lcp 0.1.0

data/lib/lcp_ruby/conditions/validator.rb

@@ -0,0 +1,35 @@
+module LcpRuby
+  module Conditions
+    # Static shape predicate for condition hashes (visible_when:, etc.).
+    #
+    # Returns true when the hash matches a recognized condition shape
+    # (role-shortcut, field/service/compound/collection per
+    # `ConditionEvaluator.condition_type`). Returns false otherwise.
+    #
+    # This is a *static* predicate — it never invokes the evaluator and
+    # never raises on missing user methods or missing fields. It exists
+    # so the boot-time RuntimeInvariantValidator (AUTH-002/003) can
+    # decide "is this a well-shaped condition" without runtime context.
+    #
+    # See docs/design/authorization_hardening.md § "The `parseable?`
+    # predicate is a new shared helper".
+    module Validator
+      module_function
+
+      def parseable?(condition)
+        return false unless condition.is_a?(Hash)
+        return false if condition.empty?
+
+        normalized = condition.transform_keys(&:to_s)
+
+        # Role-shortcut shape: { "role" => "admin" } or { "role" => [...] }
+        # The runtime evaluator (zone_resolution#zone_visible?) special-cases
+        # this before delegating to ConditionEvaluator.
+        return true if normalized.key?("role")
+
+        # Recognized condition_object shapes (field/service/compound/collection)
+        !ConditionEvaluator.condition_type(normalized).nil?
+      end
+    end
+  end
+end

data/lib/lcp_ruby/configuration.rb

@@ -0,0 +1,431 @@
+require "uri"
+
+module LcpRuby
+  class Configuration
+    attr_accessor :metadata_path, :role_method, :user_class, :mount_path,
+                  :auto_migrate, :label_method_default, :parent_controller,
+                  :strict_loading,
+                  :impersonator_roles, :impersonatable_roles,
+                  :attachment_max_size, :attachment_allowed_content_types,
+                  :breadcrumb_home_path, :not_found_handler, :empty_value,
+                  :audit_writer, :landing_page, :dev_toolbar,
+                  :webhook_allowed_hosts,
+                  :max_explicit_ids, :pagination_ends,
+                  :health_check, :metrics_endpoint, :metrics_histogram_buckets,
+                  :error_log_rate_limit, :error_log_capture_request_context,
+                  :theme,
+                  :i18n_check,
+                  :max_inheritance_depth,
+                  :runtime_type_renderers
+
+    attr_reader :tenant_association_name
+
+    # Authentication settings
+    attr_accessor :auth_allow_registration,
+                  :auth_password_min_length,
+                  :auth_session_timeout,
+                  :auth_lock_after_attempts,
+                  :auth_lock_duration,
+                  :auth_mailer_sender,
+                  :auth_after_login_path,
+                  :auth_after_logout_path,
+                  :host_url,
+                  :user_provisioner,
+                  :role_resolver,
+                  :claims_synchronizer
+
+    attr_reader :menu_mode, :authentication, :role_source, :permission_source,
+                :group_source, :role_resolution_strategy, :model_extensions,
+                :workflow_source, :job_source, :embed_providers, :page_source,
+                :mermaid_source, :error_log_enabled
+    attr_accessor :role_model, :role_model_fields,
+                  :permission_model, :permission_model_fields,
+                  :group_method, :group_model, :group_model_fields,
+                  :group_membership_model, :group_membership_fields,
+                  :group_role_mapping_model, :group_role_mapping_fields,
+                  :group_adapter,
+                  :audit_model, :audit_model_fields,
+                  :workflow_model, :workflow_model_fields, :workflow_provider,
+                  :workflow_audit_model, :workflow_audit_model_fields,
+                  :approval_request_model, :approval_step_model, :approval_task_model,
+                  :hierarchy_resolver,
+                  :job_execution_model, :job_definition_model, :job_definition_model_fields,
+                  :job_provider, :job_base_class, :schedule_adapter,
+                  :page_model, :page_model_fields
+
+    def menu_mode=(value)
+      @menu_mode = value&.to_sym
+    end
+
+    def authentication=(value)
+      value = value&.to_sym
+      unless %i[none built_in external oidc].include?(value)
+        raise ArgumentError, "authentication must be :none, :built_in, :external, or :oidc (got #{value.inspect})"
+      end
+      @authentication = value
+      @user_class = "LcpRuby::User" if %i[built_in oidc].include?(value) && @user_class == "User"
+    end
+
+    def role_source=(value)
+      value = value&.to_sym
+      unless %i[implicit model].include?(value)
+        raise ArgumentError, "role_source must be :implicit or :model (got #{value.inspect})"
+      end
+      @role_source = value
+    end
+
+    def permission_source=(value)
+      value = value&.to_sym
+      unless %i[yaml model].include?(value)
+        raise ArgumentError, "permission_source must be :yaml or :model (got #{value.inspect})"
+      end
+      @permission_source = value
+    end
+
+    def tenant_association_name=(value)
+      unless value.nil? || value.is_a?(Symbol) || value.is_a?(String)
+        raise ArgumentError, "tenant_association_name must be a Symbol, String, or nil " \
+                             "(got #{value.inspect})"
+      end
+      @tenant_association_name = value
+    end
+
+    def group_source=(value)
+      value = value&.to_sym
+      unless %i[none yaml model host].include?(value)
+        raise ArgumentError, "group_source must be :none, :yaml, :model, or :host (got #{value.inspect})"
+      end
+      @group_source = value
+    end
+
+    def workflow_source=(value)
+      value = value&.to_sym
+      unless %i[static model host].include?(value)
+        raise ArgumentError, "workflow_source must be :static, :model, or :host (got #{value.inspect})"
+      end
+      @workflow_source = value
+    end
+
+    def job_source=(value)
+      value = value&.to_sym
+      unless %i[static model host].include?(value)
+        raise ArgumentError, "job_source must be :static, :model, or :host (got #{value.inspect})"
+      end
+      @job_source = value
+    end
+
+    def page_source=(value)
+      value = value&.to_sym
+      unless %i[yaml model].include?(value)
+        raise ArgumentError, "page_source must be :yaml or :model (got #{value.inspect})"
+      end
+      @page_source = value
+    end
+
+    def error_log_enabled=(value)
+      unless [ :auto, true, false ].include?(value)
+        raise ArgumentError, "error_log_enabled must be :auto, true, or false (got #{value.inspect})"
+      end
+      @error_log_enabled = value
+    end
+
+    def mermaid_source=(value)
+      value = value.to_sym if value.is_a?(String) && %w[cdn vendored].include?(value)
+      unless (value.is_a?(Symbol) && %i[cdn vendored].include?(value)) || value.is_a?(String)
+        raise ArgumentError, "mermaid_source must be :cdn, :vendored, or a URL string (got #{value.inspect})"
+      end
+      @mermaid_source = value
+    end
+
+    def role_resolution_strategy=(value)
+      value = value&.to_sym
+      unless %i[merged groups_only direct_only].include?(value)
+        raise ArgumentError, "role_resolution_strategy must be :merged, :groups_only, or :direct_only (got #{value.inspect})"
+      end
+      @role_resolution_strategy = value
+    end
+
+    def initialize
+      @metadata_path = Rails.root.join("config", "lcp_ruby") if defined?(Rails)
+      @role_method = :lcp_role
+      @user_class = "User"
+      @mount_path = "/"
+      @auto_migrate = true
+      @label_method_default = :to_s
+      @parent_controller = "::ApplicationController"
+      @strict_loading = :never
+      @impersonator_roles = []
+      @impersonatable_roles = nil
+      @attachment_max_size = "50MB"
+      @attachment_allowed_content_types = nil
+      @breadcrumb_home_path = "/"
+      @not_found_handler = :default
+      @audit_writer = nil
+      @landing_page = nil
+      @menu_mode = :auto
+      @model_extensions = {}
+      @embed_providers = {}
+      @mermaid_source = :cdn
+      @webhook_allowed_hosts = nil
+      @max_explicit_ids = 500
+      @pagination_ends = false
+
+      # Maximum depth of `inherits_from` cascade chains. Each level adds a
+      # nested IN sub-query at scope-resolve time; deep chains stress
+      # database planners (especially SQLite) and risk DoS via accidental
+      # or hostile permission DSL. ConfigurationValidator enforces this
+      # bound at boot. 6 covers every realistic domain (factory → line →
+      # machine → reading → component → fault is already 6); raise it via
+      # `LcpRuby.configuration.max_inheritance_depth = N` when justified.
+      @max_inheritance_depth = 6
+
+      # Name of the association that represents the multi-tenant boundary
+      # (e.g. `:organization`, `:tenant`, `:account`). When set,
+      # `ConfigurationValidator` warns at boot if any model declares a
+      # `belongs_to` matching this name but is not reachable to that root
+      # via the `inherits_from` cascade — i.e. silently leaks across
+      # tenants. `nil` (default) disables the check; single-tenant apps
+      # see no behavior change. See
+      # `docs/guides/inherited-permissions.md` § "Multi-tenant cascade pattern".
+      @tenant_association_name = nil
+
+      # Theme defaults
+      @theme = {
+        default: :auto,
+        allow_user_switch: true,
+        density: { default: :comfortable },
+        border_radius: { default: :rounded },
+        overrides: {},
+        palettes: {}
+      }
+
+      # i18n_check (lint) defaults — host overrides via
+      #   LcpRuby.configuration.i18n_check = { locales: [:en, :cs], severity: :warning, ... }
+      # Empty hash means "use I18nCheck::Configuration defaults" (which
+      # warns when locales falls back to I18n.available_locales).
+      @i18n_check = {}
+
+      # invariant_check (boot validator) defaults — host overrides via
+      #   LcpRuby.configuration.invariant_check = {
+      #     severity: :error,
+      #     severity_per_code: { "AUTH-005" => :off },
+      #     fail_boot: true   # production-only; ignored in dev/test
+      #   }
+      # Lazy: nil here, the reader builds a default
+      # `Authorization::InvariantCheck::Configuration` on first access so
+      # host code can write `LcpRuby.configuration.invariant_check.severity`
+      # directly (no Hash↔Configuration ambiguity at the API surface).
+      @invariant_check = nil
+
+      # Monitoring defaults
+      @health_check = true
+      @metrics_endpoint = true
+      @metrics_histogram_buckets = [ 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10 ]
+      @error_log_enabled = :auto
+      @error_log_rate_limit = 1
+      @error_log_capture_request_context = false
+
+      # Phase 4 of type-system defaults — Decision 14. When true, presenter
+      # column-set build enriches each `column :name` whose `renderer:` is
+      # absent with the type-driven default from Types::TypeRegistry. So
+      # `column :flag` on a :boolean field auto-renders as boolean_icon (✓/✗
+      # glyph), and `column :status` on an :enum field auto-renders as a
+      # badge — without the configurator writing renderer: explicitly.
+      # Default false for one release (existing apps keep their current
+      # rendering); flips to true thereafter and `lcp new` sets it true
+      # from the start. Phase 4b runtime null_false validators are
+      # unflagged because their delta is strictly additive.
+      @runtime_type_renderers = false
+
+      # Role source defaults
+      @role_source = :implicit
+      @role_model = "role"
+      @role_model_fields = { name: "name", active: "active" }
+
+      # Permission source defaults
+      @permission_source = :yaml
+      @permission_model = "permission_config"
+      @permission_model_fields = { target_model: "target_model", definition: "definition", active: "active" }
+
+      # Group source defaults
+      @group_source = :none
+      @group_method = :lcp_groups
+      @group_model = "group"
+      @group_model_fields = { name: "name", active: "active" }
+      @group_membership_model = "group_membership"
+      @group_membership_fields = { group: "group_id", user: "user_id" }
+      @group_role_mapping_model = nil
+      @group_role_mapping_fields = { group: "group_id", role: "role_name" }
+      @group_adapter = nil
+      @role_resolution_strategy = :merged
+
+      # Audit model defaults
+      @audit_model = "audit_log"
+      @audit_model_fields = {
+        auditable_type: "auditable_type",
+        auditable_id: "auditable_id",
+        action: "action",
+        changes_data: "changes_data",
+        user_id: "user_id",
+        user_snapshot: "user_snapshot",
+        metadata: "metadata"
+      }
+
+      # Workflow defaults
+      @workflow_source = :static
+      @workflow_model = "workflow_definition"
+      @workflow_model_fields = {
+        name: "name",
+        model_name: "model_name",
+        field_name: "field_name",
+        states: "states",
+        transitions: "transitions",
+        version: "version",
+        active: "active",
+        audit_log: "audit_log",
+        approvals: "approvals"
+      }
+      @workflow_provider = nil
+      @approval_request_model = "workflow_approval_request"
+      @approval_step_model = "workflow_approval_step"
+      @approval_task_model = "workflow_approval_task"
+      @hierarchy_resolver = nil
+      @workflow_audit_model = "workflow_audit_log"
+      @workflow_audit_model_fields = {
+        record_type: "record_type",
+        record_id: "record_id",
+        workflow_name: "workflow_name",
+        workflow_version: "workflow_version",
+        transition_name: "transition_name",
+        from_state: "from_state",
+        to_state: "to_state",
+        user_id: "user_id",
+        user_snapshot: "user_snapshot",
+        comment: "comment",
+        metadata: "metadata"
+      }
+
+      # Background jobs defaults
+      @job_source = :static
+      @job_execution_model = "job_execution"
+      @job_definition_model = "job_definition"
+      @job_definition_model_fields = {
+        name: "name", handler_type: "handler_type", handler_class: "handler_class",
+        handler_config: "handler_config", queue: "queue", retry_count: "retry_count",
+        retry_interval: "retry_interval", timeout: "timeout", unique_by: "unique_by",
+        schedule: "schedule", active: "active"
+      }
+      @job_provider = nil
+      @job_base_class = "ApplicationJob"
+      @schedule_adapter = nil
+
+      # Page source defaults
+      @page_source = :yaml
+      @page_model = "page_config"
+      @page_model_fields = {
+        name: "name",
+        definition: "definition",
+        active: "active"
+      }
+
+      # Authentication defaults
+      @authentication = :external
+      @auth_allow_registration = false
+      @auth_password_min_length = 8
+      @auth_session_timeout = nil
+      @auth_lock_after_attempts = 0
+      @auth_lock_duration = 30.minutes if defined?(ActiveSupport)
+      @auth_mailer_sender = "noreply@example.com"
+      @auth_after_login_path = "/"
+      @auth_after_logout_path = nil
+
+      # OIDC authentication hooks (used when authentication == :oidc)
+      # host_url             — absolute base URL of the host app, required when any :oidc provider is configured.
+      # user_provisioner     — callable (claims, provider_name) -> LcpRuby::User | nil, used when provisioning.reject_if_host_missing: true.
+      # role_resolver        — callable (claim_values, provider_name, raw_claims) -> Array<String>, required when any provider has role_source: host.
+      # claims_synchronizer  — callable (user, claims, provider_name, auth_hash) -> void, runs after role mapping
+      #                        on every login. Mutate `user` directly (writes to columns, profile_data, attachments,
+      #                        host associations …); UserResolver persists when changes are detected. Exceptions
+      #                        in development raise; in production they are logged and the login continues so a
+      #                        flaky external sync (e.g. Microsoft Graph timeout) doesn't lock people out.
+      @host_url = nil
+      @user_provisioner = nil
+      @role_resolver = nil
+      @claims_synchronizer = nil
+    end
+
+    def register_embed_provider(name, instance)
+      @embed_providers[name.to_s] = instance
+    end
+
+    def embed_provider(name)
+      @embed_providers[name.to_s]
+    end
+
+    def embed_csp_sources
+      @embed_providers.values.filter_map do |provider|
+        next unless provider.respond_to?(:site_url) && provider.site_url
+
+        uri = URI.parse(provider.site_url)
+        next unless uri.scheme && uri.host
+
+        port_suffix = uri.port && ![ 80, 443 ].include?(uri.port) ? ":#{uri.port}" : ""
+        "#{uri.scheme}://#{uri.host}#{port_suffix}"
+      rescue URI::InvalidURIError
+        nil
+      end.uniq
+    end
+
+    def on_model_ready(model_name, &block)
+      (@model_extensions[model_name.to_s] ||= []) << block
+    end
+
+    # Deprecated: prefer `impersonator_roles` (gates who can impersonate) and
+    # `impersonatable_roles` (filters which roles appear in the dropdown — nil
+    # means "all available roles"). The old `impersonation_roles` setter only
+    # ever controlled the gate, so it now aliases `impersonator_roles`.
+    def impersonation_roles
+      @impersonator_roles
+    end
+
+    def impersonation_roles=(value)
+      Kernel.warn(
+        "[LcpRuby] DEPRECATION: config.impersonation_roles is deprecated; " \
+        "use impersonator_roles (gate) and/or impersonatable_roles (dropdown filter) instead.",
+        uplevel: 1
+      )
+      @impersonator_roles = value
+    end
+
+    # Boot-validator config. Lazy reader auto-constructs the default
+    # Configuration on first access (so a fresh host app can read
+    # `LcpRuby.configuration.invariant_check.severity` without first
+    # writing `=`). The setter accepts a Hash (built eagerly into a
+    # Configuration), an InvariantCheck::Configuration instance (stored
+    # as-is), or nil (clears; next read rebuilds the default).
+    def invariant_check
+      @invariant_check ||= Authorization::InvariantCheck::Configuration.new
+    end
+
+    def invariant_check=(value)
+      # nil clears (next read rebuilds the default). Hash and existing
+      # Configuration both flow through `Configuration.coerce`.
+      @invariant_check = value.nil? ? nil : Authorization::InvariantCheck::Configuration.coerce(value)
+    end
+
+    # Returns true when strict_loading should be enabled on AR scopes.
+    # Raises ActiveRecord::StrictLoadingViolationError on lazy association access.
+    #
+    # Options:
+    #   :always      — enabled in all environments
+    #   :development — enabled in development and test environments
+    #   :never       — disabled (default)
+    def strict_loading_enabled?
+      case strict_loading
+      when :always then true
+      when :development then defined?(Rails) && (Rails.env.development? || Rails.env.test?)
+      else false
+      end
+    end
+  end
+end

data/lib/lcp_ruby/controller/authentication.rb

@@ -0,0 +1,118 @@
+require "ostruct"
+
+module LcpRuby
+  module Controller
+    module Authentication
+      extend ActiveSupport::Concern
+
+      included do
+        before_action :authenticate_user!
+      end
+
+      private
+
+      def authenticate_user!
+        # Public view groups allow unauthenticated access
+        if current_request_public?
+          LcpRuby::Current.user = effective_user || anonymous_user
+          return
+        end
+
+        LcpRuby::Current.request_id = request.request_id
+
+        case LcpRuby.configuration.authentication
+        when :none
+          # No auth needed — current_user returns default OpenStruct
+          LcpRuby::Current.user = effective_user
+        when :built_in, :oidc
+          return render_unauthenticated unless current_user
+          return render_deactivated unless current_user.respond_to?(:active?) && current_user.active?
+
+          # `effective_user` returns `ImpersonatedUser.new(current_user, role)` when an
+          # impersonation session is active (see Controller::Impersonation), so the
+          # `impersonating` condition service and per-role permission checks see the
+          # impersonated identity — not the real admin underneath.
+          LcpRuby::Current.user = effective_user
+        when :external
+          raise "Host app must implement authentication" unless current_user
+          LcpRuby::Current.user = effective_user
+        end
+      end
+
+      def render_unauthenticated
+        respond_to do |format|
+          format.json do
+            # WWW-Authenticate: Bearer challenge so OAuth clients (Power BI,
+            # MSAL apps) can discover that bearer auth is acceptable.
+            if LcpRuby::Authentication::ProviderRegistry.oidc_enabled?
+              response.headers["WWW-Authenticate"] = 'Bearer realm="lcp"'
+            end
+            render json: { error: I18n.t("lcp_ruby.auth.session_expired", default: "Session expired. Please log in again.") }, status: :unauthorized
+          end
+          format.any do
+            session[:"user_return_to"] = request.fullpath
+            redirect_to lcp_ruby.new_user_session_path
+          end
+        end
+      end
+
+      def render_deactivated
+        sign_out current_user if respond_to?(:sign_out, true)
+        message = I18n.t("lcp_ruby.auth.account_deactivated", default: "Your account has been deactivated. Please contact an administrator.")
+        respond_to do |format|
+          format.json { render json: { error: message }, status: :unauthorized }
+          format.any  { redirect_to lcp_ruby.new_user_session_path, alert: message }
+        end
+      end
+
+      def current_user
+        case LcpRuby.configuration.authentication
+        when :none
+          # Use a distinct ivar to avoid collision with Devise's @current_user
+          @_lcp_none_user ||= OpenStruct.new(
+            id: 0,
+            LcpRuby.configuration.role_method => [ "admin" ],
+            name: "Development User"
+          )
+        when :built_in, :oidc
+          # request.env indirection lets a future bearer middleware (Phase 2)
+          # inject the resolved user before the controller stack runs, so the
+          # same `current_user` accessor serves both Warden sessions and bearer
+          # tokens without mode-switching here.
+          request.env["lcp_ruby.current_user"] ||= warden.authenticate(scope: :user)
+        else
+          super
+        end
+      end
+
+      def warden
+        request.env["warden"]
+      end
+
+      def current_request_public?
+        slug = params[:lcp_slug]
+        return false unless slug
+
+        page = Pages::Resolver.find_by_slug(slug)
+        view_group = LcpRuby.loader.view_group_for_page(page.name)
+        view_group&.public?
+      rescue LcpRuby::MetadataError
+        false
+      end
+
+      def anonymous_user
+        OpenStruct.new(
+          id: nil,
+          LcpRuby.configuration.role_method => [],
+          name: "Anonymous"
+        )
+      end
+
+      # Base implementation — returns current_user directly.
+      # Overridden by Impersonation concern to return impersonated user when active.
+      def effective_user
+        @effective_user ||= current_user
+      end
+    end
+  end
+end