permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/audit/unmasked_without_user.rb

@@ -0,0 +1,169 @@
+# frozen_string_literal: true
+
+require 'concurrent/map'
+
+module PermissionForge
+  module Audit
+    # What makes a guarded attribute returned as stored inside a web request
+    # with nobody signed in visible (masked_attributes_nil_user_strategy
+    # :bypass; Configuration#masked_attributes_without_user_for answers
+    # :record): exactly the reads :hide_in_requests would hide — every
+    # guarded attribute of a masked model but its primary key and the raw
+    # paths, never the user model. The attribute guard (AttributeAccessGuard)
+    # calls .note for each such read.
+    #
+    # - The runtime event field.unmasked_without_user (group :bypass): the
+    #   model, the attribute and the request (method, path, endpoint; request
+    #   id and IP as event columns when the audit context has none), once per
+    #   request per model and attribute (Runtime.once?). Nothing is built
+    #   while nobody listens and the group is not stored (Audit::Gate).
+    # - One SECURITY warning per model and process in the log (Warnings.emit),
+    #   so an app that stores no runtime event sees the gap too. Models are
+    #   remembered by name (a development reload does not warn again), at
+    #   most WARNED_LIMIT of them.
+    #
+    # Once the model has been warned about and nobody listens (the group not
+    # stored), there is nothing left to do: .pending? is false and the
+    # record's `attributes` returns the stored hash at once, as outside a
+    # request. A debugging read (inspect, MaskedAttributes::INSPECT_KEY) is
+    # not recorded. Neither ever raises into the read.
+    #
+    # @api private
+    module UnmaskedWithoutUser
+      EVENT = 'field.unmasked_without_user'
+      GATE = Gate.for(EVENT)
+
+      WARNED_LIMIT = 1_000
+      # The "Model#attribute" writes refused after a hidden read, logged once.
+      REFUSED = Concurrent::Map.new
+
+      # The names of the models warned about in this process: a frozen Hash
+      # replaced whole under WARNED_MUTEX, so the read on every guarded read
+      # takes no lock.
+      @warned = {}.freeze
+      WARNED_MUTEX = Mutex.new
+
+      class << self
+        # @return [Hash{String => true}] the names of the models warned about
+        attr_reader :warned
+
+        # @param model [Class, String, Symbol] the record's class (or the
+        #   Resource name when no class is known)
+        # @param attribute [Symbol, String]
+        # @return [void]
+        def note(model, attribute)
+          heard = GATE.open?
+          name = model.is_a?(Class) ? model.name : model.to_s
+          first = !@warned.key?(name)
+          return unless (first || heard) && !ExecutionState[Concerns::MaskedAttributes::INSPECT_KEY]
+
+          warn_once(name, attribute) if first
+          publish(model, attribute) if heard
+          nil
+        end
+
+        # A write refused because the record had read the attribute as hidden
+        # with nobody signed in (MaskedAttributes, write.masked_skipped
+        # `detected_by: hidden_without_user`): logged once per model and
+        # attribute and process, as the change may have been meant (a flow
+        # that changes a guarded attribute without a sign-in must sign in a
+        # system user).
+        #
+        # @param model [Class]
+        # @param attribute [Symbol, String]
+        # @param protection [Symbol] :skip or :raise
+        # @return [void]
+        def write_refused(model, attribute, protection)
+          key = "#{model.name}##{attribute}"
+          return if REFUSED.size >= WARNED_LIMIT || !REFUSED.put_if_absent(key, true).nil?
+
+          Warnings.emit("masked_attributes.write_refused_without_user.#{key}",
+                        "#{key} was not written (masked_write_protection :#{protection}): the record had read it as " \
+                        'hidden with nobody signed in, so the new value may come from the hidden one. A flow that ' \
+                        'changes a guarded attribute without a sign-in (a webhook, a token link) must sign in a system ' \
+                        'user. Logged once per attribute and process; write.masked_skipped records each refusal.',
+                        severity: :config)
+        rescue StandardError
+          nil
+        end
+
+        # Whether a read of `model` returned as stored in a web request still
+        # has something to do: the model's warning is still to come, or the
+        # event is stored or heard.
+        #
+        # @param model [Class, String]
+        # @return [Boolean]
+        def pending?(model)
+          !@warned.key?(Runtime.model_name(model)) || (GATE.open? && Audit.instrument?(EVENT))
+        end
+
+        # Forgets which models were warned about (tests; Audit.reset!).
+        # @return [void]
+        def reset!
+          WARNED_MUTEX.synchronize { @warned = {}.freeze }
+          REFUSED.clear
+        end
+
+        private
+
+        def publish(model, attribute)
+          return unless Audit.instrument?(EVENT)
+
+          name = Runtime.model_name(model)
+          attribute = attribute.to_s
+          return unless Runtime.once?(EVENT, name, attribute, nil)
+
+          with_request_context do
+            Audit.instrument(EVENT) do
+              { record_type: Runtime.record_type(model), record_id: nil, subject_user_id: nil,
+                data: { 'model' => name, 'attribute' => attribute }.merge(WebRequest.details) }
+            end
+          end
+        end
+
+        # The request id and IP of the web request, for an event recorded
+        # outside the admin's and the API's own audit context.
+        def with_request_context(&)
+          env = WebRequest.env
+          return yield if Context[:request_id] || env.nil?
+
+          request = ActionDispatch::Request.new(env)
+          Context.with(request_id: cut(request.request_id), ip: cut(RequestContext.remote_ip(request).first), &)
+        end
+
+        def cut(value)
+          value.presence && value.to_s[0, WebRequest::VALUE_LIMIT]
+        end
+
+        def warn_once(name, attribute)
+          return unless remember(name)
+
+          Warnings.emit("masked_attributes.unmasked_without_user.#{name}", warning(name, attribute), severity: :security)
+        rescue StandardError
+          nil
+        end
+
+        # Adds the model's name; false when it was there already or the
+        # limit is reached.
+        def remember(name)
+          WARNED_MUTEX.synchronize do
+            next false if @warned.key?(name) || @warned.size >= WARNED_LIMIT
+
+            @warned = @warned.merge(name => true).freeze
+            true
+          end
+        end
+
+        def warning(name, attribute)
+          request = WebRequest.details.values_at('method', 'path', 'endpoint').compact.join(' ')
+          "#{name}##{attribute} was read in a web request with nobody signed in " \
+            "(#{request.presence || 'a request'}) and returned as stored: masked_attributes_nil_user_strategy is " \
+            ':bypass. Set it to :hide_in_requests to hide guarded attributes in web requests with nobody signed in ' \
+            '(jobs, rake and the console keep the stored values), or sign the request in before it reads masked ' \
+            'models. Logged once per model and process; the field.unmasked_without_user audit event (runtime ' \
+            'group :bypass) records each request.'
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/audit.rb

@@ -164,6 +164,7 @@ module PermissionForge
         end
         Context.reset!
         Runtime.reset!
+        UnmaskedWithoutUser.reset!
       end
 
       # Installs the notification subscribers and the executor hook of the
@@ -280,22 +281,35 @@ module PermissionForge
         end
       end
 
+      # A database that does not answer or does not exist
+      # (DatabaseReach::UNREACHABLE_ERRORS) is "unchecked": nothing is
+      # recorded until it answers. Any other error of the check — a
+      # configuration error included — raises out of Audit.record, so the
+      # change it records rolls back.
       def check_table(name)
-        if PermissionForge::AuditEvent.table_exists?
-          @table_checks[name] = true
-        else
-          @table_checks[name] = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          warn_missing_table(name) unless @warned_tables[name]
-          @warned_tables[name] = true
-          false
+        cause = nil
+        exists = PermissionForge::DatabaseReach.table_exists?(PermissionForge::AuditEvent,
+                                                              errors: PermissionForge::DatabaseReach::UNREACHABLE_ERRORS) { |e| cause = e }
+        if cause
+          warn_unchecked_table(name, cause)
+          return false
         end
-      rescue ActiveRecord::NoDatabaseError, ActiveRecord::ConnectionNotEstablished => e
-        Rails.logger&.warn("[PermissionForge] cannot check for the audit table '#{name}': #{e.class}") if defined?(Rails)
+        return @table_checks[name] = true if exists
+
+        @table_checks[name] = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        warn_missing_table(name) unless @warned_tables[name]
+        @warned_tables[name] = true
         false
       end
 
+      def warn_unchecked_table(name, cause)
+        PermissionForge::Warnings.emit(:audit_table_unchecked, "cannot check for the audit table '#{name}' (#{cause.class}): " \
+                                                               'no audit events are recorded until the database answers.',
+                                       severity: :security)
+      end
+
       def warn_missing_table(name)
-        Rails.logger.warn(BootWarnings.missing_table(name)) if defined?(Rails) && Rails.logger
+        PermissionForge::Warnings.emit(:audit_table_missing, BootWarnings.missing_table(name), severity: :security)
       end
     end
   end

data/lib/permission_forge/boot_checks.rb

@@ -1,22 +1,50 @@
 # frozen_string_literal: true
 
+require_relative 'warnings'
+require_relative 'api_only_admin'
+require_relative 'database_reach'
+require_relative 'api_authorizations'
+
 module PermissionForge
   # What the engine checks while the host app boots: run (from
   # config.after_initialize) and ensure_tenancy_gem! (from an initializer).
   #
   # The configuration checks need nothing. The database steps are advisory
   # warnings or idempotent work, and they must never abort a boot: a Docker
-  # build precompiles assets with no database, a worker can start while the
-  # database fails over. The database is pinged once (db_available?); a step
-  # that loses it midway is skipped (DATABASE_STEP_ERRORS) and the next step
-  # runs. Anything else a step raises (a ConfigurationError) still stops the
-  # boot.
+  # build precompiles assets with no database, a fresh `rails new
+  # --skip-kamal` app has no production database file until the deploy sets
+  # DATABASE_URL, a worker can start while the database fails over. The
+  # database is pinged once (DatabaseReach.problem: whatever connecting
+  # raises, an adapter's refusal of its configuration included); a step that
+  # loses it midway is skipped (DATABASE_STEP_ERRORS) and the next step runs.
+  # Anything else a step raises (a ConfigurationError) still stops the boot.
+  #
+  # A process that runs nothing but asset tasks (asset_build?:
+  # `bin/rails assets:precompile`, the Dockerfile's build step) runs the
+  # configuration checks only: it reads no data and serves nothing, and a
+  # build has no database to ping (an unreachable host could hold the build
+  # for a TCP timeout).
+  #
+  # Every warning goes through Warnings.emit, which decides the channel (the
+  # log; the terminal where the log is not read) and writes nothing while a
+  # generator boots the app (Warnings.generator_running?): `bin/rails
+  # generate permission_forge:install` boots before it writes the
+  # initializer, so its warnings described a configuration the app was about
+  # to stop having (the defaults, e.g. cache_backend :memory) — the first
+  # lines a new user read in log/development.log. Nothing is checked then
+  # either (run returns before the database steps). The next server, console
+  # or task boot checks the configuration the app has.
   #
   # @api private
   module BootChecks
-    # Errors that mean "the database is not there (yet)": gone, refused, not
-    # created, not migrated.
-    DATABASE_STEP_ERRORS = [ActiveRecord::ConnectionNotEstablished, ActiveRecord::StatementInvalid].freeze
+    # Errors that mean "the database is not there (yet)" once it answered the
+    # ping: gone, refused, not created, not migrated (DatabaseReach::READ_ERRORS).
+    DATABASE_STEP_ERRORS = DatabaseReach::READ_ERRORS
+
+    # The asset tasks of Propshaft and Sprockets (each boots the app through
+    # :environment). A process whose Rake top-level tasks are all among them
+    # is an asset build (asset_build?).
+    ASSET_TASKS = %w[assets:precompile assets:clean assets:clobber].freeze
 
     # The boot steps that read the database, in order. Each runs on its
     # own: one that loses the database is skipped (database_step).
@@ -34,16 +62,47 @@ module PermissionForge
       masked_attributes: ->(_config) { MaskingSync.boot! }
     }.freeze
 
+    # The commands `bin/rails generate` and `bin/rails destroy` run (the one
+    # definition is the emitter's: Warnings::GENERATOR_COMMANDS).
+    GENERATOR_COMMANDS = Warnings::GENERATOR_COMMANDS
+
     class << self
       # @param config [Configuration]
       def run(config)
         config.validate_gdpr_explicit_choice!
+        return MaskingSync.reset! if generator_running?
+
         warn_configuration(config)
-        return database_unreachable unless db_available?
+        return MaskingSync.reset! if asset_build?
+
+        problem = database_problem
+        return database_unreachable(problem) if problem
 
         DATABASE_STEPS.each { |name, step| database_step(name) { step.call(config) } }
       end
 
+      # Whether this boot is that of a generator (`bin/rails generate` or
+      # `bin/rails destroy`): Warnings.generator_running?, which also keeps
+      # every warning quiet then.
+      #
+      # @return [Boolean]
+      def generator_running?
+        Warnings.generator_running?
+      end
+
+      # Whether this process runs nothing but asset tasks (ASSET_TASKS): the
+      # tasks Rake was asked for on the command line (`bin/rails
+      # assets:precompile`), not a task that only depends on one. False
+      # outside Rake.
+      #
+      # @return [Boolean]
+      def asset_build?
+        return false unless defined?(::Rake.application)
+
+        tasks = ::Rake.application.top_level_tasks.map { |task| task.sub(/\[.*\z/m, '') }
+        tasks.any? && tasks.all? { |task| ASSET_TASKS.include?(task) }
+      end
+
       # HasTenantScoping silently skips the scope when the gem is absent,
       # which would leave every tenant's permission data visible to every
       # other tenant — refuse to boot instead.
@@ -71,13 +130,13 @@ module PermissionForge
         return unless conditional_sets.exists?
         return unless resolved_context(config).empty?
 
-        Rails.logger.warn '[PermissionForge] SECURITY warning: ' \
-                          "#{conditional_sets.count} permission set(s) use activation conditions " \
-                          '(session flag, allowed_ips, or login hours) but request_context_resolver ' \
-                          'returns empty context. These sets will evaluate as unconditional ' \
-                          '(ALWAYS ACTIVE) — IP/hours/consent restrictions are NOT enforced. ' \
-                          'Configure config.request_context_resolver, or set ' \
-                          'config.conditional_sets_strict_mode = true to fail closed.'
+        Warnings.emit(:conditional_sets_without_context,
+                      "#{conditional_sets.count} permission set(s) use activation conditions " \
+                      '(session flag, allowed_ips, or login hours) but request_context_resolver ' \
+                      'returns empty context. These sets will evaluate as unconditional ' \
+                      '(ALWAYS ACTIVE) — IP/hours/consent restrictions are NOT enforced. ' \
+                      'Configure config.request_context_resolver, or set ' \
+                      'config.conditional_sets_strict_mode = true to fail closed.', severity: :security)
       rescue ActiveRecord::StatementInvalid
         # Tables don't exist yet (pre-migration)
       end
@@ -87,88 +146,146 @@ module PermissionForge
         return if config.api_require_authorization
         return if config.api_action_authorization && config.api_assignment_authorization
 
-        Rails.logger&.warn '[PermissionForge] SECURITY warning: API is enabled, ' \
-                           'config.api_require_authorization is false and ' \
-                           'api_action_authorization / api_assignment_authorization is not set. ' \
-                           'api_auth only proves identity — any authenticated caller can create ' \
-                           'permission sets and assign them (privilege escalation). Configure both ' \
-                           'authorization lambdas, or remove api_require_authorization = false ' \
-                           '(the default, true, denies mutations until they are set).'
+        Warnings.emit(:api_authorization_gap,
+                      'API is enabled, config.api_require_authorization is false and ' \
+                      'api_action_authorization / api_assignment_authorization is not set. ' \
+                      'api_auth only proves identity — any authenticated caller can create ' \
+                      'permission sets and assign them (privilege escalation). Configure both ' \
+                      'authorization lambdas, or remove api_require_authorization = false ' \
+                      '(the default, true, denies mutations until they are set).', severity: :security, audience: :server)
       end
 
-      # One query for the distinct unmasked names (no record is built), and
-      # one more for the resource of the first match.
-      def warn_unmasked_gdpr_fields(config)
-        patterns = config.gdpr_field_patterns
-        return if patterns.blank?
+      # The API is on and api_auth admits callers, but a lambda the API
+      # needs is unset (ApiAuthorizations.unset): what it guards is refused
+      # (403). It fails closed; the note says so before the first refused
+      # request does. Under api_require_authorization = false the missing
+      # change and assignment lambdas are api_authorization_gap's instead.
+      #
+      # @param config [Configuration]
+      def warn_api_authorizations_unset(config)
+        lines = ApiAuthorizations.lines(config)
+        return if lines.empty?
+
+        Warnings.emit(:api_authorization_unset,
+                      'The JSON API is on and api_auth admits callers, but these authorization lambdas are not ' \
+                      "set, so the API refuses (403, naming the option) what each guards — #{lines.join('; ')}. " \
+                      'Set each one in config/initializers/permission_forge.rb (docs/admin-api.md#requiring-authorization-lambdas).',
+                      audience: :server)
+      end
 
-        unmasked = PermissionForge::ResourceField.where(mask_access: false)
-        name = unmasked.distinct.pluck(:name).find { |field_name| gdpr_match?(field_name, patterns) }
+      # One query for the distinct names of the rows in the clear that reach
+      # someone's hash (in effect, in a granting set; no record is built),
+      # and one more for the resource of the first match. What counts as
+      # personal data is PermissionForge::SensitiveColumns' answer, as for
+      # the GDPR audit and the admin.
+      def warn_unmasked_gdpr_fields(config)
+        sensitive = PermissionForge::SensitiveColumns.new(configuration: config)
+        in_clear = PermissionForge::ResourceField.in_effect.merge(PermissionForge::PermissionSet.granting).exposing_unacknowledged
+        name, match = first_sensitive(in_clear.distinct.pluck(:name), sensitive)
         return unless name
 
-        resource = unmasked.where(name: name).first&.resource
-        Rails.logger.warn "[PermissionForge] GDPR warning: field '#{name}' on resource " \
-                          "'#{resource&.name}' matches GDPR pattern but is not masked. " \
-                          'Consider enabling gdpr_defaults or masking this field manually.'
+        resource = in_clear.where(name: name).first&.resource
+        Warnings.emit(:unmasked_gdpr_fields,
+                      "GDPR warning: field '#{name}' on resource '#{resource&.name}' #{matched_by(match)} " \
+                      'but is not masked. Consider enabling gdpr_defaults or masking this field manually.')
       rescue ActiveRecord::StatementInvalid
         # Table doesn't exist yet (pre-migration)
       end
 
+      # The admin screens in a `rails new --api` application: without the
+      # cookies, session and flash middlewares every admin page that renders
+      # a form is a 500 (ApiOnlyAdmin says which ones to add). Skipped when
+      # config.api_only_admin_warning is false.
+      #
+      # @param application [Rails::Application]
+      # @param config [Configuration]
+      def warn_api_only_admin(application = Rails.application, config: PermissionForge.configuration)
+        return unless config.api_only_admin_warning
+
+        missing = ApiOnlyAdmin.missing_middlewares(application)
+        return if missing.empty?
+
+        Warnings.emit(:api_only_admin, ApiOnlyAdmin.message(missing), severity: :config, audience: :server)
+      end
+
+      # The engine's after_routes_loaded hook: the api_only_admin warning,
+      # once per process (a development reload draws the routes again).
+      #
+      # @param application [Rails::Application]
+      def routes_loaded(application)
+        return if @routes_checked
+
+        @routes_checked = true
+        warn_api_only_admin(application)
+      end
+
       private
 
-      # Connects and pings. `ActiveRecord::Base.connection` alone is not enough:
-      # since Rails 7.2 it hands back a connection that has not connected yet,
-      # so an unreachable database looked available.
-      def db_available?
-        PermissionForge::PermissionSet.connection_pool.with_connection(&:verify!)
-        true
-      rescue ActiveRecord::ActiveRecordError
-        false
+      # [name, SensitiveColumns::Match] of the first name that looks like personal data.
+      def first_sensitive(names, sensitive)
+        names.lazy.filter_map { |name| (match = sensitive.match(name)) && [name, match] }.first
+      end
+
+      # What made the field personal data (SensitiveColumns::Match#source).
+      def matched_by(match)
+        match.filter_parameter? ? "is named by the application's filter_parameters" : "matches the GDPR pattern '#{match.pattern}'"
+      end
+
+      # What connecting to the gem's database raised, nil when it answered
+      # (DatabaseReach.problem).
+      #
+      # @return [Exception, nil]
+      def database_problem
+        DatabaseReach.problem
       end
 
       def database_step(name)
         yield
       rescue *DATABASE_STEP_ERRORS => e
-        Rails.logger&.warn "[PermissionForge] Boot check #{name} skipped: the database could not be read (#{e.class})."
+        Warnings.emit(:"boot_check_skipped.#{name}",
+                      "Boot check #{name} skipped: the database could not be read (#{e.class}).")
       end
 
       # The boot step did not run: the first request or job that reaches the
-      # database applies auto-applied masking (MaskingSync).
-      def database_unreachable
+      # database applies auto-applied masking (MaskingSync). The cause is
+      # named: "not configured" (an adapter's ArgumentError) reads otherwise
+      # than "refused". The ping loads the gem's models (and Active Record
+      # with them, as Rails' lazy load would): an error raised there — a
+      # host's on_load(:active_record) hook — is named the same way.
+      def database_unreachable(problem)
         MaskingSync.reset!
-        Rails.logger&.warn '[PermissionForge] The database could not be reached at boot; the boot checks that ' \
-                           'read it (security warnings) were skipped. Auto-applied masking is applied at the first ' \
-                           'request or job that reaches the database.'
+        Warnings.emit(:database_unreachable,
+                      "The database could not be reached at boot, or the gem's models could not be loaded " \
+                      "(#{problem.class}: #{problem.message.lines.first&.strip}); " \
+                      'the boot checks that read it (security warnings) were skipped. Auto-applied masking is ' \
+                      'applied at the first request or job that reaches the database.')
       end
 
       # The boot warnings that only read the configuration.
       def warn_configuration(config)
-        warn_memory_cache_in_production(config)
+        CacheWarnings.call(config)
         warn_basic_auth_without_credentials(config)
         warn_api_authorization_gap(config)
-        config.tenantless_admin_warning&.then { |message| Rails.logger&.warn(message) }
+        warn_api_authorizations_unset(config)
+        config.tenantless_admin_warning&.then { |message| warn_tenantless_admin(message) }
         QueryScopingWarnings.warn_unscoped_detection_raise_in_production(config)
+        WebRequest::StackCheck.check(config)
       end
 
-      def warn_memory_cache_in_production(config)
-        return unless Rails.env.production? && config.cache_backend == :memory
-
-        Rails.logger&.warn '[PermissionForge] WARNING: Using in-process MemoryCache in production. ' \
-                           'Permissions will be inconsistent across Puma workers. ' \
-                           'Configure config.cache_backend = :rails_cache with Redis, Memcached, or SolidCache.'
+      # AdminUiSettings#tenantless_admin_warning is the text; the emitter
+      # puts the prefix on.
+      def warn_tenantless_admin(message)
+        Warnings.emit(:tenantless_admin, message, severity: :security, audience: :server)
       end
 
       def warn_basic_auth_without_credentials(config)
         return unless config.http_basic_auth_enabled
         return if config.http_basic_auth_user.present? && config.http_basic_auth_password.present?
 
-        Rails.logger&.warn '[PermissionForge] HTTP Basic Auth is enabled but credentials are not configured. ' \
-                           'The admin UI will return 401 for all requests. ' \
-                           'Set config.http_basic_auth_user and config.http_basic_auth_password.'
-      end
-
-      def gdpr_match?(field_name, patterns)
-        patterns.any? { |regex, _| field_name.match?(regex) }
+        Warnings.emit(:basic_auth_without_credentials,
+                      'HTTP Basic Auth is enabled but credentials are not configured. The admin UI will return ' \
+                      '401 for all requests. Set config.http_basic_auth_user and config.http_basic_auth_password.',
+                      audience: :server)
       end
 
       # Taken as the per-read selection takes it: a Hash, or anything with

data/lib/permission_forge/cache/base.rb

@@ -46,6 +46,16 @@ module PermissionForge
         false
       end
 
+      # Whether the store keeps what is written to it. A store that keeps
+      # nothing (cache_backend = :null, a :null_store) caches no permission
+      # hash, and cannot carry the token MaskingSync tells other processes
+      # about a newly masked model with.
+      #
+      # @return [Boolean]
+      def keeps_entries?
+        true
+      end
+
       # Writes an entry that never expires — not even under a default expiry
       # the store applies to every entry (a Rails cache configured with
       # expires_in). Here a write without a TTL, which is that already.

data/lib/permission_forge/cache/null_cache.rb

@@ -9,6 +9,11 @@ module PermissionForge
         super
       end
 
+      # Nothing written is kept (see Base#keeps_entries?).
+      def keeps_entries?
+        false
+      end
+
       # @return [nil] always a miss
       def read(_key)
         nil