oso-oso 0.14.0 → 0.20.0.pre.beta

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e2aee8d8308beb5cb906dff373ef43f8a90c5d3f
-  data.tar.gz: a121f6f4b7534f53934f49aab4e634cbbbe7f0db
+  metadata.gz: aa0564b86f2ceb4b54a62cdbae1cf2a3cc14ee91
+  data.tar.gz: d0cbc579ac5bd7284b559d3ca3d31af9f6837e96
 SHA512:
-  metadata.gz: 6cb9212a01eaa50005a5d3923632741cfbbfff8c28c42a3c7f30b2cf6bf6aeba58fbe4f4c87ff3ccb43deb21dfd2db6e3f95ce7aded5996fe2eb6cb74d5de162
-  data.tar.gz: ef8ec9735a3aba0c18d9da63ea0fda8b36e1d6c6cd3306611b1b126d6587f1381b2e558680058c4c926ed9d736b7fa21c96f92ae179b0df485d24ea3bd1c1791
+  metadata.gz: d2a7f469cff84febf8dd66f737384523fd576d42b1d44e41247bb738a7b26ca230d9e91066be2acf2a6ade07be780aeec5fa529b21c88c7d0bb626ca66ab821a
+  data.tar.gz: 742452956eeb29797b173888a268962bbc6e92e88b7148e7ca3952bb9d9c7687abd55d74c657d170056a61e911ed0183d29fa3ef471aa5c8cd733f47d72d188b

data/.gitignore

@@ -7,6 +7,7 @@
 /spec/reports/
 /tmp/
 vendor
+active_record_test.db
 
 # rspec failure tracking
 .rspec_status

data/Gemfile.lock

@@ -1,24 +1,40 @@
 PATH
   remote: .
   specs:
-    oso-oso (0.14.0)
+    oso-oso (0.20.0.pre.beta)
       ffi (~> 1.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    activemodel (5.2.6)
+      activesupport (= 5.2.6)
+    activerecord (5.2.6)
+      activemodel (= 5.2.6)
+      activesupport (= 5.2.6)
+      arel (>= 9.0)
+    activesupport (5.2.6)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    arel (9.0.0)
     ast (2.4.1)
     backport (1.1.2)
     benchmark (0.1.0)
     byebug (11.1.3)
     coderay (1.1.3)
+    concurrent-ruby (1.1.9)
     diff-lcs (1.4.4)
     e2mmap (0.1.0)
-    ffi (1.15.1)
+    ffi (1.15.3)
+    i18n (1.8.10)
+      concurrent-ruby (~> 1.0)
     jaro_winkler (1.5.4)
     maruku (0.7.3)
     method_source (1.0.0)
     mini_portile2 (2.4.0)
+    minitest (5.14.4)
     nokogiri (1.10.10)
       mini_portile2 (~> 2.4.0)
     parallel (1.19.2)
@@ -75,8 +91,12 @@ GEM
       thor (~> 1.0)
       tilt (~> 2.0)
       yard (~> 0.9, >= 0.9.24)
+    sqlite3 (1.4.2)
     thor (1.0.1)
+    thread_safe (0.3.6)
     tilt (2.0.10)
+    tzinfo (1.2.9)
+      thread_safe (~> 0.1)
     unicode-display_width (1.7.0)
     yard (0.9.25)
 
@@ -84,12 +104,14 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  activerecord
   oso-oso!
   pry-byebug (~> 3.9.0)
   rake (~> 12.0)
   rspec (~> 3.0)
   rubocop (~> 0.89.1)
   solargraph (~> 0.39.14)
+  sqlite3
   yard (~> 0.9.25)
 
 BUNDLED WITH

data/lib/oso/polar/data_filtering.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+module Oso
+  module Polar
+    # Data filtering interface for Ruby
+    module DataFiltering
+      # Represents a set of filter sequences that should allow the host
+      # to obtain the records satisfying a query.
+      class FilterPlan
+        include Enumerable
+        attr_reader :result_sets
+
+        def initialize(polar, partials, class_name)
+          types = polar.host.serialize_types
+          parsed_json = polar.ffi.build_filter_plan(types, partials, 'resource', class_name)
+          @polar = polar
+          @result_sets = parsed_json['result_sets'].map do |rset|
+            ResultSet.new polar, rset
+          end
+        end
+
+        def each(&blk)
+          result_sets.each(&blk)
+        end
+
+        def resolve # rubocop:disable Metrics/AbcSize
+          reduce([]) do |acc, rs|
+            requests = rs.requests
+            acc + rs.resolve_order.each_with_object({}) do |i, set_results|
+              req = requests[i]
+              constraints = req.constraints
+              constraints.each { |c| c.ground set_results }
+              set_results[i] = @polar.host.types[req.class_tag].fetcher[constraints]
+            end[rs.result_id]
+          end.uniq
+        end
+
+        # Represents a sequence of filters for one set of results
+        class ResultSet
+          attr_reader :requests, :resolve_order, :result_id
+
+          def initialize(polar, parsed_json)
+            @resolve_order = parsed_json['resolve_order']
+            @result_id = parsed_json['result_id']
+            @requests = parsed_json['requests'].each_with_object({}) do |req, reqs|
+              reqs[req[0].to_i] = Request.new(polar, req[1])
+            end
+          end
+
+          # Represents a filter for a result set
+          class Request
+            attr_reader :constraints, :class_tag
+
+            def initialize(polar, parsed_json)
+              @constraints = parsed_json['constraints'].map do |con|
+                Constraint.parse polar, con
+              end
+              @class_tag = parsed_json['class_tag']
+            end
+          end
+        end
+      end
+
+      # Represents relationships between resources, eg. parent/child
+      class Relationship
+        attr_reader :kind, :other_type, :my_field, :other_field
+
+        def initialize(kind:, other_type:, my_field:, other_field:)
+          @kind = kind
+          @other_type = other_type
+          @my_field = my_field
+          @other_field = other_field
+        end
+      end
+
+      # Represents field-field relationships on one resource.
+      class Field
+        attr_reader :field
+
+        def initialize(field:)
+          @field = field
+        end
+      end
+
+      # Represents field-field relationships on different resources.
+      class Ref
+        attr_reader :field, :result_id
+
+        def initialize(field:, result_id:)
+          @field = field
+          @result_id = result_id
+        end
+      end
+
+      # Represents a condition that must hold on a resource.
+      class Constraint
+        attr_reader :kind, :field, :value
+
+        CHECKS = {
+          'Eq' => ->(a, b) { a == b },
+          'In' => ->(a, b) { b.include? a },
+          'Contains' => ->(a, b) { a.include? b }
+        }.freeze
+
+        def initialize(kind:, field:, value:)
+          @kind = kind
+          @field = field
+          @value = value
+          @check = CHECKS[kind]
+          raise "Unknown constraint kind `#{kind}`" if @check.nil?
+        end
+
+        def ground(results)
+          return unless value.is_a? Ref
+
+          ref = value
+          @value = results[ref.result_id]
+          @value = value.map { |v| v.send ref.field } unless ref.field.nil?
+        end
+
+        def check(item)
+          val = value.is_a?(Field) ? item.send(value.field) : value
+          item = field.nil? ? item : item.send(field)
+          @check[item, val]
+        end
+
+        def self.parse(polar, constraint) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+          kind = constraint['kind']
+          raise unless %w[Eq In Contains].include? kind
+
+          field = constraint['field']
+          value = constraint['value']
+
+          value_kind = value.keys.first
+          value = value[value_kind]
+
+          case value_kind
+          when 'Term'
+            value = polar.host.to_ruby value
+          when 'Ref'
+            child_field = value['field']
+            result_id = value['result_id']
+            value = Ref.new field: child_field, result_id: result_id
+          when 'Field'
+            value = Field.new field: value
+          else
+            raise "Unknown value kind `#{value_kind}`"
+          end
+
+          new kind: kind, field: field, value: value
+        end
+      end
+    end
+  end
+end

data/lib/oso/polar/ffi/error.rb

@@ -24,7 +24,7 @@ module Oso
         #
         # @return [::Oso::Polar::Error] if there's an FFI error.
         # @return [::Oso::Polar::FFIErrorNotFound] if there isn't one.
-        def self.get # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength
+        def self.get(enrich_message) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
           error = Rust.get
           return ::Oso::Polar::FFIErrorNotFound if error.null?
 
@@ -40,6 +40,13 @@ module Oso
             subkind, details = nil
           end
 
+          # Enrich error message and stack trace
+          msg = enrich_message.call(msg) if msg
+          if details
+            details['stack_trace'] = enrich_message.call(details['stack_trace']) if details['stack_trace']
+            details['msg'] = enrich_message.call(details['msg']) if details['msg']
+          end
+
           case kind
           when 'Parse'
             parse_error(subkind, msg: msg, details: details)

data/lib/oso/polar/ffi/message.rb

@@ -19,10 +19,11 @@ module Oso
           attach_function :free, :string_free, [Message], :int32
         end
 
-        def process
+        def process(enrich_message)
           message = JSON.parse(to_s)
           kind = message['kind']
           msg = message['msg']
+          msg = enrich_message.call(msg)
 
           case kind
           when 'Print'

data/lib/oso/polar/ffi/polar.rb

@@ -7,6 +7,8 @@ module Oso
     module FFI
       # Wrapper class for Polar FFI pointer + operations.
       class Polar < ::FFI::AutoPointer
+        attr_accessor :enrich_message
+
         Rust = Module.new do
           extend ::FFI::Library
           ffi_lib FFI::LIB_PATH
@@ -23,6 +25,12 @@ module Oso
           attach_function :register_constant, :polar_register_constant, [FFI::Polar, :string, :string], :int32
           attach_function :next_message, :polar_next_polar_message, [FFI::Polar], FFI::Message
           attach_function :free, :polar_free, [FFI::Polar], :int32
+          attach_function(
+            :build_filter_plan,
+            :polar_build_filter_plan,
+            [FFI::Polar, :string, :string, :string, :string],
+            :string
+          )
         end
         private_constant :Rust
 
@@ -30,7 +38,7 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def self.create
           polar = Rust.new
-          raise FFI::Error.get if polar.null?
+          handle_error if polar.null?
 
           polar
         end
@@ -39,14 +47,24 @@ module Oso
         def enable_roles
           result = Rust.enable_roles(self)
           process_messages
-          raise FFI::Error.get if result.zero?
+          handle_error if result.zero?
         end
 
         # @raise [FFI::Error] if the FFI call returns an error.
         def validate_roles_config(config)
           result = Rust.validate_roles_config(self, JSON.dump(config))
           process_messages
-          raise FFI::Error.get if result.zero?
+          handle_error if result.zero?
+        end
+
+        def build_filter_plan(types, partials, variable, class_tag)
+          types = JSON.dump(types)
+          partials = JSON.dump(partials)
+          plan = Rust.build_filter_plan(self, types, partials, variable, class_tag)
+          process_messages
+          handle_error if plan.nil?
+          # TODO(gw) more error checking?
+          JSON.parse plan
         end
 
         # @param src [String]
@@ -55,14 +73,14 @@ module Oso
         def load(src, filename: nil)
           loaded = Rust.load(self, src, filename)
           process_messages
-          raise FFI::Error.get if loaded.zero?
+          handle_error if loaded.zero?
         end
 
         # @raise [FFI::Error] if the FFI call returns an error.
         def clear_rules
           cleared = Rust.clear_rules(self)
           process_messages
-          raise FFI::Error.get if cleared.zero?
+          handle_error if cleared.zero?
         end
 
         # @return [FFI::Query] if there are remaining inline queries.
@@ -80,7 +98,7 @@ module Oso
           id = Rust.new_id(self)
           # TODO(gj): I don't think this error check is correct. If getting a new ID fails on the
           # Rust side, it'll probably surface as a panic (e.g., the KB lock is poisoned).
-          raise FFI::Error.get if id.zero?
+          handle_error if id.zero?
 
           id
         end
@@ -91,7 +109,7 @@ module Oso
         def new_query_from_str(str)
           query = Rust.new_query_from_str(self, str, 0)
           process_messages
-          raise FFI::Error.get if query.null?
+          handle_error if query.null?
 
           query
         end
@@ -102,7 +120,7 @@ module Oso
         def new_query_from_term(term)
           query = Rust.new_query_from_term(self, JSON.dump(term), 0)
           process_messages
-          raise FFI::Error.get if query.null?
+          handle_error if query.null?
 
           query
         end
@@ -112,7 +130,7 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def register_constant(value, name:)
           registered = Rust.register_constant(self, name, JSON.dump(value))
-          raise FFI::Error.get if registered.zero?
+          handle_error if registered.zero?
         end
 
         def next_message
@@ -124,9 +142,13 @@ module Oso
             message = next_message
             break if message.null?
 
-            message.process
+            message.process(enrich_message)
           end
         end
+
+        def handle_error
+          raise FFI::Error.get(enrich_message)
+        end
       end
     end
   end

data/lib/oso/polar/ffi/query.rb

@@ -7,6 +7,8 @@ module Oso
     module FFI
       # Wrapper class for Query FFI pointer + operations.
       class Query < ::FFI::AutoPointer
+        attr_accessor :enrich_message
+
         Rust = Module.new do
           extend ::FFI::Library
           ffi_lib FFI::LIB_PATH
@@ -19,6 +21,7 @@ module Oso
           attach_function :next_message, :polar_next_query_message, [FFI::Query], FFI::Message
           attach_function :source, :polar_query_source_info, [FFI::Query], FFI::Source
           attach_function :free, :query_free, [FFI::Query], :int32
+          attach_function :bind, :polar_bind, [FFI::Query, :string, :string], :int32
         end
         private_constant :Rust
 
@@ -27,7 +30,7 @@ module Oso
         def debug_command(cmd)
           res = Rust.debug_command(self, cmd)
           process_messages
-          raise FFI::Error.get if res.zero?
+          handle_error if res.zero?
         end
 
         # @param result [String]
@@ -35,7 +38,7 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def call_result(result, call_id:)
           res = Rust.call_result(self, call_id, result)
-          raise FFI::Error.get if res.zero?
+          handle_error if res.zero?
         end
 
         # @param result [Boolean]
@@ -44,7 +47,7 @@ module Oso
         def question_result(result, call_id:)
           result = result ? 1 : 0
           res = Rust.question_result(self, call_id, result)
-          raise FFI::Error.get if res.zero?
+          handle_error if res.zero?
         end
 
         # @param result [Boolean]
@@ -52,7 +55,7 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def application_error(message)
           res = Rust.application_error(self, message)
-          raise FFI::Error.get if res.zero?
+          handle_error if res.zero?
         end
 
         # @return [::Oso::Polar::QueryEvent]
@@ -60,11 +63,16 @@ module Oso
         def next_event
           event = Rust.next_event(self)
           process_messages
-          raise FFI::Error.get if event.null?
+          handle_error if event.null?
 
           ::Oso::Polar::QueryEvent.new(JSON.parse(event.to_s))
         end
 
+        def bind(name, value)
+          res = Rust.bind(self, name, JSON.dump(value))
+          handle_error if res.zero?
+        end
+
         def next_message
           Rust.next_message(self)
         end
@@ -74,7 +82,7 @@ module Oso
             message = next_message
             break if message.null?
 
-            message.process
+            message.process(enrich_message)
           end
         end
 
@@ -82,10 +90,14 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def source
           res = Rust.source(self)
-          raise FFI::Error.get if res.null?
+          handle_error if res.null?
 
           res.to_s
         end
+
+        def handle_error
+          raise FFI::Error.get(enrich_message)
+        end
       end
     end
   end

data/lib/oso/polar/host.rb

@@ -34,14 +34,29 @@ module Oso
       end
     end
 
+    # For holding type metadata: name, fields, etc.
+    class UserType
+      attr_reader :name, :klass, :id, :fields, :fetcher
+
+      def initialize(name:, klass:, id:, fields:, fetcher:)
+        @name = name
+        @klass = klass
+        @id = id
+        # accept symbol keys
+        @fields = fields.each_with_object({}) { |kv, o| o[kv[0].to_s] = kv[1] }
+        @fetcher = fetcher
+      end
+    end
+
     # Translate between Polar and the host language (Ruby).
     class Host # rubocop:disable Metrics/ClassLength
+      # @return [Hash<String, Class>]
+      attr_reader :types
+
       protected
 
       # @return [FFI::Polar]
       attr_reader :ffi_polar
-      # @return [Hash<String, Class>]
-      attr_reader :classes
       # @return [Hash<Integer, Object>]
       attr_reader :instances
       # @return [Boolean]
@@ -53,39 +68,45 @@ module Oso
 
       def initialize(ffi_polar)
         @ffi_polar = ffi_polar
-        @classes = {}
+        @types = {}
         @instances = {}
         @accept_expression = false
       end
 
       def initialize_copy(other)
         @ffi_polar = other.ffi_polar
-        @classes = other.classes.dup
+        @types = other.types.dup
         @instances = other.instances.dup
       end
 
-      # Fetch a Ruby class from the {#classes} cache.
+      # Fetch a Ruby class from the {#types} cache.
       #
       # @param name [String]
       # @return [Class]
       # @raise [UnregisteredClassError] if the class has not been registered.
       def get_class(name)
-        raise UnregisteredClassError, name unless classes.key? name
+        raise UnregisteredClassError, name unless types.key? name
 
-        classes[name].get
+        types[name].klass.get
       end
 
-      # Store a Ruby class in the {#classes} cache.
+      # Store a Ruby class in the {#types} cache.
       #
       # @param cls [Class] the class to cache.
       # @param name [String] the name to cache the class as.
       # @return [String] the name the class is cached as.
       # @raise [DuplicateClassAliasError] if attempting to register a class
       # under a previously-registered name.
-      def cache_class(cls, name:)
-        raise DuplicateClassAliasError.new name: name, old: get_class(name), new: cls if classes.key? name
+      def cache_class(cls, name:, fields: {}, fetcher: nil)
+        raise DuplicateClassAliasError.new name: name, old: get_class(name), new: cls if types.key? name
 
-        classes[name] = PolarClass.new(cls)
+        types[name] = types[cls] = UserType.new(
+          name: name,
+          klass: PolarClass.new(cls),
+          id: cache_instance(cls),
+          fields: fields,
+          fetcher: fetcher
+        )
         name
       end
 
@@ -149,6 +170,33 @@ module Oso
         raise PolarRuntimeError, "Error constructing instance of #{cls_name}: #{e}"
       end
 
+      OPS = {
+        'Lt' => :<,
+        'Gt' => :>,
+        'Eq' => :==,
+        'Geq' => :>=,
+        'Leq' => :<=,
+        'Neq' => :!=
+      }.freeze
+
+      # Compare two values
+      #
+      # @param op [String] operation to perform.
+      # @param args [Array<Object>] left and right args to operation.
+      # @raise [PolarRuntimeError] if operation fails or is unsupported.
+      # @return [Boolean]
+      def operator(operation, args)
+        left, right = args
+        op = OPS[operation]
+        raise PolarRuntimeError, "Unsupported external operation '#{left.class} #{operation} #{right.class}'" if op.nil?
+
+        begin
+          left.__send__ op, right
+        rescue StandardError
+          raise PolarRuntimeError, "External operation '#{left.class} #{operation} #{right.class}' failed."
+        end
+      end
+
       # Check if the left class is more specific than the right class
       # with respect to the given instance.
       #
@@ -163,6 +211,10 @@ module Oso
         left_index && right_index && left_index < right_index
       end
 
+      def subclass?(left_tag:, right_tag:)
+        get_class(left_tag) <= get_class(right_tag)
+      end
+
       # Check if instance is an instance of class.
       #
       # @param instance [Hash<String, Object>]
@@ -174,15 +226,30 @@ module Oso
         instance.is_a? cls
       end
 
-      # Check if two instances unify
-      #
-      # @param left_instance_id [Integer]
-      # @param right_instance_id [Integer]
-      # @return [Boolean]
-      def unify?(left_instance_id, right_instance_id)
-        left_instance = get_instance(left_instance_id)
-        right_instance = get_instance(right_instance_id)
-        left_instance == right_instance
+      def serialize_types # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        polar_types = {}
+        types.values.uniq.each do |typ|
+          tag = typ.name
+          fields = typ.fields
+          field_types = {}
+          fields.each do |k, v|
+            field_types[k] =
+              if v.is_a? ::Oso::Polar::DataFiltering::Relationship
+                {
+                  'Relationship' => {
+                    'kind' => v.kind,
+                    'other_class_tag' => v.other_type,
+                    'my_field' => v.my_field,
+                    'other_field' => v.other_field
+                  }
+                }
+              else
+                { 'Base' => { 'class_tag' => types[v].name } }
+              end
+          end
+          polar_types[tag] = field_types
+        end
+        polar_types
       end
 
       # Turn a Ruby value into a Polar term that's ready to be sent across the
@@ -226,7 +293,7 @@ module Oso
                     { 'Pattern' => { 'Instance' => { 'tag' => value.tag, 'fields' => dict['Dictionary'] } } }
                   end
                 else
-                  { 'ExternalInstance' => { 'instance_id' => cache_instance(value), 'repr' => value.to_s } }
+                  { 'ExternalInstance' => { 'instance_id' => cache_instance(value), 'repr' => nil } }
                 end
         { 'value' => value }
       end
@@ -292,6 +359,12 @@ module Oso
           raise UnexpectedPolarTypeError, tag
         end
       end
+
+      def enrich_message(msg)
+        msg.gsub(/\^\{id: ([0-9]+)\}/) do
+          get_instance(Regexp.last_match[1].to_i).to_s
+        end
+      end
     end
   end
 end

data/lib/oso/polar/polar.rb

@@ -34,9 +34,10 @@ module Oso
       # @return [Host]
       attr_reader :host
 
-      def initialize
+      def initialize # rubocop:disable Metrics/MethodLength
         @ffi_polar = FFI::Polar.create
         @host = Host.new(ffi_polar)
+        @ffi_polar.enrich_message = @host.method(:enrich_message)
         @polar_roles_enabled = false
 
         # Register global constants.
@@ -51,6 +52,10 @@ module Oso
         register_class String
       end
 
+      def ffi
+        @ffi_polar
+      end
+
       def enable_roles # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         return if polar_roles_enabled
 
@@ -87,6 +92,55 @@ module Oso
         ffi_polar.validate_roles_config(validation_query_results)
       end
 
+      # get the (maybe user-supplied) name of a class.
+      # kind of a hack because of class autoreloading.
+      def get_class_name(klass) # rubocop:disable Metrics/AbcSize
+        if host.types.key? klass
+          host.types[klass].name
+        elsif host.types.key? klass.name
+          host.types[klass.name].name
+        else
+          rec = host.types.values.find { |v| v.klass.get == klass }
+          raise "Unknown class `#{klass}`" if rec.nil?
+
+          host.types[klass] = rec
+          rec.name
+        end
+      end
+
+      def get_allowed_resources(actor, action, klass) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        resource = Variable.new 'resource'
+        class_name = get_class_name klass
+        constraint = Expression.new(
+          'And',
+          [Expression.new('Isa', [resource, Pattern.new(class_name, {})])]
+        )
+
+        results = query_rule(
+          'allow',
+          actor,
+          action,
+          resource,
+          bindings: { 'resource' => constraint },
+          accept_expression: true
+        )
+
+        complete = []
+        partial = []
+
+        results.to_a.each do |result|
+          result.to_a.each do |key, val|
+            if val.is_a? Expression
+              partial.push({ 'bindings' => { key => host.to_polar(val) } })
+            else
+              complete.push val
+            end
+          end
+        end
+        filter = ::Oso::Polar::DataFiltering::FilterPlan.new(self, partial, class_name)
+        complete + filter.resolve
+      end
+
       # Clear all rules and rule sources from the current Polar instance
       #
       # @return [self] for chaining.
@@ -149,17 +203,16 @@ module Oso
       #   @param query [Predicate]
       #   @return [Enumerator] of resulting bindings
       #   @raise [Error] if the FFI call raises one.
-      def query(query)
-        new_host = host.dup
+      def query(query, host: self.host.dup, bindings: {})
         case query
         when String
           ffi_query = ffi_polar.new_query_from_str(query)
         when Predicate
-          ffi_query = ffi_polar.new_query_from_term(new_host.to_polar(query))
+          ffi_query = ffi_polar.new_query_from_term(host.to_polar(query))
         else
           raise InvalidQueryTypeError
         end
-        Query.new(ffi_query, host: new_host)
+        Query.new(ffi_query, host: host, bindings: bindings)
       end
 
       # Query for a rule.
@@ -168,8 +221,10 @@ module Oso
       # @param args [Array<Object>]
       # @return [Enumerator] of resulting bindings
       # @raise [Error] if the FFI call raises one.
-      def query_rule(name, *args)
-        query(Predicate.new(name, args: args))
+      def query_rule(name, *args, accept_expression: false, bindings: {})
+        host = self.host.dup
+        host.accept_expression = accept_expression
+        query(Predicate.new(name, args: args), host: host, bindings: bindings)
       end
 
       # Register a Ruby class with Polar.
@@ -180,8 +235,8 @@ module Oso
       # under a previously-registered name.
       # @raise [FFI::Error] if the FFI call returns an error.
       # @return [self] for chaining.
-      def register_class(cls, name: nil)
-        name = host.cache_class(cls, name: name || cls.name)
+      def register_class(cls, name: nil, fields: {}, fetcher: nil)
+        name = host.cache_class(cls, name: name || cls.name, fields: fields, fetcher: fetcher)
         register_constant(cls, name: name)
       end
 

data/lib/oso/polar/query.rb

@@ -10,10 +10,12 @@ module Oso
 
       # @param ffi_query [FFI::Query]
       # @param host [Oso::Polar::Host]
-      def initialize(ffi_query, host:)
+      def initialize(ffi_query, host:, bindings: {})
         @calls = {}
         @ffi_query = ffi_query
+        ffi_query.enrich_message = host.method(:enrich_message)
         @host = host
+        bindings.each { |k, v| ffi_query.bind k, host.to_polar(v) }
       end
 
       private
@@ -70,6 +72,9 @@ module Oso
       # @raise [Error] if the FFI call raises one.
       def handle_call(attribute, call_id:, instance:, args:, kwargs:) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         instance = host.to_ruby(instance)
+        rel = get_relationship(instance.class, attribute)
+        return handle_relationship(call_id, instance, rel) unless rel.nil?
+
         args = args.map { |a| host.to_ruby(a) }
         kwargs = Hash[kwargs.map { |k, v| [k.to_sym, host.to_ruby(v)] }]
         # The kwargs.empty? check is for Ruby < 2.7.
@@ -85,6 +90,40 @@ module Oso
         call_result(nil, call_id: call_id)
       end
 
+      # Get the type information for a field on a class.
+      #
+      # @param cls [UserType]
+      # @param tag [String]
+      # @return [UserType]
+      # @raise [Error] if no information is found
+      def get_field(cls, tag) # rubocop:disable Metrics/AbcSize
+        raise unless cls.fields.key? tag
+
+        ref = cls.fields[tag]
+        return host.types[ref] unless ref.is_a? ::Oso::Polar::DataFiltering::Relationship
+
+        case ref.kind
+        when 'parent'
+          host.types[ref.other_type]
+        when 'children'
+          host.types[Array]
+        end
+      end
+
+      # Check if a series of dot operations on a base class yield an
+      # instance of another class.
+      def handle_external_isa_with_path(data) # rubocop:disable Metrics/AbcSize
+        sup = host.types[data['class_tag']]
+        bas = host.types[data['base_tag']]
+        path = data['path'].map(&host.method(:to_ruby))
+        sub = path.reduce(bas) { |cls, tag| get_field(cls, tag) }
+        answer = sub.klass.get <= sup.klass.get
+        question_result(answer, call_id: data['call_id'])
+      rescue StandardError => e
+        application_error e.message
+        question_result(nil, call_id: data['call_id'])
+      end
+
       def handle_next_external(call_id, iterable)
         unless calls.key? call_id
           value = host.to_ruby iterable
@@ -128,6 +167,8 @@ module Oso
             yield event.data['bindings'].transform_values { |v| host.to_ruby(v) }
           when 'MakeExternal'
             handle_make_external(event.data)
+          when 'ExternalIsaWithPath'
+            handle_external_isa_with_path(event.data)
           when 'ExternalCall'
             call_id = event.data['call_id']
             instance = event.data['instance']
@@ -141,18 +182,23 @@ module Oso
             right_tag = event.data['right_class_tag']
             answer = host.subspecializer?(instance_id, left_tag: left_tag, right_tag: right_tag)
             question_result(answer, call_id: event.data['call_id'])
+          when 'ExternalIsSubclass'
+            call_id = event.data['call_id']
+            left = event.data['left_class_tag']
+            right = event.data['right_class_tag']
+            answer = host.subclass?(left_tag: left, right_tag: right)
+            question_result(answer, call_id: call_id)
           when 'ExternalIsa'
             instance = event.data['instance']
             class_tag = event.data['class_tag']
             answer = host.isa?(instance, class_tag: class_tag)
             question_result(answer, call_id: event.data['call_id'])
-          when 'ExternalUnify'
-            left_instance_id = event.data['left_instance_id']
-            right_instance_id = event.data['right_instance_id']
-            answer = host.unify?(left_instance_id, right_instance_id)
-            question_result(answer, call_id: event.data['call_id'])
           when 'Debug'
-            puts event.data['message'] if event.data['message']
+            msg = event.data['message']
+            if msg
+              msg = host.enrich_message(msg) if msg
+              puts msg
+            end
             print 'debug> '
             begin
               input = $stdin.readline.chomp.chomp(';')
@@ -162,7 +208,10 @@ module Oso
             command = JSON.dump(host.to_polar(input))
             ffi_query.debug_command(command)
           when 'ExternalOp'
-            raise UnimplementedOperationError, 'comparison operators'
+            op = event.data['operator']
+            args = event.data['args'].map(&host.method(:to_ruby))
+            answer = host.operator(op, args)
+            question_result(answer, call_id: event.data['call_id'])
           when 'NextExternal'
             call_id = event.data['call_id']
             iterable = event.data['iterable']
@@ -172,6 +221,35 @@ module Oso
           end
         end
       end
+
+      def get_relationship(cls, attr)
+        typ = host.types[cls]
+        return unless typ
+
+        rel = typ.fields[attr]
+        return unless rel.is_a? ::Oso::Polar::DataFiltering::Relationship
+
+        rel
+      end
+
+      def handle_relationship(call_id, instance, rel) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        fetcher = host.types[rel.other_type].fetcher
+        constraint = ::Oso::Polar::DataFiltering::Constraint.new(
+          kind: 'Eq',
+          field: rel.other_field,
+          value: instance.send(rel.my_field)
+        )
+        res = fetcher[[constraint]].uniq
+
+        if rel.kind == 'parent'
+          raise "multiple parents: #{res}" unless res.length == 1
+
+          res = res[0]
+        end
+
+        res = JSON.dump host.to_polar res
+        call_result(res, call_id: call_id)
+      end
     end
   end
 end

data/lib/oso/polar.rb

@@ -10,6 +10,7 @@ require 'oso/polar/predicate'
 require 'oso/polar/query'
 require 'oso/polar/query_event'
 require 'oso/polar/variable'
+require 'oso/polar/data_filtering'
 
 module Oso
   # Top-level namespace for Polar language library.

data/lib/oso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Oso
-  VERSION = '0.14.0'
+  VERSION = '0.20.0-beta'
 end

data/oso-oso.gemspec

@@ -31,10 +31,12 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'ffi', '~> 1.0'
 
   # Development dependencies
+  spec.add_development_dependency 'activerecord'
   spec.add_development_dependency 'pry-byebug', '~> 3.9.0'
   spec.add_development_dependency 'rake', '~> 12.0'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rubocop', '~> 0.89.1'
   spec.add_development_dependency 'solargraph', '~> 0.39.14'
+  spec.add_development_dependency 'sqlite3'
   spec.add_development_dependency 'yard', '~> 0.9.25'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oso-oso
 version: !ruby/object:Gem::Version
-  version: 0.14.0
+  version: 0.20.0.pre.beta
 platform: ruby
 authors:
 - Oso Security, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-07-16 00:00:00.000000000 Z
+date: 2021-08-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: pry-byebug
   requirement: !ruby/object:Gem::Requirement
@@ -94,6 +108,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.39.14
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: yard
   requirement: !ruby/object:Gem::Requirement
@@ -132,6 +160,7 @@ files:
 - lib/oso.rb
 - lib/oso/oso.rb
 - lib/oso/polar.rb
+- lib/oso/polar/data_filtering.rb
 - lib/oso/polar/errors.rb
 - lib/oso/polar/expression.rb
 - lib/oso/polar/ffi.rb
@@ -167,9 +196,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.6.14.4