pebblebed 0.0.22 → 0.0.23

data/README.md

@@ -152,3 +152,10 @@ For some pebbles Pebblebed may furnish a richer client with helper methods. This
 augmented client in the `/lib/pebblebed/clients` folder and naming the class `Pebblebed::<YourPebbleName>Client`. For
 an example of this see `CheckpointClient` which in addition to the common http-methods provides the method `me` which
 returns the logged in user and `god?` which checks whether she's a god(dess).
+
+Troubleshooting
+===============
+
+When something fails, say you're trying to post to grove using a pebblebed connector, it might be a good idea to try the same thing from command line first:
+
+	curl -XPOST 'http://example.com/api/grove/v1/posts/post.todo:dna.org.a.b' --data '{"session":"session_name","post":{"document": {"body": "Hello Grove!"},"tags": ["welcome", "tutorial"]}}' -H "Content-Type: application/json"

data/lib/pebblebed/security/access_data.rb

@@ -0,0 +1,85 @@
+# Models the checkpoint group access data for one identity
+module Pebblebed
+  module Security
+    class AccessData
+      attr_reader :group_ids
+
+      def initialize(data)
+        if data[:subtrees] || data[:group_ids]
+          @group_ids = Set.new(data[:group_ids])
+          @subtrees = Set.new
+          data[:subtrees].each do |subtree|
+            @subtrees << subtree.split('.')
+          end
+        else
+          # Assume this is a /identities/:id/memberships result from checkpoint
+          parse_checkpoint_record(data)
+        end
+      end
+
+      # Takes a path (possibly with wildcards) and returns
+      # any subtrees that are relevant to determine accessibility
+      # to restricted content in a query of documents in that
+      # wildcard_path. All relevant subtrees are guaranteed to be
+      # returned, but not all returned subtrees are guaranteed to be
+      # relevant. I.e. some irrelevant subtrees may be returned.
+      # (If the path does not use wildcards, relevance is
+      # guaranteed.)
+      def relevant_subtrees(wildcard_path)
+        pristine = self.class.pristine_path(wildcard_path)
+        intersecting_subtrees(pristine)
+      end
+
+      def subtrees
+        @subtrees.map { |subtree| subtree.join('.') }
+      end
+
+      private
+
+      # Takes a path possibly containing wildcard characters and returns
+      # a superset path that just contains proper labels. E.g. "a.b.c|d.*" returns
+      # "a.b"
+      def self.pristine_path(wildcard_path)
+        result = []
+        wildcard_path.split('.').each do |label|
+          break unless Pebblebed::Uid.valid_label?(label)
+          result << label
+        end
+        result.join('.')
+      end
+
+      # Returns any subtrees that "intersect" the provided location. That is
+      # they are either supersets of the location ("a.b" is a superset of "a.b.c")
+      # or subsets ("a.b.c.d" is a subset of "a.b.c"). Also exact matches are returned
+      # ('a.b.c' matches 'a.b.c', duh!)
+      def intersecting_subtrees(location)
+        location = location.split('.')
+        result = []
+        @subtrees.each do |subtree|
+          if subtree.length >= location.length
+            # is this a subset tree?
+            result << subtree if location == subtree[0...location.length]
+          else
+            # is this a superset tree?
+            result << subtree if subtree == location[0...subtree.length]
+          end
+        end
+        result.map { |subtree| subtree.join('.') }
+      end
+
+      # Initializes the instance with data from a checkpoint GET /identities/:id/memberships request
+      def parse_checkpoint_record(memberships_record)
+        @group_ids = Set.new
+        @subtrees = Set.new
+        memberships_record['memberships'].each do |membership|
+          @group_ids << membership['membership']['group_id']
+        end
+        memberships_record['groups'].each do |group|
+          group['group']['subtrees'].each do |subtree|
+            @subtrees << subtree.split('.')
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pebblebed/security/client.rb

@@ -0,0 +1,33 @@
+# A class that helps 
+module Pebblebed
+  module Security
+    class Client
+      IDENTITY_MEMBERSHIPS_TTL = 10*60
+
+      def initialize(connector)
+        @connector = connector
+        @access_data = {} # Memoized identity access data records
+      end
+
+      # Returns an object representing the current access data for a given identity
+      def access_data_for(identity)
+        identity = identity.id unless identity.is_a?(Numeric)
+        return @access_data[identity] if @access_data[identity]
+        membership_data = fetch_membership_data_for(identity)
+        result = Pebblebed::Security::AccessData.new(membership_data)
+        @access_data[identity] = result
+        result
+      end
+
+      private
+
+      def fetch_membership_data_for(identity_id)
+        result = Pebblebed.memcached.fetch("identity_membership_data:#{identity}", IDENTITY_MEMBERSHIPS_TTL) do
+          @connector.checkpoint.get("/identities/#{identity}/memberships").to_json
+        end
+        JSON.parse(result)
+      end
+
+    end
+  end
+end

data/lib/pebblebed/security/listener.rb

@@ -0,0 +1,94 @@
+# Listens to security configuration updates and lets the client application
+# register custom handlers for each event.
+module Pebblebed
+  module Security
+    class Listener
+
+      def initialize(options)
+        @app_name = options[:app_name]
+        @handlers = {:group => {}, :group_membership => {}, :group_subtree => {}}
+      end
+
+      def start
+        @thread ||= Thread.new do
+          process
+        end
+      end
+
+      def stop
+        @thread.kill if @thread
+        @thread = nil
+      end
+
+      def on_group_declared(&block)
+        @handlers[:group][:create] = block
+        @handlers[:group][:update] = block
+      end
+
+      def on_group_removed(&block)
+        @handlers[:group][:delete] = block
+      end
+
+      def on_subtree_declared(&block)
+        @handlers[:group_subtree][:create] = block
+        @handlers[:group_subtree][:update] = block
+      end
+
+      def on_subtree_removed(&block)
+        @handlers[:group_subtree][:delete] = block
+      end
+
+      def on_membership_declared(&block)
+        @handlers[:group_membership][:create] = block
+        @handlers[:group_membership][:update] = block
+      end
+
+      def on_membership_removed(&block)
+        @handlers[:group_membership][:delete] = block
+      end
+
+      private
+
+      # Subscribe to queue and handle incoming messages
+      def process
+        river = Pebblebed::River.new
+        queue_options =  {
+          :name => "#{@app_name}.security_listener",
+          :path => '**',
+          :klass => 'group|group_membership|group_subtree',
+          :event => '**',
+          :interval => 1
+        }
+        queue = river.queue queue_options
+        queue.subscribe(ack: true) do |message|
+          consider message
+        end
+      end
+
+      # Parse an incoming message and pass it on
+      def consider(message)
+        payload = JSON.parse(message[:payload])
+        event = payload['event']
+        attributes = payload['attributes']
+        klass = Pebblebed::Uid.raw_parse(payload['uid']).first
+        handle(event, klass, attributes)
+      end
+
+      # Determines the correct event handler for the message and calls it
+      def handle(event, klass, attributes)
+        event_handler = @handlers[klass.to_sym][event.to_sym]
+        return unless event_handler
+        case klass
+        when 'group'
+          event_handler.call(:id => attributes['id'], :label => attributes['label'])
+        when 'group_membership'
+          event_handler.call(:group_id => attributes['group_id'],
+            :identity_id => attributes['identity_id'])
+        when 'group_subtree'
+          event_handler.call(:group_id => attributes['group_id'],
+            :location => attributes['location'])
+        end
+      end
+    end
+  end
+end

data/lib/pebblebed/uid.rb

@@ -116,29 +116,31 @@ module Pebblebed
           stars_are_solitary?(path) && pipes_are_interleaved?(path) && carets_are_leading?(path) && stars_are_terminating?(path)
         end
 
-        # a.*.c is valid
+        # a.*.c is accepted
         # a.*b.c is not
+        # A later rule ensures that * always falls at the end of a path
         def stars_are_solitary?(path)
           !path.split('.').any? {|s| s.match(/.+\*|\*.+/)}
         end
 
-        # a.b|c.d is valid
+        # a.b|c.d is accepted
         # a.|b.c is not
         def pipes_are_interleaved?(path)
           !path.split('.').any? {|s| s.match(/^\||\|$/)}
         end
 
-        # a.^b.c is valid
+        # a.^b.c is accepted
         # a.b^c.d is not
         def carets_are_leading?(path)
           !path.split('.').any? {|s| s.match(/.+\^|\^$/) }
         end
 
-        # a.b.* is valid
+        # a.b.* is accepted
         # *.b.c is not
         def stars_are_terminating?(path)
           path !~ /.*\*\.\w/
         end
+
       end
     end
 

data/lib/pebblebed/version.rb

@@ -1,3 +1,3 @@
 module Pebblebed
-  VERSION = "0.0.22"
+  VERSION = "0.0.23"
 end

data/lib/pebblebed.rb

@@ -10,3 +10,6 @@ require 'pebblebed/clients/quorum_client'
 require 'pebblebed/parts'
 require 'pebblebed/river'
 require 'pebblebed/labels'
+require 'pebblebed/security/access_data'
+require 'pebblebed/security/client'
+require 'pebblebed/security/listener'

data/spec/security/access_data_spec.rb

@@ -0,0 +1,40 @@
+require 'spec_helper'
+require 'pebblebed/uid'
+require 'pebblebed/security/access_data'
+
+describe Pebblebed::Security::AccessData do
+  let :access_data do
+    Pebblebed::Security::AccessData.new(
+      :groups => [1,2,3],
+      :subtrees => ['a.b', 'a.b.c.d.e', 'a.c.d', 'a.c.e.f']
+    )
+  end
+
+  it "can calculate a pristine path" do
+    Pebblebed::Security::AccessData.pristine_path("a.b.c|d").should eq "a.b"
+    Pebblebed::Security::AccessData.pristine_path("a.b").should eq "a.b"
+  end
+
+  it "can calculate relevant paths" do
+    access_data.relevant_subtrees('a.b').sort.should eq ['a.b', 'a.b.c.d.e']
+    access_data.relevant_subtrees('a.b.c').sort.should eq ['a.b', 'a.b.c.d.e']
+    access_data.relevant_subtrees('a.c.e').sort.should eq ['a.c.e.f']
+    access_data.relevant_subtrees('a.*').sort.should eq ['a.b', 'a.b.c.d.e', 'a.c.d', 'a.c.e.f']
+  end
+
+  it "can parse a checkpoint record" do
+    record = {
+      'memberships' => [
+        {'membership' => {'id' => 10, 'group_id' => 1, 'identity_id' => 1}},
+        {'membership' => {'id' => 20, 'group_id' => 2, 'identity_id' => 1}},
+      ],
+      'groups' => [
+        {'group' => {'id' => 1, 'label' => "group_1", 'subtrees' => ["a.b.c"]}},
+        {'group' => {'id' => 2, 'label' => "group_2", 'subtrees' => ["a.c.d.c"]}}
+      ]
+    }
+    ad = Pebblebed::Security::AccessData.new(record)
+    ad.subtrees.sort.should eq ['a.b.c', 'a.c.d.c']
+    ad.group_ids.sort.should eq [1,2]
+  end
+end

data/spec/security/client_spec.rb

@@ -0,0 +1,29 @@
+require 'spec_helper'
+require 'pebblebed/uid'
+require 'pebblebed/security/access_data'
+require 'pebblebed/security/client'
+
+describe Pebblebed::Security::Client do
+  let :client do
+    Pebblebed::Security::Client.new(nil)
+  end
+
+  let :sample_memberships_record do
+    {
+      'memberships' => [
+        {'membership' => {'id' => 10, 'group_id' => 1, 'identity_id' => 1}},
+        {'membership' => {'id' => 20, 'group_id' => 2, 'identity_id' => 1}},
+      ],
+      'groups' => [
+        {'group' => {'id' => 1, 'label' => "group_1", 'subtrees' => ["a.b.c"]}},
+        {'group' => {'id' => 2, 'label' => "group_2", 'subtrees' => ["a.c.d.c"]}}
+      ]
+    }
+  end
+
+  it "can fetch access_data" do
+    client.stub(:fetch_membership_data_for).and_return(sample_memberships_record)
+    ad = client.access_data_for(1)
+    ad.subtrees.sort.should eq ['a.b.c', 'a.c.d.c']
+  end
+end

data/spec/security/listener_spec.rb

@@ -0,0 +1,26 @@
+require 'spec_helper'
+require 'pebblebed/uid'
+require 'pebblebed/security/listener'
+
+describe Pebblebed::Security::Listener do
+  let :listener do
+    Pebblebed::Security::Listener.new(:app_name => "test")
+  end
+
+  it "can generate events from incoming messages" do
+    the_attrs = nil
+    listener.on_group_declared do |attrs|
+      the_attrs = attrs
+    end
+    message = {:payload => {
+      'event' => 'create',
+      'uid' => 'group:abc.groups$10',
+      'attributes' => {
+        'id' => 10,
+        'label' => 'the_label'
+      }
+    }.to_json}
+    listener.send(:consider, message)
+    the_attrs[:id].should eq 10
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pebblebed
 version: !ruby/object:Gem::Version
-  version: 0.0.22
+  version: 0.0.23
   prerelease: 
 platform: ruby
 authors:
@@ -10,11 +10,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-09-07 00:00:00.000000000 Z
+date: 2012-09-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70305565590520 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -22,10 +22,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70305565590520
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &70305565590060 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -33,10 +38,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70305565590060
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: simplecov
-  requirement: &70305565589480 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -44,10 +54,15 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70305565589480
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: deepstruct
-  requirement: &70305565588760 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -55,10 +70,15 @@ dependencies:
         version: 0.0.2
   type: :runtime
   prerelease: false
-  version_requirements: *70305565588760
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.0.2
 - !ruby/object:Gem::Dependency
   name: curb
-  requirement: &70305565588160 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -66,10 +86,15 @@ dependencies:
         version: 0.7.14
   type: :runtime
   prerelease: false
-  version_requirements: *70305565588160
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.7.14
 - !ruby/object:Gem::Dependency
   name: yajl-ruby
-  requirement: &70305565587700 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -77,10 +102,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565587700
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: queryparams
-  requirement: &70305565609740 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -88,10 +118,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565609740
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: futurevalue
-  requirement: &70305565608660 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -99,10 +134,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565608660
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: pathbuilder
-  requirement: &70305565607720 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -110,10 +150,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565607720
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: nokogiri
-  requirement: &70305565606900 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -121,10 +166,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565606900
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: i18n
-  requirement: &70305565605840 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -132,10 +182,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565605840
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: activesupport
-  requirement: &70305565603700 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -143,10 +198,15 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565603700
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bunny
-  requirement: &70305565602840 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -154,7 +214,12 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70305565602840
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Development tools for working with Pebblebed
 email:
 - katrina@bengler.no
@@ -180,6 +245,9 @@ files:
 - lib/pebblebed/parts.rb
 - lib/pebblebed/river.rb
 - lib/pebblebed/river/subscription.rb
+- lib/pebblebed/security/access_data.rb
+- lib/pebblebed/security/client.rb
+- lib/pebblebed/security/listener.rb
 - lib/pebblebed/sinatra.rb
 - lib/pebblebed/uid.rb
 - lib/pebblebed/uid_query.rb
@@ -194,6 +262,9 @@ files:
 - spec/mockcached.rb
 - spec/river_spec.rb
 - spec/river_subscription_spec.rb
+- spec/security/access_data_spec.rb
+- spec/security/client_spec.rb
+- spec/security/listener_spec.rb
 - spec/spec_helper.rb
 - spec/uid_query_spec.rb
 - spec/uid_spec.rb
@@ -209,15 +280,21 @@ required_ruby_version: !ruby/object:Gem::Requirement
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: 4364516963973573943
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: 4364516963973573943
 requirements: []
 rubyforge_project: pebblebed
-rubygems_version: 1.8.15
+rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: Development tools for working with Pebblebed
@@ -231,6 +308,9 @@ test_files:
 - spec/mockcached.rb
 - spec/river_spec.rb
 - spec/river_subscription_spec.rb
+- spec/security/access_data_spec.rb
+- spec/security/client_spec.rb
+- spec/security/listener_spec.rb
 - spec/spec_helper.rb
 - spec/uid_query_spec.rb
 - spec/uid_spec.rb