oso-cloud 1.0.1 → 1.1.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rubocop.yml +5 -0
- data/Gemfile.lock +1 -1
- data/lib/oso/api.rb +75 -98
- data/lib/oso/helpers.rb +30 -15
- data/lib/oso/oso.rb +71 -52
- data/lib/oso/version.rb +1 -1
- metadata +3 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 9268075db2dd7d76b41905d870962afa84ec350ff9d0b335f4c473cef169868e
|
4
|
+
data.tar.gz: 7eacd7959071d7d2500ceeebf14d09846d5482cd5189139a92667155df796db9
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 8fbea6dd735db2f768fd9d1c8a6af8b3219abc5e688b3d9bc2e557b512aa9303fa2e6afa792f701aa60bebc0443d6703fa6fcd3e48ce5a6fcfd3aad8a09e17c4
|
7
|
+
data.tar.gz: 84baac085041cf7d3e34c0b2261b3bf66a83245ea82d42b42ed3d47de39600d28939e31bf119d000477d5e67dce09a40a3a4a64bd60ecf0bf80ceb1d2f3d8c97
|
data/.rubocop.yml
ADDED
data/Gemfile.lock
CHANGED
data/lib/oso/api.rb
CHANGED
@@ -4,6 +4,7 @@ require 'faraday'
|
|
4
4
|
require 'faraday/retry'
|
5
5
|
|
6
6
|
require 'oso/helpers'
|
7
|
+
require 'oso/version'
|
7
8
|
|
8
9
|
module OsoCloud
|
9
10
|
# @!visibility private
|
@@ -26,8 +27,7 @@ module OsoCloud
|
|
26
27
|
|
27
28
|
# @!visibility private
|
28
29
|
class Policy
|
29
|
-
attr_reader :filename
|
30
|
-
attr_reader :src
|
30
|
+
attr_reader :filename, :src
|
31
31
|
|
32
32
|
def initialize(filename:, src:)
|
33
33
|
@filename = filename
|
@@ -40,29 +40,27 @@ module OsoCloud
|
|
40
40
|
attr_reader :policy
|
41
41
|
|
42
42
|
def initialize(policy:)
|
43
|
-
if policy.is_a? Policy
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
43
|
+
@policy = if policy.is_a? Policy
|
44
|
+
policy
|
45
|
+
else
|
46
|
+
Policy.new(**policy)
|
47
|
+
end
|
48
48
|
end
|
49
49
|
end
|
50
50
|
|
51
51
|
# @!visibility private
|
52
52
|
class Fact
|
53
|
-
attr_reader :predicate
|
54
|
-
attr_reader :args
|
53
|
+
attr_reader :predicate, :args
|
55
54
|
|
56
55
|
def initialize(predicate:, args:)
|
57
56
|
@predicate = predicate
|
58
|
-
@args = args.map { |v|
|
57
|
+
@args = args.map { |v| (v.is_a? Value) ? v : Value.new(**v) }
|
59
58
|
end
|
60
59
|
end
|
61
60
|
|
62
61
|
# @!visibility private
|
63
62
|
class Value
|
64
|
-
attr_reader :type
|
65
|
-
attr_reader :id
|
63
|
+
attr_reader :type, :id
|
66
64
|
|
67
65
|
def initialize(type:, id:)
|
68
66
|
@type = type
|
@@ -72,12 +70,11 @@ module OsoCloud
|
|
72
70
|
|
73
71
|
# @!visibility private
|
74
72
|
class Bulk
|
75
|
-
attr_reader :delete
|
76
|
-
attr_reader :tell
|
73
|
+
attr_reader :delete, :tell
|
77
74
|
|
78
75
|
def initialize(delete:, tell:)
|
79
|
-
@delete = delete.map { |v|
|
80
|
-
@tell = tell.map { |v|
|
76
|
+
@delete = delete.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
77
|
+
@tell = tell.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
81
78
|
end
|
82
79
|
end
|
83
80
|
|
@@ -92,12 +89,7 @@ module OsoCloud
|
|
92
89
|
|
93
90
|
# @!visibility private
|
94
91
|
class AuthorizeQuery
|
95
|
-
attr_reader :actor_type
|
96
|
-
attr_reader :actor_id
|
97
|
-
attr_reader :action
|
98
|
-
attr_reader :resource_type
|
99
|
-
attr_reader :resource_id
|
100
|
-
attr_reader :context_facts
|
92
|
+
attr_reader :actor_type, :actor_id, :action, :resource_type, :resource_id, :context_facts
|
101
93
|
|
102
94
|
def initialize(actor_type:, actor_id:, action:, resource_type:, resource_id:, context_facts:)
|
103
95
|
@actor_type = actor_type
|
@@ -105,7 +97,7 @@ module OsoCloud
|
|
105
97
|
@action = action
|
106
98
|
@resource_type = resource_type
|
107
99
|
@resource_id = resource_id
|
108
|
-
@context_facts = context_facts.map { |v|
|
100
|
+
@context_facts = context_facts.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
109
101
|
end
|
110
102
|
end
|
111
103
|
|
@@ -114,24 +106,20 @@ module OsoCloud
|
|
114
106
|
attr_reader :results
|
115
107
|
|
116
108
|
def initialize(results:)
|
117
|
-
@results = results.map { |v|
|
109
|
+
@results = results.map { |v| (v.is_a? Value) ? v : Value.new(**v) }
|
118
110
|
end
|
119
111
|
end
|
120
112
|
|
121
113
|
# @!visibility private
|
122
114
|
class AuthorizeResourcesQuery
|
123
|
-
attr_reader :actor_type
|
124
|
-
attr_reader :actor_id
|
125
|
-
attr_reader :action
|
126
|
-
attr_reader :resources
|
127
|
-
attr_reader :context_facts
|
115
|
+
attr_reader :actor_type, :actor_id, :action, :resources, :context_facts
|
128
116
|
|
129
117
|
def initialize(actor_type:, actor_id:, action:, resources:, context_facts:)
|
130
118
|
@actor_type = actor_type
|
131
119
|
@actor_id = actor_id
|
132
120
|
@action = action
|
133
|
-
@resources = resources.map { |v|
|
134
|
-
@context_facts = context_facts.map { |v|
|
121
|
+
@resources = resources.map { |v| (v.is_a? Value) ? v : Value.new(**v) }
|
122
|
+
@context_facts = context_facts.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
135
123
|
end
|
136
124
|
end
|
137
125
|
|
@@ -146,18 +134,14 @@ module OsoCloud
|
|
146
134
|
|
147
135
|
# @!visibility private
|
148
136
|
class ListQuery
|
149
|
-
attr_reader :actor_type
|
150
|
-
attr_reader :actor_id
|
151
|
-
attr_reader :action
|
152
|
-
attr_reader :resource_type
|
153
|
-
attr_reader :context_facts
|
137
|
+
attr_reader :actor_type, :actor_id, :action, :resource_type, :context_facts
|
154
138
|
|
155
139
|
def initialize(actor_type:, actor_id:, action:, resource_type:, context_facts:)
|
156
140
|
@actor_type = actor_type
|
157
141
|
@actor_id = actor_id
|
158
142
|
@action = action
|
159
143
|
@resource_type = resource_type
|
160
|
-
@context_facts = context_facts.map { |v|
|
144
|
+
@context_facts = context_facts.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
161
145
|
end
|
162
146
|
end
|
163
147
|
|
@@ -172,18 +156,14 @@ module OsoCloud
|
|
172
156
|
|
173
157
|
# @!visibility private
|
174
158
|
class ActionsQuery
|
175
|
-
attr_reader :actor_type
|
176
|
-
attr_reader :actor_id
|
177
|
-
attr_reader :resource_type
|
178
|
-
attr_reader :resource_id
|
179
|
-
attr_reader :context_facts
|
159
|
+
attr_reader :actor_type, :actor_id, :resource_type, :resource_id, :context_facts
|
180
160
|
|
181
161
|
def initialize(actor_type:, actor_id:, resource_type:, resource_id:, context_facts:)
|
182
162
|
@actor_type = actor_type
|
183
163
|
@actor_id = actor_id
|
184
164
|
@resource_type = resource_type
|
185
165
|
@resource_id = resource_id
|
186
|
-
@context_facts = context_facts.map { |v|
|
166
|
+
@context_facts = context_facts.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
187
167
|
end
|
188
168
|
end
|
189
169
|
|
@@ -192,30 +172,27 @@ module OsoCloud
|
|
192
172
|
attr_reader :results
|
193
173
|
|
194
174
|
def initialize(results:)
|
195
|
-
@results = results.map { |v|
|
175
|
+
@results = results.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
196
176
|
end
|
197
177
|
end
|
198
178
|
|
199
179
|
# @!visibility private
|
200
180
|
class Query
|
201
|
-
attr_reader :fact
|
202
|
-
attr_reader :context_facts
|
181
|
+
attr_reader :fact, :context_facts
|
203
182
|
|
204
183
|
def initialize(fact:, context_facts:)
|
205
|
-
if fact.is_a? Fact
|
206
|
-
|
207
|
-
|
208
|
-
|
209
|
-
|
210
|
-
@context_facts = context_facts.map { |v|
|
184
|
+
@fact = if fact.is_a? Fact
|
185
|
+
fact
|
186
|
+
else
|
187
|
+
Fact.new(**fact)
|
188
|
+
end
|
189
|
+
@context_facts = context_facts.map { |v| (v.is_a? Fact) ? v : Fact.new(**v) }
|
211
190
|
end
|
212
191
|
end
|
213
192
|
|
214
193
|
# @!visibility private
|
215
194
|
class StatsResult
|
216
|
-
attr_reader :num_roles
|
217
|
-
attr_reader :num_relations
|
218
|
-
attr_reader :num_facts
|
195
|
+
attr_reader :num_roles, :num_relations, :num_facts
|
219
196
|
|
220
197
|
def initialize(num_roles:, num_relations:, num_facts:)
|
221
198
|
@num_roles = num_roles
|
@@ -224,7 +201,6 @@ module OsoCloud
|
|
224
201
|
end
|
225
202
|
end
|
226
203
|
|
227
|
-
|
228
204
|
# @!visibility private
|
229
205
|
class Api
|
230
206
|
def initialize(url: 'https://cloud.osohq.com', api_key: nil, options: nil)
|
@@ -246,7 +222,7 @@ module OsoCloud
|
|
246
222
|
retry_statuses: [429, 500, 502, 503, 504],
|
247
223
|
# ensure authorize and related check functions are retried because
|
248
224
|
# they are POST requests, which are not retried automatically
|
249
|
-
retry_if:
|
225
|
+
retry_if: lambda { |env, _exc|
|
250
226
|
%w[
|
251
227
|
/api/authorize
|
252
228
|
/api/authorize_resources
|
@@ -254,18 +230,18 @@ module OsoCloud
|
|
254
230
|
/api/actions
|
255
231
|
/api/query
|
256
232
|
].include? env.url.path
|
257
|
-
}
|
233
|
+
}
|
258
234
|
}
|
259
235
|
|
260
|
-
if
|
236
|
+
if options && options[:test_adapter]
|
261
237
|
faraday.adapter :test do |stub|
|
262
|
-
stub.post(options[:test_adapter][:path]) do |
|
238
|
+
stub.post(options[:test_adapter][:path]) do |_env|
|
263
239
|
options[:test_adapter][:func].call
|
264
240
|
end
|
265
|
-
stub.get(options[:test_adapter][:path]) do |
|
241
|
+
stub.get(options[:test_adapter][:path]) do |_env|
|
266
242
|
options[:test_adapter][:func].call
|
267
243
|
end
|
268
|
-
stub.delete(options[:test_adapter][:path]) do |
|
244
|
+
stub.delete(options[:test_adapter][:path]) do |_env|
|
269
245
|
options[:test_adapter][:func].call
|
270
246
|
end
|
271
247
|
end
|
@@ -274,12 +250,13 @@ module OsoCloud
|
|
274
250
|
end
|
275
251
|
end
|
276
252
|
@api_key = api_key
|
253
|
+
@user_agent = "Oso Cloud (ruby #{RUBY_VERSION}p#{RUBY_PATCHLEVEL}; rv:#{VERSION})"
|
277
254
|
end
|
278
255
|
|
279
|
-
def get_policy
|
256
|
+
def get_policy
|
280
257
|
params = {}
|
281
258
|
data = nil
|
282
|
-
url =
|
259
|
+
url = '/policy'
|
283
260
|
result = GET(url, params, data)
|
284
261
|
GetPolicyResult.new(**result)
|
285
262
|
end
|
@@ -287,7 +264,7 @@ module OsoCloud
|
|
287
264
|
def post_policy(data)
|
288
265
|
params = {}
|
289
266
|
data = OsoCloud::Helpers.to_hash(data)
|
290
|
-
url =
|
267
|
+
url = '/policy'
|
291
268
|
result = POST(url, params, data)
|
292
269
|
ApiResult.new(**result)
|
293
270
|
end
|
@@ -295,7 +272,7 @@ module OsoCloud
|
|
295
272
|
def post_facts(data)
|
296
273
|
params = {}
|
297
274
|
data = OsoCloud::Helpers.to_hash(data)
|
298
|
-
url =
|
275
|
+
url = '/facts'
|
299
276
|
result = POST(url, params, data)
|
300
277
|
Fact.new(**result)
|
301
278
|
end
|
@@ -303,7 +280,7 @@ module OsoCloud
|
|
303
280
|
def delete_facts(data)
|
304
281
|
params = {}
|
305
282
|
data = OsoCloud::Helpers.to_hash(data)
|
306
|
-
url =
|
283
|
+
url = '/facts'
|
307
284
|
result = DELETE(url, params, data)
|
308
285
|
ApiResult.new(**result)
|
309
286
|
end
|
@@ -311,7 +288,7 @@ module OsoCloud
|
|
311
288
|
def post_bulk_load(data)
|
312
289
|
params = {}
|
313
290
|
data = OsoCloud::Helpers.to_hash(data)
|
314
|
-
url =
|
291
|
+
url = '/bulk_load'
|
315
292
|
result = POST(url, params, data)
|
316
293
|
ApiResult.new(**result)
|
317
294
|
end
|
@@ -319,7 +296,7 @@ module OsoCloud
|
|
319
296
|
def post_bulk_delete(data)
|
320
297
|
params = {}
|
321
298
|
data = OsoCloud::Helpers.to_hash(data)
|
322
|
-
url =
|
299
|
+
url = '/bulk_delete'
|
323
300
|
result = POST(url, params, data)
|
324
301
|
ApiResult.new(**result)
|
325
302
|
end
|
@@ -327,7 +304,7 @@ module OsoCloud
|
|
327
304
|
def post_bulk(data)
|
328
305
|
params = {}
|
329
306
|
data = OsoCloud::Helpers.to_hash(data)
|
330
|
-
url =
|
307
|
+
url = '/bulk'
|
331
308
|
result = POST(url, params, data)
|
332
309
|
ApiResult.new(**result)
|
333
310
|
end
|
@@ -335,7 +312,7 @@ module OsoCloud
|
|
335
312
|
def post_authorize(data)
|
336
313
|
params = {}
|
337
314
|
data = OsoCloud::Helpers.to_hash(data)
|
338
|
-
url =
|
315
|
+
url = '/authorize'
|
339
316
|
result = POST(url, params, data)
|
340
317
|
AuthorizeResult.new(**result)
|
341
318
|
end
|
@@ -343,7 +320,7 @@ module OsoCloud
|
|
343
320
|
def post_authorize_resources(data)
|
344
321
|
params = {}
|
345
322
|
data = OsoCloud::Helpers.to_hash(data)
|
346
|
-
url =
|
323
|
+
url = '/authorize_resources'
|
347
324
|
result = POST(url, params, data)
|
348
325
|
AuthorizeResourcesResult.new(**result)
|
349
326
|
end
|
@@ -351,7 +328,7 @@ module OsoCloud
|
|
351
328
|
def post_list(data)
|
352
329
|
params = {}
|
353
330
|
data = OsoCloud::Helpers.to_hash(data)
|
354
|
-
url =
|
331
|
+
url = '/list'
|
355
332
|
result = POST(url, params, data)
|
356
333
|
ListResult.new(**result)
|
357
334
|
end
|
@@ -359,7 +336,7 @@ module OsoCloud
|
|
359
336
|
def post_actions(data)
|
360
337
|
params = {}
|
361
338
|
data = OsoCloud::Helpers.to_hash(data)
|
362
|
-
url =
|
339
|
+
url = '/actions'
|
363
340
|
result = POST(url, params, data)
|
364
341
|
ActionsResult.new(**result)
|
365
342
|
end
|
@@ -367,33 +344,34 @@ module OsoCloud
|
|
367
344
|
def post_query(data)
|
368
345
|
params = {}
|
369
346
|
data = OsoCloud::Helpers.to_hash(data)
|
370
|
-
url =
|
347
|
+
url = '/query'
|
371
348
|
result = POST(url, params, data)
|
372
349
|
QueryResult.new(**result)
|
373
350
|
end
|
374
351
|
|
375
|
-
def get_stats
|
352
|
+
def get_stats
|
376
353
|
params = {}
|
377
354
|
data = nil
|
378
|
-
url =
|
355
|
+
url = '/stats'
|
379
356
|
result = GET(url, params, data)
|
380
357
|
StatsResult.new(**result)
|
381
358
|
end
|
382
359
|
|
383
|
-
def clear_data
|
360
|
+
def clear_data
|
384
361
|
params = {}
|
385
362
|
data = nil
|
386
|
-
url =
|
363
|
+
url = '/clear_data'
|
387
364
|
result = POST(url, params, data)
|
388
365
|
ApiResult.new(**result)
|
389
366
|
end
|
390
367
|
|
391
|
-
|
392
368
|
# hard-coded, not generated
|
393
369
|
def get_facts(predicate, args)
|
394
370
|
params = {}
|
395
|
-
params[
|
371
|
+
params['predicate'] = predicate
|
396
372
|
args.each_with_index do |arg, i|
|
373
|
+
next if arg.nil?
|
374
|
+
|
397
375
|
arg_query = OsoCloud::Helpers.extract_arg_query(arg)
|
398
376
|
if arg_query
|
399
377
|
params["args.#{i}.type"] = arg_query.type
|
@@ -401,26 +379,26 @@ module OsoCloud
|
|
401
379
|
end
|
402
380
|
end
|
403
381
|
data = nil
|
404
|
-
url =
|
382
|
+
url = '/facts'
|
405
383
|
result = GET(url, params, data)
|
406
384
|
result.map { |v| Fact.new(**v) }
|
407
385
|
end
|
408
386
|
|
409
|
-
def headers
|
387
|
+
def headers
|
410
388
|
{
|
411
|
-
|
412
|
-
|
413
|
-
|
414
|
-
|
415
|
-
|
389
|
+
'Authorization' => format('Bearer %s', @api_key),
|
390
|
+
'User-Agent' => @user_agent,
|
391
|
+
Accept: 'application/json',
|
392
|
+
'Content-Type': 'application/json',
|
393
|
+
'X-OsoApiVersion': '0'
|
416
394
|
}
|
417
395
|
end
|
418
396
|
|
419
|
-
def GET(path, params,
|
420
|
-
response = @connection.get("api#{path}", params, headers
|
397
|
+
def GET(path, params, _body)
|
398
|
+
response = @connection.get("api#{path}", params, headers)
|
421
399
|
handle_faraday_response response
|
422
|
-
rescue Faraday::Error =>
|
423
|
-
handle_faraday_error
|
400
|
+
rescue Faraday::Error => e
|
401
|
+
handle_faraday_error e
|
424
402
|
end
|
425
403
|
|
426
404
|
def POST(path, params, body)
|
@@ -428,8 +406,8 @@ module OsoCloud
|
|
428
406
|
req.params = params
|
429
407
|
end
|
430
408
|
handle_faraday_response response
|
431
|
-
rescue Faraday::Error =>
|
432
|
-
handle_faraday_error
|
409
|
+
rescue Faraday::Error => e
|
410
|
+
handle_faraday_error e
|
433
411
|
end
|
434
412
|
|
435
413
|
def DELETE(path, params, body)
|
@@ -437,12 +415,12 @@ module OsoCloud
|
|
437
415
|
req.body = body
|
438
416
|
end
|
439
417
|
handle_faraday_response response
|
440
|
-
rescue Faraday::Error =>
|
441
|
-
handle_faraday_error
|
418
|
+
rescue Faraday::Error => e
|
419
|
+
handle_faraday_error e
|
442
420
|
end
|
443
421
|
|
444
422
|
def handle_faraday_response(response)
|
445
|
-
# TODO:(@patrickod) refactor duplicative JSON parsing
|
423
|
+
# TODO: (@patrickod) refactor duplicative JSON parsing
|
446
424
|
JSON.parse(response.env[:raw_body], symbolize_names: true)
|
447
425
|
end
|
448
426
|
|
@@ -453,6 +431,5 @@ module OsoCloud
|
|
453
431
|
raise ApiError.new(message: e.message)
|
454
432
|
end
|
455
433
|
end
|
456
|
-
|
457
434
|
end
|
458
435
|
end
|
data/lib/oso/helpers.rb
CHANGED
@@ -3,9 +3,9 @@ module OsoCloud
|
|
3
3
|
module Helpers
|
4
4
|
# @!visibility private
|
5
5
|
def self.extract_value(x)
|
6
|
-
return OsoCloud::Core::Value.new(type:
|
6
|
+
return OsoCloud::Core::Value.new(type: 'String', id: x) if x.is_a? String
|
7
7
|
|
8
|
-
return nil if x.nil?
|
8
|
+
return OsoCloud::Core::Value.new(type: nil, id: nil) if x.nil?
|
9
9
|
|
10
10
|
type = (x.type.nil? ? nil : x.type.to_s)
|
11
11
|
id = (x.id.nil? ? nil : x.id.to_s)
|
@@ -14,17 +14,33 @@ module OsoCloud
|
|
14
14
|
|
15
15
|
# @!visibility private
|
16
16
|
def self.extract_arg_query(x)
|
17
|
-
|
17
|
+
extract_value(x)
|
18
18
|
end
|
19
19
|
|
20
20
|
# @!visibility private
|
21
21
|
def self.param_to_fact(predicate, args)
|
22
|
-
OsoCloud::Core::Fact.new(predicate: predicate, args: args.map { |a|
|
22
|
+
OsoCloud::Core::Fact.new(predicate: predicate, args: args.map { |a| extract_value(a) })
|
23
23
|
end
|
24
24
|
|
25
25
|
# @!visibility private
|
26
26
|
def self.params_to_facts(facts)
|
27
|
-
facts.map { |predicate, *args|
|
27
|
+
facts.map { |predicate, *args| param_to_fact(predicate, args) }
|
28
|
+
end
|
29
|
+
|
30
|
+
# @!visibility private
|
31
|
+
def self.facts_to_params(facts)
|
32
|
+
facts.map do |f|
|
33
|
+
name = f.predicate
|
34
|
+
args = f.args.map do |a|
|
35
|
+
v = from_value(a)
|
36
|
+
if v.is_a? Hash
|
37
|
+
OsoCloud::Value.new(type: v[:type], id: v[:id])
|
38
|
+
else
|
39
|
+
v
|
40
|
+
end
|
41
|
+
end
|
42
|
+
[name, *args]
|
43
|
+
end
|
28
44
|
end
|
29
45
|
|
30
46
|
def self.from_value(value)
|
@@ -34,25 +50,24 @@ module OsoCloud
|
|
34
50
|
else
|
35
51
|
{ type: value.type }
|
36
52
|
end
|
53
|
+
elsif value.type == 'String'
|
54
|
+
value.id
|
37
55
|
else
|
38
|
-
|
39
|
-
value.id
|
40
|
-
else
|
41
|
-
{ id: value.id, type: value.type }
|
42
|
-
end
|
56
|
+
{ id: value.id, type: value.type }
|
43
57
|
end
|
44
58
|
end
|
45
59
|
|
46
60
|
# @!visibility private
|
47
61
|
def self.to_hash(o)
|
48
|
-
return o.map { |v|
|
62
|
+
return o.map { |v| to_hash(v) } if o.is_a? Array
|
49
63
|
return o if o.instance_variables.empty?
|
64
|
+
|
50
65
|
hash = {}
|
51
|
-
o.instance_variables.each
|
52
|
-
v = var.to_s.delete(
|
66
|
+
o.instance_variables.each do |var|
|
67
|
+
v = var.to_s.delete('@')
|
53
68
|
value = o.send(v)
|
54
|
-
hash[v] =
|
55
|
-
|
69
|
+
hash[v] = to_hash(value)
|
70
|
+
end
|
56
71
|
hash
|
57
72
|
end
|
58
73
|
end
|
data/lib/oso/oso.rb
CHANGED
@@ -10,11 +10,9 @@ require 'oso/helpers'
|
|
10
10
|
# For more detailed documentation, see
|
11
11
|
# https://www.osohq.com/docs/reference/client-apis/ruby
|
12
12
|
module OsoCloud
|
13
|
-
|
14
13
|
# Represents an object in your application, with a type and id.
|
15
14
|
# Both "type" and "id" should be strings.
|
16
|
-
Value = Struct
|
17
|
-
|
15
|
+
Value = Struct.new(:type, :id, keyword_init: true) do
|
18
16
|
def to_api_value
|
19
17
|
OsoCloud::Helpers.extract_value(self)
|
20
18
|
end
|
@@ -43,7 +41,7 @@ module OsoCloud
|
|
43
41
|
# @param policy [String]
|
44
42
|
# @return [nil]
|
45
43
|
def policy(policy)
|
46
|
-
@api.post_policy(OsoCloud::Core::Policy.new(src: policy, filename:
|
44
|
+
@api.post_policy(OsoCloud::Core::Policy.new(src: policy, filename: ''))
|
47
45
|
nil
|
48
46
|
end
|
49
47
|
|
@@ -58,18 +56,18 @@ module OsoCloud
|
|
58
56
|
# @param resource [OsoCloud::Value]
|
59
57
|
# @param context_facts [Array<fact>]
|
60
58
|
# @return [Boolean]
|
61
|
-
# @see Oso more information about facts
|
59
|
+
# @see Oso for more information about facts
|
62
60
|
def authorize(actor, action, resource, context_facts = [])
|
63
61
|
actor_typed_id = actor.to_api_value
|
64
62
|
resource_typed_id = resource.to_api_value
|
65
63
|
result = @api.post_authorize(OsoCloud::Core::AuthorizeQuery.new(
|
66
|
-
|
67
|
-
|
68
|
-
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
64
|
+
actor_type: actor_typed_id.type,
|
65
|
+
actor_id: actor_typed_id.id,
|
66
|
+
action: action,
|
67
|
+
resource_type: resource_typed_id.type,
|
68
|
+
resource_id: resource_typed_id.id,
|
69
|
+
context_facts: OsoCloud::Helpers.params_to_facts(context_facts)
|
70
|
+
))
|
73
71
|
result.allowed
|
74
72
|
end
|
75
73
|
|
@@ -84,7 +82,7 @@ module OsoCloud
|
|
84
82
|
# @param resources [Array<OsoCloud::Value>]
|
85
83
|
# @param context_facts [Array<fact>]
|
86
84
|
# @return [Array<OsoCloud::Value>]
|
87
|
-
# @see Oso more information about facts
|
85
|
+
# @see Oso for more information about facts
|
88
86
|
def authorize_resources(actor, action, resources, context_facts = [])
|
89
87
|
return [] if resources.nil?
|
90
88
|
return [] if resources.empty?
|
@@ -99,26 +97,23 @@ module OsoCloud
|
|
99
97
|
actor_type: actor_typed_id.type, actor_id: actor_typed_id.id,
|
100
98
|
action: action,
|
101
99
|
resources: resources_extracted,
|
102
|
-
context_facts: OsoCloud::Helpers
|
100
|
+
context_facts: OsoCloud::Helpers.params_to_facts(context_facts)
|
103
101
|
)
|
104
102
|
result = @api.post_authorize_resources(data)
|
105
103
|
|
106
104
|
return [] if result.results.empty?
|
107
105
|
|
108
|
-
results_lookup =
|
106
|
+
results_lookup = {}
|
109
107
|
result.results.each do |r|
|
110
108
|
k = key.call(r.type, r.id)
|
111
|
-
if results_lookup[k]
|
112
|
-
results_lookup[k] = true
|
113
|
-
end
|
109
|
+
results_lookup[k] = true if results_lookup[k].nil?
|
114
110
|
end
|
115
111
|
|
116
|
-
|
112
|
+
resources.select do |r|
|
117
113
|
e = r.to_api_value
|
118
114
|
exists = results_lookup[key.call(e.type, e.id)]
|
119
115
|
exists
|
120
116
|
end
|
121
|
-
results
|
122
117
|
end
|
123
118
|
|
124
119
|
##
|
@@ -132,16 +127,16 @@ module OsoCloud
|
|
132
127
|
# @param resource_type [String]
|
133
128
|
# @param context_facts [Array<fact>]
|
134
129
|
# @return [Array<String>]
|
135
|
-
# @see Oso more information about facts
|
130
|
+
# @see Oso for more information about facts
|
136
131
|
def list(actor, action, resource_type, context_facts = [])
|
137
132
|
actor_typed_id = actor.to_api_value
|
138
133
|
result = @api.post_list(OsoCloud::Core::ListQuery.new(
|
139
|
-
|
140
|
-
|
141
|
-
|
142
|
-
|
143
|
-
|
144
|
-
|
134
|
+
actor_type: actor_typed_id.type,
|
135
|
+
actor_id: actor_typed_id.id,
|
136
|
+
action: action,
|
137
|
+
resource_type: resource_type,
|
138
|
+
context_facts: OsoCloud::Helpers.params_to_facts(context_facts)
|
139
|
+
))
|
145
140
|
result.results
|
146
141
|
end
|
147
142
|
|
@@ -154,17 +149,17 @@ module OsoCloud
|
|
154
149
|
# @param resource [OsoCloud::Value]
|
155
150
|
# @param context_facts [Array<fact>]
|
156
151
|
# @return [Array<String>]
|
157
|
-
# @see Oso more information about facts
|
152
|
+
# @see Oso for more information about facts
|
158
153
|
def actions(actor, resource, context_facts = [])
|
159
154
|
actor_typed_id = actor.to_api_value
|
160
155
|
resource_typed_id = resource.to_api_value
|
161
156
|
result = @api.post_actions(OsoCloud::Core::ActionsQuery.new(
|
162
|
-
|
163
|
-
|
164
|
-
|
165
|
-
|
166
|
-
|
167
|
-
|
157
|
+
actor_type: actor_typed_id.type,
|
158
|
+
actor_id: actor_typed_id.id,
|
159
|
+
resource_type: resource_typed_id.type,
|
160
|
+
resource_id: resource_typed_id.id,
|
161
|
+
context_facts: OsoCloud::Helpers.params_to_facts(context_facts)
|
162
|
+
))
|
168
163
|
result.results
|
169
164
|
end
|
170
165
|
|
@@ -177,7 +172,7 @@ module OsoCloud
|
|
177
172
|
# @param args [*[String, OsoCloud::Value]]
|
178
173
|
# @return [nil]
|
179
174
|
def tell(name, *args)
|
180
|
-
typed_args = args.map { |a| OsoCloud::Helpers.extract_value(a)}
|
175
|
+
typed_args = args.map { |a| OsoCloud::Helpers.extract_value(a) }
|
181
176
|
@api.post_facts(OsoCloud::Core::Fact.new(predicate: name, args: typed_args))
|
182
177
|
nil
|
183
178
|
end
|
@@ -189,7 +184,7 @@ module OsoCloud
|
|
189
184
|
#
|
190
185
|
# @param facts [Array<fact>]
|
191
186
|
# @return [nil]
|
192
|
-
# @see Oso more information about facts
|
187
|
+
# @see Oso for more information about facts
|
193
188
|
def bulk_tell(facts)
|
194
189
|
@api.post_bulk_load(OsoCloud::Helpers.params_to_facts(facts))
|
195
190
|
nil
|
@@ -217,12 +212,32 @@ module OsoCloud
|
|
217
212
|
#
|
218
213
|
# @param facts [Array<fact>]
|
219
214
|
# @return [nil]
|
220
|
-
# @see Oso more information about facts
|
215
|
+
# @see Oso for more information about facts
|
221
216
|
def bulk_delete(facts)
|
222
217
|
@api.post_bulk_delete(OsoCloud::Helpers.params_to_facts(facts))
|
223
218
|
nil
|
224
219
|
end
|
225
220
|
|
221
|
+
##
|
222
|
+
# Transactionally delete and insert fact(s)
|
223
|
+
#
|
224
|
+
# Delete(s) are processed before insertion(s). nil arguments in facts to be
|
225
|
+
# deleted act as wildcards. Does not throw an error if facts to be deleted
|
226
|
+
# are not found or facts to be inserted already exist.
|
227
|
+
#
|
228
|
+
#
|
229
|
+
# Throws an OsoCloud::Core::Api exception if error returned from server.
|
230
|
+
#
|
231
|
+
# @param delete [Array<fact>]
|
232
|
+
# @param insert [Array<fact>]
|
233
|
+
# @return [nil]
|
234
|
+
# @see Oso for more information about facts
|
235
|
+
def bulk(delete: [], insert: [])
|
236
|
+
@api.post_bulk(OsoCloud::Core::Bulk.new(delete: OsoCloud::Helpers.params_to_facts(delete),
|
237
|
+
tell: OsoCloud::Helpers.params_to_facts(insert)))
|
238
|
+
nil
|
239
|
+
end
|
240
|
+
|
226
241
|
##
|
227
242
|
# List facts
|
228
243
|
#
|
@@ -233,23 +248,27 @@ module OsoCloud
|
|
233
248
|
# @param name [String]
|
234
249
|
# @param args [*[String, OsoCloud::Value, nil]]
|
235
250
|
# @return [Array<fact>]
|
236
|
-
# @see Oso more information about facts
|
251
|
+
# @see Oso for more information about facts
|
237
252
|
def get(name, *args)
|
238
|
-
@api.get_facts(name, args)
|
239
|
-
name = f.predicate
|
240
|
-
args = f.args.map do |a|
|
241
|
-
v = OsoCloud::Helpers.from_value(a)
|
242
|
-
if v.is_a? Hash
|
243
|
-
OsoCloud::Value.new(type: v[:type], id: v[:id])
|
244
|
-
else
|
245
|
-
v
|
246
|
-
end
|
247
|
-
end
|
248
|
-
[name, *args]
|
249
|
-
end
|
253
|
+
OsoCloud::Helpers.facts_to_params(@api.get_facts(name, args))
|
250
254
|
end
|
251
255
|
|
252
|
-
|
253
|
-
#
|
256
|
+
##
|
257
|
+
# List added and derived facts
|
258
|
+
#
|
259
|
+
# Lists facts that are stored in Oso Cloud in addition to derived facts
|
260
|
+
# from evaluating the policy. nil arguments operate as wildcards.
|
261
|
+
#
|
262
|
+
# @param name [String]
|
263
|
+
# @param args [Array<[String, OsoCloud::Value, nil]>]
|
264
|
+
# @param context_facts [Array<fact>]
|
265
|
+
# @return [Array<fact>]
|
266
|
+
# @see Oso for more information about facts
|
267
|
+
def query(name, *args, context_facts: [])
|
268
|
+
typed_args = args.map { |a| OsoCloud::Helpers.extract_value(a) }
|
269
|
+
result = @api.post_query(OsoCloud::Core::Query.new(fact: OsoCloud::Helpers.param_to_fact(name, typed_args),
|
270
|
+
context_facts: OsoCloud::Helpers.params_to_facts(context_facts)))
|
271
|
+
OsoCloud::Helpers.facts_to_params(result.results)
|
272
|
+
end
|
254
273
|
end
|
255
274
|
end
|
data/lib/oso/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: oso-cloud
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.1.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Oso Security, Inc.
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2023-
|
11
|
+
date: 2023-04-27 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: faraday
|
@@ -60,6 +60,7 @@ extensions: []
|
|
60
60
|
extra_rdoc_files: []
|
61
61
|
files:
|
62
62
|
- ".gitignore"
|
63
|
+
- ".rubocop.yml"
|
63
64
|
- Gemfile
|
64
65
|
- Gemfile.lock
|
65
66
|
- README.md
|