oso-oso 0.21.0 → 0.22.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a9fbbff1209cf44803895d162562cb6d9c8a4c37
-  data.tar.gz: 8196f85296430d4c85a283bfec132c05a86e1433
+  metadata.gz: 328999aba2d62f777db79b812e762b2546e49a80
+  data.tar.gz: ad1803fa38712d1272d494300dafbab11d4e322a
 SHA512:
-  metadata.gz: 2d49aec9759922b92b874f981709a57b6c04afc1b30762302c6020a37bde144d0b56b0343482f7f18ed96f3c3d298a0e493967fbbf8939fb91cc7dc493417e54
-  data.tar.gz: 867123b379ef0ff554f9c433d317826e6b6e3b84a26008fe97e56f83d588737064ba71b61f4c5848969b7c6f6a0fd2cef9e8a488f238a86a152dcef7b452844e
+  metadata.gz: 2706c6fd40a1fe5e33e2b48fddfb4814031b75f5c62e7bb832b2ecc2707e3111d6b6cfa749863743b4c3424d90daca69dc5662d1fd83577b2fb95656eb3c54a4
+  data.tar.gz: e274ad60e2dcaed817e46f38f55362b87bad70f6d67b3cdaad838762459d0172e9e37cf6aa23e4256536bb6e807c54aefce8b97f817cbbad4b68d1ab097cf5a2

data/.gitignore

@@ -7,7 +7,7 @@
 /spec/reports/
 /tmp/
 vendor
-active_record_test.db
+*test.db
 
 # rspec failure tracking
 .rspec_status

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    oso-oso (0.21.0)
+    oso-oso (0.22.0)
       ffi (~> 1.0)
 
 GEM

data/lib/oso/oso.rb

@@ -218,5 +218,15 @@ module Oso
 
       host.types[get_class_name resource_cls].exec_query[q]
     end
+
+    # Register default values for data filtering query functions.
+    # These can be overridden by passing specific implementations to
+    # `register_class` or by defining `build_query`, `exec_query` and
+    # `combine_query` methods on the class object.
+    def set_data_filtering_query_defaults(build_query: nil, exec_query: nil, combine_query: nil)
+      host.build_query = build_query if build_query
+      host.exec_query = exec_query if exec_query
+      host.combine_query = combine_query if combine_query
+    end
   end
 end

data/lib/oso/polar/data_filtering.rb

@@ -4,6 +4,7 @@ module Oso
   module Polar
     # Data filtering interface for Ruby
     module DataFiltering
+      GETATTR = ->(x, attr) { attr.nil? ? x : x.send(attr) }
       # Represents a set of filter sequences that should allow the host
       # to obtain the records satisfying a query.
       class FilterPlan
@@ -29,7 +30,7 @@ module Oso
           result_sets.each_with_object([]) do |rs, qb|
             rs.resolve_order.each_with_object({}) do |i, set_results|
               req = rs.requests[i]
-              cs = req.constraints.each { |c| c.ground set_results }
+              cs = req.ground(set_results)
               typ = @polar.host.types[req.class_tag]
               q = typ.build_query[cs]
               if i != rs.result_id
@@ -68,6 +69,7 @@ module Oso
           attr_reader :constraints, :class_tag
 
           def self.parse(polar, parsed_json)
+            @polar = polar
             constraints = parsed_json['constraints'].map do |con|
               Filter.parse polar, con
             end
@@ -76,6 +78,24 @@ module Oso
             new(constraints: constraints, class_tag: class_tag)
           end
 
+          def ground(results) # rubocop:disable Metrics/MethodLength, Metrics/CyclomaticComplexity, Metrics/AbcSize, Metrics/PerceivedComplexity
+            xrefs, rest = constraints.partition do |c|
+              c.value.is_a?(Ref) and !c.value.result_id.nil?
+            end
+
+            yrefs, nrefs = xrefs.partition { |r| %w[In Eq].include? r.kind }
+            [[yrefs, 'In'], [nrefs, 'Nin']].each do |refs, kind|
+              next unless refs.any?
+
+              refs.group_by { |f| f.value.result_id }.each do |rid, fils|
+                value = results[rid].map { |r| fils.map { |f| GETATTR[r, f.value.field] } }
+                field = fils.map(&:field)
+                rest.push(Filter.new(kind: kind, value: value, field: field))
+              end
+            end
+            rest
+          end
+
           def initialize(constraints:, class_tag:)
             @constraints = constraints
             @class_tag = class_tag
@@ -127,6 +147,7 @@ module Oso
           'Eq' => ->(a, b) { a == b },
           'In' => ->(a, b) { b.include? a },
           'Neq' => ->(a, b) { a != b },
+          'Nin' => ->(a, b) { !b.include?(a) },
           'Contains' => ->(a, b) { a.include? b }
         }.freeze
 
@@ -138,8 +159,6 @@ module Oso
           @kind = kind
           @field = field
           @value = value
-          @check = CHECKS[kind]
-          raise "Unknown constraint kind `#{kind}`" if @check.nil?
         end
 
         def ground(results)
@@ -150,10 +169,16 @@ module Oso
           @value = value.map { |v| v.send ref.field } unless ref.field.nil?
         end
 
-        def check(item)
+        def check(item) # rubocop:disable Metrics/AbcSize
           val = value.is_a?(Field) ? item.send(value.field) : value
-          item = field.nil? ? item : item.send(field)
-          @check[item, val]
+          item = if field.nil?
+                   item
+                 elsif field.is_a? Array
+                   field.map { |f| GETATTR[item, f] }
+                 else
+                   item.send field
+                 end
+          CHECKS[@kind][item, val]
         end
 
         def self.parse(polar, constraint) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength

data/lib/oso/polar/host.rb

@@ -67,12 +67,20 @@ module Oso
       public
 
       attr_writer :accept_expression
+      attr_accessor :build_query, :combine_query, :exec_query
+
+      DEFAULT_COMBINE_QUERY = proc { raise 'implement combine_query to use data filtering' }
+      DEFAULT_BUILD_QUERY = proc { raise 'implement build_query to use data filtering' }
+      DEFAULT_EXEC_QUERY = proc { raise 'implement exec_query to use data filtering' }
 
       def initialize(ffi_polar)
         @ffi_polar = ffi_polar
         @types = {}
         @instances = {}
         @accept_expression = false
+        @combine_query = DEFAULT_COMBINE_QUERY
+        @build_query = DEFAULT_BUILD_QUERY
+        @exec_query = DEFAULT_EXEC_QUERY
       end
 
       def initialize_copy(other)
@@ -107,9 +115,9 @@ module Oso
           klass: PolarClass.new(cls),
           id: cache_instance(cls),
           fields: fields || {},
-          combine_query: combine_query,
-          exec_query: exec_query,
-          build_query: build_query
+          combine_query: combine_query || self.combine_query,
+          exec_query: exec_query || self.exec_query,
+          build_query: build_query || self.build_query
         )
         name
       end

data/lib/oso/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Oso
-  VERSION = '0.21.0'
+  VERSION = '0.22.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oso-oso
 version: !ruby/object:Gem::Version
-  version: 0.21.0
+  version: 0.22.0
 platform: ruby
 authors:
 - Oso Security, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-09-28 00:00:00.000000000 Z
+date: 2021-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi