permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/cache/outcome.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Cache
+    # What one cache-touching operation did to the cached permissions, as
+    # every surface reports it — the terminal (RakeOutput), the admin flash
+    # (CacheConfirmation), the API body and the summary audit event:
+    #
+    # - `confirmed`: true when the store confirmed every removal the
+    #   operation asked for (Cache::Failure reported nothing), false when it
+    #   did not (the old permissions may be served until cache_ttl), nil when
+    #   that is not known where the outcome is made — the invalidation
+    #   follows the surrounding transaction's commit (Cache::Settlement), or
+    #   the summary event is written before the cache work runs;
+    # - `process_local`: the store lives in each process
+    #   (Cache::Base#process_local?: `cache_backend = :memory`, or Rails.cache a
+    #   `:memory_store`), so only the process that ran the operation saw it;
+    # - `in_request`: the operation ran in a server process (the admin or
+    #   the API: Audit::Source 'admin_ui' / 'api', or any code of a web
+    #   server process, a host controller among it: Report.in_request?), so
+    #   on a process-local store that server process did see it and the
+    #   *other* web workers and the job processes kept theirs; false for a
+    #   rake task, a runner, a console or a job process, where every other
+    #   process kept theirs;
+    # - `unconfirmed`: how many users the store did not confirm (nil when not
+    #   known yet);
+    # - `work`: false when the operation did no cache work at all — a dry run
+    #   (.none: `confirmed` nil, `unconfirmed` 0); true otherwise. Only an
+    #   outcome without work carries the key in #to_h (`work: false`), so
+    #   every answer of an operation that did its work keeps its four keys.
+    #   A dry run used to answer `confirmed: true` for work it never did
+    #   (field test round 7, E#55).
+    #
+    # Made by Cache::Report, the one way a service measures an invalidation.
+    #
+    # @api private
+    Outcome = Data.define(:confirmed, :process_local, :unconfirmed, :in_request, :work) do
+      # @param work [Boolean] false only for an operation that did no cache work (.none)
+      def initialize(confirmed:, process_local:, unconfirmed:, in_request:, work: true)
+        super
+      end
+
+      # The outcome of an operation that did no cache work (every dry run):
+      # nothing asked of the store, so nothing confirmed and nobody left
+      # unconfirmed; the store's scope and the origin as measured.
+      #
+      # @param process_local [Boolean]
+      # @param in_request [Boolean]
+      # @return [Outcome]
+      def self.none(process_local:, in_request:)
+        new(confirmed: nil, process_local: process_local, unconfirmed: 0, in_request: in_request, work: false)
+      end
+
+      # The outcome before the cache work has run, or where its result is not
+      # known: nothing confirmed yet, the store's scope and the origin known
+      # already.
+      #
+      # @param process_local [Boolean]
+      # @param in_request [Boolean]
+      # @return [Outcome]
+      def self.deferred(process_local:, in_request:)
+        new(confirmed: nil, process_local: process_local, unconfirmed: nil, in_request: in_request)
+      end
+
+      # An Outcome from what a service answered under `cache:` (its Hash, or
+      # the Outcome itself).
+      #
+      # @param value [Outcome, Hash]
+      # @return [Outcome]
+      def self.wrap(value)
+        return value if value.is_a?(self)
+
+        hash = value.to_h.transform_keys(&:to_sym)
+        new(confirmed: hash[:confirmed], process_local: hash[:process_local] == true, unconfirmed: hash[:unconfirmed],
+            in_request: hash[:in_request] == true, work: hash[:work] != false)
+      end
+
+      # What a summary event records (string keys, as event data is stored).
+      #
+      # @return [Hash]
+      def event_data
+        { 'cache_confirmed' => confirmed, 'process_local' => process_local, 'in_request' => in_request, 'unconfirmed' => unconfirmed }
+      end
+
+      def process_local? = process_local == true
+      def in_request? = in_request == true
+      def confirmed? = confirmed == true
+      # No cache work was done (.none: a dry run).
+      def none? = work == false
+
+      # The outcome as a service answers it: the four keys, and `work: false`
+      # for an operation that did no cache work (#none?).
+      #
+      # @return [Hash]
+      def to_h
+        none? ? super : super.except(:work)
+      end
+
+      # A flash: an alert only when the store said no; a confirmation that is
+      # not known yet is not a failure to announce.
+      #
+      # @return [Symbol] :notice or :alert
+      def flash_kind = confirmed == false ? :alert : :notice
+
+      # Which processes kept their cached permissions: `:none` (a shared
+      # store), `:other_processes` (a process-local store, the operation ran
+      # in a server process: the other web workers and the job processes),
+      # `:servers` (a process-local store, the operation ran elsewhere: every
+      # web and job process).
+      #
+      # @return [Symbol]
+      def kept_by
+        return :none unless process_local?
+
+        in_request? ? :other_processes : :servers
+      end
+    end
+  end
+end

data/lib/permission_forge/cache/rails_cache.rb

@@ -83,6 +83,12 @@ module PermissionForge
         cache_store.is_a?(ActiveSupport::Cache::MemoryStore)
       end
 
+      # A :null_store keeps nothing (the Rails 7.1/7.2 development default
+      # without `bin/rails dev:cache`).
+      def keeps_entries?
+        !cache_store.is_a?(ActiveSupport::Cache::NullStore)
+      end
+
       # An explicit `expires_in: nil` overrides the store's default expiry.
       def write_permanent(key, value)
         cache_store.write(prefixed_key(key), value, expires_in: nil)

data/lib/permission_forge/cache/report.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require_relative 'outcome'
+
+module PermissionForge
+  module Cache
+    # The one way a service measures the cache work it does: runs the block
+    # under Cache::Failure.collect (so a host's override of
+    # invalidate_permissions decides nothing), asks the store once whether it
+    # is process-local, and answers a Cache::Outcome.
+    #
+    #   outcome = Cache::Report.of { user.invalidate_permissions }        # one user
+    #   outcome = Cache::Report.of(user_ids: ids) { ids.each { ... } }   # several: unconfirmed counted per user
+    #
+    # Measured inside a caller's transaction the outcome is pending
+    # (#deferred?, the one reading): the invalidations follow its commit.
+    #
+    #   report = Cache::Report.new                 # when the summary event is written inside the measured block
+    #   report.pending.event_data                  # the scope known in advance, nothing confirmed yet
+    #   report.measure { ... }.value
+    #   report.outcome(user_ids: ids)
+    #
+    # @api private
+    class Report
+      # @return [Object] what the measured block returned
+      attr_reader :value
+
+      class << self
+        # Measures the block's cache work.
+        #
+        # @param user_ids [Array, nil] the users invalidated (nil: one, unnamed)
+        # @return [Outcome] pending (#deferred?) inside a caller's transaction
+        def of(user_ids: nil, &)
+          measure(&).outcome(user_ids: user_ids)
+        end
+
+        # @return [Report] measured; `value` holds what the block returned
+        def measure(&)
+          new.measure(&)
+        end
+      end
+
+      # Runs the block, collecting the cache failures reported inside it.
+      # Whether the work waits for a caller's transaction is read here, once,
+      # before the first block (#deferred?).
+      #
+      # @return [Report] self
+      def measure
+        @deferred = PermissionForge::OpenTransaction.current ? true : false if @deferred.nil?
+        @collected = Failure.collect { @value = yield }
+        self
+      end
+
+      # The one reading of "deferred" for every operation that measures its
+      # cache work: a caller's transaction was open when it was measured
+      # (OpenTransaction.current), so the invalidations follow its commit
+      # (the rows' own after_commit, Cache::Settlement) and nothing is
+      # confirmed yet. False before anything was measured.
+      #
+      # @return [Boolean]
+      def deferred? = @deferred == true
+
+      # Whether the store lives in this process only — asked once per report.
+      #
+      # @return [Boolean]
+      def process_local?
+        @process_local = PermissionForge.cache.process_local? if @process_local.nil?
+        @process_local
+      end
+
+      # Whether the operation runs in a server process (Report.in_request?).
+      #
+      # @return [Boolean]
+      def in_request?
+        @in_request = Report.in_request? if @in_request.nil?
+        @in_request
+      end
+
+      # The one definition of "the operation ran in a server process": the
+      # audit context says it came from the admin or the API, or this process
+      # is a web server (Warnings.server_process?: a host controller, or a
+      # job run inline by Puma, whatever its audit source). A rake task, a
+      # runner, a console or a job process is a process of its own.
+      #
+      # @return [Boolean]
+      def self.in_request?
+        REQUEST_SOURCES.include?(PermissionForge::Audit::Source.current) || PermissionForge::Warnings.server_process?
+      end
+
+      # The audit sources of a request a server process serves.
+      REQUEST_SOURCES = %w[admin_ui api].freeze
+
+      # Those of `user_ids` whose invalidation the store confirmed.
+      #
+      # @param user_ids [Array]
+      # @return [Array]
+      def confirmed(user_ids)
+        collected.confirmed(user_ids)
+      end
+
+      # The outcome before the measurement (the summary event of a service
+      # that invalidates after writing it records this).
+      #
+      # @return [Outcome]
+      def pending
+        Outcome.deferred(process_local: process_local?, in_request: in_request?)
+      end
+
+      # The outcome of an operation that does no cache work (a dry run):
+      # Outcome.none, with the store's scope and the origin as this report
+      # reads them.
+      #
+      # @return [Outcome]
+      def none
+        Outcome.none(process_local: process_local?, in_request: in_request?)
+      end
+
+      # The outcome of a dry run, measured nowhere (Report#none).
+      #
+      # @return [Outcome]
+      def self.none
+        new.none
+      end
+
+      # @param user_ids [Array, nil] the users invalidated, to count the
+      #   unconfirmed ones (nil: one unnamed — any failure counts as one)
+      # @param unconfirmed [Integer, nil] a count the caller made itself
+      #   (PermissionCacheClearer counts by slice)
+      # @return [Outcome] pending while #deferred?
+      def outcome(user_ids: nil, unconfirmed: nil)
+        return pending if deferred?
+
+        unconfirmed ||= count_unconfirmed(user_ids)
+        Outcome.new(confirmed: unconfirmed.zero?, process_local: process_local?, unconfirmed: unconfirmed, in_request: in_request?)
+      end
+
+      private
+
+      def collected
+        @collected || Failure::Collected.new
+      end
+
+      def count_unconfirmed(user_ids)
+        return user_ids.size - confirmed(user_ids).size if user_ids
+
+        collected.to_a.empty? ? 0 : 1
+      end
+    end
+  end
+end

data/lib/permission_forge/cache/user_keys.rb

@@ -15,7 +15,9 @@ module PermissionForge
     # another version never reads an entry it would misread. An invalidation
     # removes the keys of the previous namespaces as well
     # (PREVIOUS_ENTRY_NAMESPACES), so a change made through either version
-    # reaches both. The stamp is not namespaced: every version must see it.
+    # reaches both — for one minor version after a bump (0.15 dropped the
+    # bare keys of 0.13; none is listed now). The stamp is not namespaced:
+    # every version must see it.
     #
     # An invalidation removes the base entries, and reads nothing: the
     # per-context variants of a user with conditional sets cannot be reached
@@ -30,8 +32,10 @@ module PermissionForge
     # @api private
     module UserKeys
       ENTRY_NAMESPACE = 'v2'
-      # '' is the bare key of 0.13. Drop in 0.15.
-      PREVIOUS_ENTRY_NAMESPACES = [''].freeze
+      # The namespaces of the previous entry format, removed by every
+      # invalidation for one minor version after a bump ('' would be a bare
+      # key). Empty since 0.15, which dropped the bare keys of 0.13.
+      PREVIOUS_ENTRY_NAMESPACES = [].freeze
 
       module_function
 
@@ -118,7 +122,7 @@ module PermissionForge
         [current, previous]
       end
 
-      # `key`, of this namespace, in another one ('' : the bare key of 0.13).
+      # `key`, of this namespace, in another one ('' : a bare key).
       def in_namespace(key, namespace)
         bare = key.delete_prefix("#{ENTRY_NAMESPACE}:")
         namespace.empty? ? bare : "#{namespace}:#{bare}"

data/lib/permission_forge/cache_warnings.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  # Boot warnings about a cache store that does not reach other processes.
+  # Called by BootChecks once per boot; only the configuration and the
+  # store's class are read. Each warning goes through Warnings.emit, which
+  # decides the channel (in development the terminal as well as the log:
+  # the boot logs before `bin/rails server` attaches its console logger, and
+  # `bin/rails runner`, the console and `db:seed` never do).
+  #
+  # A store of its own in every process (Cache::Base#process_local?:
+  # cache_backend = :memory, or Rails.cache / a store instance that is an
+  # ActiveSupport MemoryStore): an invalidation reaches the cache of the
+  # process that makes it, so a change made elsewhere (a console,
+  # `bin/rails runner`, a rake task, another Puma worker) leaves this
+  # process's cached permission hashes as they were until cache_ttl.
+  #
+  # Such a store, or one that keeps nothing (Cache::Base#keeps_entries?:
+  # cache_backend = :null, a :null_store), also cannot carry the token
+  # MaskingSync announces a newly masked model with, while a masking setting
+  # takes its models from the Resource rows (MaskedModels.row_driven?). In
+  # development MaskingSync re-reads the Resource names from the database
+  # instead (MaskingSync.database_recheck?); elsewhere a model first named in
+  # another process stays unmasked here until a restart.
+  #
+  # @api private
+  module CacheWarnings
+    # The remedies for masking that cannot be announced, in every warning.
+    MASKING_REMEDIES = 'Use a cache store every process shares (Redis, Memcached, Solid Cache; ' \
+                       'in development also :file_store), or include PermissionForge::Concerns::MaskedAttributes ' \
+                       'in each model that holds personal data and set config.auto_apply_masked_attributes = false ' \
+                       '(the recommended production setup), or list the models in ' \
+                       'config.auto_apply_masked_attributes. See docs/masked-attributes.md.'
+
+    # What store_description adds about a :memory_store in development.
+    DEVELOPMENT_DEFAULT = ', the Rails development default'
+
+    module_function
+
+    # @param config [Configuration]
+    # @return [void]
+    def call(config)
+      if Rails.env.production?
+        warn_in_production(config)
+      elsif Rails.env.development?
+        warn_in_development(config)
+      end
+    end
+
+    def warn_in_production(config)
+      cache = PermissionForge.cache
+      if cache.process_local?
+        Warnings.emit(:cache_process_local,
+                      'Using an in-process permission cache in production (cache_backend = :memory, or ' \
+                      'Rails.cache is a :memory_store). Permissions will be inconsistent across Puma workers: a ' \
+                      'revoked permission stays in use in the other workers until cache_ttl. ' \
+                      'Configure config.cache_backend = :rails_cache with Redis, Memcached, or SolidCache.', severity: :security)
+      end
+      return unless unannounced_masking?(cache)
+
+      Warnings.emit(:cache_unannounced_masking,
+                    "#{masking_setting} takes its models from the Resource rows, but the cache store is " \
+                    "#{store_description(config, cache)}: it cannot tell the other processes that a Resource row " \
+                    'names a new model. A model first named by a row committed in another process (another ' \
+                    'worker, a console, a rake task) stays unmasked in this process until it restarts. ' \
+                    "#{MASKING_REMEDIES}", severity: :security)
+    end
+
+    # Rails 8.0+ generates `config.cache_store = :memory_store` for
+    # development (7.1/7.2: :memory_store after `bin/rails dev:cache`,
+    # :null_store otherwise), and the generated initializer caches through
+    # Rails.cache.
+    def warn_in_development(config)
+      cache = PermissionForge.cache
+      Warnings.emit(:cache_stale_permissions, stale_permissions_warning(config)) if cache.process_local?
+      Warnings.emit(:cache_development_masking, development_masking_warning(config, cache)) if unannounced_masking?(cache)
+    end
+
+    # Printed by every development process that boots (a server, a console,
+    # `bin/rails runner`, `db:seed`), so it speaks of processes, not of
+    # "this server".
+    def stale_permissions_warning(config)
+      "Development: the permission cache is #{store_description(config, PermissionForge.cache)}, " \
+        'one per process. A permission change made in one process (a console, `bin/rails runner`, ' \
+        "a rake task or db:seed) invalidates only that process's cache: a running server keeps the " \
+        "permissions it has cached until cache_ttl (#{config.cache_ttl.inspect} s) or a restart. " \
+        "Changes made in the server's own admin UI apply there at once. To share the cache between " \
+        'processes, set config.cache_store = :file_store, "tmp/cache/store" in ' \
+        'config/environments/development.rb (with config.cache_backend = :rails_cache), or set ' \
+        'config.cache_backend = :null in development (no caching). See docs/configuration.md#cache-consistency.'
+    end
+
+    def development_masking_warning(config, cache)
+      "Development: #{masking_setting} takes its models from the Resource rows, and the cache " \
+        "store is #{store_description(config, cache)}: it cannot tell a running server that a Resource row " \
+        'committed from a console, `bin/rails runner` or a rake task names a new model. In development ' \
+        'the server re-reads the Resource names from the database instead (one query at most every ' \
+        "#{MaskingSync::DATABASE_RECHECK} s); in production a process would mask such a model only after a " \
+        "restart. #{MASKING_REMEDIES}"
+    end
+
+    # A row-driven masking setting with a store that cannot carry
+    # MaskingSync's token to another process.
+    def unannounced_masking?(cache)
+      MaskedModels.row_driven? && (cache.process_local? || !cache.keeps_entries?)
+    end
+
+    def masking_setting
+      config = PermissionForge.configuration
+      names = { 'auto_apply_masked_attributes' => config.auto_apply_masked_attributes,
+                'mask_virtual_attributes' => config.mask_virtual_attributes }
+      on = names.reject { |_name, value| MaskedModels::OFF.include?(value) || value.is_a?(Array) }
+      "auto-applied masking (#{on.map { |name, value| "#{name} = #{value.inspect}" }.join(', ')})"
+    end
+
+    # How the warnings name the store. A :memory_store is what Rails
+    # generates for development (DEVELOPMENT_DEFAULT): said in a development
+    # boot only — a production boot with one has chosen it (field test
+    # round 8, E#66).
+    #
+    # @param env [ActiveSupport::EnvironmentInquirer] the environment booting
+    def store_description(config, cache, env: Rails.env)
+      return kept_nothing_description(config) unless cache.keeps_entries?
+
+      case config.cache_backend
+      when :memory then 'in memory (cache_backend = :memory)'
+      when :rails_cache then "an in-memory store (Rails.cache is a :memory_store#{DEVELOPMENT_DEFAULT if env.development?})"
+      else 'an in-memory store (cache_backend is an ActiveSupport::Cache::MemoryStore)'
+      end
+    end
+
+    def kept_nothing_description(config)
+      case config.cache_backend
+      when :null then 'one that keeps nothing (cache_backend = :null)'
+      when :rails_cache then 'one that keeps nothing (Rails.cache is a :null_store)'
+      else 'one that keeps nothing (cache_backend is an ActiveSupport::Cache::NullStore)'
+      end
+    end
+  end
+end

data/lib/permission_forge/concerns/auto_permission_scoping.rb

@@ -107,6 +107,7 @@ module PermissionForge
         def pf_build_auto_scope
           current_user = PermissionForge.current_user
           return pf_nil_user_auto_scope unless current_user
+          return pf_no_read_access_auto_scope(current_user) if PermissionForge::RecordReadAccess.denied?(current_user, self)
 
           # Resolve the rules once — permissions_hash is a cache read per
           # call, and this hook runs on every relation build: those of this
@@ -130,6 +131,17 @@ module PermissionForge
           )
         end
 
+        # A signed-in user the model's Resource chain grants no read_access,
+        # under no_read_access_strategy :deny (RecordReadAccess): no rows,
+        # access.denied once per request.
+        def pf_no_read_access_auto_scope(current_user)
+          PermissionForge::Audit::Runtime.denied(
+            PermissionForge::Audit::Runtime::DENIED,
+            reason: PermissionForge::RecordReadAccess::REASON, model: self, via: 'auto_scope', user: current_user, once: true
+          )
+          none
+        end
+
         # Fail closed for :deny AND :raise — raising from inside a default_scope
         # would detonate in consoles, rake tasks, and view-layer counts, so the
         # strictest safe behavior is an empty relation (documented deviation).
@@ -148,9 +160,14 @@ module PermissionForge
         # Filter-type rules only: join-type rules inside a default_scope would
         # break includes/count/pluck and duplicate rows, so they remain the job
         # of permission_scoped (a boot warning fires when join rules exist while
-        # Level 1 is enabled).
+        # Level 1 is enabled). A join type this version does not know joins
+        # nothing — the applier makes such a rule match nothing — so it applies
+        # here too: skipped, it would leave the default scope wider than
+        # find_by and permission_scoped.
         def pf_filter_rule?(rule)
-          PermissionForge::PermissionSetRule.filter_join_type?(rule[:join_type])
+          join_type = rule[:join_type]
+          PermissionForge::PermissionSetRule.filter_join_type?(join_type) ||
+            !PermissionForge::Services::PermissionRuleApplier::JOIN_METHODS.key?(join_type.to_s)
         end
       end
     end

data/lib/permission_forge/concerns/has_tenant_scoping.rb

@@ -76,7 +76,7 @@ module PermissionForge
           return all unless config.tenant_enabled? && tenant_scoping_applied?
 
           column = config.resolved_tenant_column
-          return unscoped if tenant_id.nil? || !column_names.include?(column.to_s)
+          return unscoped if tenant_id.nil? || !PermissionForge::SchemaRead.column?(self, column.to_s, ignored: false)
 
           unscoped.where(column => [tenant_id, nil])
         end

data/lib/permission_forge/concerns/has_uuid.rb

@@ -11,7 +11,7 @@ module PermissionForge
       included do
         before_create :generate_uuid, if: -> { respond_to?(:uuid) && uuid.blank? }
 
-        validates :uuid, uniqueness: true, allow_nil: true
+        validates :uuid, uniqueness: { message: ->(*) { I18n.t('permission_forge.validations.taken') } }, allow_nil: true
       end
 
       private

data/lib/permission_forge/concerns/keeps_copied_values.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Concerns
+    # A copy (Services::Clonable: `record.dup`) names what its original names.
+    # The checks a row gets when it is new or when an attribute changes —
+    # an operator or join type this version knows, a mask strategy that is
+    # one, an IP list of addresses — would refuse a copy of a row stored
+    # before them (or written past the model), and with it the whole copy
+    # of the set: a 500 in the admin's Duplicate. The copy keeps its
+    # original's stored values instead and behaves exactly like it (the rule
+    # matches nothing, the field masks fully, the condition never passes);
+    # `rake permission_forge:audit` reports both rows.
+    #
+    #   keeps_copied :operator, :join_type
+    #   validates :operator, ..., if: -> { !copied_unchanged?(:operator) && (new_record? || ...) }
+    #
+    # @api private
+    module KeepsCopiedValues
+      extend ActiveSupport::Concern
+
+      included do
+        class_attribute :pf_copied_attributes, instance_writer: false, default: [].freeze
+      end
+
+      class_methods do
+        # @param attributes [Array<Symbol>] the attributes a copy keeps unchecked while it holds the original's value
+        # @return [void]
+        def keeps_copied(*attributes)
+          self.pf_copied_attributes = (pf_copied_attributes + attributes.map(&:to_s)).uniq.freeze
+        end
+      end
+
+      def initialize_dup(other)
+        super
+        @pf_copied = attributes.slice(*pf_copied_attributes).freeze
+      end
+
+      private
+
+      # Whether this row is a copy and each attribute still holds what the
+      # original held: a check-on-change validation is not due for it.
+      def copied_unchanged?(*names)
+        !@pf_copied.nil? && names.all? { |name| @pf_copied.key?(name.to_s) && @pf_copied[name.to_s] == self[name] }
+      end
+    end
+  end
+end

data/lib/permission_forge/concerns/masked_attributes/alias_access.rb

@@ -36,8 +36,10 @@ module PermissionForge
         # The module a class's alias readers and writers live in.
         class AccessorModule < Module; end
 
-        # `id_value`, which Rails itself aliases to `id`, stays Rails': `id`
-        # is the primary key reader, not the reader of a column called id.
+        # `id_value`, which Rails itself aliases to `id` (every model up to
+        # Rails 8.1; from 8.2 only a model with a composite key, the others
+        # get a plain reader), stays Rails': `id` is the primary key reader,
+        # not the reader of a column called id.
         UNMASKED_TARGET = 'id'
 
         CREATION = Mutex.new
@@ -61,11 +63,19 @@ module PermissionForge
             accessors.redefine_method(:"#{name}=", &writer(klass, name, declared))
           end
 
+          # The unmasked read is the one Rails' own alias reader makes: on
+          # Rails 8.2 `_read_attribute!` (it raises MissingAttributeError for
+          # an attribute the query did not load; `_read_attribute` takes no
+          # block there), before it `_read_attribute` with the block that
+          # raises. Which one is decided once, when the accessor is defined.
           def self.reader(klass, name, declared)
+            raising = klass.method_defined?(:_read_attribute!) || klass.private_method_defined?(:_read_attribute!)
             proc do
               target = klass.attribute_aliases.fetch(name, declared)
               if is_a?(MaskedAttributes) && pf_masked_reader?(target)
                 read_attribute(target) { |missing| missing_attribute(missing, caller) }
+              elsif raising
+                _read_attribute!(target)
               else
                 _read_attribute(target) { |missing| missing_attribute(missing, caller) }
               end

data/lib/permission_forge/concerns/masked_attributes/virtual_readers.rb

@@ -102,14 +102,16 @@ module PermissionForge
 
           def pf_warn_virtual_readers_unmasked(error)
             method = PermissionForge.configuration.extra_fields_method
-            Rails.logger&.warn("[PermissionForge] SECURITY warning: the virtual readers #{name} declares are NOT " \
-                               "masked on the model: #{name}.#{method} raised #{error.class}: #{error.message}. " \
-                               'Fix it and restart, or call pf_mask_virtual_readers with explicit names.')
+            PermissionForge::Warnings.emit("virtual_readers.unmasked.#{name}",
+                                           "the virtual readers #{name} declares are NOT masked on the model: " \
+                                           "#{name}.#{method} raised #{error.class}: #{error.message}. Fix it and " \
+                                           'restart, or call pf_mask_virtual_readers with explicit names.',
+                                           severity: :security)
           end
 
           def pf_virtual_reader?(name)
             return false unless name.match?(READER_NAME)
-            return false if Array(primary_key).map(&:to_s).include?(name) || columns_hash.key?(name)
+            return false if Array(primary_key).map(&:to_s).include?(name) || PermissionForge::SchemaRead.column?(self, name, ignored: false)
 
             attribute_names.include?(name) || (!pf_framework_method?(name) && pf_argumentless_reader?(name))
           end