oso-oso 0.23.0 → 0.26.0

data/lib/oso/polar/ffi/polar.rb

@@ -6,7 +6,7 @@ module Oso
   module Polar
     module FFI
       # Wrapper class for Polar FFI pointer + operations.
-      class Polar < ::FFI::AutoPointer
+      class Polar < ::FFI::AutoPointer # rubocop:disable Metrics/ClassLength
         attr_accessor :enrich_message
 
         Rust = Module.new do
@@ -14,21 +14,28 @@ module Oso
           ffi_lib FFI::LIB_PATH
 
           attach_function :new, :polar_new, [], FFI::Polar
-          attach_function :load, :polar_load, [FFI::Polar, :string], :int32
-          attach_function :clear_rules, :polar_clear_rules, [FFI::Polar], :int32
+          attach_function :load, :polar_load, [FFI::Polar, :string], CResultVoid
+          attach_function :clear_rules, :polar_clear_rules, [FFI::Polar], CResultVoid
           attach_function :next_inline_query, :polar_next_inline_query, [FFI::Polar, :uint32], FFI::Query
           attach_function :new_id, :polar_get_external_id, [FFI::Polar], :uint64
-          attach_function :new_query_from_str, :polar_new_query, [FFI::Polar, :string, :uint32], FFI::Query
-          attach_function :new_query_from_term, :polar_new_query_from_term, [FFI::Polar, :string, :uint32], FFI::Query
-          attach_function :register_constant, :polar_register_constant, [FFI::Polar, :string, :string], :int32
-          attach_function :register_mro, :polar_register_mro, [FFI::Polar, :string, :string], :int32
-          attach_function :next_message, :polar_next_polar_message, [FFI::Polar], FFI::Message
+          attach_function :new_query_from_str, :polar_new_query, [FFI::Polar, :string, :uint32], CResultQuery
+          attach_function :new_query_from_term, :polar_new_query_from_term, [FFI::Polar, :string, :uint32], CResultQuery
+          attach_function :register_constant, :polar_register_constant, [FFI::Polar, :string, :string], CResultVoid
+          attach_function :register_mro, :polar_register_mro, [FFI::Polar, :string, :string], CResultVoid
+          attach_function :next_message, :polar_next_polar_message, [FFI::Polar], CResultString
           attach_function :free, :polar_free, [FFI::Polar], :int32
+          attach_function :result_free, :result_free, [:pointer], :int32
           attach_function(
             :build_filter_plan,
             :polar_build_filter_plan,
             [FFI::Polar, :string, :string, :string, :string],
-            :string
+            CResultString
+          )
+          attach_function(
+            :build_data_filter,
+            :polar_build_data_filter,
+            [FFI::Polar, :string, :string, :string, :string],
+            CResultString
           )
         end
         private_constant :Rust
@@ -36,10 +43,7 @@ module Oso
         # @return [FFI::Polar]
         # @raise [FFI::Error] if the FFI call returns an error.
         def self.create
-          polar = Rust.new
-          handle_error if polar.null?
-
-          polar
+          Rust.new
         end
 
         def build_filter_plan(types, partials, variable, class_tag)
@@ -47,9 +51,19 @@ module Oso
           partials = JSON.dump(partials)
           plan = Rust.build_filter_plan(self, types, partials, variable, class_tag)
           process_messages
-          handle_error if plan.nil?
+          plan = check_result plan
+          # TODO(gw) more error checking?
+          JSON.parse plan.to_s
+        end
+
+        def build_data_filter(types, partials, variable, class_tag)
+          types = JSON.dump(types)
+          partials = JSON.dump(partials)
+          plan = Rust.build_data_filter(self, types, partials, variable, class_tag)
+          process_messages
+          plan = check_result plan
           # TODO(gw) more error checking?
-          JSON.parse plan
+          JSON.parse plan.to_s
         end
 
         # @param sources [Array<Source>]
@@ -57,14 +71,14 @@ module Oso
         def load(sources)
           loaded = Rust.load(self, JSON.dump(sources))
           process_messages
-          handle_error if loaded.zero?
+          check_result loaded
         end
 
         # @raise [FFI::Error] if the FFI call returns an error.
         def clear_rules
           cleared = Rust.clear_rules(self)
           process_messages
-          handle_error if cleared.zero?
+          check_result cleared
         end
 
         # @return [FFI::Query] if there are remaining inline queries.
@@ -79,12 +93,7 @@ module Oso
         # @return [Integer]
         # @raise [FFI::Error] if the FFI call returns an error.
         def new_id
-          id = Rust.new_id(self)
-          # TODO(gj): I don't think this error check is correct. If getting a new ID fails on the
-          # Rust side, it'll probably surface as a panic (e.g., the KB lock is poisoned).
-          handle_error if id.zero?
-
-          id
+          Rust.new_id(self)
         end
 
         # @param str [String] Query string.
@@ -93,9 +102,7 @@ module Oso
         def new_query_from_str(str)
           query = Rust.new_query_from_str(self, str, 0)
           process_messages
-          handle_error if query.null?
-
-          query
+          check_result query
         end
 
         # @param term [Hash<String, Object>]
@@ -104,9 +111,7 @@ module Oso
         def new_query_from_term(term)
           query = Rust.new_query_from_term(self, JSON.dump(term), 0)
           process_messages
-          handle_error if query.null?
-
-          query
+          check_result query
         end
 
         # @param name [String]
@@ -114,7 +119,7 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def register_constant(value, name:)
           registered = Rust.register_constant(self, name, JSON.dump(value))
-          handle_error if registered.zero?
+          check_result registered
         end
 
         # @param name [String]
@@ -122,11 +127,24 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def register_mro(name, mro)
           registered = Rust.register_mro(self, name, JSON.dump(mro))
-          handle_error if registered.zero?
+          check_result registered
         end
 
         def next_message
-          Rust.next_message(self)
+          check_result Rust.next_message(self)
+        end
+
+        def process_message(message, enrich_message)
+          message = JSON.parse(message.to_s)
+          kind = message['kind']
+          msg = enrich_message.call(message['msg'])
+
+          case kind
+          when 'Print'
+            puts(msg)
+          when 'Warning'
+            warn(format('[warning] %<msg>s', msg: msg))
+          end
         end
 
         def process_messages
@@ -134,12 +152,19 @@ module Oso
             message = next_message
             break if message.null?
 
-            message.process(enrich_message)
+            process_message(message, enrich_message)
           end
         end
 
-        def handle_error
-          raise FFI::Error.get(enrich_message)
+        def check_result(res)
+          result = res[:result]
+          error = res[:error]
+          Rust.result_free(res)
+
+          raise 'internal error: both result and error pointers are not null' if !error.null? && !result.zero?
+          raise FFI::Error.get(error, enrich_message) unless error.null?
+
+          result
         end
       end
     end

data/lib/oso/polar/ffi/query.rb

@@ -13,15 +13,16 @@ module Oso
           extend ::FFI::Library
           ffi_lib FFI::LIB_PATH
 
-          attach_function :debug_command, :polar_debug_command, [FFI::Query, :string], :int32
-          attach_function :call_result, :polar_call_result, [FFI::Query, :uint64, :string], :int32
-          attach_function :question_result, :polar_question_result, [FFI::Query, :uint64, :int32], :int32
-          attach_function :application_error, :polar_application_error, [FFI::Query, :string], :int32
-          attach_function :next_event, :polar_next_query_event, [FFI::Query], FFI::QueryEvent
-          attach_function :next_message, :polar_next_query_message, [FFI::Query], FFI::Message
-          attach_function :source, :polar_query_source_info, [FFI::Query], FFI::Source
+          attach_function :debug_command, :polar_debug_command, [FFI::Query, :string], CResultVoid
+          attach_function :call_result, :polar_call_result, [FFI::Query, :uint64, :string], CResultVoid
+          attach_function :question_result, :polar_question_result, [FFI::Query, :uint64, :int32], CResultVoid
+          attach_function :application_error, :polar_application_error, [FFI::Query, :string], CResultVoid
+          attach_function :next_event, :polar_next_query_event, [FFI::Query], CResultString
+          attach_function :next_message, :polar_next_query_message, [FFI::Query], CResultString
+          attach_function :source, :polar_query_source_info, [FFI::Query], CResultString
           attach_function :free, :query_free, [FFI::Query], :int32
-          attach_function :bind, :polar_bind, [FFI::Query, :string, :string], :int32
+          attach_function :result_free, :result_free, [:pointer], :int32
+          attach_function :bind, :polar_bind, [FFI::Query, :string, :string], CResultVoid
         end
         private_constant :Rust
 
@@ -30,15 +31,15 @@ module Oso
         def debug_command(cmd)
           res = Rust.debug_command(self, cmd)
           process_messages
-          handle_error if res.zero?
+          check_result res
         end
 
-        # @param result [String]
+        # @param value [Object]
         # @param call_id [Integer]
         # @raise [FFI::Error] if the FFI call returns an error.
-        def call_result(result, call_id:)
-          res = Rust.call_result(self, call_id, result)
-          handle_error if res.zero?
+        def call_result(value, call_id:)
+          res = Rust.call_result(self, call_id, JSON.dump(value))
+          check_result res
         end
 
         # @param result [Boolean]
@@ -47,14 +48,14 @@ module Oso
         def question_result(result, call_id:)
           result = result ? 1 : 0
           res = Rust.question_result(self, call_id, result)
-          handle_error if res.zero?
+          check_result res
         end
 
         # @param message [String]
         # @raise [FFI::Error] if the FFI call returns an error.
         def application_error(message)
           res = Rust.application_error(self, message)
-          handle_error if res.zero?
+          check_result res
         end
 
         # @return [::Oso::Polar::QueryEvent]
@@ -62,18 +63,32 @@ module Oso
         def next_event
           event = Rust.next_event(self)
           process_messages
-          handle_error if event.null?
+          event = check_result event
 
           ::Oso::Polar::QueryEvent.new(JSON.parse(event.to_s))
         end
 
         def bind(name, value)
           res = Rust.bind(self, name, JSON.dump(value))
-          handle_error if res.zero?
+          check_result res
         end
 
         def next_message
-          Rust.next_message(self)
+          check_result Rust.next_message(self)
+        end
+
+        def process_message(message, enrich_message)
+          message = JSON.parse(message.to_s)
+          kind = message['kind']
+          msg = message['msg']
+          msg = enrich_message.call(msg)
+
+          case kind
+          when 'Print'
+            puts(msg)
+          when 'Warning'
+            warn(format('[warning] %<msg>s', msg: msg))
+          end
         end
 
         def process_messages
@@ -81,7 +96,7 @@ module Oso
             message = next_message
             break if message.null?
 
-            message.process(enrich_message)
+            process_message(message, enrich_message)
           end
         end
 
@@ -89,13 +104,24 @@ module Oso
         # @raise [FFI::Error] if the FFI call returns an error.
         def source
           res = Rust.source(self)
-          handle_error if res.null?
+          res = check_result res
 
           res.to_s
         end
 
-        def handle_error
-          raise FFI::Error.get(enrich_message)
+        # Unwrap the result by (a) extracting the pointers for
+        # result and error, (b) freeing the result pointers, and then
+        # (c) either returning the result pointer, or constructing and
+        # raising the error.
+        def check_result(res)
+          result = res[:result]
+          error = res[:error]
+          Rust.result_free(res)
+
+          raise 'internal error: both result and error pointers are not null' if !error.null? && !result.zero?
+          raise FFI::Error.get(error, enrich_message) unless error.null?
+
+          result
         end
       end
     end

data/lib/oso/polar/ffi/{source.rb → rust_string.rb}

@@ -1,10 +1,16 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module Oso
   module Polar
     module FFI
-      # Wrapper class for Source FFI pointer.
-      class Source < ::FFI::AutoPointer
+      # Wrapper class for Rust strings.
+      #
+      # Since we force all strings to go through this
+      # the `AutoPointer` class will handle
+      # actually freeing the string when deleting it
+      class RustString < ::FFI::AutoPointer
         # @return [String]
         def to_s
           @to_s ||= read_string.force_encoding('UTF-8')
@@ -14,7 +20,7 @@ module Oso
           extend ::FFI::Library
           ffi_lib FFI::LIB_PATH
 
-          attach_function :free, :string_free, [Message], :int32
+          attach_function :free, :string_free, [RustString], :int32
         end
 
         private_constant :Rust

data/lib/oso/polar/ffi.rb

@@ -4,6 +4,7 @@ require 'ffi'
 
 module Oso
   module Polar
+    # FFI classes shared between all ffi/*.rb modules
     module FFI
       LIB = "#{::FFI::Platform::LIBPREFIX}polar.#{::FFI::Platform::LIBSUFFIX}"
       RELEASE_PATH = File.expand_path(File.join(__dir__, "../../../ext/oso-oso/lib/#{LIB}"))
@@ -18,41 +19,50 @@ module Oso
 
       # Wrapper class for Polar FFI pointer + operations.
       class Polar < ::FFI::AutoPointer
+        def zero?
+          null?
+        end
+
         def self.release(ptr)
           Rust.free(ptr) unless ptr.null?
         end
       end
       # Wrapper class for Query FFI pointer + operations.
       class Query < ::FFI::AutoPointer
-        def self.release(ptr)
-          Rust.free(ptr) unless ptr.null?
+        def zero?
+          null?
         end
-      end
-      # Wrapper class for QueryEvent FFI pointer + operations.
-      class QueryEvent < ::FFI::AutoPointer
+
         def self.release(ptr)
           Rust.free(ptr) unless ptr.null?
         end
       end
-      # Wrapper class for Error FFI pointer + operations.
-      class Error < ::FFI::AutoPointer
-        def self.release(ptr)
-          Rust.free(ptr) unless ptr.null?
+
+      # Wrapper class for Rust strings FFI pointer + operations.
+      class RustString < ::FFI::AutoPointer
+        def zero?
+          null?
         end
-      end
-      # Wrapper class for Message FFI pointer + operations.
-      class Message < ::FFI::AutoPointer
+
         def self.release(ptr)
           Rust.free(ptr) unless ptr.null?
         end
       end
 
-      # Wrapper class for Source FFI pointer.
-      class Source < ::FFI::AutoPointer
-        def self.release(ptr)
-          Rust.free(ptr) unless ptr.null?
-        end
+      # Helper method to generate a Result type for different
+      # inner types
+      def self.result(result_klass)
+        Class.new(::FFI::Struct) do
+          layout :result, result_klass, :error, RustString
+        end.by_ref
       end
+
+      # Defines the result type version of
+      # each of these structs
+      # result(T) => { result: T, error: string }
+      CResultVoid = result(:int)
+      CResultString = result(RustString)
+      CResultQuery = result(Query)
     end
     private_constant :FFI
   end
@@ -60,7 +70,5 @@ end
 
 require 'oso/polar/ffi/polar'
 require 'oso/polar/ffi/query'
-require 'oso/polar/ffi/query_event'
 require 'oso/polar/ffi/error'
-require 'oso/polar/ffi/message'
-require 'oso/polar/ffi/source'
+require 'oso/polar/ffi/rust_string'

data/lib/oso/polar/host.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'data'
+
 module Oso
   module Polar
     # Ruby code reloaders (i.e. the one used by rails) swap out the value of
@@ -67,7 +69,7 @@ module Oso
       public
 
       attr_writer :accept_expression
-      attr_accessor :build_query, :combine_query, :exec_query
+      attr_accessor :build_query, :combine_query, :exec_query, :adapter
 
       DEFAULT_COMBINE_QUERY = proc { raise 'implement combine_query to use data filtering' }
       DEFAULT_BUILD_QUERY = proc { raise 'implement build_query to use data filtering' }
@@ -95,9 +97,10 @@ module Oso
       # @return [Class]
       # @raise [UnregisteredClassError] if the class has not been registered.
       def get_class(name)
-        raise UnregisteredClassError, name unless types.key? name
+        typ = types[name]
+        raise UnregisteredClassError, name if typ.nil?
 
-        types[name].klass.get
+        typ.klass.get
       end
 
       # Store a Ruby class in the {#types} cache.
@@ -316,8 +319,26 @@ module Oso
                   end
                 else
                   instance_id = nil
-                  instance_id = types[value].id if value.is_a?(Class) && types.key?(value)
-                  { 'ExternalInstance' => { 'instance_id' => cache_instance(value, id: instance_id), 'repr' => nil } }
+                  class_id = nil
+                  class_repr = nil
+                  # id=class_id,
+
+                  # pass `class_id` & `class_repr` for registered types
+                  if value.is_a?(Class) && types.key?(value)
+                    instance_id = class_id = types[value].id
+                  elsif types.key?(value.class)
+                    class_id = types[value.class].id
+                    class_repr = types[value.class].name
+                  end
+
+                  {
+                    'ExternalInstance' => {
+                      'instance_id' => cache_instance(value, id: instance_id),
+                      'repr' => nil,
+                      'class_repr' => class_repr,
+                      'class_id' => class_id
+                    }
+                  }
                 end
         { 'value' => value }
       end
@@ -337,21 +358,25 @@ module Oso
           value
         when 'Number'
           num = value.values.first
-          if value.key? 'Float'
+          case value.keys.first
+          when 'Float'
             case num
             when 'Infinity'
-              return Float::INFINITY
+              Float::INFINITY
             when '-Infinity'
-              return -Float::INFINITY
+              -Float::INFINITY
             when 'NaN'
-              return Float::NAN
+              Float::NAN
             else
               unless value['Float'].is_a? Float # rubocop:disable Metrics/BlockNesting
                 raise PolarRuntimeError, "Expected a floating point number, got \"#{value['Float']}\""
               end
+
+              num
             end
+          else
+            num
           end
-          num
         when 'List'
           value.map { |el| to_ruby(el) }
         when 'Dictionary'

data/lib/oso/polar/polar.rb

@@ -84,20 +84,8 @@ module Oso
         @ffi_polar
       end
 
-      # get the (maybe user-supplied) name of a class.
-      # kind of a hack because of class autoreloading.
-      def get_class_name(klass) # rubocop:disable Metrics/AbcSize
-        if host.types.key? klass
-          host.types[klass].name
-        elsif host.types.key? klass.name
-          host.types[klass.name].name
-        else
-          rec = host.types.values.find { |v| v.klass.get == klass }
-          raise "Unknown class `#{klass}`" if rec.nil?
-
-          host.types[klass] = rec
-          rec.name
-        end
+      def name_to_class(class_name)
+        host.types[class_name].klass.get
       end
 
       # Clear all rules and rule sources from the current Polar instance
@@ -229,6 +217,7 @@ module Oso
           exec_query: exec_query || maybe_mtd(cls, :exec_query)
         )
         register_constant(cls, name: name)
+        host.register_mros
       end
 
       # Register a Ruby object with Polar.
@@ -259,10 +248,82 @@ module Oso
 
       private
 
+      # new/old data filtering core API shared logic
+      def partial_query(actor, action, resource_cls) # rubocop:disable Metrics/MethodLength
+        var_name = 'resource'
+        resource = Variable.new var_name
+
+        partials = query_rule(
+          'allow',
+          actor,
+          action,
+          resource,
+          bindings: { var_name => type_constraint(resource, resource_cls) },
+          accept_expression: true
+        )
+
+        partials.each_with_object([]) do |result, out|
+          result.each do |key, val|
+            out.push prefilter_isas(key, val)
+          end
+        end
+      end
+
+      def new_authorized_query(actor, action, resource_class)
+        partials = partial_query(actor, action, resource_class)
+        types = host.serialize_types
+        class_name = class_to_name resource_class
+        plan = ffi.build_data_filter(types, partials, 'resource', class_name)
+        filter = ::Oso::Polar::Data::Filter.parse(self, plan)
+        host.adapter.build_query filter
+      end
+
+      # handle Isa constraints in a partial query
+      def prefilter_isas(key, val) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        # this will usually be the case! sometimes not, if it's an instance.
+        if val.is_a?(Expression) && val.operator == 'And'
+          # get the isas
+          isas, othas = val.args.partition do |expr|
+            expr.operator == 'Isa' &&
+              expr.args[1].is_a?(Pattern) &&
+              expr.args[1].fields.empty?
+          end
+
+          # drop all the isas we can verify now, keep everything else
+          othas += isas.reject do |isa|
+            isa.args[0].is_a? name_to_class isa.args[1].tag
+          end
+
+          # TODO(gw) check the rest of them instead of just adding them?
+          val.args = othas
+        end
+        val = host.to_polar val
+        { 'bindings' => { key => val } }
+      end
+
+      # get the (maybe user-supplied) name of a class.
+      # kind of a hack because of class autoreloading.
+      def class_to_name(klass) # rubocop:disable Metrics/AbcSize
+        if (rec = host.types[klass]) || (rec = host.types[klass.name])
+          rec.name
+        elsif (rec = host.types.values.find { |v| v.klass.get == klass })
+          host.types[klass] = rec
+          rec.name
+        else
+          raise NameError, "Unknown class `#{klass}`"
+        end
+      end
+
+      def try_class_to_name(klass)
+        class_to_name klass
+      rescue NameError
+        nil
+      end
+
       def type_constraint(var, cls)
         Expression.new(
           'And',
-          [Expression.new('Isa', [var, Pattern.new(get_class_name(cls), {})])]
+          [Expression.new('Isa', [var, Pattern.new(class_to_name(cls), {})])]
         )
       end
 
@@ -276,7 +337,6 @@ module Oso
       # Register MROs, load Polar code, and check inline queries.
       # @param sources [Array<Source>] Polar sources to load.
       def load_sources(sources)
-        host.register_mros
         ffi_polar.load(sources)
         check_inline_queries
       end