mikras_utils 0.3.1 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c7d48444e75236d0188b539182a80aefeaea2770cdf7982188d7f055c8b552e
-  data.tar.gz: 5d790361a1c314d7bda6013c1db9c904b50c81f3be39c8396d6c9e4da43e68bd
+  metadata.gz: bf10f02dfcf24bfe2f518edfda534abbb78047b6876610f6a09adfac5217f73c
+  data.tar.gz: 7801d2245d2cd810b4defcf94b2bace9f8a6587e3fbebccc49240a689b47763e
 SHA512:
-  metadata.gz: 8e117ef1b45f0217ec14065d37405cf4b043259465c82a7df09caebc416a60ec15b80293c45c349ffb9cd0b9bd07fe8b9420b85e19f24a88a5dd62d3be62380f
-  data.tar.gz: 285faf4c815810af7111d49176218401f86afc1568a915c721ee67787cbb11df2cd6c016bad9d7b33db61b6120d5726d65aa8e2f0d27fc4cfb06a5685f69de9f
+  metadata.gz: 565ee40963dc77d9759bd78a55dacddab5296f23c022a07ccce42fd8c890db65eddcb6ce015c909943a34483009233f53d2c75dd0fe05faa1ccca2c1831b5375
+  data.tar.gz: 8d8afe7d2bb415edd5c3a275bca441a0d4bf73299b97e5f2d8578c9efa0b37b62840679ba73eeb60b525dbf0254e1a8a3a893ba11c4ba0add75f89706219bf50

data/exe/mkacl

@@ -1,13 +1,19 @@
 #!/usr/bin/env ruby
 
 SPEC = %(
-  @ Make RLS policies
+  @ Make RLS functions and policies
 
   -- [DATABASE [USERNAME]] SPEC-FILE
 
   Read SPEC and generate following functions, policies, and triggers
 
-  SPEC FILE 
+  FUNCTIONS
+    todo
+
+  TRIGGERS
+    todo
+
+  SPEC FILE
     The format is a YAML file where each root key represents a table. A table
     consists of insert, select, update, and delete actions that are arrays of
     ACL entries. An ACL entry list of associated roles and possibly a check SQL
@@ -25,9 +31,9 @@ SPEC = %(
     The following roles are recognized: RLA, LA, TA, KON, AKK, CLA, CTA, ELA,
     and ETA
 
-    Sagsys also defines the ADM role that is excluded because it is now a RBAC
-    fole, and PUP and NON that are excluded because they are not implemented in
-    Mikras
+    Sagsys also defines the ADM role that is excluded because it is a RBAC role
+    in Mikras, and PUP and NON roles that are excluded because they are not
+    implemented in Mikras
 
   OPTIONS
     -i,interactive

data/lib/mikras_utils/mkacl/generators/acl_functions.rb

@@ -101,7 +101,7 @@ module MkAcl
             case_roles = rule.roles.select { _1 == _1.upcase }
 
             if !auth_roles.empty?
-              role_seq = conn.quote_value_seq(auth_roles)
+              role_seq = conn.quote_values(auth_roles)
               puts %(
                 -- Find "#{action}" system role ACLs
                 _acls := array[]::integer[];
@@ -114,7 +114,7 @@ module MkAcl
             end
 
             if !case_roles.empty?
-              role_seq = conn.quote_value_seq(case_roles)
+              role_seq = conn.quote_values(case_roles)
               puts  %(
                 -- Find "#{action}" case role ACLs
                 select _acls || array_agg(id)
@@ -151,8 +151,8 @@ module MkAcl
         # Insert a attach record per parent table. This snippet handles
         # multiple parents of a record but the check algorithm probably does
         # not TODO
-        auth_role_list = conn.quote_value_seq table.insert.rules.map(&:auth_roles).flatten
-        case_role_list = conn.quote_value_seq table.insert.rules.map(&:case_roles).flatten
+        auth_role_list = conn.quote_values table.insert.rules.map(&:auth_roles).flatten
+        case_role_list = conn.quote_values table.insert.rules.map(&:case_roles).flatten
         for parent in table.parents
           id_fields = conn.values %(select column_name from acl.links where table_name = '#{table}')
           for id_field in id_fields

data/lib/mikras_utils/mkacl/generators/id_functions.rb

@@ -17,6 +17,42 @@ module MkAcl
         @chains = {}
       end
 
+      # Generate a set of per-table functions that returns the associated
+      # case_id/event_id/vist_id for the given record. The Functions are
+      # generated for each table in the spec file (todo read from meta)
+      #
+      # app_portal functions:
+      #
+      #   case_id_of_RECORD(object_id integer)
+      #   event_id_of_RECORD(object_id integer)
+      #   visit_id_of_RECORD(object_id integer)
+      #
+      # 'RECORD' is substituted with the record name of a table. Record names
+      # are the singular name of a table. TODO: Make it plural again
+      #
+      # acl_portal functions with a record argument (used in triggers):
+      #
+      #   case_id_of_RECORD(r record)
+      #   event_id_of_RECORD(r record)
+      #   visit_id_of_RECORD(r record)
+      #
+      # Returns the case, event, or visit id associated with the given record.
+      # The record should be an ACL table record type. These functions are used
+      # in before insert triggers because it takes a record (eg. NEW) instead
+      # of an ID - this saves a lookup
+      #
+      # acl_portal general id-of functions:
+      #
+      #   case_id_of(table varchar, id integer)
+      #   event_id_of(table varchar, id integer)
+      #   visit_id_of(table varchar, id integer)
+      #
+      # These methods are practically as efficient as using the more
+      # specialized versions above
+      #
+      # Returns null if not found. Note that the record has to exists because
+      # we access it to read the foreign keys
+      #
       # TODO: ACL checks so that a user can't get IDs of other users' records
       def generate
         # Find chains
@@ -30,7 +66,7 @@ module MkAcl
             meta.chains
           where src_schema_name = '#{app_schema}'
             and dst_schema_name = '#{app_schema}'
-            and dst_table_name in #{conn.quote_value_list(DOMAIN_TABLES)}
+            and dst_table_name in (#{conn.quote_values(DOMAIN_TABLES)})
         )
 
         generate_per_table_id_functions
@@ -44,46 +80,24 @@ module MkAcl
 #     # SQL sequence of spec file tables
 #     def table_seq() @table_seq ||= spec.tables.map(&:uid).join(', ') end
 
-      # Generate a set of per-table functions that returns the associated
-      # case_id/event_id/vist_id for the given record. The Functions are
-      # generated for each table in the spec file
-      #
-      # The geneated functions are
-      #
-      #   case_id_of_RECORD(id integer)
-      #   event_id_of_RECORD(id integer)
-      #   domain_id_of_RECORD(id integer)
-      #
-      # and the record variants
-      #
-      #   case_id_of_RECORD(r record)
-      #   event_id_of_RECORD(r record)
-      #   domain_id_of_RECORD(r record)
-      #
-      # 'RECORD' is substituted with the record name of a table. Record names
-      # are the singular name of a table. TODO: Make it plural again
-      #
-      # The domain functions returns event_id if related to an event and
-      # case_id if not. It is meant to return the most specialized domin id for
-      # a record. TODO Is it used?
-      #
-      # Returns null if not found. Note that the record has to exists because
-      # we access it to read the foreign keys
+      # Generate
+      #   case_id_of_RECORD(object_id integer)
+      #   event_id_of_RECORD(object_id integer)
+      #   visit_id_of_RECORD(object_id integer)
       #
       def generate_per_table_id_functions
-        # Generate functions by domain
-        for domain in DOMAINS
+        for domain in DOMAINS # Generate functions by domain
 
           # Create the identity functions first. The identity functions are
           # case_id_of_case() and event_id_of_event(). This makes some stuff
           # easier later on
           table = "#{domain}s"
           id_field = "#{domain}_id"
-          signature = "#{acl_schema}.#{id_field}_of_#{domain}(_id integer)"
+          signature = "#{app_schema}.#{id_field}_of_#{domain}(_object_id integer)"
           puts %(
             drop function if exists #{signature} cascade;
             create function #{signature} returns integer as $$
-              select _id;
+              select _object_id;
             $$ language sql
               set search_path to ''; -- intentionally empty
           ).align
@@ -120,47 +134,43 @@ module MkAcl
           end
         end
 
-        # Tables that references visits, events, and cases
-        visit_tables = chains['visits'].map(&:first)
-
-        # Tables that references events and cases
-        event_tables = chains['events'].map(&:first) - visit_tables
-
-        # Tables that references only cases
-        case_tables = chains['cases'].map(&:first) - event_tables
-
-        # Create domain functions
-        for domain, tables in { case: case_tables, event: event_tables, visit: visit_tables }
-          for table_name in tables
-            record_name = Prick::Inflector.singularize(table_name)
-            signature = "#{acl_schema}.domain_id_of_#{record_name}(_id integer)"
-            domain_function = "#{acl_schema}.#{domain}_id_of_#{record_name}"
-            puts %(
-              drop function if exists #{signature} cascade;
-              create function #{signature} returns integer as $$
-                select #{domain_function}(_id);
-              $$ language sql
-                set search_path to ''; -- intentionally empty
-            ).align
-            puts
-          end
-        end
+#       # Tables that references visits, events, and cases
+#       visit_tables = chains['visits'].map(&:first)
+#
+#       # Tables that references events and cases
+#       event_tables = chains['events'].map(&:first) - visit_tables
+#
+#       # Tables that references only cases
+#       case_tables = chains['cases'].map(&:first) - event_tables
+#
+#       # Create domain functions
+#       for domain, tables in { case: case_tables, event: event_tables, visit: visit_tables }
+#         for table_name in tables
+#           record_name = Prick::Inflector.singularize(table_name)
+#           signature = "#{acl_schema}.domain_id_of_#{record_name}(_object_id integer)"
+#           domain_function = "#{acl_schema}.#{domain}_id_of_#{record_name}"
+#           puts %(
+#             drop function if exists #{signature} cascade;
+#             create function #{signature} returns integer as $$
+#               select #{domain_function}(_object_id);
+#             $$ language sql
+#               set search_path to ''; -- intentionally empty
+#           ).align
+#           puts
+#         end
+#       end
       end
 
-      # Generate general case/event id-of functions:
-      #
+      # Generate
       #   case_id_of(table varchar, id integer)
       #   event_id_of(table varchar, id integer)
-      #   domain_id_of(table varchar, id integer)
-      #
-      # These methods are practically as efficient as using the more
-      # specialized versions above
+      #   visit_id_of(table varchar, id integer)
       #
       def generate_general_id_functions
         for domain in DOMAINS
           domain_table = Prick::Inflector.pluralize(domain)
           field = "#{domain}_id"
-          signature = "#{acl_schema}.#{field}_of(_table varchar, _id integer)"
+          signature = "#{acl_schema}.#{field}_of(_table varchar, _object_id integer)"
 
           puts %(
             drop function if exists #{signature} cascade;
@@ -173,11 +183,11 @@ module MkAcl
               for table_name in chains[domain_table].map(&:first)
                 record_name = Prick::Inflector.singularize(table_name)
                 function_name = "#{field}_of_#{record_name}"
-                puts "when '#{table_name}' then #{acl_schema}.#{function_name}(_id)"
+                puts "when '#{table_name}' then #{acl_schema}.#{function_name}(_object_id)"
               end
-              puts "when 'cases' then _id"
-              puts "when 'events' then _id"
-              puts "when 'visits' then _id"
+              puts "when 'cases' then _object_id"
+              puts "when 'events' then _object_id"
+              puts "when 'visits' then _object_id"
               puts "else null"
             }
             puts "end case;"
@@ -185,34 +195,13 @@ module MkAcl
           puts "$$ language sql;"
           puts
         end
-
-        signature = "#{acl_schema}.domain_id_of(_table varchar, _id integer)"
-        puts %(
-          -- FIXME: Ugly implementation
-          drop function if exists #{signature} cascade;
-          create function #{signature} returns integer as $$
-            select coalesce(
-              acl_portal.visit_id_of(_table, _id),
-              acl_portal.event_id_of(_table, _id),
-              acl_portal.case_id_of(_table, _id)
-            );
-          $$ language sql;
-        ).align
-        puts
       end
 
-      # General domain-id-of-record functions
-      #
+      # Generate
       #   case_id_of(r record)
       #   event_id_of(r record)
       #   domain_id_of(r record)
       #
-      # Returns the case, event, or visit id associated with the given record.
-      # The record should be an ACL table record type
-      #
-      # Very useful in before insert triggers because it takes a record (eg.
-      # NEW) instead of an ID
-      #
       def generate_general_id_of_record_functions
         links = (conn.structs %(
           select
@@ -276,22 +265,22 @@ module MkAcl
           puts
         end
 
-        signature = "#{acl_schema}.domain_id_of(_r record)"
-        puts %(
-          -- Note: Ugly implementation but maybe close to optimal
-          drop function if exists #{signature} cascade;
-          create function #{signature} returns integer as $$
-            declare
-              _id integer;
-            begin
-              select coalesce(acl_portal.visit_id_of(_r), acl_portal.event_id_of(_r), acl_portal.case_id_of(_r))
-                into _id;
-              return _id;
-            end;
-          $$ language plpgsql
-            set search_path to ''; -- intentionally ''
-        ).align
-        puts
+#       signature = "#{acl_schema}.domain_id_of(_r record)"
+#       puts %(
+#         -- Note: Ugly implementation but maybe close to optimal
+#         drop function if exists #{signature} cascade;
+#         create function #{signature} returns integer as $$
+#           declare
+#             _object_id integer;
+#           begin
+#             select coalesce(acl_portal.visit_id_of(_r), acl_portal.event_id_of(_r), acl_portal.case_id_of(_r))
+#               into _object_id;
+#             return _object_id;
+#           end;
+#         $$ language plpgsql
+#           set search_path to ''; -- intentionally ''
+#       ).align
+#       puts
       end
     end
   end

data/lib/mikras_utils/mkacl/generators/role_functions.rb

@@ -1,4 +1,21 @@
 module MkAcl
+  # Generates the functions
+  #
+  #   acl_portal.user_is_role(_user_id integer, _object_id integer, _roles text[])
+  #   acl_portal.user_is_role(_user_id integer, _object_id integer, _roles text)
+  #     Returns true if the user has one of the given roles on the domain
+  #     object
+  #
+  #   public.current_is_role(_object_id integer, _roles text[])
+  #   public.current_is_role(_object_id integer, _roles text)
+  #     Returns true if the current user has one of the given roles on the
+  #     domain object
+  #
+  #   public.current_is_ROLE(_object_id integer)
+  #     ROLE is one of the role kinds. Returns true if the current user has the
+  #     given role
+  #
+
   class Generator
     class RoleFunctions
       using String::Text
@@ -20,54 +37,34 @@ module MkAcl
     private
       def generate_user_role_functions
         # TODO: Test. Then combine with per-table methods
-        signature = "#{acl_schema}.user_is_role(_user_id integer, _domain_id integer, _roles text[])"
+        signature = "#{acl_schema}.user_is_role(_user_id integer, _object_id integer, _roles text[])"
         puts %(
           -- Return true if the user possess one or more of the given roles on the
-          -- domain record (cases, events, visits) with the given ID
+          -- object (cases, events, visits) with the given ID
           --
           drop function if exists #{signature} cascade;
           create function #{signature} returns boolean as $$
             select exists (
               select
-              from #{app_schema}.case_roles cr
-              join #{app_schema}.case_role_users cru on cru.case_role_id = cr.id
-              where cr.case_id = _domain_id
-                and cru.user_id = _user_id
-                and cr.kind = any(_roles)
-
-              union
-
-              select
-              from #{app_schema}.event_roles cr
-              join #{app_schema}.event_role_users cru on cru.event_role_id = cr.id
-              where cr.event_id = _domain_id
-                and cru.user_id = _user_id
-                and cr.kind = any(_roles)
-
-              union
-
-              select
-              from #{app_schema}.visit_roles cr
-              join #{app_schema}.visit_role_users cru on cru.visit_role_id = cr.id
-              where cr.visit_id = _domain_id
-                and cru.user_id = _user_id
-                and cr.kind = any(_roles)
-
-            );
+              from app_portal.domain_users
+              where domain_id = _domain_id
+              and user_id = _user_id
+              and role = any(_roles)
+            )
           $$ language sql
             security definer;
         ).align
         puts
 
-        signature = "#{acl_schema}.user_is_role(_user_id integer, _domain_id integer, role text)"
+        signature = "#{acl_schema}.user_is_role(_user_id integer, _object_id integer, role text)"
         puts %(
-          -- Return true if the user has the given role on the domain record
+          -- Return true if the user has the given role on the object
           -- (cases, events, visits). Note that this function overloads the multi-role
           -- version
           --
           drop function if exists #{signature} cascade;
           create function #{signature} returns boolean as $$
-            select #{acl_schema}.user_is_role(_user_id, _domain_id, array[role]);
+            select #{acl_schema}.user_is_role(_user_id, _object_id, array[role]);
           $$ language sql
             security definer;
         ).align
@@ -75,13 +72,13 @@ module MkAcl
 
         for domain, roles in DOMAINS.zip([CASE_ROLES, EVENT_ROLES, VISIT_ROLES])
           for role in roles
-            signature = "#{acl_schema}.user_is_#{role.downcase}(_user_id integer, _domain_id integer)"
+            signature = "#{acl_schema}.user_is_#{role.downcase}(_user_id integer, _object_id integer)"
             puts %(
               -- Return true if the user possess the '#{role}' role
               --
               drop function if exists #{signature} cascade;
               create function #{signature} returns boolean as $$
-                select #{acl_schema}.user_is_role(_user_id, _domain_id, '#{role}');
+                select #{acl_schema}.user_is_role(_user_id, _object_id, '#{role}');
               $$ language sql
                 security definer;
             ).align
@@ -92,28 +89,28 @@ module MkAcl
 
       def generate_current_role_functions
         # TODO: Test. Then combine with per-table methods
-        signature = "public.current_is_role(_domain_id integer, _roles text[])"
+        signature = "public.current_is_role(_object_id integer, _roles text[])"
         puts %(
           -- Return true if the current user possess one or more of the given roles on the
-          -- domain record (cases, events, visits) with the given ID
+          -- object (cases, events, visits) with the given ID
           --
           drop function if exists #{signature} cascade;
           create function #{signature} returns boolean as $$
-            select #{acl_schema}.user_is_role(public.current_user_id(), _domain_id, _roles);
+            select #{acl_schema}.user_is_role(public.current_user_id(), _object_id, _roles);
           $$ language sql
             security definer;
         ).align
         puts
 
-        signature = "public.current_is_role(_domain_id integer, _role text)"
+        signature = "public.current_is_role(_object_id integer, _role text)"
         puts %(
-          -- Return true if the current user possess the given role on the domain record
+          -- Return true if the current user possess the given role on the object
           -- (cases, events, visits). Note that this function overloads the multi-role
           -- version
           --
           drop function if exists #{signature} cascade;
           create function #{signature} returns boolean as $$
-            select #{acl_schema}.user_is_role(public.current_user_id(), _domain_id, array[_role]);
+            select #{acl_schema}.user_is_role(public.current_user_id(), _object_id, array[_role]);
           $$ language sql
             security definer;
         ).align
@@ -121,13 +118,13 @@ module MkAcl
 
         for domain, roles in DOMAINS.zip([CASE_ROLES, EVENT_ROLES, VISIT_ROLES])
           for role in roles
-            signature = "public.current_is_#{role.downcase}(_domain_id integer)"
+            signature = "public.current_is_#{role.downcase}(_object_id integer)"
             puts %(
               -- Return true if the current user possess the '#{role}' role
               --
               drop function if exists #{signature} cascade;
               create function #{signature} returns boolean as $$
-                select #{acl_schema}.user_is_role(public.current_user_id(), _domain_id, '#{role}');
+                select #{acl_schema}.user_is_role(public.current_user_id(), _object_id, '#{role}');
               $$ language sql
                 security definer;
             ).align

data/lib/mikras_utils/mkacl.rb

@@ -12,6 +12,7 @@ module MkAcl
   DOMAINS = %w(case event visit)
   DOMAIN_TABLES = DOMAINS.map { "#{_1}s" }
 
+  # TODO Read from database (or maybe not)
   CASE_ROLES = %w(LA TA KON AKK RLA CLA CTA)
   EVENT_ROLES = %w(ELA ETA)
   VISIT_ROLES = %w(VLA VTA)

data/lib/mikras_utils/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MikrasUtils
-  VERSION = "0.3.1"
+  VERSION = "0.3.3"
 end

data/tests/final-functions.sql

@@ -1,8 +1,10 @@
 
+drop function if exists public.current_role_ids() cascade;
+drop function if exists public.current_domain_roles(integer) cascade;
+
 -- Returns an array of role IDs for the current user (from both auth and
 -- app_portal). This array is matched against the relevant ACL field in the RLS
 -- policies so performance is important (TODO)
-drop function if exists public.current_role_ids() cascade;
 create function public.current_role_ids() returns integer[] as $$
   select acl_portal.select_user_acl(public.current_user_id());
 $$ language sql
@@ -13,7 +15,6 @@ $$ language sql
 
 -- Returns an array of app_portal role names (kind) for the current user in the
 -- given domain
-drop function if exists public.current_domain_roles(integer) cascade;
 create function public.current_domain_roles(_domain_id integer) returns text[] as $$
   select coalesce(array_agg(dr.role), array[]::text[])
   from acl_portal.domain_users du

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mikras_utils
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.3
 platform: ruby
 authors:
 - Claus Rasmussen
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-07-15 00:00:00.000000000 Z
+date: 2024-08-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: pg_conn