oso-oso 0.15.0 → 0.20.0.pre.beta

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 12fca0670b29961bafc90ea1565f5ef2e501a778
-  data.tar.gz: ca3fee786141d350b6d79e67ab042e650a082566
+  metadata.gz: aa0564b86f2ceb4b54a62cdbae1cf2a3cc14ee91
+  data.tar.gz: d0cbc579ac5bd7284b559d3ca3d31af9f6837e96
 SHA512:
-  metadata.gz: edcc9dd56153cc927d2791dfe398264c538030f44e7a1e36e9157b37bacc05033ad31f24d6d0c0f95b71a8de166633bcd24755e94fcb90683fee70a02711d0c2
-  data.tar.gz: e3155aef370a1d61c388f0342ee5a692afad0a473a362e740e1f8124afc86d3d18ae080e7acac856b081b7fc7e27d50b56b5e273d51e7cc1359092896480e92b
+  metadata.gz: d2a7f469cff84febf8dd66f737384523fd576d42b1d44e41247bb738a7b26ca230d9e91066be2acf2a6ade07be780aeec5fa529b21c88c7d0bb626ca66ab821a
+  data.tar.gz: 742452956eeb29797b173888a268962bbc6e92e88b7148e7ca3952bb9d9c7687abd55d74c657d170056a61e911ed0183d29fa3ef471aa5c8cd733f47d72d188b

data/.gitignore

@@ -7,6 +7,7 @@
 /spec/reports/
 /tmp/
 vendor
+active_record_test.db
 
 # rspec failure tracking
 .rspec_status

data/Gemfile.lock

@@ -1,24 +1,40 @@
 PATH
   remote: .
   specs:
-    oso-oso (0.15.0)
+    oso-oso (0.20.0.pre.beta)
       ffi (~> 1.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    activemodel (5.2.6)
+      activesupport (= 5.2.6)
+    activerecord (5.2.6)
+      activemodel (= 5.2.6)
+      activesupport (= 5.2.6)
+      arel (>= 9.0)
+    activesupport (5.2.6)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (>= 0.7, < 2)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    arel (9.0.0)
     ast (2.4.1)
     backport (1.1.2)
     benchmark (0.1.0)
     byebug (11.1.3)
     coderay (1.1.3)
+    concurrent-ruby (1.1.9)
     diff-lcs (1.4.4)
     e2mmap (0.1.0)
-    ffi (1.15.1)
+    ffi (1.15.3)
+    i18n (1.8.10)
+      concurrent-ruby (~> 1.0)
     jaro_winkler (1.5.4)
     maruku (0.7.3)
     method_source (1.0.0)
     mini_portile2 (2.4.0)
+    minitest (5.14.4)
     nokogiri (1.10.10)
       mini_portile2 (~> 2.4.0)
     parallel (1.19.2)
@@ -75,8 +91,12 @@ GEM
       thor (~> 1.0)
       tilt (~> 2.0)
       yard (~> 0.9, >= 0.9.24)
+    sqlite3 (1.4.2)
     thor (1.0.1)
+    thread_safe (0.3.6)
     tilt (2.0.10)
+    tzinfo (1.2.9)
+      thread_safe (~> 0.1)
     unicode-display_width (1.7.0)
     yard (0.9.25)
 
@@ -84,12 +104,14 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  activerecord
   oso-oso!
   pry-byebug (~> 3.9.0)
   rake (~> 12.0)
   rspec (~> 3.0)
   rubocop (~> 0.89.1)
   solargraph (~> 0.39.14)
+  sqlite3
   yard (~> 0.9.25)
 
 BUNDLED WITH

data/lib/oso/polar/data_filtering.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+module Oso
+  module Polar
+    # Data filtering interface for Ruby
+    module DataFiltering
+      # Represents a set of filter sequences that should allow the host
+      # to obtain the records satisfying a query.
+      class FilterPlan
+        include Enumerable
+        attr_reader :result_sets
+
+        def initialize(polar, partials, class_name)
+          types = polar.host.serialize_types
+          parsed_json = polar.ffi.build_filter_plan(types, partials, 'resource', class_name)
+          @polar = polar
+          @result_sets = parsed_json['result_sets'].map do |rset|
+            ResultSet.new polar, rset
+          end
+        end
+
+        def each(&blk)
+          result_sets.each(&blk)
+        end
+
+        def resolve # rubocop:disable Metrics/AbcSize
+          reduce([]) do |acc, rs|
+            requests = rs.requests
+            acc + rs.resolve_order.each_with_object({}) do |i, set_results|
+              req = requests[i]
+              constraints = req.constraints
+              constraints.each { |c| c.ground set_results }
+              set_results[i] = @polar.host.types[req.class_tag].fetcher[constraints]
+            end[rs.result_id]
+          end.uniq
+        end
+
+        # Represents a sequence of filters for one set of results
+        class ResultSet
+          attr_reader :requests, :resolve_order, :result_id
+
+          def initialize(polar, parsed_json)
+            @resolve_order = parsed_json['resolve_order']
+            @result_id = parsed_json['result_id']
+            @requests = parsed_json['requests'].each_with_object({}) do |req, reqs|
+              reqs[req[0].to_i] = Request.new(polar, req[1])
+            end
+          end
+
+          # Represents a filter for a result set
+          class Request
+            attr_reader :constraints, :class_tag
+
+            def initialize(polar, parsed_json)
+              @constraints = parsed_json['constraints'].map do |con|
+                Constraint.parse polar, con
+              end
+              @class_tag = parsed_json['class_tag']
+            end
+          end
+        end
+      end
+
+      # Represents relationships between resources, eg. parent/child
+      class Relationship
+        attr_reader :kind, :other_type, :my_field, :other_field
+
+        def initialize(kind:, other_type:, my_field:, other_field:)
+          @kind = kind
+          @other_type = other_type
+          @my_field = my_field
+          @other_field = other_field
+        end
+      end
+
+      # Represents field-field relationships on one resource.
+      class Field
+        attr_reader :field
+
+        def initialize(field:)
+          @field = field
+        end
+      end
+
+      # Represents field-field relationships on different resources.
+      class Ref
+        attr_reader :field, :result_id
+
+        def initialize(field:, result_id:)
+          @field = field
+          @result_id = result_id
+        end
+      end
+
+      # Represents a condition that must hold on a resource.
+      class Constraint
+        attr_reader :kind, :field, :value
+
+        CHECKS = {
+          'Eq' => ->(a, b) { a == b },
+          'In' => ->(a, b) { b.include? a },
+          'Contains' => ->(a, b) { a.include? b }
+        }.freeze
+
+        def initialize(kind:, field:, value:)
+          @kind = kind
+          @field = field
+          @value = value
+          @check = CHECKS[kind]
+          raise "Unknown constraint kind `#{kind}`" if @check.nil?
+        end
+
+        def ground(results)
+          return unless value.is_a? Ref
+
+          ref = value
+          @value = results[ref.result_id]
+          @value = value.map { |v| v.send ref.field } unless ref.field.nil?
+        end
+
+        def check(item)
+          val = value.is_a?(Field) ? item.send(value.field) : value
+          item = field.nil? ? item : item.send(field)
+          @check[item, val]
+        end
+
+        def self.parse(polar, constraint) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+          kind = constraint['kind']
+          raise unless %w[Eq In Contains].include? kind
+
+          field = constraint['field']
+          value = constraint['value']
+
+          value_kind = value.keys.first
+          value = value[value_kind]
+
+          case value_kind
+          when 'Term'
+            value = polar.host.to_ruby value
+          when 'Ref'
+            child_field = value['field']
+            result_id = value['result_id']
+            value = Ref.new field: child_field, result_id: result_id
+          when 'Field'
+            value = Field.new field: value
+          else
+            raise "Unknown value kind `#{value_kind}`"
+          end
+
+          new kind: kind, field: field, value: value
+        end
+      end
+    end
+  end
+end

data/lib/oso/polar/ffi/polar.rb

@@ -25,6 +25,12 @@ module Oso
           attach_function :register_constant, :polar_register_constant, [FFI::Polar, :string, :string], :int32
           attach_function :next_message, :polar_next_polar_message, [FFI::Polar], FFI::Message
           attach_function :free, :polar_free, [FFI::Polar], :int32
+          attach_function(
+            :build_filter_plan,
+            :polar_build_filter_plan,
+            [FFI::Polar, :string, :string, :string, :string],
+            :string
+          )
         end
         private_constant :Rust
 
@@ -51,6 +57,16 @@ module Oso
           handle_error if result.zero?
         end
 
+        def build_filter_plan(types, partials, variable, class_tag)
+          types = JSON.dump(types)
+          partials = JSON.dump(partials)
+          plan = Rust.build_filter_plan(self, types, partials, variable, class_tag)
+          process_messages
+          handle_error if plan.nil?
+          # TODO(gw) more error checking?
+          JSON.parse plan
+        end
+
         # @param src [String]
         # @param filename [String]
         # @raise [FFI::Error] if the FFI call returns an error.

data/lib/oso/polar/ffi/query.rb

@@ -21,6 +21,7 @@ module Oso
           attach_function :next_message, :polar_next_query_message, [FFI::Query], FFI::Message
           attach_function :source, :polar_query_source_info, [FFI::Query], FFI::Source
           attach_function :free, :query_free, [FFI::Query], :int32
+          attach_function :bind, :polar_bind, [FFI::Query, :string, :string], :int32
         end
         private_constant :Rust
 
@@ -67,6 +68,11 @@ module Oso
           ::Oso::Polar::QueryEvent.new(JSON.parse(event.to_s))
         end
 
+        def bind(name, value)
+          res = Rust.bind(self, name, JSON.dump(value))
+          handle_error if res.zero?
+        end
+
         def next_message
           Rust.next_message(self)
         end

data/lib/oso/polar/host.rb

@@ -34,14 +34,29 @@ module Oso
       end
     end
 
+    # For holding type metadata: name, fields, etc.
+    class UserType
+      attr_reader :name, :klass, :id, :fields, :fetcher
+
+      def initialize(name:, klass:, id:, fields:, fetcher:)
+        @name = name
+        @klass = klass
+        @id = id
+        # accept symbol keys
+        @fields = fields.each_with_object({}) { |kv, o| o[kv[0].to_s] = kv[1] }
+        @fetcher = fetcher
+      end
+    end
+
     # Translate between Polar and the host language (Ruby).
     class Host # rubocop:disable Metrics/ClassLength
+      # @return [Hash<String, Class>]
+      attr_reader :types
+
       protected
 
       # @return [FFI::Polar]
       attr_reader :ffi_polar
-      # @return [Hash<String, Class>]
-      attr_reader :classes
       # @return [Hash<Integer, Object>]
       attr_reader :instances
       # @return [Boolean]
@@ -53,39 +68,45 @@ module Oso
 
       def initialize(ffi_polar)
         @ffi_polar = ffi_polar
-        @classes = {}
+        @types = {}
         @instances = {}
         @accept_expression = false
       end
 
       def initialize_copy(other)
         @ffi_polar = other.ffi_polar
-        @classes = other.classes.dup
+        @types = other.types.dup
         @instances = other.instances.dup
       end
 
-      # Fetch a Ruby class from the {#classes} cache.
+      # Fetch a Ruby class from the {#types} cache.
       #
       # @param name [String]
       # @return [Class]
       # @raise [UnregisteredClassError] if the class has not been registered.
       def get_class(name)
-        raise UnregisteredClassError, name unless classes.key? name
+        raise UnregisteredClassError, name unless types.key? name
 
-        classes[name].get
+        types[name].klass.get
       end
 
-      # Store a Ruby class in the {#classes} cache.
+      # Store a Ruby class in the {#types} cache.
       #
       # @param cls [Class] the class to cache.
       # @param name [String] the name to cache the class as.
       # @return [String] the name the class is cached as.
       # @raise [DuplicateClassAliasError] if attempting to register a class
       # under a previously-registered name.
-      def cache_class(cls, name:)
-        raise DuplicateClassAliasError.new name: name, old: get_class(name), new: cls if classes.key? name
+      def cache_class(cls, name:, fields: {}, fetcher: nil)
+        raise DuplicateClassAliasError.new name: name, old: get_class(name), new: cls if types.key? name
 
-        classes[name] = PolarClass.new(cls)
+        types[name] = types[cls] = UserType.new(
+          name: name,
+          klass: PolarClass.new(cls),
+          id: cache_instance(cls),
+          fields: fields,
+          fetcher: fetcher
+        )
         name
       end
 
@@ -190,6 +211,10 @@ module Oso
         left_index && right_index && left_index < right_index
       end
 
+      def subclass?(left_tag:, right_tag:)
+        get_class(left_tag) <= get_class(right_tag)
+      end
+
       # Check if instance is an instance of class.
       #
       # @param instance [Hash<String, Object>]
@@ -201,6 +226,32 @@ module Oso
         instance.is_a? cls
       end
 
+      def serialize_types # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        polar_types = {}
+        types.values.uniq.each do |typ|
+          tag = typ.name
+          fields = typ.fields
+          field_types = {}
+          fields.each do |k, v|
+            field_types[k] =
+              if v.is_a? ::Oso::Polar::DataFiltering::Relationship
+                {
+                  'Relationship' => {
+                    'kind' => v.kind,
+                    'other_class_tag' => v.other_type,
+                    'my_field' => v.my_field,
+                    'other_field' => v.other_field
+                  }
+                }
+              else
+                { 'Base' => { 'class_tag' => types[v].name } }
+              end
+          end
+          polar_types[tag] = field_types
+        end
+        polar_types
+      end
+
       # Turn a Ruby value into a Polar term that's ready to be sent across the
       # FFI boundary.
       #

data/lib/oso/polar/polar.rb

@@ -52,6 +52,10 @@ module Oso
         register_class String
       end
 
+      def ffi
+        @ffi_polar
+      end
+
       def enable_roles # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         return if polar_roles_enabled
 
@@ -88,6 +92,55 @@ module Oso
         ffi_polar.validate_roles_config(validation_query_results)
       end
 
+      # get the (maybe user-supplied) name of a class.
+      # kind of a hack because of class autoreloading.
+      def get_class_name(klass) # rubocop:disable Metrics/AbcSize
+        if host.types.key? klass
+          host.types[klass].name
+        elsif host.types.key? klass.name
+          host.types[klass.name].name
+        else
+          rec = host.types.values.find { |v| v.klass.get == klass }
+          raise "Unknown class `#{klass}`" if rec.nil?
+
+          host.types[klass] = rec
+          rec.name
+        end
+      end
+
+      def get_allowed_resources(actor, action, klass) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        resource = Variable.new 'resource'
+        class_name = get_class_name klass
+        constraint = Expression.new(
+          'And',
+          [Expression.new('Isa', [resource, Pattern.new(class_name, {})])]
+        )
+
+        results = query_rule(
+          'allow',
+          actor,
+          action,
+          resource,
+          bindings: { 'resource' => constraint },
+          accept_expression: true
+        )
+
+        complete = []
+        partial = []
+
+        results.to_a.each do |result|
+          result.to_a.each do |key, val|
+            if val.is_a? Expression
+              partial.push({ 'bindings' => { key => host.to_polar(val) } })
+            else
+              complete.push val
+            end
+          end
+        end
+        filter = ::Oso::Polar::DataFiltering::FilterPlan.new(self, partial, class_name)
+        complete + filter.resolve
+      end
+
       # Clear all rules and rule sources from the current Polar instance
       #
       # @return [self] for chaining.
@@ -150,17 +203,16 @@ module Oso
       #   @param query [Predicate]
       #   @return [Enumerator] of resulting bindings
       #   @raise [Error] if the FFI call raises one.
-      def query(query)
-        new_host = host.dup
+      def query(query, host: self.host.dup, bindings: {})
         case query
         when String
           ffi_query = ffi_polar.new_query_from_str(query)
         when Predicate
-          ffi_query = ffi_polar.new_query_from_term(new_host.to_polar(query))
+          ffi_query = ffi_polar.new_query_from_term(host.to_polar(query))
         else
           raise InvalidQueryTypeError
         end
-        Query.new(ffi_query, host: new_host)
+        Query.new(ffi_query, host: host, bindings: bindings)
       end
 
       # Query for a rule.
@@ -169,8 +221,10 @@ module Oso
       # @param args [Array<Object>]
       # @return [Enumerator] of resulting bindings
       # @raise [Error] if the FFI call raises one.
-      def query_rule(name, *args)
-        query(Predicate.new(name, args: args))
+      def query_rule(name, *args, accept_expression: false, bindings: {})
+        host = self.host.dup
+        host.accept_expression = accept_expression
+        query(Predicate.new(name, args: args), host: host, bindings: bindings)
       end
 
       # Register a Ruby class with Polar.
@@ -181,8 +235,8 @@ module Oso
       # under a previously-registered name.
       # @raise [FFI::Error] if the FFI call returns an error.
       # @return [self] for chaining.
-      def register_class(cls, name: nil)
-        name = host.cache_class(cls, name: name || cls.name)
+      def register_class(cls, name: nil, fields: {}, fetcher: nil)
+        name = host.cache_class(cls, name: name || cls.name, fields: fields, fetcher: fetcher)
         register_constant(cls, name: name)
       end
 

data/lib/oso/polar/query.rb

@@ -10,11 +10,12 @@ module Oso
 
       # @param ffi_query [FFI::Query]
       # @param host [Oso::Polar::Host]
-      def initialize(ffi_query, host:)
+      def initialize(ffi_query, host:, bindings: {})
         @calls = {}
         @ffi_query = ffi_query
         ffi_query.enrich_message = host.method(:enrich_message)
         @host = host
+        bindings.each { |k, v| ffi_query.bind k, host.to_polar(v) }
       end
 
       private
@@ -71,6 +72,9 @@ module Oso
       # @raise [Error] if the FFI call raises one.
       def handle_call(attribute, call_id:, instance:, args:, kwargs:) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         instance = host.to_ruby(instance)
+        rel = get_relationship(instance.class, attribute)
+        return handle_relationship(call_id, instance, rel) unless rel.nil?
+
         args = args.map { |a| host.to_ruby(a) }
         kwargs = Hash[kwargs.map { |k, v| [k.to_sym, host.to_ruby(v)] }]
         # The kwargs.empty? check is for Ruby < 2.7.
@@ -86,6 +90,40 @@ module Oso
         call_result(nil, call_id: call_id)
       end
 
+      # Get the type information for a field on a class.
+      #
+      # @param cls [UserType]
+      # @param tag [String]
+      # @return [UserType]
+      # @raise [Error] if no information is found
+      def get_field(cls, tag) # rubocop:disable Metrics/AbcSize
+        raise unless cls.fields.key? tag
+
+        ref = cls.fields[tag]
+        return host.types[ref] unless ref.is_a? ::Oso::Polar::DataFiltering::Relationship
+
+        case ref.kind
+        when 'parent'
+          host.types[ref.other_type]
+        when 'children'
+          host.types[Array]
+        end
+      end
+
+      # Check if a series of dot operations on a base class yield an
+      # instance of another class.
+      def handle_external_isa_with_path(data) # rubocop:disable Metrics/AbcSize
+        sup = host.types[data['class_tag']]
+        bas = host.types[data['base_tag']]
+        path = data['path'].map(&host.method(:to_ruby))
+        sub = path.reduce(bas) { |cls, tag| get_field(cls, tag) }
+        answer = sub.klass.get <= sup.klass.get
+        question_result(answer, call_id: data['call_id'])
+      rescue StandardError => e
+        application_error e.message
+        question_result(nil, call_id: data['call_id'])
+      end
+
       def handle_next_external(call_id, iterable)
         unless calls.key? call_id
           value = host.to_ruby iterable
@@ -129,6 +167,8 @@ module Oso
             yield event.data['bindings'].transform_values { |v| host.to_ruby(v) }
           when 'MakeExternal'
             handle_make_external(event.data)
+          when 'ExternalIsaWithPath'
+            handle_external_isa_with_path(event.data)
           when 'ExternalCall'
             call_id = event.data['call_id']
             instance = event.data['instance']
@@ -142,6 +182,12 @@ module Oso
             right_tag = event.data['right_class_tag']
             answer = host.subspecializer?(instance_id, left_tag: left_tag, right_tag: right_tag)
             question_result(answer, call_id: event.data['call_id'])
+          when 'ExternalIsSubclass'
+            call_id = event.data['call_id']
+            left = event.data['left_class_tag']
+            right = event.data['right_class_tag']
+            answer = host.subclass?(left_tag: left, right_tag: right)
+            question_result(answer, call_id: call_id)
           when 'ExternalIsa'
             instance = event.data['instance']
             class_tag = event.data['class_tag']
@@ -175,6 +221,35 @@ module Oso
           end
         end
       end
+
+      def get_relationship(cls, attr)
+        typ = host.types[cls]
+        return unless typ
+
+        rel = typ.fields[attr]
+        return unless rel.is_a? ::Oso::Polar::DataFiltering::Relationship
+
+        rel
+      end
+
+      def handle_relationship(call_id, instance, rel) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        fetcher = host.types[rel.other_type].fetcher
+        constraint = ::Oso::Polar::DataFiltering::Constraint.new(
+          kind: 'Eq',
+          field: rel.other_field,
+          value: instance.send(rel.my_field)
+        )
+        res = fetcher[[constraint]].uniq
+
+        if rel.kind == 'parent'
+          raise "multiple parents: #{res}" unless res.length == 1
+
+          res = res[0]
+        end
+
+        res = JSON.dump host.to_polar res
+        call_result(res, call_id: call_id)
+      end
     end
   end
 end

data/lib/oso/polar.rb

@@ -10,6 +10,7 @@ require 'oso/polar/predicate'
 require 'oso/polar/query'
 require 'oso/polar/query_event'
 require 'oso/polar/variable'
+require 'oso/polar/data_filtering'
 
 module Oso
   # Top-level namespace for Polar language library.

data/lib/oso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Oso
-  VERSION = '0.15.0'
+  VERSION = '0.20.0-beta'
 end

data/oso-oso.gemspec

@@ -31,10 +31,12 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'ffi', '~> 1.0'
 
   # Development dependencies
+  spec.add_development_dependency 'activerecord'
   spec.add_development_dependency 'pry-byebug', '~> 3.9.0'
   spec.add_development_dependency 'rake', '~> 12.0'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rubocop', '~> 0.89.1'
   spec.add_development_dependency 'solargraph', '~> 0.39.14'
+  spec.add_development_dependency 'sqlite3'
   spec.add_development_dependency 'yard', '~> 0.9.25'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oso-oso
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.20.0.pre.beta
 platform: ruby
 authors:
 - Oso Security, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-08-13 00:00:00.000000000 Z
+date: 2021-08-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: pry-byebug
   requirement: !ruby/object:Gem::Requirement
@@ -94,6 +108,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.39.14
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: yard
   requirement: !ruby/object:Gem::Requirement
@@ -132,6 +160,7 @@ files:
 - lib/oso.rb
 - lib/oso/oso.rb
 - lib/oso/polar.rb
+- lib/oso/polar/data_filtering.rb
 - lib/oso/polar/errors.rb
 - lib/oso/polar/expression.rb
 - lib/oso/polar/ffi.rb
@@ -167,9 +196,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.6.14.4