orfeas_pam_dsl 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbc7589ac5d89e024056bc8ba7c7cd24344accf0774d110841d7df67c063d12d
-  data.tar.gz: 513b8a259f2f1b98802152f0358bfc4d0b615aa6175e83780fc92a42fd426bbe
+  metadata.gz: 491fcb9f14e0d6b8902e18855face0c4f7fac3e59984e3b994f645f8127f3b91
+  data.tar.gz: 982d327acf820378e65f1c3c39f18dcb4056efb7aa9c5c465b30c1f8b02fd9e0
 SHA512:
-  metadata.gz: 2f4205ae19ef26ca957a28104833d26e567b1ba5ed74623393eea7e5a9a80492b5378c7952a6159edeb4a2e06de5c2ee731a719002f169c131b52898c559e1be
-  data.tar.gz: 58506a1d1c9e4106c570fcdb4513c7928b0b8f1207a97e5807f5f1b779eaf5e030c7aa78fe5d9a0093e0efffcd9a26a8f7437ca948254c862ce332ebd3e2f411
+  metadata.gz: cff013a4a07623d006613bfcad540c13f237a23e61be2324ef542e744c52b091b113dd6c7a653ee18d7ac0c683873e473063f87db702649fe5c52b3a7615f13d
+  data.tar.gz: 9303fb69a0822272ad2b6e9156d8d92f8a142e01d49052b2dd551b24f885c6c849a9c15a0a628846d0838b4c7647bff5b19b7261291648c1f79aba9f67834d76

data/CHANGELOG.md

@@ -4,6 +4,65 @@ All notable changes to PAM DSL will be documented in this file.
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-10
+
+### Added
+- **`online_identifier` is a declarable field type** — the detector had a pattern by that name
+  but `Field::PII_TYPES` lacked it, so a policy could not declare such a field. It is a
+  non-special, non-sensitive type. (The detector still reports login-name columns as
+  `identifier`.)
+- **The policy generators keep an existing policy file** — `generate:policy` and
+  `generate:from_models` raise `PolicyGenerator::FileExistsError` instead of overwriting
+  `config/initializers/pam_dsl_policy.rb`; `FORCE=1` on the rake tasks (`force: true` in Ruby)
+  replaces it.
+- **Article 30 register from declarations, not placeholders** — `article_30_report` printed
+  "Internal staff" as every purpose's recipients, "No international transfers", a list of
+  asserted security measures (TLS, role-based access, PaperTrail), a per-purpose retention that
+  was always the default (it passed a field where a model name belongs), and a data-subject
+  rights section of "[Configure implementation path]" that Article 30 does not ask for. Purposes
+  now declare `data_subjects`, `recipients` and `transfer to:, safeguard:` (or `no_transfers!`),
+  and policies `security_measures` (Art. 30(1)(c), (d), (e), (g)); the register prints them, a
+  retention schedule from the policy's rules (Art. 30(1)(f)), and a completeness section listing
+  each undeclared item with its clause (`Policy#article_30_gaps`). The JSON export carries the
+  same, under `not_declared` for the gaps. Durations read "1 year", not "1 years".
+- **One PII dictionary; detection fixed on a foreign codebase** — `PolicyGenerator` kept its own
+  exact-name patterns and exclusions, separate from `PIIDetector`'s; on Solidus 4.7 the
+  generator found 6 of 26 personal columns and flagged an order's state machine as an address.
+  The generator now detects with `PIIDetector` (its `PII_PATTERNS` and `EXCLUDE_PATTERNS` are
+  gone), scans each table's real columns (a column the model ignores is reported, and the
+  generated policy says the application cannot see or erase it), and counts a bare `name` only
+  in a model that holds other personal data (a product's or a payment plan's name is not a
+  person's). The detector gained `address1`/`address2`, `zipcode`/`postcode`, `state_name`, any
+  `*_ip`, `last_digits`/`last4`, `login`/`username` (an `:identifier`), `bic`/`swift`/account
+  numbers, `birth_date`, and a person's account and session tokens and credentials (password
+  hashes and salts, remember/confirmation/reset/unlock/guest tokens), which the `encrypted_` and
+  `_token` exclusions used to drop; names match name forms and the names of people in a role
+  (`debtor_name`, `approver_name`), not every `*_name`. New exclusions: foreign keys (`*_id`,
+  except identifiers such as `vat_id`, `customer_national_id`), `*_iso`, `*_message`, `*_reason`,
+  `*_notes`; a bare `state` and `rest_income_budget` are no longer personal. On Solidus: 24 of
+  26; on the Aegean testbed: 29 fields (27 personal) where the old generator reported 18; on the
+  labelled evaluation dataset: recall 99.1% (was 97.4%), precision 98.3% (was 98.2%).
+- **Access recorder** (`PamDsl.access_recorder`, `Enforcement::Access`): every
+  `validate_access!` call, whatever its outcome, is passed to the recorder before it returns or
+  raises, as an `Access` (policy, purpose, legal basis, fields, subject, outcome `:granted`,
+  `:audited` or `:denied`, the violations found, time). The recorder answers `record?(policy)`
+  and `call(access)`; an error it raises propagates, so an access it cannot record does not go
+  ahead. One per process, set by the host (Lyra's access log); `PamDsl.reset!` leaves it in place.
+- **Enforcement modes** (`PamDsl.enforcement_mode`, `PamDsl::Enforcement`): `:strict`, the
+  default and the behaviour so far, blocks an invalid access by raising its typed exception;
+  `:audit` lets it through, records **every** violation found (not only the first), logs each
+  (`PamDsl.logger`: `Rails.logger` under Rails, standard error otherwise), passes each to the
+  `PamDsl.on_violation { |violation| ... }` handlers as an `Enforcement::Violation` (policy,
+  purpose, fields, subject, error class, message, time), and makes `validate_access!` return
+  `false`. A policy can override the global mode (`enforcement :audit` in its definition). In
+  strict mode the first violation raised is the same, in the same order, as before.
+  `Policy#access_violations` returns them all without raising. `PamDsl.reset!` also resets the
+  mode and the handlers.
+### Changed
+- **Ruby 4.0 or later is required** (`required_ruby_version >= 4.0`; none was declared before).
+### Fixed
+- `PamDsl.reporter` dropped the `output:` option, so reports always went to standard output.
+
 ## [0.8.0] - 2026-06-15
 
 The first release to RubyGems since 0.6.0, and the version the PAM article (Requirements