oso-oso 0.20.1 → 0.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: da642b9fbbfcad2d836a8db8c6ac83cbc8f1127a
-  data.tar.gz: 1012ef61aa0a1791a1c759ba9f62e108918898b6
+  metadata.gz: 1e323fdc380d0763cb3b4d84618fb81c3b6957a8
+  data.tar.gz: 8571c1594862ec12dd1ed9bbbc49dec49a71567b
 SHA512:
-  metadata.gz: 48d52111b817769f31086b4adbd7252bcab4355792ba85e378ab4a27c68272e8d2af55f8d2a258e0a3bb3b2cea30b6d0c98f6e20eec7ed9d1b127011a506cab7
-  data.tar.gz: f40a6c5565655ee508ebc0c20b7f571616b42d4a76f986b51ad4349c1fe05200d8165990c98a00e2a7388ac41eb96182095b52a9f08ad022cc0880801ad87997
+  metadata.gz: 451a25cd51d463002223839c152a96aed018b958b0619103c8a7ad2e7e31fe4bab05ffded087ecde46036849b07d5f7ab34b5e8a5b2f6d761a741fe255c817a6
+  data.tar.gz: 2ccbcd09c12aeeedc86ce473b8f76439bc576016fb087dbbf9b8279c7a14128847130492698c37bdc76be2da5792fc674ee2be384e12f6f787c738fa5539cc6e

data/.gitignore

@@ -7,7 +7,7 @@
 /spec/reports/
 /tmp/
 vendor
-active_record_test.db
+*test.db
 
 # rspec failure tracking
 .rspec_status

data/.rubocop.yml

@@ -5,3 +5,6 @@ AllCops:
     - "bin/oso"
     - "vendor/**/*"
   NewCops: enable
+Naming/FileName:
+  Exclude:
+    - "lib/oso-oso.rb"

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    oso-oso (0.20.1)
+    oso-oso (0.23.0)
       ffi (~> 1.0)
 
 GEM

data/lib/oso/oso.rb

@@ -218,5 +218,15 @@ module Oso
 
       host.types[get_class_name resource_cls].exec_query[q]
     end
+
+    # Register default values for data filtering query functions.
+    # These can be overridden by passing specific implementations to
+    # `register_class` or by defining `build_query`, `exec_query` and
+    # `combine_query` methods on the class object.
+    def set_data_filtering_query_defaults(build_query: nil, exec_query: nil, combine_query: nil)
+      host.build_query = build_query if build_query
+      host.exec_query = exec_query if exec_query
+      host.combine_query = combine_query if combine_query
+    end
   end
 end

data/lib/oso/polar/data_filtering.rb

@@ -4,6 +4,7 @@ module Oso
   module Polar
     # Data filtering interface for Ruby
     module DataFiltering
+      GETATTR = ->(x, attr) { attr.nil? ? x : x.send(attr) }
       # Represents a set of filter sequences that should allow the host
       # to obtain the records satisfying a query.
       class FilterPlan
@@ -29,7 +30,7 @@ module Oso
           result_sets.each_with_object([]) do |rs, qb|
             rs.resolve_order.each_with_object({}) do |i, set_results|
               req = rs.requests[i]
-              cs = req.constraints.each { |c| c.ground set_results }
+              cs = req.ground(set_results)
               typ = @polar.host.types[req.class_tag]
               q = typ.build_query[cs]
               if i != rs.result_id
@@ -68,6 +69,7 @@ module Oso
           attr_reader :constraints, :class_tag
 
           def self.parse(polar, parsed_json)
+            @polar = polar
             constraints = parsed_json['constraints'].map do |con|
               Filter.parse polar, con
             end
@@ -76,6 +78,29 @@ module Oso
             new(constraints: constraints, class_tag: class_tag)
           end
 
+          def ground(results) # rubocop:disable Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/AbcSize, Metrics/PerceivedComplexity
+            xrefs, rest = constraints.partition do |c|
+              c.value.is_a?(Ref) and !c.value.result_id.nil?
+            end
+
+            yrefs, nrefs = xrefs.partition { |r| %w[In Eq].include? r.kind }
+            [[yrefs, 'In'], [nrefs, 'Nin']].each do |refs, kind|
+              refs.group_by { |f| f.value.result_id }.each do |rid, fils|
+                if fils.length > 1
+                  value = results[rid].map { |r| fils.map { |f| GETATTR[r, f.value.field] } }
+                  field = fils.map(&:field)
+                  rest.push(Filter.new(kind: kind, value: value, field: field))
+                else
+                  fil = fils[0]
+                  field = fil.value.field
+                  value = results[rid].map { |r| field.nil? ? r : r.send(field) }
+                  rest.push(Filter.new(kind: kind, field: fil.field, value: value))
+                end
+              end
+            end
+            rest
+          end
+
           def initialize(constraints:, class_tag:)
             @constraints = constraints
             @class_tag = class_tag
@@ -127,6 +152,7 @@ module Oso
           'Eq' => ->(a, b) { a == b },
           'In' => ->(a, b) { b.include? a },
           'Neq' => ->(a, b) { a != b },
+          'Nin' => ->(a, b) { !b.include?(a) },
           'Contains' => ->(a, b) { a.include? b }
         }.freeze
 
@@ -138,8 +164,6 @@ module Oso
           @kind = kind
           @field = field
           @value = value
-          @check = CHECKS[kind]
-          raise "Unknown constraint kind `#{kind}`" if @check.nil?
         end
 
         def ground(results)
@@ -150,10 +174,16 @@ module Oso
           @value = value.map { |v| v.send ref.field } unless ref.field.nil?
         end
 
-        def check(item)
+        def check(item) # rubocop:disable Metrics/AbcSize
           val = value.is_a?(Field) ? item.send(value.field) : value
-          item = field.nil? ? item : item.send(field)
-          @check[item, val]
+          item = if field.nil?
+                   item
+                 elsif field.is_a? Array
+                   field.map { |f| GETATTR[item, f] }
+                 else
+                   item.send field
+                 end
+          CHECKS[@kind][item, val]
         end
 
         def self.parse(polar, constraint) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength

data/lib/oso/polar/errors.rb

@@ -23,7 +23,6 @@ module Oso
 
     # Errors from across the FFI boundary.
 
-    class SerializationError < PolarRuntimeError; end
     class UnsupportedError < PolarRuntimeError; end
     class PolarTypeError < PolarRuntimeError; end
     class StackOverflowError < PolarRuntimeError; end
@@ -96,10 +95,6 @@ module Oso
       class UnrecognizedToken < ParseError; end
     end
 
-    # Generic Polar API exception.
-    class ApiError < Error; end
-    class ParameterError < ApiError; end
-
     class ValidationError < Error; end
 
     UNEXPECTED_EXPRESSION_MESSAGE = <<~MSG

data/lib/oso/polar/ffi/error.rb

@@ -54,8 +54,6 @@ module Oso
             runtime_error(subkind, msg: msg, details: details)
           when 'Operational'
             operational_error(subkind, msg: msg, details: details)
-          when 'Parameter'
-            api_error(subkind, msg: msg, details: details)
           when 'Validation'
             validation_error(msg, details: details)
           end
@@ -94,8 +92,6 @@ module Oso
         # @return [::Oso::Polar::PolarRuntimeError] the object converted into the expected format.
         private_class_method def self.runtime_error(kind, msg:, details:) # rubocop:disable Metrics/MethodLength
           case kind
-          when 'Serialization'
-            ::Oso::Polar::SerializationError.new(msg, details: details)
           when 'Unsupported'
             ::Oso::Polar::UnsupportedError.new(msg, details: details)
           when 'TypeError'
@@ -124,21 +120,6 @@ module Oso
           end
         end
 
-        # Map FFI API errors into Ruby exceptions.
-        #
-        # @param kind [String]
-        # @param msg [String]
-        # @param details [Hash<String, Object>]
-        # @return [::Oso::Polar::ApiError] the object converted into the expected format.
-        private_class_method def self.api_error(kind, msg:, details:)
-          case kind
-          when 'Parameter'
-            ::Oso::Polar::ParameterError.new(msg, details: details)
-          else
-            ::Oso::Polar::ApiError.new(msg, details: details)
-          end
-        end
-
         # Map FFI Validation errors into Ruby exceptions.
         #
         # @param msg [String]

data/lib/oso/polar/host.rb

@@ -67,12 +67,20 @@ module Oso
       public
 
       attr_writer :accept_expression
+      attr_accessor :build_query, :combine_query, :exec_query
+
+      DEFAULT_COMBINE_QUERY = proc { raise 'implement combine_query to use data filtering' }
+      DEFAULT_BUILD_QUERY = proc { raise 'implement build_query to use data filtering' }
+      DEFAULT_EXEC_QUERY = proc { raise 'implement exec_query to use data filtering' }
 
       def initialize(ffi_polar)
         @ffi_polar = ffi_polar
         @types = {}
         @instances = {}
         @accept_expression = false
+        @combine_query = DEFAULT_COMBINE_QUERY
+        @build_query = DEFAULT_BUILD_QUERY
+        @exec_query = DEFAULT_EXEC_QUERY
       end
 
       def initialize_copy(other)
@@ -107,9 +115,9 @@ module Oso
           klass: PolarClass.new(cls),
           id: cache_instance(cls),
           fields: fields || {},
-          combine_query: combine_query,
-          exec_query: exec_query,
-          build_query: build_query
+          combine_query: combine_query || self.combine_query,
+          exec_query: exec_query || self.exec_query,
+          build_query: build_query || self.build_query
         )
         name
       end

data/lib/oso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Oso
-  VERSION = '0.20.1'
+  VERSION = '0.23.0'
 end

data/lib/oso-oso.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative './oso'

data/lib/oso.rb

@@ -7,6 +7,9 @@ require 'oso/version'
 
 # Top-level namespace for Oso authorization library.
 module Oso
+  Relation = ::Oso::Polar::DataFiltering::Relation
+  Filter = ::Oso::Polar::DataFiltering::Filter
+
   def self.new(not_found_error: NotFoundError, forbidden_error: ForbiddenError, read_action: 'read')
     ::Oso::Oso.new(not_found_error: not_found_error, forbidden_error: forbidden_error, read_action: read_action)
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oso-oso
 version: !ruby/object:Gem::Version
-  version: 0.20.1
+  version: 0.23.0
 platform: ruby
 authors:
 - Oso Security, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-14 00:00:00.000000000 Z
+date: 2021-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -157,6 +157,7 @@ files:
 - ext/oso-oso/lib/libpolar.dylib
 - ext/oso-oso/lib/libpolar.so
 - ext/oso-oso/lib/polar.dll
+- lib/oso-oso.rb
 - lib/oso.rb
 - lib/oso/errors.rb
 - lib/oso/oso.rb