omen 0.4.0 → 0.5.0

data/lib/omen/inquirer.rb

@@ -14,30 +14,30 @@ module Omen
     UNMADE = 'Could not make %{role}, so every reading will say this app is misconfigured. Ask ' \
              'for that role, NOLOGIN, granted SELECT on every table but %{tables}.'
 
-    # Said per statement, since the grants, the revocations and the functions need nothing from
-    # one another and one refusal should not discard the rest.
+    # Said per group, since the grants, the revocations and the functions need nothing from one
+    # another and one refusal should not discard the rest.
     REFUSED = 'Skipped, refused by the database: %{statement} (%{error})'
 
     # Said where a role that already existed is one a reading should not be able to reach through.
     DANGEROUS = '%{role} holds %{held}. This gem cannot take that away without being a superuser ' \
                 'itself, so ask for it to be taken away.'
 
-    # Creates the role and the function, on every database this environment prepares.
+    # Creates the role and the functions, and writes every narrowing a host declared, on every
+    # database this environment prepares.
     # @return [void]
-    def self.grant
-      environments.each do |environment|
-        config = ActiveRecord::Base.configurations.configs_for env_name: environment,
-          name: 'primary'
-        next unless config
-        ActiveRecord::Tasks::DatabaseTasks.with_temporary_connection config do |connection|
-          grant_on connection
+    def self.grant = Omen.each_database { |connection| grant_on connection }
+
+    # Takes every narrowing back off, leaving each table read the way it was read before one.
+    # @return [void]
+    def self.widen
+      Omen.each_database do |connection|
+        Omen::Reading.narrowings.each do |narrowing|
+          narrowing.widening(connection).each { |group| attempted connection, *group }
+          puts "Widened #{connection.current_database} back out of #{narrowing.role}"
         end
       end
     end
 
-    # @return [Array<String>] the environments whose databases this run should cover.
-    def self.environments = Rails.env.development? ? %w[ development test ] : [Rails.env.to_s]
-
     # Warns rather than raises: a managed database never grants CREATEROLE, and a deploy that
     # cannot make the role must still finish, having said what has to be made by hand.
     # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
@@ -54,18 +54,34 @@ module Omen
       held = Attributes.dangerous connection
       warn DANGEROUS % { role: role, held: held.to_sentence } if held.any?
       puts "Granted SELECT on #{connection.current_database} to #{role}"
+      narrow connection, members
     end
 
-    # One statement at a time, so a database that refuses one still runs the others -- and each
-    # inside a savepoint of its own, since a refusal inside a transaction refuses everything
-    # after it too, and this task is as likely to be run from a console as from a deploy.
+    # Every audience a host declared, written into the database its readings are answered from.
     # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
-    # @param statement [String] one of the statements Omen::Grants builds.
+    # @param members [Array<String>] the roles that may enter a narrowed one.
     # @return [void]
-    def self.attempted(connection, statement)
-      connection.transaction(requires_new: true) { connection.execute statement }
+    def self.narrow(connection, members)
+      Omen::Reading.narrowings.each do |narrowing|
+        narrowing.statements(connection, members).each { |group| attempted connection, *group }
+        puts "Narrowed #{narrowing.role} to the rows #{narrowing.setting} names"
+      end
+    end
+
+    # A group at a time, so a database that refuses one still runs the others -- and each inside
+    # a savepoint of its own, since a refusal inside a transaction refuses everything after it
+    # too, and this task is as likely to be run from a console as from a deploy. What arrives
+    # together is applied together: a table is never left with row level security on and no
+    # policy under it.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @param statements [Array<String>] what Omen::Grants or a narrowing built.
+    # @return [void]
+    def self.attempted(connection, *statements)
+      connection.transaction(requires_new: true) do
+        statements.each { |statement| connection.execute statement }
+      end
     rescue ActiveRecord::StatementInvalid => error
-      warn REFUSED % { statement: statement.squish, error: error.message.lines.first.strip }
+      warn REFUSED % { statement: statements.first.squish, error: error.message.lines.first.strip }
     end
 
     # Discovered rather than named: SET LOCAL ROLE needs the connecting role to be a member of

data/lib/omen/narrowing.rb

@@ -0,0 +1,87 @@
+module Omen
+  # What one audience of a reading may read: the role its statement runs as, the rows each
+  # table admits it, and the tables it reads whole because nothing in them is anybody's.
+  class Narrowing
+    # The policy every role holds, so that turning row level security on takes nothing away
+    # from whoever could already read -- a role made after this ran included. The narrowed role
+    # is held back by the restrictive policy beside it, which is ANDed with this one and
+    # applies to nobody else.
+    EVERYBODY = 'omen_everybody'
+
+    # @return [String] the Postgres role a reading of this audience runs as.
+    attr_reader :role
+
+    # @return [Symbol] the column of the reading that says whose rows these are.
+    attr_reader :by
+
+    # @param role [String] the Postgres role a reading of this audience runs as.
+    # @param by [Symbol] the column of the reading that says whose rows these are.
+    # @param own [Hash] every table it reads rows of, to what makes a row its own. A table is
+    #   named either way, since a host writing one of these writes symbols or strings by habit.
+    # @param whole [Array<String>] the tables it reads whole, nobody's in particular.
+    # @param except [Regexp, nil] the columns of those it may not read, a counter over everybody
+    #   being the case this exists for: it counts every owner rather than this one.
+    def initialize(role:, by:, own:, whole: [], except: nil)
+      @role = role
+      @by = by
+      @own = own.transform_keys(&:to_s)
+      @whole = whole.map(&:to_s)
+      @except = except
+    end
+
+    # @return [String] the setting a policy reads to know whose rows it is looking at.
+    def setting = "omen.#{@by}"
+
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @param members [Array<String>] the roles that may enter this one.
+    # @return [Array<Array<String>>] the statements, grouped: what arrives together is applied
+    #   together, so no table is left with row level security on and no policy under it.
+    def statements(connection, members)
+      [ Grants.narrowed(connection, @role, members),
+        *@whole.map { |table| granted connection, table },
+        *@own.map { |table, own| narrowed connection, table, own }, ]
+    end
+
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @return [Array<Array<String>>] the statements that take it back off, table by table.
+    def widening(connection)
+      @own.keys.map { |table| widened connection, table }
+    end
+
+  private
+
+    # The permissive policy first and the table turned on last, so a group that stops short
+    # leaves a table nobody has been narrowed on rather than one nobody can read.
+    def narrowed(connection, table, own)
+      quoted = connection.quote_table_name table
+      [ *granted(connection, table),
+        *policy(connection, quoted, EVERYBODY, 'FOR ALL TO PUBLIC USING (true) WITH CHECK (true)'),
+        *policy(connection, quoted, "#{table}_#{@role}",
+          "AS RESTRICTIVE FOR SELECT TO #{connection.quote_table_name @role} " \
+          "USING (#{format own, owner: owner, setting: setting})"),
+        "ALTER TABLE #{quoted} ENABLE ROW LEVEL SECURITY", ]
+    end
+
+    # Dropped first, so that running this again says what it said the first time.
+    def policy(connection, quoted, name, rule)
+      named = connection.quote_table_name name
+      [ "DROP POLICY IF EXISTS #{named} ON #{quoted}",
+        "CREATE POLICY #{named} ON #{quoted} #{rule}", ]
+    end
+
+    def widened(connection, table)
+      quoted = connection.quote_table_name table
+      [ "DROP POLICY IF EXISTS #{connection.quote_table_name "#{table}_#{@role}"} ON #{quoted}",
+        "DROP POLICY IF EXISTS #{connection.quote_table_name EVERYBODY} ON #{quoted}",
+        "ALTER TABLE #{quoted} DISABLE ROW LEVEL SECURITY", ]
+    end
+
+    # Empty where the reading names nobody, and no row is nobody's, so nobody reads nothing.
+    def owner = "NULLIF(current_setting('#{setting}', true), '')::bigint"
+
+    def granted(connection, table)
+      refused = [ Omen::Column::CREDENTIALS, (@except if @whole.include? table) ].compact
+      Grants.granted connection, @role, table, Regexp.union(refused)
+    end
+  end
+end

data/lib/omen/version.rb

@@ -1,4 +1,4 @@
 module Omen
   # The version of this gem, as RubyGems knows it.
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

data/lib/omen.rb

@@ -7,6 +7,8 @@ require 'omen/distance'
 require 'omen/grants'
 require 'omen/renamed'
 require 'omen/time_zone'
+require 'omen/bound'
+require 'omen/narrowing'
 require 'omen/inquirer'
 require 'omen/requirements'
 require 'omen/version'
@@ -24,4 +26,19 @@ module Omen
   # Yields the configuration, so a host states its own facts in one initializer.
   # @return [void]
   def self.configure = yield config
+
+  # @return [Array<String>] the environments whose databases a grant should cover.
+  def self.environments = Rails.env.development? ? %w[ development test ] : [Rails.env.to_s]
+
+  # @yield [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing connection to each
+  #   database this environment prepares.
+  # @return [void]
+  def self.each_database
+    environments.each do |environment|
+      config = ActiveRecord::Base.configurations.configs_for env_name: environment,
+        name: 'primary'
+      next unless config
+      ActiveRecord::Tasks::DatabaseTasks.with_temporary_connection(config) { |it| yield it }
+    end
+  end
 end

data/lib/tasks/omen.rake

@@ -1,9 +1,23 @@
 namespace :db do
   namespace :omen do
-    desc 'Create the role a reading runs its statement as, and the function it reads a ' \
-         'timestamp through'
+    desc 'Create the role a reading runs its statement as, the function it reads a ' \
+         'timestamp through, and the policies every narrowing a host declared asks for'
     task grant: :environment do
       Omen::Inquirer.grant
     end
+
+    desc 'Take every narrowing back off, leaving each table read the way it was read before'
+    task widen: :environment do
+      Omen::Inquirer.widen
+    end
+
+    desc 'Say which roles the policies of a narrowing hold back, membership included'
+    task narrowed: :environment do
+      Omen.config.record.with_connection do |connection|
+        Omen::Bound.roles(connection).each { |row| puts row.join ' ' }
+        surprises = Omen::Bound.surprises connection
+        abort "Narrowed without being asked for: #{surprises.inspect}" if surprises.any?
+      end
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omen
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Claudio Baccigalupo
@@ -73,6 +73,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
+- INSTRUCTIONS.md
 - LICENSE.txt
 - README.md
 - app/models/omen/answer.rb
@@ -83,9 +84,12 @@ files:
 - app/models/omen/executed.rb
 - app/models/omen/instructions.md
 - app/models/omen/instructions.rb
+- app/models/omen/narrowed.rb
 - app/models/omen/query.rb
 - app/models/omen/question.rb
 - app/models/omen/reading.rb
+- app/models/omen/refusal.rb
+- app/models/omen/reply.rb
 - app/models/omen/revealed.rb
 - app/models/omen/role.rb
 - app/models/omen/schema.rb
@@ -94,15 +98,25 @@ files:
 - db/migrate/20260821120000_create_omen_readings.rb
 - db/migrate/20260821120001_create_omen_questions.rb
 - db/migrate/20260821120002_create_omen_answers.rb
+- db/migrate/20260912000000_add_type_to_omen_readings.rb
 - lib/generators/omen/install/install_generator.rb
 - lib/generators/omen/install/templates/omen.rb
+- lib/generators/omen/pages/USAGE
+- lib/generators/omen/pages/pages_generator.rb
+- lib/generators/omen/pages/templates/_form.html.erb.tt
+- lib/generators/omen/pages/templates/controller.rb.tt
+- lib/generators/omen/pages/templates/index.html.erb.tt
+- lib/generators/omen/pages/templates/model.rb.tt
+- lib/generators/omen/pages/templates/show.html.erb.tt
 - lib/omen.rb
 - lib/omen/attributes.rb
+- lib/omen/bound.rb
 - lib/omen/config.rb
 - lib/omen/distance.rb
 - lib/omen/engine.rb
 - lib/omen/grants.rb
 - lib/omen/inquirer.rb
+- lib/omen/narrowing.rb
 - lib/omen/renamed.rb
 - lib/omen/requirements.rb
 - lib/omen/stubs.rb