mikras_utils 0.14.1 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a7a7d9d893a73103e2159bfbc3ec2d0ff48fc644dec46bff98e35173d98bcff0
-  data.tar.gz: 872e5596dead57f495e4b7f903a5607063a4efd2e46b7716414fdfd0c6688e34
+  metadata.gz: 4fe12ca731ca5946497ff1c82d4d31f00b383dc467588581a8af123347e961d9
+  data.tar.gz: f703327b44103dcd3d0cb0e5b87f5ac87322d48a9756a23ed1ca14fd19cac580
 SHA512:
-  metadata.gz: 198336a960602043f627077526bbdb1962ea32709aa9d82cecd6b244bdc64a59034db125f429c11fe51b19037e5d08141077f7b8d9145924169f06ebb9eb4daf
-  data.tar.gz: ace4fdcf35f66b9be6ee8e4ecdac0e0a70f6fdd4d9e79468bfbb39819a5a7c554f1be6ca4c73a7280139c0de1ad9e814c2eba90029d4482600c2ddf8fd8f937e
+  metadata.gz: 5bd1d52942bf6493256aecf50776fe0c77d86e47566fd049d858d8439d027ec2f99dfffeb0973cb14f70747c6862cdb52f73b2c610037a63b7d413478f445c30
+  data.tar.gz: df3cac1ea3ce8b620db3417304798e53e5ac5efe6773d8cf88f3d9e765669293aff97277f4f77ef6f314e41d4f113a22a53c322422d67bef7693302ac64fd394

data/lib/mikras_utils/mkacl/analyzer.rb

@@ -86,6 +86,19 @@ module MkAcl
       # Resolve domains
       spec.tables.select(&:acl).each { |t| resolve_domain(t) }
 
+      # Function defaults
+      rules = spec.tables.map { |table| table.actions.values.map { |action| action.rules } }.flatten
+      rules.each { |rule|
+        if rule.mutation && !%w(attach detach).include?(rule.action)
+          if !rule.function
+            rule.function = DEFAULT_FUNCTION
+          end
+        else # rule.mutation.nil?
+          # do nothing
+        end
+      }
+
+
       spec
     end
 

data/lib/mikras_utils/mkacl/generators/seeds.rb

@@ -54,6 +54,7 @@ module MkAcl
 
           table.actions.values.each { |action|
             puts %(
+              -- #{action.name.upcase}
               insert into acl_portal.acl_actions (acl_table_id, kind)
                 values (:table_id, '#{action.name.upcase}')
                 returning id as "action_id"
@@ -62,11 +63,11 @@ module MkAcl
             puts
 
             action.rules.each { |rule|
-              fields = %w(roles filter assert mutation fields tables ordinal)
+              fields = %w(roles filter assert mutation function fields tables ordinal)
               values = fields.map { |field| conn.quote_value(rule.send(field.to_sym), elem_type: :text) }
               puts %(
                 insert into acl_portal.acl_rules (
-                    acl_action_id, roles, filter, assert, function_name, fields, tables, ordinal)
+                    acl_action_id, roles, filter, assert, mutation_name, function_name, fields, tables, ordinal)
                   values (:action_id, #{values.join(', ')})
                   returning id as "rule_id"
                 \\gset
@@ -75,11 +76,12 @@ module MkAcl
 
               rule.stamps.each { |stamp|
                 puts %(
-                  insert into acl_portal.acl_stamps (acl_rule_id, watch, stamp)
+                  insert into acl_portal.acl_stamps (acl_rule_id, watch, stamp, value)
                     values (
                       :rule_id,
                       #{conn.quote_value(stamp.watch)},
-                      #{conn.quote_value(stamp.stamp)}
+                      #{conn.quote_value(stamp.stamp)},
+                      #{conn.quote_value(stamp.value)}
                     );
                 ).align
               }
@@ -87,7 +89,11 @@ module MkAcl
           }
         end
 
+        # Patch-up acl_tables
         puts %(
+          --
+          -- ASSIGN TABLE PARENT ID
+          --
           update acl_portal.acl_tables sub
             set parent_id = (
               select id
@@ -97,6 +103,33 @@ module MkAcl
             );
         ).align
         puts
+
+        # Patch-up acl_stamps
+        puts %(
+          --
+          -- ASSIGN STAMP TYPE AND VALUE
+          --
+          update acl_portal.acl_stamps s
+            set type = c.column_type,
+                value = coalesce(
+                  s.value,
+                  case c.column_type
+                    when 'int' then 'public.current_role_id()'
+                    when 'time' then 'now()'
+                  end
+                )
+          from
+            acl_portal.acl_rules r
+            join acl_portal.acl_actions a on a.id = r.acl_action_id
+            join acl_portal.acl_tables t on t.id = a.acl_table_id
+            join meta.columns c
+              on  c.schema_name = t.schema_name
+              and c.table_name = t.table_name
+          where
+            r.id = s.acl_rule_id
+            and c.column_name = s.stamp
+          ;
+        ).align
       end
     end
   end

data/lib/mikras_utils/mkacl/parser.rb

@@ -88,6 +88,7 @@ module MkAcl
             when :filter; rule.filter = norm_value(value)
             when :assert; rule.assert = norm_value(value)
             when :mutation; rule.mutation = value.nil? ? nil : norm_value(value)
+            when :function; rule.function = value.nil? ? nil : norm_value(value)
             when :fields; rule.fields = value.nil? ? nil : norm_array(value)
             when :tables; rule.tables = norm_array(value)
           else
@@ -103,12 +104,9 @@ module MkAcl
     def parse_stamps(rule, stamps)
       constrain rule, Rule
       constrain stamps, String, Hash, Array
-#     constrain stamps, String, Hash[watch: NilClass | String | [String], stamp: String | [String]]
 
       # Normalize stamps
-      stamps = Array(stamps)
-
-      stamps.map! { |stamp|
+      stamps = Array(stamps).map! { |stamp|
         case stamp
           when Hash; stamp
           when String; { stamp: stamp }
@@ -120,32 +118,16 @@ module MkAcl
       # Check fields and create stamp
       stamps.each { |stamp|
         # Check fields
-        diff = stamp.keys - [:watch, :stamp]
+        diff = stamp.keys - [:watch, :stamp, :value]
         diff.empty? or raise "Illegal field '#{diff.first}' in #{rule.name} rule in table #{rule.table.name}"
-        Stamp.new(rule, stamp[:watch]&.split, stamp[:stamp].split)
+        (stamp[:watch]&.split || [nil]).map { |watch_field|
+          stamp[:stamp].split.map { |stamp_field|
+            Stamp.new(rule, watch_field, stamp_field, stamp[:value])
+          }
+        }
+        StampExpr.new(rule, stamp[:watch]&.split, stamp[:stamp].split, stamp[:value])
       }
     end
   end
 end
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-

data/lib/mikras_utils/mkacl/spec.rb

@@ -1,6 +1,6 @@
 
 module MkAcl
-  DEFAULT_MUTATION = "app_portal.mutate"
+  DEFAULT_FUNCTION = "app_portal.mutate"
   ACTIONS = %w(insert select update delete attach detach)
 
   class Spec
@@ -175,13 +175,9 @@ module MkAcl
       end
     end
 
-    def dump(header = nil)
-      if header
-        header = "#{header || name}:"
-        indent { dump_body }
-      else
-        dump_body
-      end
+    def dump(header = name)
+      puts "#{header || name}:"
+      indent { dump_body }
     end
 
   private
@@ -195,13 +191,31 @@ module MkAcl
 
     attr_reader :action
     forward_to :action, :table, :name
-    attr_accessor :roles # Roles that this rule applies to
-    attr_accessor :filter # Goes into the postgres policy, may be nil
-    attr_accessor :assert # Goes into the postgres trigger, may be nil
-    attr_accessor :mutation # Mutation function to use, may be nil. Default app_portal.mutate() except attach/detach
-    attr_accessor :fields # Only used for insert and update, nil otherwise
-    attr_accessor :tables # Only used for attach and detach, nil otherwise
+
+    # Roles that this rule applies to
+    attr_accessor :roles
+
+    # Goes into the postgres policy, may be nil
+    attr_accessor :filter
+
+    # Goes into the postgres trigger, may be nil
+    attr_accessor :assert
+
+    # Mutation function, may be nil. Default create/update/delete_RECORD except
+    # select/attach/detach
+    attr_accessor :mutation
+
+    # Implementation function, may be nil. Default 'app_portal.mutate()' except attach/detach
+    attr_accessor :function
+
+    # Only used for insert and update, nil otherwise
+    attr_accessor :fields
+
+    # Only used for attach and detach, nil otherwise
+    attr_accessor :tables
+
     attr_accessor :stamps
+    attr_accessor :stamp_exprs
     attr_reader :ordinal
 
     # admin, internal, etc.
@@ -216,63 +230,109 @@ module MkAcl
       @roles = []
       @filter = nil
       @assert = nil
-      @mutation = (action.name == "select" ? nil : DEFAULT_MUTATION)
+#     @mutation = (action.name == "select" ? nil : "#{action}_#{table.record_name}")
+      @mutation = default_mutation
+      @function = nil #(action.name == "select" ? nil : DEFAULT_MUTATION)
       @fields = %w(insert update).include?(action.name) ? [] : nil
       @tables = %w(attach detach).include?(action.name) ? [] : nil
       @stamps = []
+      @stamp_exprs = []
 
       action.send :attach_rule, self
     end
 
     def dump
       puts "roles: #{roles.join(' ')}"
+      puts "tables: #{tables.join(' ')}" if tables && !tables.empty?
       puts "filter: #{filter}" if filter
       puts "assert: #{assert}" if assert
-      puts "mutation: #{mutation || 'nil'}" if !mutation.nil? && mutation != DEFAULT_MUTATION
+      if %w(insert update delete).include?(action.name)
+        puts "mutation: #{mutation || 'nil'}" \
+            if name != 'select' && (mutation.nil? || mutation != default_mutation)
+        puts "function: #{function || 'nil'}" if name != 'select' && function != DEFAULT_FUNCTION
+      else
+        puts "function: #{function}" if function
+      end
       puts "fields: #{fields.join(' ')}" if fields && !fields.empty?
-      puts "tables: #{tables.join(' ')}" if tables && !tables.empty?
 
-      if stamps.size == 1
-        stamps.first.dump
-      elsif stamps.size > 1
+      if stamp_exprs.size == 1
+        stamp_exprs.first.dump
+      elsif stamp_exprs.size > 1
         puts "stamps:"
         indent {
-          for stamp in stamps
+          for stamp_expr in stamp_exprs
             print "- "
-            indent(bol: false) { stamp.dump }
+            indent(bol: false) { stamp_expr.dump }
           end
         }
       end
 
       puts "ordinal: #{ordinal}"
     end
+
   private
+    def default_mutation
+      %w(insert update delete).include?(action.name) ? "#{action.name}_#{table.record_name}" : nil
+    end
+
     def attach_stamp(stamp)
       @stamps << stamp
     end
+
+    def attach_stamp_expr(stamp_expr)
+      @stamp_exprs << stamp_expr
+    end
   end
 
   class Stamp
     attr_reader :rule
+
     forward_to :rule, :table, :name
 
     attr_accessor :watch
     attr_accessor :stamp
+    attr_accessor :value
 
-    def initialize(rule, watch = nil, stamp)
+    def initialize(rule, watch, stamp, value)
       constrain rule, Rule
+      constrain watch, String, nil
+      constrain stamp, String
       @rule = rule
-      @watch, @stamp = watch, stamp
+      @watch, @stamp, @value = watch, stamp, value
       rule.send :attach_stamp, self
     end
 
+    def to_s() = watch ? "#{watch}->#{stamp}" : stamp
+
+    def dump
+      puts "watch: #{watch}" if watch
+      puts "stamp: #{stamp}" if stamp
+      puts "value: #{value}" if value
+    end
+  end
+
+  class StampExpr # For debug. Express the structure of stamp syntax
+    attr_reader :rule
+    forward_to :rule, :table, :name
+
+    attr_accessor :watch # [String]
+    attr_accessor :stamp # [String]
+    attr_accessor :value
+
+    def initialize(rule, watch, stamp, value)
+      constrain rule, Rule
+      @rule = rule
+      @watch, @stamp, @value = watch, stamp, value
+      rule.send :attach_stamp_expr, self
+    end
+
     def to_s() = watch
 
     def dump
       puts "watch: #{watch.join(" ")}" if watch
       puts "stamp: #{stamp.join(" ")}" if stamp
+      puts "value: #{value}" if value
     end
   end
-
 end
 

data/lib/mikras_utils/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MikrasUtils
-  VERSION = "0.14.1"
+  VERSION = "0.16.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mikras_utils
 version: !ruby/object:Gem::Version
-  version: 0.14.1
+  version: 0.16.0
 platform: ruby
 authors:
 - Claus Rasmussen
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-03-21 00:00:00.000000000 Z
+date: 2025-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: pg_conn