json2sql 1.0.11 → 1.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b734e672123b35d6b3878a30bf9629821915140e3240eba21cd8e853ac414911
-  data.tar.gz: 819e7767505a2154f0071a46ffee6640d30954e7bae623f308cb185791f2f1f3
+  metadata.gz: 3a1ea5e0f95c4a548b1bb9360e2adb5a4b5356992016d76b4babc16acb0d85c9
+  data.tar.gz: '01873a86ae29993fd7b5e9902506b074333294207fa8ef6b4b8d122272bad4b6'
 SHA512:
-  metadata.gz: 8a0743bbb6f1e26aacf1cdf62e0e81ce19992a79b0c748225a3d563a810ef4d8278b59d068fe28ee8707bb55080130d27538dc6711a2782dc392762aefd92a32
-  data.tar.gz: 90cb0a70a7443c7bd6b3f4c6f12d02298d6e6c906d399cebc02c1edf1c566dc5eef470790d7f9213ef88b266a3b11f39f53fd74eaaa1ca1f37ef8daa015331d8
+  metadata.gz: 01d567792598296fbeaa37e25a215a33a911fabcf8c847818a3f6c1dba59c9a9ef792ccd387f4728bbf2616a3135ff6a6246a637376e9b3940414c8127160ce6
+  data.tar.gz: 0263df1d2046c256341c926b9dfece8bdedc9722e603153df64c7175884acf76bd66fe24f9de360177dcb97639444c6b32539d2eaec52cc91761d229ba426f23

data/lib/json2sql/{input_policy.rb → query_policy.rb}

@@ -6,7 +6,9 @@ module Json2sql
   #   mode:   :allow (default) — only tables listed in `tables:` are accessible.
   #                              Tables absent from `tables:` are blocked entirely.
   #                              Empty `tables:` = no restriction.
-  #           :deny            — all tables pass; only listed columns are stripped.
+  #           :deny            — all tables pass. After column filtering, tables
+  #                              with no remaining accessible columns are removed.
+  #                              Same rule applies to children and parents.
   #   tables: Per-table configuration Hash (recursive):
   #     { table_name => { columns: [...],
   #                       children: { child_table => { columns: [...], ... } },
@@ -25,7 +27,7 @@ module Json2sql
   #               user-supplied values — primary IDOR guard.
   #
   # Usage:
-  #   policy = Json2sql::InputPolicy.new(
+  #   policy = Json2sql::QueryPolicy.new(
   #     mode:   :allow,
   #     tables: {
   #       orders: {
@@ -39,7 +41,7 @@ module Json2sql
   #   safe_input = policy.apply(raw_params)
   #   sql = Json2sql::SelectRunner.build(safe_input)
 
-  class InputPolicy
+  class QueryPolicy
 
     def initialize(mode: :allow, tables: {})
 
@@ -54,73 +56,79 @@ module Json2sql
     def apply(input)
 
       input = Json2sql.normalize(input)
+      
+      filter_tables(input, @tables)
 
-      input = filter_tables(input)
+      input.each { |table, params| sanitize_table(params, @tables[table]) }
 
-      input.each { |table, params| sanitize_table(params, @tables[table] || {}) }
+      input.reject! { |_, params| empty_columns?(params) }
 
       input
     end
 
     private
 
-    def filter_tables(input)
-
-      return input if @mode == :deny || @tables.empty?
-
-      input.select { |table, _| @tables.key?(table) }
-    end
-
     def sanitize_table(params, config)
 
       return unless params.is_a?(Hash)
 
+      return unless config.is_a?(Hash)
+
       filter_columns(params, config)
 
       inject_where(params, config)
 
       %w[children parents].each do |relation|
 
-        if @mode == :deny
+        filter_relations(params, config, relation)
 
-          next unless params[relation].is_a?(Hash)
+        next unless params[relation].is_a?(Hash)
 
-          relation_configs = config[relation].is_a?(Hash) ? config[relation] : {}
+        tables = config[relation].is_a?(Hash) ? config[relation] : {}
 
-          params[relation].each { |child_table, child_params| sanitize_table(child_params, relation_configs[child_table] || {}) }
+        params[relation].each { |table, params| sanitize_table(params, tables[table]) }
 
-          params[relation].reject! { |_, child_params| child_params.is_a?(Hash) && child_params["columns"].is_a?(Array) && child_params["columns"].empty? }
+        params[relation].reject! { |_, params| empty_columns?(params) }
 
-        else
+      end
+    end
 
-          filter_relations(params, config, relation)
+    def empty_columns?(params)
 
-          next unless params[relation].is_a?(Hash)
+      params.is_a?(Hash) && params["columns"].is_a?(Array) && params["columns"].empty?
+    end
 
-          relation_configs = config[relation].is_a?(Hash) ? config[relation] : {}
+    def filter_tables(params, config)
 
-          params[relation].each { |child_table, child_params| sanitize_table(child_params, relation_configs[child_table] || {}) }
+      return if @mode == :deny
 
-        end
-      end
-    end
+      return unless params.is_a?(Hash)
+
+      tables = config.is_a?(Hash) ? config : {}
 
+      return if tables.empty?
+
+      params.select! { |table, _| tables.key?(table) }
+    end
+    
     # Filters children/parents relations in :allow mode.
-    # Only relations present as keys in config[relation_key] pass through.
-    # If config[relation_key] is absent or not a Hash, relations are untouched.
-    # In :deny mode, pruning is handled in sanitize_table after column filtering.
+    # Only relations present as keys in config[relation] pass through.
+    # If config[relation] is absent or not a Hash, relations are untouched.
+    # No-op in :deny mode.
+
+    def filter_relations(params, config, relation)
 
-    def filter_relations(params, config, relation_key)
+      return if @mode == :deny
 
-      relations = params[relation_key]
+      param_tables = params[relation]
 
-      return unless relations.is_a?(Hash)
+      return unless param_tables.is_a?(Hash)
 
-      relation_config = config[relation_key]
+      config_tables = config[relation]
 
-      return unless relation_config.is_a?(Hash)
+      return unless config_tables.is_a?(Hash)
 
-      params[relation_key] = relations.select { |t, _| relation_config.key?(t) }
+      params[relation] = param_tables.select { |table, _| config_tables.key?(table) }
     end
 
     # Filters "columns" using mode (:allow or :deny).

data/lib/json2sql/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Json2sql
-  VERSION = "1.0.11"
+  VERSION = "1.0.12"
 end

data/lib/json2sql.rb

@@ -10,7 +10,7 @@ require_relative "json2sql/update_model"
 require_relative "json2sql/update_runner"
 require_relative "json2sql/delete_model"
 require_relative "json2sql/delete_runner"
-require_relative "json2sql/input_policy"
+require_relative "json2sql/query_policy"
 
 # Json2sql — SQL builder that generates MySQL/MariaDB query strings from
 # plain Ruby Hashes (or parsed JSON).

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json2sql
 version: !ruby/object:Gem::Version
-  version: 1.0.11
+  version: 1.0.12
 platform: ruby
 authors:
 - Tiago da Silva
@@ -49,9 +49,9 @@ files:
 - lib/json2sql.rb
 - lib/json2sql/delete_model.rb
 - lib/json2sql/delete_runner.rb
-- lib/json2sql/input_policy.rb
 - lib/json2sql/insert_model.rb
 - lib/json2sql/insert_runner.rb
+- lib/json2sql/query_policy.rb
 - lib/json2sql/sanitizer.rb
 - lib/json2sql/select_model.rb
 - lib/json2sql/select_runner.rb