oso-oso 0.5.2 → 0.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: eb279f6dd2c9ea6d862b47f1e6cc109bab429d19
-  data.tar.gz: 8c998ace146905bfb32574fe7d233fa0cb69e240
+  metadata.gz: 58af2c75ff3f419ca9c411e3863fcc4523c2c0ca
+  data.tar.gz: 13b0ded3710700f1a228c44b334dcfca6589f840
 SHA512:
-  metadata.gz: 1bd787012da6991d59d14877111b4022bc8855d16e3556faf859eaa1e09dcb41cb0e6d91d6d7e52faba7cf2c0a8b7993a784553221afcb6fa9dc7633ea40ec1b
-  data.tar.gz: c26f0285df44ac39e6f10717f0ca5143cf32ca1193133ce1a977885688fe72f0665de74d0c13cbc0d3ab71f4f85aa6fd39719b0872ebc4e738c25aa798fd6887
+  metadata.gz: 7eb4566dd1f0c680c3ed59f88149fd44aa10e557d1bfac4a55d0a6381f8fdeaf7d78287e11d1380d07bd739edaa487374728b36f24e669a98a91651599c9436f
+  data.tar.gz: d0c6366a3166665055cbc23e7b510fafa9a179ef534bc773cd23327c3c6d153e7b70120c25671670d2d30602f736a7f5708e21b205c88209044ebb256985b945

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    oso-oso (0.5.2)
+    oso-oso (0.8.1)
       ffi (~> 1.0)
 
 GEM

data/lib/oso/polar/errors.rb

@@ -32,11 +32,13 @@ module Oso
     # Errors originating from this side of the FFI boundary.
 
     class UnregisteredClassError < PolarRuntimeError; end
-    class MissingConstructorError < PolarRuntimeError; end
     class UnregisteredInstanceError < PolarRuntimeError; end
     class DuplicateInstanceRegistrationError < PolarRuntimeError; end
+
+    # TODO: I think this should probably have some arguments to say what the call is
     class InvalidCallError < PolarRuntimeError; end
     class InvalidConstructorError < PolarRuntimeError; end
+    class InvalidIteratorError < PolarRuntimeError; end
     class InvalidQueryTypeError < PolarRuntimeError; end
     class NullByteInPolarFileError < PolarRuntimeError; end
     class UnexpectedPolarTypeError < PolarRuntimeError; end
@@ -66,6 +68,12 @@ module Oso
       end
     end
 
+    class UnimplementedOperationError < PolarRuntimeError # rubocop:disable Style/Documentation
+      def initialize(operation)
+        super("#{operation} are unimplemented in the oso Ruby library")
+      end
+    end
+
     # Generic operational exception.
     class OperationalError < Error; end
     class UnknownError < OperationalError; end

data/lib/oso/polar/ffi/error.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module Oso
   module Polar
     module FFI

data/lib/oso/polar/ffi/message.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module Oso
   module Polar
     module FFI

data/lib/oso/polar/ffi/polar.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module Oso
   module Polar
     module FFI
@@ -11,6 +13,7 @@ module Oso
 
           attach_function :new, :polar_new, [], FFI::Polar
           attach_function :load, :polar_load, [FFI::Polar, :string, :string], :int32
+          attach_function :clear_rules, :polar_clear_rules, [FFI::Polar], :int32
           attach_function :next_inline_query, :polar_next_inline_query, [FFI::Polar, :uint32], FFI::Query
           attach_function :new_id, :polar_get_external_id, [FFI::Polar], :uint64
           attach_function :new_query_from_str, :polar_new_query, [FFI::Polar, :string, :uint32], FFI::Query
@@ -39,6 +42,13 @@ module Oso
           raise FFI::Error.get if loaded.zero?
         end
 
+        # @raise [FFI::Error] if the FFI call returns an error.
+        def clear_rules
+          cleared = Rust.clear_rules(self)
+          process_messages
+          raise FFI::Error.get if cleared.zero?
+        end
+
         # @return [FFI::Query] if there are remaining inline queries.
         # @return [nil] if there are no remaining inline queries.
         # @raise [FFI::Error] if the FFI call returns an error.
@@ -84,7 +94,7 @@ module Oso
         # @param name [String]
         # @param value [Hash<String, Object>]
         # @raise [FFI::Error] if the FFI call returns an error.
-        def register_constant(name, value:)
+        def register_constant(value, name:)
           registered = Rust.register_constant(self, name, JSON.dump(value))
           raise FFI::Error.get if registered.zero?
         end

data/lib/oso/polar/ffi/query.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module Oso
   module Polar
     module FFI

data/lib/oso/polar/host.rb

@@ -10,8 +10,6 @@ module Oso
       attr_reader :ffi_polar
       # @return [Hash<String, Class>]
       attr_reader :classes
-      # @return [Hash<String, Object>]
-      attr_reader :constructors
       # @return [Hash<Integer, Object>]
       attr_reader :instances
 
@@ -20,14 +18,12 @@ module Oso
       def initialize(ffi_polar)
         @ffi_polar = ffi_polar
         @classes = {}
-        @constructors = {}
         @instances = {}
       end
 
       def initialize_copy(other)
         @ffi_polar = other.ffi_polar
         @classes = other.classes.dup
-        @constructors = other.constructors.dup
         @instances = other.instances.dup
       end
 
@@ -44,38 +40,18 @@ module Oso
 
       # Store a Ruby class in the {#classes} cache.
       #
-      # @param cls [Class] the class to cache
-      # @param name [String] the name to cache the class as. Defaults to the name of the class.
-      # @param constructor [Proc] optional custom constructor function. Defaults to the :new method.
+      # @param cls [Class] the class to cache.
+      # @param name [String] the name to cache the class as.
       # @return [String] the name the class is cached as.
-      # @raise [UnregisteredClassError] if the class has not been registered.
-      def cache_class(cls, name:, constructor:) # rubocop:disable Metrics/MethodLength
-        name = cls.name if name.nil?
+      # @raise [DuplicateClassAliasError] if attempting to register a class
+      # under a previously-registered name.
+      def cache_class(cls, name:)
         raise DuplicateClassAliasError, name: name, old: get_class(name), new: cls if classes.key? name
 
         classes[name] = cls
-        if constructor.nil?
-          constructors[name] = :new
-        elsif constructor.respond_to? :call
-          constructors[name] = constructor
-        else
-          raise InvalidConstructorError
-        end
         name
       end
 
-      # Fetch a constructor from the {#constructors} cache.
-      #
-      # @param name [String]
-      # @return [Symbol] if constructor is the default of `:new`.
-      # @return [Proc] if a custom constructor was registered.
-      # @raise [UnregisteredConstructorError] if the constructor has not been registered.
-      def get_constructor(name)
-        raise MissingConstructorError, name unless constructors.key? name
-
-        constructors[name]
-      end
-
       # Check if an instance exists in the {#instances} cache.
       #
       # @param id [Integer]
@@ -100,12 +76,12 @@ module Oso
         instances[id]
       end
 
-      # Cache a Ruby instance in the {#instances} cache, fetching a {#new_id}
-      # if one isn't provided.
+      # Cache a Ruby instance in the {#instances} cache, fetching a new id if
+      # one isn't provided.
       #
       # @param instance [Object]
-      # @param id [Integer]
-      # @return [Integer]
+      # @param id [Integer] the instance ID. Generated via FFI if not provided.
+      # @return [Integer] the instance ID.
       def cache_instance(instance, id: nil)
         id = ffi_polar.new_id if id.nil?
         instances[id] = instance
@@ -114,23 +90,17 @@ module Oso
 
       # Construct and cache a Ruby instance.
       #
-      # @param cls_name [String]
-      # @param args [Array<Object>]
-      # @param kwargs [Hash<String, Object>]
-      # @param id [Integer]
+      # @param cls_name [String] name of the instance's class.
+      # @param args [Array<Object>] positional args to the constructor.
+      # @param kwargs [Hash<String, Object>] keyword args to the constructor.
+      # @param id [Integer] the instance ID.
       # @raise [PolarRuntimeError] if instance construction fails.
-      def make_instance(cls_name, args:, kwargs:, id:) # rubocop:disable Metrics/MethodLength
-        constructor = get_constructor(cls_name)
-        instance = if constructor == :new
-                     if kwargs.empty?
-                       get_class(cls_name).__send__(:new, *args)
-                     else
-                       get_class(cls_name).__send__(:new, *args, **kwargs)
-                     end
-                   elsif kwargs.empty?
-                     constructor.call(*args)
+      # @return [Integer] the instance ID.
+      def make_instance(cls_name, args:, kwargs:, id:)
+        instance = if kwargs.empty? # This check is for Ruby < 2.7.
+                     get_class(cls_name).__send__(:new, *args)
                    else
-                     constructor.call(*args, **kwargs)
+                     get_class(cls_name).__send__(:new, *args, **kwargs)
                    end
         cache_instance(instance, id: id)
       rescue StandardError => e
@@ -146,9 +116,9 @@ module Oso
       # @return [Boolean]
       def subspecializer?(instance_id, left_tag:, right_tag:)
         mro = get_instance(instance_id).class.ancestors
-        mro.index(get_class(left_tag)) < mro.index(get_class(right_tag))
-      rescue StandardError
-        false
+        left_index = mro.index(get_class(left_tag))
+        right_index = mro.index(get_class(right_tag))
+        left_index && right_index && left_index < right_index
       end
 
       # Check if instance is an instance of class.
@@ -160,8 +130,6 @@ module Oso
         instance = to_ruby(instance)
         cls = get_class(class_tag)
         instance.is_a? cls
-      rescue PolarRuntimeError
-        false
       end
 
       # Check if two instances unify
@@ -173,8 +141,6 @@ module Oso
         left_instance = get_instance(left_instance_id)
         right_instance = get_instance(right_instance_id)
         left_instance == right_instance
-      rescue PolarRuntimeError
-        false
       end
 
       # Turn a Ruby value into a Polar term that's ready to be sent across the

data/lib/oso/polar/polar.rb

@@ -1,10 +1,5 @@
 # frozen_string_literal: true
 
-require 'json'
-require 'pp'
-require 'set'
-require 'digest/md5'
-
 # Missing Ruby type.
 module PolarBoolean; end
 # Monkey-patch Ruby true type.
@@ -43,6 +38,9 @@ module Oso
         @ffi_polar = FFI::Polar.create
         @host = Host.new(ffi_polar)
 
+        # Register global constants.
+        register_constant nil, name: 'nil'
+
         # Register built-in classes.
         register_class PolarBoolean, name: 'Boolean'
         register_class Integer
@@ -52,9 +50,12 @@ module Oso
         register_class String
       end
 
-      # Replace the current Polar instance but retain all registered classes and constructors.
-      def clear
-        @ffi_polar = FFI::Polar.create
+      # Clear all rules and rule sources from the current Polar instance
+      #
+      # @return [self] for chaining.
+      def clear_rules
+        ffi_polar.clear_rules
+        self
       end
 
       # Load a Polar policy file.
@@ -62,6 +63,7 @@ module Oso
       # @param name [String]
       # @raise [PolarFileExtensionError] if provided filename has invalid extension.
       # @raise [PolarFileNotFoundError] if provided filename does not exist.
+      # @return [self] for chaining.
       def load_file(name)
         raise PolarFileExtensionError, name unless File.extname(name) == '.polar'
 
@@ -78,6 +80,7 @@ module Oso
       # @raise [NullByteInPolarFileError] if str includes a non-terminating null byte.
       # @raise [InlineQueryFailedError] on the first failed inline query.
       # @raise [Error] if any of the FFI calls raise one.
+      # @return [self] for chaining.
       def load_str(str, filename: nil) # rubocop:disable Metrics/MethodLength
         raise NullByteInPolarFileError if str.chomp("\0").include?("\0")
 
@@ -92,6 +95,7 @@ module Oso
             raise InlineQueryFailedError, next_query.source
           end
         end
+        self
       end
 
       # Query for a Polar predicate or string.
@@ -129,18 +133,26 @@ module Oso
 
       # Register a Ruby class with Polar.
       #
-      # @param cls [Class]
-      # @param name [String]
-      # @param from_polar [Proc]
-      # @raise [InvalidConstructorError] if provided an invalid 'from_polar' constructor.
-      def register_class(cls, name: nil, from_polar: nil)
-        from_polar = Proc.new if block_given?
-        name = host.cache_class(cls, name: name, constructor: from_polar)
-        register_constant(name, value: cls)
+      # @param cls [Class] the class to register.
+      # @param name [String] the name to register the class as. Defaults to the name of the class.
+      # @raise [DuplicateClassAliasError] if attempting to register a class
+      # under a previously-registered name.
+      # @raise [FFI::Error] if the FFI call returns an error.
+      # @return [self] for chaining.
+      def register_class(cls, name: nil)
+        name = host.cache_class(cls, name: name || cls.name)
+        register_constant(cls, name: name)
       end
 
-      def register_constant(name, value:)
-        ffi_polar.register_constant(name, value: host.to_polar(value))
+      # Register a Ruby object with Polar.
+      #
+      # @param value [Object] the object to register.
+      # @param name [String] the name to register the object as.
+      # @return [self] for chaining.
+      # @raise [FFI::Error] if the FFI call returns an error.
+      def register_constant(value, name:)
+        ffi_polar.register_constant(host.to_polar(value), name: name)
+        self
       end
 
       # Start a REPL session.
@@ -162,10 +174,6 @@ module Oso
 
       # @return [FFI::Polar]
       attr_reader :ffi_polar
-      # @return [Hash<String, String>]
-      attr_reader :loaded_names
-      # @return [Hash<String, String>]
-      attr_reader :loaded_contents
 
       # The R and L in REPL for systems where readline is available.
       def repl_readline(prompt)

data/lib/oso/polar/query.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module Oso
   module Polar
     # A single Polar query.
@@ -34,31 +36,6 @@ module Oso
         ffi_query.question_result(result, call_id: call_id)
       end
 
-      # Register a Ruby method call, wrapping the call result in a generator if
-      # it isn't already one.
-      #
-      # @param method [#to_sym]
-      # @param call_id [Integer]
-      # @param instance [Hash<String, Object>]
-      # @param args [Array<Hash>]
-      # @raise [InvalidCallError] if the method doesn't exist on the instance or
-      #   the args passed to the method are invalid.
-      def register_call(attribute, call_id:, instance:, args:) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
-        return if calls.key?(call_id)
-
-        instance = host.to_ruby(instance)
-        if args.nil?
-          result = instance.__send__(attribute)
-        else
-          args = args.map { |a| host.to_ruby(a) }
-          result = instance.__send__(attribute, *args)
-        end
-        result = [result].to_enum unless result.is_a? Enumerator # Call must be a generator.
-        calls[call_id] = result.lazy
-      rescue ArgumentError, NoMethodError
-        raise InvalidCallError
-      end
-
       # Send next result of Ruby method call across FFI boundary.
       #
       # @param result [String]
@@ -93,39 +70,48 @@ module Oso
       # @param call_id [Integer]
       # @param instance [Hash<String, Object>]
       # @raise [Error] if the FFI call raises one.
-      def handle_call(attribute, call_id:, instance:, args:)
-        register_call(attribute, call_id: call_id, instance: instance, args: args)
-        result = JSON.dump(next_call_result(call_id))
+      def handle_call(attribute, call_id:, instance:, args:, kwargs:) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        instance = host.to_ruby(instance)
+        args = args.map { |a| host.to_ruby(a) }
+        kwargs = Hash[kwargs.map { |k, v| [k.to_sym, host.to_ruby(v)] }]
+        # The kwargs.empty? check is for Ruby < 2.7.
+        result = if kwargs.empty?
+                   instance.__send__(attribute, *args)
+                 else
+                   instance.__send__(attribute, *args, **kwargs)
+                 end
+        result = JSON.dump(host.to_polar(result))
         call_result(result, call_id: call_id)
-      rescue InvalidCallError => e
+      rescue ArgumentError, NoMethodError => e
         application_error(e.message)
         call_result(nil, call_id: call_id)
+      end
+
+      def handle_next_external(call_id, iterable)
+        unless calls.key? call_id
+          value = host.to_ruby iterable
+          raise InvalidIteratorError unless value.is_a? Enumerable
+
+          calls[call_id] = value.lazy
+        end
+
+        result = JSON.dump(next_call_result(call_id))
+        call_result(result, call_id: call_id)
       rescue StopIteration
         call_result(nil, call_id: call_id)
       end
 
-      def handle_make_external(data) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity
+      def handle_make_external(data) # rubocop:disable Metrics/AbcSize
         id = data['instance_id']
         raise DuplicateInstanceRegistrationError, id if host.instance? id
 
         constructor = data['constructor']['value']
-        if constructor.key? 'InstanceLiteral'
-          cls_name = constructor['InstanceLiteral']['tag']
-          fields = constructor['InstanceLiteral']['fields']['fields']
-          kwargs = Hash[fields.map { |k, v| [k.to_sym, host.to_ruby(v)] }]
-          args = []
-        elsif constructor.key? 'Call'
-          cls_name = constructor['Call']['name']
-          args = constructor['Call']['args'].map { |arg| host.to_ruby(arg) }
-          kwargs = constructor['Call']['kwargs']
-          kwargs = if kwargs.nil?
-                     {}
-                   else
-                     Hash[kwargs.map { |k, v| [k.to_sym, host.to_ruby(v)] }]
-                   end
-        else
-          raise InvalidConstructorError
-        end
+        raise InvalidConstructorError unless constructor.key? 'Call'
+
+        cls_name = constructor['Call']['name']
+        args = constructor['Call']['args'].map { |arg| host.to_ruby(arg) }
+        kwargs = constructor['Call']['kwargs'] || {}
+        kwargs = Hash[kwargs.map { |k, v| [k.to_sym, host.to_ruby(v)] }]
         host.make_instance(cls_name, args: args, kwargs: kwargs, id: id)
       end
 
@@ -134,7 +120,7 @@ module Oso
       # @yieldparam [Hash<String, Object>]
       # @return [Enumerator]
       # @raise [Error] if any of the FFI calls raise one.
-      def start # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength
+      def start # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
         Enumerator.new do |yielder| # rubocop:disable Metrics/BlockLength
           loop do # rubocop:disable Metrics/BlockLength
             event = ffi_query.next_event
@@ -149,8 +135,9 @@ module Oso
               call_id = event.data['call_id']
               instance = event.data['instance']
               attribute = event.data['attribute']
-              args = event.data['args']
-              handle_call(attribute, call_id: call_id, instance: instance, args: args)
+              args = event.data['args'] || []
+              kwargs = event.data['kwargs'] || {}
+              handle_call(attribute, call_id: call_id, instance: instance, args: args, kwargs: kwargs)
             when 'ExternalIsSubSpecializer'
               instance_id = event.data['instance_id']
               left_tag = event.data['left_class_tag']
@@ -177,6 +164,12 @@ module Oso
               end
               command = JSON.dump(host.to_polar(input))
               ffi_query.debug_command(command)
+            when 'ExternalOp'
+              raise UnimplementedOperationError, 'comparison operators'
+            when 'NextExternal'
+              call_id = event.data['call_id']
+              iterable = event.data['iterable']
+              handle_next_external(call_id, iterable)
             else
               raise "Unhandled event: #{JSON.dump(event.inspect)}"
             end

data/lib/oso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Oso
-  VERSION = '0.5.2'
+  VERSION = '0.8.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oso-oso
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.8.1
 platform: ruby
 authors:
 - Oso Security, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-09 00:00:00.000000000 Z
+date: 2020-11-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi