: base_query_options)
+        else
+          { result: [] }
+        end
+
+      {
+        results: search_results[:results],
+        total_entries: search_results[:total_entries],
+        current_page: search_results[:current_page],
+        per_page: search_results[:per_page]
+      }
+    end
+
+    class << self
+      private
+
+      def validate_resources!(resources, application)
+        unless resources.any?
+          raise GraphQL::ExecutionError, "No resources specified. Please provide a resource(s)."
+        end
+
+        invalid_resources = resources.each_with_object([]) do |resource, arr|
+          invalid = ::HasHelpers::Search::SearchUtils.validate_resource!(resource, application)
+          arr << "'#{resource}'" if invalid && invalid[:status] == 400
+        end
+
+        if invalid_resources.any?
+          raise GraphQL::ExecutionError, "Invalid Resource: #{invalid_resources.join(" ")}"
+        end
+      end
+    end
+  end
+end

data/app/models/ability.rb

@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+class Ability
+  if defined?(CanCan::Ability)
+    include CanCan::Ability
+  end
+
+  attr_reader :application, :resource_klass, :user
+
+  # The ability class is used by CanCan to authorize create/read/update/delete access to resources.
+  # Permissions are defined for each application in config/initializers/applications.rb
+  # The roles table is on hqAdmin and HQSSO, so roles can be added/modified/assigned there.
+  # When a user logs in, it will collect their roles, serialize the associated permissions, and cassy
+  # will send them with the extra_attributes to be stored as a hash in the users.permissions field.
+  # If they have access to everything, the permissions hash will have the key :all, such as:
+  #
+  #   {:all => :permissions}
+  #
+  # This is so that the ability model can immediately see they have all access and tell CanCan, without
+  # having to set up and check permissions for individual resources
+  # Otherwise it will be a nested structure representing Application/Section/View and look something like:
+  #
+  #   {
+  #     "AgenciesHQ"=>{
+  #       "Advisors"=>{"permissions" => [:read, :create, :update, :delete]},
+  #       "Policies"=>{"permissions" => [:read]},
+  #       ...
+  #     },
+  #     "CarriersHQ" => {...}
+  #   }
+
+  def initialize(user, application, resource_klass = nil)
+    @application = application
+    @resource_klass = resource_klass && resource_klass.try(:base_class)
+    @user = user
+
+    # Set aliases
+    ability_aliases!
+
+    authorize_resources!
+  end
+
+  def safe_params(params)
+    return params unless resource
+    params.to_h.each do |attribute, values|
+      if /\A(?<association_name>.*)_attributes\z/ =~ attribute && (association = resource_klass.reflect_on_association(association_name)) && nested_resources.include?(find_resource(association.klass.name))
+        if association.macro == :has_many
+          values.reject! { |_, attribute_values| unsafe_nested_attributes?(attribute_values.to_h, association) }
+        else
+          params.reject! { |attribute_name, attribute_values| attribute_name == attribute && unsafe_nested_attributes?(attribute_values.to_h, association) }
+        end
+      end
+    end
+  end
+
+  private
+
+  def authorize_resources!
+    if application == ::HasHelpers::Application::HQVIEW
+      can(:read, user)
+
+      [Policy, Contract, License, Advisor, Client, Firm].each do |resource_klass|
+        can(:read, resource_klass, &organization_match_proc)
+        can(:read, find_resource(resource_klass.name))
+      end
+
+      # HQView users can create, delete, and comment on discussions
+      can(:manage, ::HasOutlook::Discussion)
+    else
+      # Can always manage self
+      can(:manage, user)
+
+      # Lazy Load Permissions
+      can do |action, subject_class, subject|
+        memoized_permission_hash = memoized_permissions[subject || subject_class] ||= {}
+        memoized_permission_hash.fetch(action) do |k|
+          memoized_permission_hash[k] =
+            if is_blocked_org_firm_action?(action, subject)
+              false
+            elsif subject && subject_class == ::HasHelpers::Resource
+              authorize_resource(action, subject)
+            elsif subject && subject.is_a?(String)
+              authorize_resource_by_name(action, subject)
+            elsif subject && subject_class == Module
+              # If you pass a Class into can?, then subject is NULL
+              # If you pass a Module into can?, then subject should be NULL, but it contains the module
+              # This is a CanCanCan bug
+              authorize_class(action, subject)
+            elsif subject
+              authorize_subject(action, subject)
+            else
+              authorize_class(action, subject_class)
+            end
+        end
+      end
+    end
+
+    if !user.is_admin?
+      cannot(:manage, HasHelpers::Organization)
+    end
+  end
+
+  # Returns true if the subject is an org firm and the action is blocked.
+  # For an org firm, destroy is always blocked. In addition, if the user is
+  # NOT an admin, then edit, update, and merge are also blocked.
+  def is_blocked_org_firm_action?(action, subject)
+    subject &&
+      subject.class.try(:base_class).try(:name) == "Firm" &&
+      subject.try(:linked_organization) &&
+      (action == :destroy || (!user.is_admin? && [:edit, :update, :merge].include?(action))
+      )
+  end
+
+  def authorize_class(action, subject_class)
+    class_name = subject_class.respond_to?(:base_class) ? subject_class.base_class.name : subject_class.name
+    authorize_class_name(action, class_name)
+  end
+
+  def authorize_class_name(action, class_name)
+    if can_manage_all?
+      true
+    elsif nested_resource_permissions.include?(class_name)
+      (nested_resource_permissions[class_name]["permissions"] & aliases_for_action(action).map(&:to_s)).present?
+    else
+      current_resource = find_resource(class_name)
+      if current_resource && [::HasHelpers::ResourceType::BASE.id, ::HasHelpers::ResourceType::SUB.id].include?(current_resource.resource_type_id)
+        application_permissions.include?(class_name) &&
+          (application_permissions[class_name]["permissions"] & aliases_for_action(action).map(&:to_s)).present?
+      else
+        nested_resources.map(&:name).exclude?(class_name)
+      end
+    end
+  end
+
+  def authorize_subject(action, subject)
+    authorize_class(action, subject.class) && organization_match_proc.call(subject) && authorize_support_user(action, subject)
+  end
+
+  # Other users cannot create, update, or destroy support users
+  def authorize_support_user(action, subject)
+    !(subject.is_a?(HasHelpers::User) && subject.is_support && expand_actions([:create, :update, :destroy]).include?(action))
+  end
+
+  def authorize_resource(action, resource)
+    if (klass = resource.klass(safe: true))
+      authorize_class(action, klass)
+    else
+      authorize_class_name(action, resource.name)
+    end
+  end
+
+  def authorize_resource_by_name(action, resource_name)
+    normalized_name = resource_name.classify.tr(" ", "")
+    nested_resource = nested_resources.detect { |r| r.alias_name == normalized_name || r.name == normalized_name || r.name.end_with?("::#{normalized_name}") }
+    if nested_resource
+      authorize_resource(action, nested_resource)
+    elsif (resource_klass = normalized_name.safe_constantize)
+      authorize_class(action, resource_klass)
+    else
+      authorize_class_name(action, normalized_name)
+    end
+  end
+
+  def ability_aliases!
+    alias_action :cards, to: :read
+    alias_action :download, to: :read
+    alias_action :favorite, to: :read
+    alias_action :copy, to: :create
+    alias_action :delete, to: :destroy
+    alias_action :email, to: :export
+    alias_action :re_run, to: :update
+  end
+
+  def can_manage_all?
+    !user.organization.is_use_roles_for_authorization ||
+      user.permissions_hash.has_key?("all") ||
+      application_permissions.has_key?("all") ||
+      user.is_support?
+  end
+
+  # Not all resources have an organization. These are the multiple avenues in which we can find the organization
+  def organization_match_proc
+    @organization_match_proc ||=
+      -> resource do
+        organization_id = resource.is_a?(::HasHelpers::Organization) && resource.id
+        organization_id ||= resource.respond_to?(:organization_id) && resource.organization_id
+        organization_id ||= resource.respond_to?(:owner) && resource.owner && resource.owner.respond_to?(:organization_id) && resource.owner.organization_id
+        organization_id ||= resource.respond_to?(:link) && resource.link && resource.link.respond_to?(:organization_id) && resource.link.organization_id
+        user.organization_id == organization_id || !organization_id || resource.try(:skip_organization_match_for_authorization)
+      end
+  end
+
+  def unsafe_nested_attributes?(nested_attributes, association)
+    (nested_attributes.include?(:X) && cannot?(:delete, association.klass)) ||
+      (nested_attributes.include?(:id) && cannot?(:update, association.klass)) ||
+      (nested_attributes.exclude?(:id) && cannot?(:create, association.klass))
+  end
+
+  def application_permissions
+    @application_permissions ||= user.permissions_hash[application.name] || {}
+  end
+
+  def application_resources
+    @application_resources ||= application.resources
+  end
+
+  def resource_permissions
+    @resource_permissions ||= (resource_klass && application_permissions[resource_klass.name]) || {}
+  end
+
+  def resource
+    @resource ||= resource_klass && find_resource(resource_klass.name)
+  end
+
+  def nested_resources
+    @nested_resources ||= (resource && resource.resources.to_a) || []
+  end
+
+  def nested_resource_permissions
+    @nested_resource_permissions ||= Array(resource_permissions["nested_resources"]).inject(Hash.new, :merge)
+  end
+
+  def find_resource(resource_name)
+    application_resources.detect { |r| r.name == resource_name && r.resource_type_id == ::HasHelpers::ResourceType::BASE.id } ||
+      application_resources.detect { |r| r.name == resource_name && r.resource_type_id == ::HasHelpers::ResourceType::SUB.id } ||
+      application_resources.detect { |r| r.name == resource_name && r.parent_id == nil } ||
+      application_resources.detect { |r| r.name == resource_name }
+  end
+
+  def memoized_permissions
+    @memoized_permissions ||= {}
+  end
+end

data/app/models/has_helpers/application.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  class Application < ApplicationRecord
+    self.table_name = :applications
+    include ::HasHelpers::Constant
+
+    # Allow this to be preinitialized from other code locations. This is useful for setting up tests with Combustion and not needing to add test code to this file.
+    APPLICATIONS ||= []
+
+    has_many :resources, dependent: :destroy
+
+    def url
+      @url ||= if ENV["ENV_NAME"] && ENV["ENV_NAME"].include?("preview") # remove this if the url for preview below works
+        production_url
+      else
+        case ::HasUtils::Env.current_environment
+        when ::HasUtils::Env::PRODUCTION
+          production_url
+        when ::HasUtils::Env::PREVIEW, ::HasUtils::Env::STAGING
+          staging_url
+        else
+          development_url
+        end
+      end
+    end
+
+    def self.project
+      Rails.application.class.module_parent_name.downcase
+    end
+
+    def self.current_application(request = nil)
+      if ::HasUtils::Env.development? && ENV["APP"] # only for develoopment specify app by environment var. `APP=HQView rails s`. Needed because hqview, advisorshq and agencieshq are in the same project
+        lookup(ENV["APP"])
+      elsif ::HasUtils::Env.development? && request && (request.host == "localhost" || request.host =~ /\A(192\.168\.|10\.)/)
+        port_regex = /:#{request.port}/
+        APPLICATIONS.detect { |application| application.url =~ port_regex }
+      else # GCP Environments (Production, Staging, Preview & PR)
+        begin
+          "HasHelpers::Application::#{request.host.split(".")[-2].upcase}".constantize
+        rescue NameError
+          lookup(project) # needed for when IP is the url (health check and user keying in IP address in the browser address bar / won't work for advisorshq and hqview)
+        end
+      end
+    end
+  end
+end

data/app/models/has_helpers/application_record.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  class ApplicationRecord < ::ActiveRecord::Base
+    self.abstract_class = true
+  end
+end