oso-cloud 1.5.2 → 1.6.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile.lock +1 -1
- data/lib/oso/oso.rb +68 -75
- data/lib/oso/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b48ecc6151f39a3d6201a3cf2484cfcf38d434f7d611741bd08a6442d321e707
|
4
|
+
data.tar.gz: b7b901e42b41796396ef6e58c2f0772cf9f03c35f7349e411c66b32ed54bfcdc
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 562381acc9b486e722b03096a18d588e3971f37f811f33c2286ea7a8655ed6fd462b6b07f7551a10f74c0fc85e2da67b245abfd04854de6aaa975acdea6497c9
|
7
|
+
data.tar.gz: c107f84d6290b88fd757221195909d5ba007c89919161fd52f0b169f6a5e51815b272a6b8752e5db078b63111ea6b6755f6c84f0f3fbb07f53ce31cc3785d4ae
|
data/Gemfile.lock
CHANGED
data/lib/oso/oso.rb
CHANGED
@@ -28,67 +28,59 @@ module OsoCloud
|
|
28
28
|
# Any other elements in the array, which together represent the fact's arguments,
|
29
29
|
# can be "OsoCloud::Value" objects or strings.
|
30
30
|
class Oso
|
31
|
-
attr_reader :experimental
|
32
|
-
|
33
31
|
def initialize(url: 'https://cloud.osohq.com', api_key: nil, fallback_url: nil, data_bindings: nil)
|
34
|
-
@api = OsoCloud::Core::Api.new(url: url, api_key: api_key, data_bindings: data_bindings,
|
35
|
-
|
32
|
+
@api = OsoCloud::Core::Api.new(url: url, api_key: api_key, data_bindings: data_bindings,
|
33
|
+
options: { fallback_url: fallback_url })
|
36
34
|
end
|
37
35
|
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
58
|
-
actor_type: actor_typed_id.type,
|
59
|
-
actor_id: actor_typed_id.id,
|
60
|
-
action: action,
|
61
|
-
resource_type: resource_typed_id.type,
|
62
|
-
resource_id: resource_typed_id.id,
|
63
|
-
context_facts: []
|
64
|
-
)
|
36
|
+
##
|
37
|
+
# Check a permission depending on data both in Oso Cloud and stored in a local database
|
38
|
+
#
|
39
|
+
# Returns a SQL query to run against the local database
|
40
|
+
#
|
41
|
+
# @param actor [OsoCloud::Value]
|
42
|
+
# @param action [String]
|
43
|
+
# @param resource [OsoCloud::Value]
|
44
|
+
# @return [Array<String>]
|
45
|
+
def authorize_local(actor, action, resource)
|
46
|
+
actor_typed_id = actor.to_api_value
|
47
|
+
resource_typed_id = resource.to_api_value
|
48
|
+
result = @api.post_authorize_query(
|
49
|
+
OsoCloud::Core::AuthorizeQuery.new(
|
50
|
+
actor_type: actor_typed_id.type,
|
51
|
+
actor_id: actor_typed_id.id,
|
52
|
+
action: action,
|
53
|
+
resource_type: resource_typed_id.type,
|
54
|
+
resource_id: resource_typed_id.id,
|
55
|
+
context_facts: []
|
65
56
|
)
|
66
|
-
|
67
|
-
|
57
|
+
)
|
58
|
+
result.sql
|
59
|
+
end
|
68
60
|
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
|
61
|
+
##
|
62
|
+
# List authorized resources depending on data both in Oso Cloud and stored in a local database
|
63
|
+
#
|
64
|
+
# Returns a SQL query to run against the local database
|
65
|
+
#
|
66
|
+
# @param actor [OsoCloud::Value]
|
67
|
+
# @param action [String]
|
68
|
+
# @param resource_type [String]
|
69
|
+
# @param column [String]
|
70
|
+
# @return [Array<String>]
|
71
|
+
def list_local(actor, action, resource_type, column)
|
72
|
+
actor_typed_id = actor.to_api_value
|
73
|
+
result = @api.post_list_query(
|
74
|
+
query: OsoCloud::Core::ListQuery.new(
|
75
|
+
actor_type: actor_typed_id.type,
|
76
|
+
actor_id: actor_typed_id.id,
|
77
|
+
action: action,
|
78
|
+
resource_type: resource_type,
|
79
|
+
context_facts: []
|
80
|
+
),
|
81
|
+
column: column
|
82
|
+
)
|
83
|
+
result.sql
|
92
84
|
end
|
93
85
|
|
94
86
|
##
|
@@ -335,6 +327,7 @@ module OsoCloud
|
|
335
327
|
context_facts: OsoCloud::Helpers.params_to_facts(context_facts)))
|
336
328
|
OsoCloud::Helpers.facts_to_params(result.results)
|
337
329
|
end
|
330
|
+
|
338
331
|
##
|
339
332
|
# List authorized actions for a batch of queries
|
340
333
|
#
|
@@ -345,26 +338,26 @@ module OsoCloud
|
|
345
338
|
# @return [Array<Array<String>>]
|
346
339
|
# @see Oso for more information about facts
|
347
340
|
def bulk_actions(actor, queries:)
|
348
|
-
|
349
|
-
|
350
|
-
|
351
|
-
|
352
|
-
|
353
|
-
|
354
|
-
|
355
|
-
|
356
|
-
|
357
|
-
|
358
|
-
|
359
|
-
|
360
|
-
|
361
|
-
|
362
|
-
|
363
|
-
|
364
|
-
|
365
|
-
|
341
|
+
actor_typed_id = actor.to_api_value
|
342
|
+
data = queries.map do |q|
|
343
|
+
context_facts = []
|
344
|
+
resource = nil
|
345
|
+
if q.is_a?(Array)
|
346
|
+
resource = q[0]
|
347
|
+
context_facts = q[1]
|
348
|
+
else
|
349
|
+
resource = q
|
350
|
+
end
|
351
|
+
resource_typed_id = resource.to_api_value
|
352
|
+
OsoCloud::Core::ActionsQuery.new(
|
353
|
+
actor_type: actor_typed_id.type,
|
354
|
+
actor_id: actor_typed_id.id,
|
355
|
+
resource_type: resource_typed_id.type,
|
356
|
+
resource_id: resource_typed_id.id,
|
357
|
+
context_facts: OsoCloud::Helpers.params_to_facts(context_facts)
|
358
|
+
)
|
366
359
|
end
|
367
|
-
@api.post_bulk_actions(data).map
|
360
|
+
@api.post_bulk_actions(data).map(&:results)
|
368
361
|
end
|
369
362
|
end
|
370
363
|
end
|
data/lib/oso/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: oso-cloud
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.6.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Oso Security, Inc.
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-
|
11
|
+
date: 2024-04-15 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: faraday
|