insights-api-common 3.7.0 → 3.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 81867b9d7ef11af5730e42563f88c156e7f51c2ef9e474990942f68535483fee
-  data.tar.gz: bba675752b9788c7fff6e4375b2301217a063f291713d32694a49227c8bed981
+  metadata.gz: 7d2889f1fb8a92c64f95de6f5d4a97f111d35e796a2ab4fb6a6b54ade5bbef05
+  data.tar.gz: 951defb8fb43a566b3f16b49e76f340d95d68f839831c1d6896b72c91dd0428d
 SHA512:
-  metadata.gz: 40c3eab1a34663c42f8d85416d5b30d32d2066235dbe7bf86992860aa6a8ebd551b0c800ec80b0d8b82ef69e17707a79e2eeed4737205f678fe0c35fe41489ee
-  data.tar.gz: fc3a7e98ca9a116e94347ba8a09892628299c37571fa940063f5ddd95915ffc633b76170c4b738943c0ab3c4f4484f45f790e68a19494339b0876a3426232202
+  metadata.gz: 37ea90782a5dad4f376bcc9b99f051394e855b02f4689c93c8049f7a292cf373da4e4f20f8730efd4f8830e6a680b14e61849c2bf3c5198104b5efb9c167b9ef
+  data.tar.gz: 8d331fdbfa57116010b32374e8dfc0ef016249336db7e86dc40d5f685f2f382ff2277064aea57dc9eca451e8be1248f40039828f97762358f3d0d7f9c121f9ed

data/lib/insights/api/common/application_controller_mixins/parameters.rb

@@ -90,7 +90,11 @@ module Insights
 
           def filtered
             check_if_openapi_enabled
-            Insights::API::Common::Filter.new(model, safe_params_for_list[:filter], api_doc_definition).apply
+            Insights::API::Common::Filter.new(model, safe_params_for_list[:filter], api_doc_definition, extra_attributes_for_filtering).apply
+          end
+
+          def extra_attributes_for_filtering
+            {}
           end
 
           def pagination_limit

data/lib/insights/api/common/filter.rb

@@ -5,13 +5,30 @@ module Insights
         INTEGER_COMPARISON_KEYWORDS = ["eq", "gt", "gte", "lt", "lte", "nil", "not_nil"].freeze
         STRING_COMPARISON_KEYWORDS  = ["contains", "contains_i", "eq", "eq_i", "starts_with", "starts_with_i", "ends_with", "ends_with_i", "nil", "not_nil"].freeze
 
-        attr_reader :apply, :arel_table, :api_doc_definition
-
-        def initialize(model, raw_filter, api_doc_definition)
-          self.query          = model
-          @arel_table         = model.arel_table
-          @raw_filter         = raw_filter
-          @api_doc_definition = api_doc_definition
+        attr_reader :apply, :arel_table, :api_doc_definition, :extra_filterable_attributes, :model
+
+        # Instantiates a new Filter object
+        #
+        # == Parameters:
+        # model::
+        #   An AR model that acts as the base collection to be filtered
+        # raw_filter::
+        #   The filter from the request query string
+        # api_doc_definition::
+        #   The documented object definition from the OpenAPI doc
+        # extra_filterable_attributes::
+        #   Attributes that can be used for filtering but are not documented in the OpenAPI doc.  Something like `{"undocumented_column" => {"type" => "string"}}`
+        #
+        # == Returns:
+        # A new Filter object, call #apply to get the filtered set of results.
+        #
+        def initialize(model, raw_filter, api_doc_definition, extra_filterable_attributes = {})
+          self.query                   = model
+          @api_doc_definition          = api_doc_definition
+          @arel_table                  = model.arel_table
+          @extra_filterable_attributes = extra_filterable_attributes
+          @model                       = model
+          @raw_filter                  = raw_filter
         end
 
         def apply
@@ -34,11 +51,13 @@ module Insights
         private
 
         attr_accessor :query
+        delegate(:arel_attribute, :to => :model)
 
         class Error < ArgumentError; end
 
         def attribute_for_key(key)
           attribute = api_doc_definition.properties[key.to_s]
+          attribute ||= extra_filterable_attributes[key.to_s]
           return attribute if attribute
           errors << "found unpermitted parameter: #{key}"
           nil
@@ -108,66 +127,70 @@ module Insights
           end
         end
 
+        def arel_lower(key)
+          Arel::Nodes::NamedFunction.new("LOWER", [arel_attribute(key)])
+        end
+
         def comparator_contains(key, value)
           return value.each { |v| comparator_contains(key, v) } if value.kind_of?(Array)
 
-          self.query = query.where(arel_table[key].matches("%#{query.sanitize_sql_like(value)}%", nil, true))
+          self.query = query.where(arel_attribute(key).matches("%#{query.sanitize_sql_like(value)}%", nil, true))
         end
 
         def comparator_contains_i(key, value)
           return value.each { |v| comparator_contains_i(key, v) } if value.kind_of?(Array)
 
-          self.query = query.where(arel_table[key].lower.matches("%#{query.sanitize_sql_like(value.downcase)}%", nil, true))
+          self.query = query.where(arel_table.grouping(arel_lower(key).matches("%#{query.sanitize_sql_like(value.downcase)}%", nil, true)))
         end
 
         def comparator_starts_with(key, value)
-          self.query = query.where(arel_table[key].matches("#{query.sanitize_sql_like(value)}%", nil, true))
+          self.query = query.where(arel_attribute(key).matches("#{query.sanitize_sql_like(value)}%", nil, true))
         end
 
         def comparator_starts_with_i(key, value)
-          self.query = query.where(arel_table[key].lower.matches("#{query.sanitize_sql_like(value.downcase)}%", nil, true))
+          self.query = query.where(arel_table.grouping(arel_lower(key).matches("#{query.sanitize_sql_like(value.downcase)}%", nil, true)))
         end
 
         def comparator_ends_with(key, value)
-          self.query = query.where(arel_table[key].matches("%#{query.sanitize_sql_like(value)}", nil, true))
+          self.query = query.where(arel_attribute(key).matches("%#{query.sanitize_sql_like(value)}", nil, true))
         end
 
         def comparator_ends_with_i(key, value)
-          self.query = query.where(arel_table[key].lower.matches("%#{query.sanitize_sql_like(value.downcase)}", nil, true))
+          self.query = query.where(arel_table.grouping(arel_lower(key).matches("%#{query.sanitize_sql_like(value.downcase)}", nil, true)))
         end
 
         def comparator_eq(key, value)
-          self.query = query.where(key => value)
+          self.query = query.where(arel_attribute(key).eq_any(Array(value)))
         end
 
         def comparator_eq_i(key, value)
           values = Array(value).map { |v| query.sanitize_sql_like(v.downcase) }
 
-          self.query = query.where(arel_table[key].lower.matches_any(values))
+          self.query = query.where(arel_table.grouping(arel_lower(key).matches_any(values)))
         end
 
         def comparator_gt(key, value)
-          self.query = query.where(arel_table[key].gt(value))
+          self.query = query.where(arel_attribute(key).gt(value))
         end
 
         def comparator_gte(key, value)
-          self.query = query.where(arel_table[key].gteq(value))
+          self.query = query.where(arel_attribute(key).gteq(value))
         end
 
         def comparator_lt(key, value)
-          self.query = query.where(arel_table[key].lt(value))
+          self.query = query.where(arel_attribute(key).lt(value))
         end
 
         def comparator_lte(key, value)
-          self.query = query.where(arel_table[key].lteq(value))
+          self.query = query.where(arel_attribute(key).lteq(value))
         end
 
         def comparator_nil(key, _value = nil)
-          self.query = query.where(key => nil)
+          self.query = query.where(arel_attribute(key).eq(nil))
         end
 
         def comparator_not_nil(key, _value = nil)
-          self.query = query.where.not(key => nil)
+          self.query = query.where.not(arel_attribute(key).eq(nil))
         end
       end
     end

data/lib/insights/api/common/open_api/generator.rb

@@ -96,11 +96,6 @@ module Insights
                 "description" => "ID of the resource",
                 "pattern"     => "^\\d+$",
                 "readOnly"    => true,
-              },
-              "SortByAttribute"    => {
-                "type"        => "string",
-                "description" => "Attribute with optional order to sort the result set by.",
-                "pattern"     => "^[a-z\\-_]+(:asc|:desc)?$"
               }
             }
           end
@@ -179,11 +174,10 @@ module Insights
                 "name"        => "sort_by",
                 "description" => "The list of attribute and order to sort the result set by.",
                 "required"    => false,
+                "style"       => "deepObject",
+                "explode"     => true,
                 "schema"      => {
-                  "oneOf" => [
-                    { "$ref" => "##{SCHEMAS_PATH}/SortByAttribute" },
-                    { "type" => "array", "items" => { "$ref" => "##{SCHEMAS_PATH}/SortByAttribute" } }
-                  ]
+                  "type" => "object"
                 }
               }
             }

data/lib/insights/api/common/paginated_response_v2.rb

@@ -2,35 +2,125 @@ module Insights
   module API
     module Common
       class PaginatedResponseV2 < PaginatedResponse
+        # GraphQL name regex: /[_A-Za-z][_0-9A-Za-z]*/
+        ASSOCIATION_COUNT_ATTR = "__count".freeze
+
         attr_reader :limit, :offset, :sort_by
 
+        def records
+          @records ||= begin
+            res = @base_query.order(:id).limit(limit).offset(offset)
+
+            select_for_associations, group_by_associations = sort_by_associations_query_parameters
+            res = res.select(*select_for_associations)          if select_for_associations.present?
+            res = res.left_outer_joins(*sort_by_associations)   if sort_by_associations.present?
+            res = res.group(group_by_associations)              if group_by_associations.present?
+
+            order_options = sort_by_options(res.klass)
+            res = res.reorder(order_options) if order_options.present?
+            res
+          end
+        end
+
+        # Condenses parameter values for handling multi-level associations
+        # and returns an array of key, value pairs.
+        #
+        # Examples:
+        #
+        # Input:  { "association" => { "attribute" => "value" }, "direct_attribute" => "value2" }
+        # Output: [["association.attribute", "value"], ["direct_attribute", "value2"]]
+        #
+        # Input:  { "association" => { "attribute" => "value" }, "association2" => { "attribute2" => "value2" } }
+        # Output: [["association.attribute", "value"], ["association2.attribute2", "value2"]]
+        #
+        # Input:  { "association" => { "attribute1" => "value1", "attribute2" => "value2" } }
+        # Output: [["association.attribute1", "value1"], ["association.attribute2", "value2"]]
+        #
+        def compact_parameter(param)
+          result = []
+          return result if param.blank?
+
+          param.each do |k, v|
+            result += if v.kind_of?(Hash) || v.kind_of?(ActionController::Parameters)
+                        Hash(v).map { |ak, av| ["#{k}.#{ak}", av] }
+                      else
+                        [[k, v]]
+                      end
+          end
+          result
+        end
+
         private
 
         def sort_by_options(model)
           @sort_by_options ||= begin
-            sort_options = []
-            return sort_options if sort_by.blank?
-
-            sort_by.each do |sort_attr, sort_order|
+            compact_parameter(sort_by).collect do |sort_attr, sort_order|
               sort_order = "asc" if sort_order.blank?
-              arel = model.arel_attribute(sort_attr)
-              arel = (sort_order == "desc") ? arel.desc : arel.asc
-              sort_options << arel
+              arel = if sort_attr.include?('.')
+                       association, sort_attr = sort_attr.split('.')
+                       association_class = association.classify.constantize
+                       if sort_attr == ASSOCIATION_COUNT_ATTR
+                         Arel.sql("COUNT (#{association_class.table_name}.id)")
+                       else
+                         association_class.arel_attribute(sort_attr)
+                       end
+                     else
+                       model.arel_attribute(sort_attr)
+                     end
+              (sort_order == "desc") ? arel.desc : arel.asc
+            end
+          end
+        end
+
+        def sort_by_associations
+          @sort_by_associations ||= begin
+            compact_parameter(sort_by).collect do |sort_attr, sort_order|
+              next unless sort_attr.include?('.')
+
+              sort_attr.split('.').first.to_sym
+            end.compact.uniq
+          end
+        end
+
+        def sort_by_associations_query_parameters
+          select_for_associations = []
+          group_by_associations   = []
+          count_selects           = []
+
+          compact_parameter(sort_by).each do |sort_attr, _sort_order|
+            next unless sort_attr.include?('.')
+
+            association, attr = sort_attr.split('.')
+
+            base_id  = "#{@base_query.table_name}.id"
+            base_all = "#{@base_query.table_name}.*"
+            select_for_associations << base_id << base_all if select_for_associations.empty?
+            group_by_associations   << base_id << base_all if group_by_associations.empty?
+
+            if attr == ASSOCIATION_COUNT_ATTR
+              count_selects << Arel.sql("COUNT (#{association.classify.constantize.table_name}.id)")
+            else
+              arel_attr = association.classify.constantize.arel_attribute(attr)
+              association_attr = "#{association}_#{attr}"
+              select_for_associations << arel_attr.as(association_attr)
+              group_by_associations   << association_attr
             end
-            sort_options
           end
+          select_for_associations.append(*count_selects) unless count_selects.empty?
+
+          [select_for_associations.compact.uniq, group_by_associations.compact.uniq]
         end
 
         def validate_sort_by
           return unless sort_by.present?
           raise ArgumentError, "Invalid sort_by parameter specified \"#{sort_by}\"" unless sort_by.kind_of?(ActionController::Parameters) || sort_by.kind_of?(Hash)
 
-          sort_by.each { |sort_attr, sort_order| validate_sort_by_directive(sort_attr, sort_order) }
+          compact_parameter(sort_by).each { |sort_attr, sort_order| validate_sort_by_directive(sort_attr, sort_order) }
         end
 
         def validate_sort_by_directive(sort_attr, sort_order)
           order = sort_order.blank? ? "asc" : sort_order
-          raise ArgumentError, "Invalid sort_by directive specified \"#{sort_attr}=#{sort_order}\"" unless sort_attr.match?(/^[a-z\\-_]+$/) && order.match?(/^(asc|desc)$/)
+          raise ArgumentError, "Invalid sort_by directive specified \"#{sort_attr}=#{sort_order}\"" unless sort_attr.match?(/^[a-z\-_\.]+$/) && order.match?(/^(asc|desc)$/)
         end
       end
     end

data/lib/insights/api/common/rbac/access.rb

@@ -5,32 +5,45 @@ module Insights
         class Access
           attr_reader :acl
           DEFAULT_LIMIT = 500
-          def initialize(resource, verb)
-            @resource = resource
-            @verb     = verb
-            @regexp   = Regexp.new(":(#{Regexp.escape(@resource)}|\\*):(#{Regexp.escape(@verb)}|\\*)")
-            @app_name = ENV["APP_NAME"]
+          ADMIN_SCOPE = "admin"
+          GROUP_SCOPE = "group"
+          USER_SCOPE = "user"
+
+          def initialize(app_name_filter = ENV["APP_NAME"])
+            @app_name_filter = app_name_filter
           end
 
           def process
             Service.call(RBACApiClient::AccessApi) do |api|
-              @acl ||= Service.paginate(api, :get_principal_access, {:limit => DEFAULT_LIMIT}, @app_name).select do |item|
-                @regexp.match?(item.permission)
-              end
+              @acls ||= Service.paginate(api, :get_principal_access, {:limit => DEFAULT_LIMIT}, @app_name_filter).to_a
             end
             self
           end
 
-          def accessible?
-            @acl.any?
+          def scopes(resource, verb, app_name = ENV['APP_NAME'])
+            regexp = create_regexp(app_name, resource, verb)
+            @acls.each_with_object([]) do |item, memo|
+              if regexp.match?(item.permission)
+                memo << all_scopes(item)
+              end
+            end.flatten.uniq.sort
+          end
+
+          def accessible?(resource, verb, app_name = ENV['APP_NAME'])
+            regexp = create_regexp(app_name, resource, verb)
+            @acls.any? { |item| regexp.match?(item.permission) }
+          end
+
+          def admin_scope?(resource, verb, app_name = ENV['APP_NAME'])
+            scope?(app_name, resource, verb, ADMIN_SCOPE)
           end
 
-          def id_list
-            ids.include?('*') ? [] : ids
+          def group_scope?(resource, verb, app_name = ENV['APP_NAME'])
+            scope?(app_name, resource, verb, GROUP_SCOPE)
           end
 
-          def owner_scoped?
-            ids.include?('*') ? false : owner_scope_filter?
+          def user_scope?(resource, verb, app_name = ENV['APP_NAME'])
+            scope?(app_name, resource, verb, USER_SCOPE)
           end
 
           def self.enabled?
@@ -39,26 +52,33 @@ module Insights
 
           private
 
-          def ids
-            @ids ||= @acl.each_with_object([]) do |item, ids|
-              item.resource_definitions.each do |rd|
-                next unless rd.attribute_filter.key == 'id'
-                next unless rd.attribute_filter.operation == 'equal'
+          def scope?(app_name, resource, verb, scope)
+            regexp = create_regexp(app_name, resource, verb)
+            @acls.any? do |item|
+              regexp.match?(item.permission) && scope_matches?(item, scope)
+            end
+          end
 
-                ids << rd.attribute_filter.value
-              end
+          def scope_matches?(item, scope)
+            item.resource_definitions.any? do |rd|
+              rd.attribute_filter.key == 'scope' &&
+                rd.attribute_filter.operation == 'equal' &&
+                rd.attribute_filter.value == scope
             end
           end
 
-          def owner_scope_filter?
-            @acl.any? do |item|
-              item.resource_definitions.any? do |rd|
-                rd.attribute_filter.key == 'owner' &&
-                  rd.attribute_filter.operation == 'equal' &&
-                  rd.attribute_filter.value == '{{username}}'
+          def all_scopes(item)
+            item.resource_definitions.each_with_object([]) do |rd, memo|
+              if rd.attribute_filter.key == 'scope' &&
+                rd.attribute_filter.operation == 'equal'
+                memo << rd.attribute_filter.value
               end
             end
           end
+
+          def create_regexp(app_name, resource, verb)
+            Regexp.new("(#{Regexp.escape(app_name)}):(#{Regexp.escape(resource)}):(#{Regexp.escape(verb)})")
+          end
         end
       end
     end

data/lib/insights/api/common/rbac/service.rb

@@ -8,9 +8,9 @@ module Insights
         class TimedOutError < StandardError; end
 
         class Service
-          def self.call(klass)
+          def self.call(klass, extra_headers = {})
             setup
-            yield init(klass)
+            yield init(klass, extra_headers)
           rescue RBACApiClient::ApiError => err
             raise TimedOutError.new('Connection timed out') if err.code.nil?
             raise NetworkError.new(err.message) if err.code.zero?
@@ -55,8 +55,8 @@ module Insights
             end
           end
 
-          private_class_method def self.init(klass)
-            headers = Insights::API::Common::Request.current_forwardable
+          private_class_method def self.init(klass, extra_headers)
+            headers = Insights::API::Common::Request.current_forwardable.merge(extra_headers)
             klass.new.tap do |api|
               api.api_client.default_headers = api.api_client.default_headers.merge(headers)
             end

data/lib/insights/api/common/version.rb

@@ -1,7 +1,7 @@
 module Insights
   module API
     module Common
-      VERSION = "3.7.0".freeze
+      VERSION = "3.8.0".freeze
     end
   end
 end

data/spec/support/rbac_shared_contexts.rb

@@ -24,10 +24,19 @@ RSpec.shared_context "rbac_objects" do
   let(:resource_def3) { instance_double(RBACApiClient::ResourceDefinition, :attribute_filter => filter3) }
   let(:filter4) { instance_double(RBACApiClient::ResourceDefinitionFilter, :key => 'id', :operation => 'equal', :value => '*') }
   let(:resource_def4) { instance_double(RBACApiClient::ResourceDefinition, :attribute_filter => filter4) }
+  let(:filter5) { instance_double(RBACApiClient::ResourceDefinitionFilter, :key => 'scope', :operation => 'equal', :value => 'admin') }
+  let(:resource_def5) { instance_double(RBACApiClient::ResourceDefinition, :attribute_filter => filter5) }
+  let(:filter6) { instance_double(RBACApiClient::ResourceDefinitionFilter, :key => 'scope', :operation => 'equal', :value => 'group') }
+  let(:resource_def6) { instance_double(RBACApiClient::ResourceDefinition, :attribute_filter => filter6) }
+  let(:filter7) { instance_double(RBACApiClient::ResourceDefinitionFilter, :key => 'scope', :operation => 'equal', :value => 'user') }
+  let(:resource_def7) { instance_double(RBACApiClient::ResourceDefinition, :attribute_filter => filter7) }
   let(:access1) { instance_double(RBACApiClient::Access, :permission => "#{app_name}:#{resource}:read", :resource_definitions => [resource_def1]) }
   let(:access2) { instance_double(RBACApiClient::Access, :permission => "#{app_name}:#{resource}:write", :resource_definitions => [resource_def2]) }
   let(:access3) { instance_double(RBACApiClient::Access, :permission => "#{app_name}:#{resource}:order", :resource_definitions => []) }
   let(:admin_access) { instance_double(RBACApiClient::Access, :permission => "#{app_name}:#{resource}:read", :resource_definitions => [resource_def4]) }
+  let(:admin_scope) { instance_double(RBACApiClient::Access, :permission => "#{app_name}:#{resource}:read", :resource_definitions => [resource_def5]) }
+  let(:group_scope) { instance_double(RBACApiClient::Access, :permission => "#{app_name}:#{resource}:read", :resource_definitions => [resource_def6]) }
+  let(:user_scope) { instance_double(RBACApiClient::Access, :permission => "#{app_name}:#{resource}:read", :resource_definitions => [resource_def7]) }
   let(:group_uuids) { [group1.uuid, group2.uuid, group3.uuid] }
   let(:api_instance) { double }
   let(:rs_class) { class_double("Insights::API::Common::RBAC::Service").as_stubbed_const(:transfer_nested_constants => true) }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: insights-api-common
 version: !ruby/object:Gem::Version
-  version: 3.7.0
+  version: 3.8.0
 platform: ruby
 authors:
 - Insights Authors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-10 00:00:00.000000000 Z
+date: 2020-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acts_as_tenant