oso-cloud 1.5.1 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c024d83cfedf34c1651af2ae18b55871030b1bceb321503ccb4ad6f431e28e72
-  data.tar.gz: 6b09b842d1e03a632fb812a874c77a2bbe7ee205daadf12be6f14e9ee3f84430
+  metadata.gz: b48ecc6151f39a3d6201a3cf2484cfcf38d434f7d611741bd08a6442d321e707
+  data.tar.gz: b7b901e42b41796396ef6e58c2f0772cf9f03c35f7349e411c66b32ed54bfcdc
 SHA512:
-  metadata.gz: 05a25bb4a5c6e5bf9634e71c764610c59e04c40fe65b713a89c3f2a921f120ec229d4aa651700aecac3c181227a11b78583b290a3c3fb7c876c706283bf7aaaf
-  data.tar.gz: 6bb8a131b8024389ce5ff9a18d13d25cfe990bc35ef571a821781567570ba717017ba9485776e767c7faa57966865b11e3a12bad2a91cf97afabbcbcf730977d
+  metadata.gz: 562381acc9b486e722b03096a18d588e3971f37f811f33c2286ea7a8655ed6fd462b6b07f7551a10f74c0fc85e2da67b245abfd04854de6aaa975acdea6497c9
+  data.tar.gz: c107f84d6290b88fd757221195909d5ba007c89919161fd52f0b169f6a5e51815b272a6b8752e5db078b63111ea6b6755f6c84f0f3fbb07f53ce31cc3785d4ae

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    oso-cloud (1.5.1)
+    oso-cloud (1.6.0)
       faraday (~> 2.5.2)
       faraday-net_http_persistent (~> 2.0)
       faraday-retry (~> 2.0.0)
@@ -9,7 +9,28 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
+    activemodel (7.1.3)
+      activesupport (= 7.1.3)
+    activerecord (7.1.3)
+      activemodel (= 7.1.3)
+      activesupport (= 7.1.3)
+      timeout (>= 0.4.0)
+    activesupport (7.1.3)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      mutex_m
+      tzinfo (~> 2.0)
+    base64 (0.2.0)
+    bigdecimal (3.1.6)
+    concurrent-ruby (1.2.3)
     connection_pool (2.4.1)
+    drb (2.2.0)
+      ruby2_keywords
     faraday (2.5.2)
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
@@ -19,19 +40,28 @@ GEM
       net-http-persistent (~> 4.0)
     faraday-retry (2.0.0)
       faraday (~> 2.0)
+    i18n (1.14.1)
+      concurrent-ruby (~> 1.0)
     minitest (5.18.0)
+    mutex_m (0.2.0)
     net-http-persistent (4.0.2)
       connection_pool (~> 2.2)
+    pg (1.5.4)
     rake (12.3.3)
     ruby2_keywords (0.0.5)
+    timeout (0.4.1)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
+  activerecord (~> 7.0)
   minitest (~> 5.15)
   oso-cloud!
+  pg (~> 1.0)
   rake (~> 12.0)
 
 BUNDLED WITH
-   2.3.13
+   2.5.6

data/lib/oso/api.rb

@@ -239,9 +239,39 @@ module OsoCloud
       end
     end
 
+    # @!visibility private
+    class LocalAuthQuery
+      attr_reader :query, :data_bindings
+
+      def initialize(query:, data_bindings:)
+        @query = query
+        @data_bindings = data_bindings
+      end
+    end
+
+    # @!visibility private
+    class LocalListQuery
+      attr_reader :query, :column, :data_bindings
+
+      def initialize(query:, column:, data_bindings:)
+        @query = query
+        @column = column
+        @data_bindings = data_bindings
+      end
+    end
+
+    # @!visibility private
+    class LocalQueryResult
+      attr_reader :sql
+
+      def initialize(sql:)
+        @sql = sql
+      end
+    end
+
     # @!visibility private
     class Api
-      def initialize(url: 'https://api.osohq.com', api_key: nil, options: nil)
+      def initialize(url: 'https://api.osohq.com', api_key: nil, data_bindings: nil, options: nil)
         @url = url
         @connection = Faraday.new(url: url) do |faraday|
           faraday.request :json
@@ -291,6 +321,7 @@ module OsoCloud
         @api_key = api_key
         @user_agent = "Oso Cloud (ruby #{RUBY_VERSION}p#{RUBY_PATCHLEVEL}; rv:#{VERSION})"
         @last_offset = nil
+        @data_bindings = IO.read(data_bindings) unless data_bindings.nil?
       end
 
       def fallback_eligible(path)
@@ -391,6 +422,20 @@ module OsoCloud
         StatsResult.new(**result)
       end
 
+      def post_authorize_query(query)
+        url = '/authorize_query'
+        data = LocalAuthQuery.new(query: query, data_bindings: @data_bindings)
+        result = POST(url, nil, data, false)
+        LocalQueryResult.new(**result)
+      end
+
+      def post_list_query(query:, column:)
+        url = '/list_query'
+        data = LocalListQuery.new(query: query, column: column, data_bindings: @data_bindings)
+        result = POST(url, nil, data, false)
+        LocalQueryResult.new(**result)
+      end
+
       def clear_data
         url = '/clear_data'
         result = POST(url, nil, nil, true)

data/lib/oso/oso.rb

@@ -28,8 +28,59 @@ module OsoCloud
   # Any other elements in the array, which together represent the fact's arguments,
   # can be "OsoCloud::Value" objects or strings.
   class Oso
-    def initialize(url: 'https://cloud.osohq.com', api_key: nil, fallback_url: nil)
-      @api = OsoCloud::Core::Api.new(url: url, api_key: api_key, options: { :fallback_url => fallback_url })
+    def initialize(url: 'https://cloud.osohq.com', api_key: nil, fallback_url: nil, data_bindings: nil)
+      @api = OsoCloud::Core::Api.new(url: url, api_key: api_key, data_bindings: data_bindings,
+                                     options: { fallback_url: fallback_url })
+    end
+
+    ##
+    # Check a permission depending on data both in Oso Cloud and stored in a local database
+    #
+    # Returns a SQL query to run against the local database
+    #
+    # @param actor [OsoCloud::Value]
+    # @param action [String]
+    # @param resource [OsoCloud::Value]
+    # @return [Array<String>]
+    def authorize_local(actor, action, resource)
+      actor_typed_id = actor.to_api_value
+      resource_typed_id = resource.to_api_value
+      result = @api.post_authorize_query(
+        OsoCloud::Core::AuthorizeQuery.new(
+          actor_type: actor_typed_id.type,
+          actor_id: actor_typed_id.id,
+          action: action,
+          resource_type: resource_typed_id.type,
+          resource_id: resource_typed_id.id,
+          context_facts: []
+        )
+      )
+      result.sql
+    end
+
+    ##
+    # List authorized resources depending on data both in Oso Cloud and stored in a local database
+    #
+    # Returns a SQL query to run against the local database
+    #
+    # @param actor [OsoCloud::Value]
+    # @param action [String]
+    # @param resource_type [String]
+    # @param column [String]
+    # @return [Array<String>]
+    def list_local(actor, action, resource_type, column)
+      actor_typed_id = actor.to_api_value
+      result = @api.post_list_query(
+        query: OsoCloud::Core::ListQuery.new(
+          actor_type: actor_typed_id.type,
+          actor_id: actor_typed_id.id,
+          action: action,
+          resource_type: resource_type,
+          context_facts: []
+        ),
+        column: column
+      )
+      result.sql
     end
 
     ##
@@ -276,6 +327,7 @@ module OsoCloud
                                                          context_facts: OsoCloud::Helpers.params_to_facts(context_facts)))
       OsoCloud::Helpers.facts_to_params(result.results)
     end
+
     ##
     # List authorized actions for a batch of queries
     #
@@ -286,26 +338,26 @@ module OsoCloud
     # @return [Array<Array<String>>]
     # @see Oso for more information about facts
     def bulk_actions(actor, queries:)
-        actor_typed_id = actor.to_api_value
-        data = queries.map do |q|
-          context_facts = []
-          resource = nil
-          if (q.is_a?(Array))
-            resource = q[0]
-            context_facts = q[1]
-          else
-            resource = q
-          end
-          resource_typed_id = resource.to_api_value
-          OsoCloud::Core::ActionsQuery.new(
-              actor_type: actor_typed_id.type,
-              actor_id: actor_typed_id.id,
-              resource_type: resource_typed_id.type,
-              resource_id: resource_typed_id.id,
-              context_facts: OsoCloud::Helpers.params_to_facts(context_facts)
-            )
+      actor_typed_id = actor.to_api_value
+      data = queries.map do |q|
+        context_facts = []
+        resource = nil
+        if q.is_a?(Array)
+          resource = q[0]
+          context_facts = q[1]
+        else
+          resource = q
+        end
+        resource_typed_id = resource.to_api_value
+        OsoCloud::Core::ActionsQuery.new(
+          actor_type: actor_typed_id.type,
+          actor_id: actor_typed_id.id,
+          resource_type: resource_typed_id.type,
+          resource_id: resource_typed_id.id,
+          context_facts: OsoCloud::Helpers.params_to_facts(context_facts)
+        )
       end
-      @api.post_bulk_actions(data).map { |result| result.results}
+      @api.post_bulk_actions(data).map(&:results)
     end
   end
 end

data/lib/oso/version.rb

@@ -1,3 +1,3 @@
 module OsoCloud
-  VERSION = '1.5.1'.freeze
+  VERSION = '1.6.0'.freeze
 end

data/oso-cloud.gemspec

@@ -24,4 +24,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'faraday-retry', '~> 2.0.0'
   spec.add_dependency 'faraday-net_http_persistent', '~> 2.0'
   spec.add_development_dependency 'minitest', '~> 5.15'
+  spec.add_development_dependency 'pg', '~> 1.0'
+  spec.add_development_dependency 'activerecord', '~> 7.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oso-cloud
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.6.0
 platform: ruby
 authors:
 - Oso Security, Inc.
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-03-07 00:00:00.000000000 Z
+date: 2024-04-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -66,6 +66,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.15'
+- !ruby/object:Gem::Dependency
+  name: pg
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.0'
 description: 
 email:
 - support@osohq.com