nquery 0.1.0 → 0.1.2

data/lib/generators/nquery/install_generator.rb

@@ -1,37 +1,29 @@
 # frozen_string_literal: true
 
 require "rails/generators/base"
-require "rails/generators/migration"
 
 module Nquery
   module Generators
     class InstallGenerator < Rails::Generators::Base
-      include Rails::Generators::Migration
       source_root File.expand_path("templates", __dir__)
 
-      desc "Install nquery: copies migration, initializer, and route mount snippet"
-
-      def copy_migration
-        migration_template "install.rb.tt", "db/migrate/install_nquery.rb", migration_version: migration_version
-      end
+      desc "Install nquery: copies initializer and prints setup instructions"
 
       def copy_initializer
         template "nquery.rb.tt", "config/initializers/nquery.rb"
       end
 
       def show_route_snippet
-        say "\nAdd to config/routes.rb:\n", :green
+        say "\nNext steps:\n", :green
+        say "  1. rails active_storage:install   # required for organization logo/cover uploads"
+        say "  2. rails db:migrate               # engine migrations load from the gem automatically"
+        say "  3. rails nquery:setup"
+        say "  4. Add to config/routes.rb:\n"
         say <<~ROUTE
-          authenticate :user, ->(u) { u.admin? } do
-            mount Nquery::Engine, at: "/nquery"
-          end
+             mount Nquery::Engine, at: "/nquery"
         ROUTE
-      end
-
-      private
-
-      def migration_version
-        "[#{ActiveRecord::Migration.current_version}]"
+        say "  5. Set mailer_sender + smtp in config/initializers/nquery.rb"
+        say "  6. Visit /nquery and complete the onboarding wizard\n"
       end
     end
   end

data/lib/nquery/configuration.rb

@@ -2,39 +2,23 @@
 
 module Nquery
   class Configuration
-    attr_accessor :authentication_mode
-    attr_accessor :current_user_method
     attr_accessor :parent_controller
     attr_accessor :data_sources
+    attr_accessor :default_data_source
+    attr_accessor :mailer_sender
+    attr_accessor :smtp
     attr_accessor :query_timeout
     attr_accessor :query_row_limit
     attr_accessor :embed_secret
 
     def initialize
-      @authentication_mode = :standalone
-      @current_user_method = :current_nquery_user
-      @data_sources = { main: :rails }
+      @data_sources = { main: { adapter: :rails, name: "Application database" } }
+      @default_data_source = :main
+      @mailer_sender = nil
+      @smtp = {}
       @query_timeout = 15
       @query_row_limit = 10_000
       @embed_secret = nil
-      @authenticate_with = nil
-      @resolve_nquery_user = nil
-    end
-
-    def authenticate_with(&block)
-      @authenticate_with = block
-    end
-
-    def authenticate
-      @authenticate_with
-    end
-
-    def resolve_nquery_user(&block)
-      @resolve_nquery_user = block
-    end
-
-    def resolve_user
-      @resolve_nquery_user
     end
 
     def embed_signing_key

data/lib/nquery/csv_importer.rb

@@ -31,10 +31,10 @@ module Nquery
       create_import_table(connection, table_name, columns)
       insert_rows(connection, table_name, rows, columns)
 
-      data_source = DataSource.create!(
+      DataSource.create!(
         name: @name,
-        adapter: connection.adapter_name.downcase.include?("postgres") ? "postgresql" : "rails",
-        connection_config: { import_table: table_name }.to_json
+        adapter: "rails",
+        connection_config_hash: { "import_table" => table_name }
       )
 
       upload.update!(status: "completed", column_mapping: columns)

data/lib/nquery/data_sources/adapter.rb

@@ -29,6 +29,10 @@ module Nquery
       def execute_readonly(statement, timeout: 15, row_limit: 10_000)
         raise NotImplementedError
       end
+
+      def test_connection
+        raise NotImplementedError
+      end
     end
   end
 end

data/lib/nquery/data_sources/postgresql_adapter.rb

@@ -13,6 +13,11 @@ module Nquery
         end
       end
 
+      def test_connection
+        with_connection { |conn| conn.exec_query("SELECT 1") }
+        true
+      end
+
       def execute_readonly(statement, timeout: 15, row_limit: 10_000)
         with_connection do |conn|
           rows = []
@@ -35,12 +40,21 @@ module Nquery
 
       def with_connection
         config = @data_source.connection_config_hash
-        klass = Class.new(ActiveRecord::Base) { self.abstract_class = true }
+        klass = ephemeral_connection_class
         klass.establish_connection(config)
         yield klass.connection
       ensure
         klass.remove_connection if defined?(klass) && klass.connected?
       end
+
+      def ephemeral_connection_class
+        class_name = "Nquery::DataSources::EphemeralConnection#{@data_source.id || "new"}#{object_id}"
+        Class.new(ActiveRecord::Base) do
+          self.abstract_class = true
+
+          define_singleton_method(:name) { class_name }
+        end
+      end
     end
   end
 end

data/lib/nquery/data_sources/rails_adapter.rb

@@ -13,6 +13,11 @@ module Nquery
         connection.columns(table_name).map { |c| { name: c.name, type: c.type.to_s } }
       end
 
+      def test_connection
+        connection.exec_query("SELECT 1")
+        true
+      end
+
       def execute_readonly(statement, timeout: 15, row_limit: 10_000)
         rows = []
         columns = []

data/lib/nquery/data_sources/syncer.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Nquery
+  module DataSources
+    class Syncer
+      CREDENTIAL_KEYS = %i[host port database username password database_path sslmode].freeze
+
+      def self.call
+        new.call
+      end
+
+      def call
+        Nquery.configuration.data_sources.each do |key, definition|
+          sync_data_source!(key, definition)
+        end
+      end
+
+      private
+
+      def sync_data_source!(key, definition)
+        attrs = normalize_definition(definition, key)
+        data_source = DataSource.find_or_initialize_by(key: key.to_s)
+        data_source.name = attrs.fetch(:name)
+        data_source.adapter = attrs.fetch(:adapter).to_s
+        data_source.connection_config_hash = {} if data_source.adapter == "rails"
+        data_source.save!
+        data_source
+      end
+
+      def normalize_definition(definition, key)
+        if definition.is_a?(Hash)
+          symbolized = definition.deep_symbolize_keys
+          {
+            adapter: symbolized.fetch(:adapter),
+            name: symbolized.fetch(:name)
+          }
+        else
+          {
+            adapter: definition,
+            name: default_name_for(key)
+          }
+        end
+      end
+
+      def default_name_for(key)
+        key.to_s.humanize
+      end
+    end
+  end
+end

data/lib/nquery/encryption.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Nquery
+  module Encryption
+    module_function
+
+    def configure!(app)
+      encryption = app.config.active_record.encryption
+      return if encryption.primary_key.present?
+
+      unless derive_keys_allowed?(app)
+        warn_missing_keys(app)
+        return
+      end
+
+      secret = app.secret_key_base
+      encryption.primary_key = derived_key(secret, "primary")
+      encryption.deterministic_key = derived_key(secret, "deterministic")
+      encryption.key_derivation_salt = derived_key(secret, "salt")
+      encryption.support_unencrypted_data = support_unencrypted_data if encryption.support_unencrypted_data.nil?
+    end
+
+    def derive_keys_allowed?(app)
+      app.config.consider_all_requests_local
+    end
+
+    def support_unencrypted_data
+      if ENV.key?("NQUERY_SUPPORT_UNENCRYPTED_DATA")
+        return ActiveModel::Type::Boolean.new.cast(ENV.fetch("NQUERY_SUPPORT_UNENCRYPTED_DATA"))
+      end
+
+      true
+    end
+
+    def derived_key(secret, label)
+      Digest::SHA256.hexdigest("nquery-#{label}-#{secret}")
+    end
+
+    def warn_missing_keys(app)
+      return unless defined?(Rails) && Rails.logger
+
+      Rails.logger.warn(
+        "[nquery] Active Record encryption keys are not configured. " \
+        "Set active_record_encryption in Rails credentials before deploying to production."
+      )
+    end
+  end
+end

data/lib/nquery/engine.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "devise"
+
 module Nquery
   class Engine < ::Rails::Engine
     isolate_namespace Nquery
@@ -36,12 +38,49 @@ module Nquery
       app.config.paths["db/migrate"] << migration_path unless app.config.paths["db/migrate"].include?(migration_path)
     end
 
-    initializer "nquery.config" do
-      Nquery.configure do |config|
-        config.authentication_mode = ENV.fetch("NQUERY_AUTHENTICATION_MODE", "standalone").to_sym
+    initializer "nquery.schema_dumper" do
+      ActiveSupport.on_load(:active_record) do
+        ActiveRecord::SchemaDumper.ignore_tables |= Nquery::SampleData::Ecommerce::REQUIRED_TABLES
+      end
+    end
+
+    initializer "nquery.encryption", before: "active_record_encryption" do |app|
+      Nquery::Encryption.configure!(app)
+    end
+
+    initializer "nquery.filter_parameters" do |app|
+      app.config.filter_parameters += %i[
+        password
+        password_confirmation
+        connection_config
+        username
+        database
+        database_path
+        host
+        port
+        sslmode
+      ]
+    end
+
+    initializer "nquery.mailer" do
+      config.to_prepare do
+        mailer_sender = Nquery.configuration.mailer_sender
+        smtp_settings = Nquery.configuration.smtp&.deep_symbolize_keys
+
+        [Nquery::ApplicationMailer, Nquery::DeviseMailer].each do |mailer_class|
+          mailer_class.default from: mailer_sender if mailer_sender.present?
+          mailer_class.smtp_settings = smtp_settings if smtp_settings.present?
+        end
       end
     end
 
+    # Devise mapping options (router_name, sign_out_via) live on devise_for in
+    # config/routes.rb. Mail is sent via User#send_devise_notification.
+    # Do not mutate global Devise settings (parent_controller, Warden failure_app,
+    # navigational_formats, mailer) — host apps that also use Devise must keep
+    # their own settings. Stock Devise::FailureApp + router_name: :nquery preserves
+    # the engine mount prefix on unauthenticated redirects.
+
     initializer "nquery.components" do
       ActiveSupport.on_load(:action_controller) do
         append_view_path Nquery::Engine.root.join("app/components")

data/lib/nquery/onboarding/admin_provisioner.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Onboarding
+    class AdminProvisioner
+      Result = Data.define(:user, :mail_delivered?)
+
+      def self.call(user)
+        new(user).call
+      end
+
+      def initialize(user)
+        @user = user
+      end
+
+      def call
+        @user.skip_confirmation_notification!
+
+        ActiveRecord::Base.transaction do
+          @user.save!
+          administrators_group.group_memberships.find_or_create_by!(user: @user)
+          @user.ensure_all_users_membership!
+          @user.ensure_personal_collection!
+        end
+
+        Result.new(user: @user, mail_delivered?: deliver_confirmation_email)
+      end
+
+      private
+
+      def deliver_confirmation_email
+        @user.send_confirmation_instructions != false
+      end
+
+      def administrators_group
+        Group.find_by!(system_group: "administrators")
+      end
+    end
+  end
+end

data/lib/nquery/onboarding/password_confirmation.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Onboarding
+    class PasswordConfirmation
+      Result = Data.define(:success?, :user)
+
+      def self.call(user:, password:, password_confirmation:)
+        new(user:, password:, password_confirmation:).call
+      end
+
+      def initialize(user:, password:, password_confirmation:)
+        @user = user
+        @password = password
+        @password_confirmation = password_confirmation
+      end
+
+      def call
+        return failure unless user
+
+        user.assign_attributes(password: password, password_confirmation: password_confirmation)
+        return failure unless user.save
+
+        user.confirm unless user.confirmed?
+        latch_onboarding_completion!
+        success
+      end
+
+      private
+
+      attr_reader :user, :password, :password_confirmation
+
+      def latch_onboarding_completion!
+        Organization.first&.update!(onboarding_completed_at: Time.current)
+      end
+
+      def success
+        Result.new(success?: true, user: user)
+      end
+
+      def failure
+        Result.new(success?: false, user: user)
+      end
+    end
+  end
+end

data/lib/nquery/onboarding.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Onboarding
+    module_function
+
+    def required?
+      !complete?
+    end
+
+    def complete?
+      Organization.exists? && (onboarding_latched? || confirmed_admin_exists?)
+    end
+
+    def pending_admin_confirmation?
+      return false if complete?
+      return false unless Organization.exists?
+
+      unconfirmed_admin_exists?
+    end
+
+    def onboarding_latched?
+      Organization.where.not(onboarding_completed_at: nil).exists?
+    end
+
+    def confirmed_admin_exists?
+      administrators = Group.find_by(system_group: "administrators")
+      return false unless administrators
+
+      administrators.users.active.where.not(confirmed_at: nil).exists?
+    end
+
+    def unconfirmed_admin_exists?
+      administrators = Group.find_by(system_group: "administrators")
+      return false unless administrators
+
+      administrators.users.active.where(confirmed_at: nil).exists?
+    end
+  end
+end

data/lib/nquery/permissions/resolver.rb

@@ -20,10 +20,7 @@ module Nquery
       def collection_access(collection)
         return :curate if admin?
 
-        levels = @groups.filter_map do |group|
-          perm = Nquery::CollectionPermission.find_by(group: group, collection: collection)
-          perm&.access_level
-        end
+        levels = collection_access_levels_by_id[collection.id] || []
         max_level(levels, COLLECTION_LEVELS)&.to_sym || :no_access
       end
 
@@ -62,6 +59,19 @@ module Nquery
 
       private
 
+      def collection_access_levels_by_id
+        @collection_access_levels_by_id ||= load_collection_access_levels_by_id
+      end
+
+      def load_collection_access_levels_by_id
+        return {} if @groups.empty?
+
+        Nquery::CollectionPermission
+          .where(group_id: @groups.map(&:id))
+          .group_by(&:collection_id)
+          .transform_values { |permissions| permissions.map(&:access_level) }
+      end
+
       def max_level(levels, map)
         levels.max_by { |l| map[l] || -1 }
       end

data/lib/nquery/query_runner.rb

@@ -5,8 +5,6 @@ module Nquery
     class Error < StandardError; end
     class PermissionError < Error; end
 
-    FORBIDDEN_KEYWORDS = /\b(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|GRANT|REVOKE|INTO)\b/i
-
     def initialize(data_source:, statement:, user: nil, query: nil)
       @data_source = data_source
       @statement = statement.to_s.strip
@@ -14,7 +12,7 @@ module Nquery
       @query = query
     end
 
-    def run
+    def run(audit: true)
       validate_statement!
       check_permissions!
 
@@ -25,22 +23,20 @@ module Nquery
         row_limit: Nquery.configuration.query_row_limit
       )
 
-      record_audit!(result, "success")
+      record_audit!(result, "success") if audit
       result
     rescue PermissionError
       raise
     rescue StandardError => e
-      record_audit!({}, "error", e.message)
+      record_audit!({}, "error", e.message) if audit
       raise Error, e.message
     end
 
     private
 
     def validate_statement!
-      raise Error, "Query cannot be blank" if @statement.blank?
-      raise Error, "Multi-statement queries are not allowed" if @statement.include?(";")
-      raise Error, "Query must start with SELECT or WITH" unless @statement.match?(/\A\s*(SELECT|WITH)\b/i)
-      raise Error, "Only SELECT queries are allowed" if @statement.match?(FORBIDDEN_KEYWORDS)
+      message = ReadonlySql.error_message(@statement)
+      raise Error, message if message
     end
 
     def check_permissions!

data/lib/nquery/readonly_sql.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Nquery
+  # Validates that a SQL statement is read-only (SELECT / WITH … SELECT).
+  module ReadonlySql
+    FORBIDDEN_KEYWORDS = /\b(
+      INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|
+      GRANT|REVOKE|INTO|MERGE|REPLACE|CALL|EXEC|EXECUTE|
+      COPY|ATTACH|DETACH|VACUUM|PRAGMA|REINDEX|RENAME
+    )\b/ix
+
+    module_function
+
+    def error_message(statement, allow_blank: false)
+      sql = statement.to_s.strip
+
+      return "Query cannot be blank" if sql.blank? && !allow_blank
+      return if sql.blank?
+
+      return "Multi-statement queries are not allowed" if sql.include?(";")
+      return "Query must start with SELECT or WITH" unless sql.match?(/\A\s*(SELECT|WITH)\b/i)
+      "Only SELECT queries are allowed" if sql.match?(FORBIDDEN_KEYWORDS)
+    end
+  end
+end

data/lib/nquery/seeder.rb

@@ -7,10 +7,15 @@ module Nquery
     end
 
     def run!
+      Setup.run!
+
+      organization = Organization.find_or_create_by!(name: "Nquery Demo") do |org|
+        org.website = "https://nquery.dev"
+      end
+
       seed_sample_data!
 
-      admin_group = ensure_group!("Administrators", "administrators")
-      all_users_group = ensure_group!("All Users", "all_users")
+      admin_group = Group.find_by!(system_group: "administrators")
       engineering = ensure_group!("Engineering", "custom", "Engineering team")
 
       admin = ensure_user!("admin@nquery.dev", "Admin", "User", "password123")
@@ -20,15 +25,12 @@ module Nquery
       admin_group.group_memberships.find_or_create_by!(user: admin)
       engineering.group_memberships.find_or_create_by!(user: analyst)
 
-      data_source = DataSource.find_or_create_by!(name: "Main Database") do |ds|
-        ds.adapter = "rails"
-        ds.connection_config = {}.to_json
-      end
+      data_source = DataSource.find_by(key: "main") || DataSource.find_by!(name: "Application database")
 
-      root_collection = Collection.find_or_create_by!(name: "Our analytics", kind: "root")
+      root_collection = Collection.find_or_create_by!(name: Setup::ROOT_COLLECTION_NAME, kind: "root")
       admin.ensure_personal_collection!
 
-      seed_permissions!(admin_group, all_users_group, engineering, root_collection, data_source)
+      seed_demo_permissions!(engineering, root_collection, data_source)
 
       sample_tables = SampleData::Ecommerce::TABLES
       query = Query.find_or_initialize_by(name: "Monthly revenue")
@@ -74,11 +76,7 @@ module Nquery
         expires_at: 1.year.from_now
       ) unless EmbedToken.exists?(resource_type: "Nquery::Chart", resource_id: chart.id)
 
-      ApplicationPermission::FEATURES.each do |feature|
-        ApplicationPermission.find_or_create_by!(group: admin_group, feature: feature) do |p|
-          p.access_level = "yes"
-        end
-      end
+      organization.update!(onboarding_completed_at: Time.current) if organization.onboarding_completed_at.blank?
     end
 
     private
@@ -97,34 +95,27 @@ module Nquery
     end
 
     def ensure_user!(email, first_name, last_name, password)
-      User.find_or_create_by!(email: email) do |u|
-        u.first_name = first_name
-        u.last_name = last_name
-        u.password = password
+      User.find_or_create_by!(email: email) do |user|
+        user.first_name = first_name
+        user.last_name = last_name
+        user.password = password
+        user.password_confirmation = password
+        user.confirmed_at = Time.current
+      end.tap do |user|
+        user.update!(confirmed_at: Time.current) if user.confirmed_at.blank?
       end
     end
 
-    def seed_permissions!(admin_group, all_users_group, engineering, root_collection, data_source)
-      CollectionPermission.find_or_create_by!(group: admin_group, collection: root_collection) do |p|
-        p.access_level = "curate"
-      end
-      CollectionPermission.find_or_create_by!(group: all_users_group, collection: root_collection) do |p|
-        p.access_level = "view"
-      end
+    def seed_demo_permissions!(engineering, root_collection, data_source)
       CollectionPermission.find_or_create_by!(group: engineering, collection: root_collection) do |p|
         p.access_level = "view"
       end
 
-      [admin_group, all_users_group, engineering].each do |group|
-        level = group.system_group == "administrators" ? "can_view" : (group.system_group == "all_users" ? "can_view" : "blocked")
-        create_level = group.system_group == "administrators" ? "query_builder_and_native" : "no"
-
-        DataPermission.find_or_create_by!(group: group, data_source: data_source, permission_type: "view_data", resource_path: nil) do |p|
-          p.access_level = level
-        end
-        DataPermission.find_or_create_by!(group: group, data_source: data_source, permission_type: "create_queries", resource_path: nil) do |p|
-          p.access_level = create_level
-        end
+      DataPermission.find_or_create_by!(group: engineering, data_source: data_source, permission_type: "view_data", resource_path: nil) do |p|
+        p.access_level = "blocked"
+      end
+      DataPermission.find_or_create_by!(group: engineering, data_source: data_source, permission_type: "create_queries", resource_path: nil) do |p|
+        p.access_level = "no"
       end
     end
   end