permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/operators/rule_problem.rb

@@ -0,0 +1,309 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Operators
+    # The English of RuleProblem#validation_message, by RuleProblem#message_key
+    # (translated under permission_forge.validations.permission_set_rule).
+    RULE_PROBLEM_MESSAGES = {
+      unknown_association: 'names %<association>s, which is not an association of %<model>s',
+      empty_association: 'has an empty association name (two dots in a row, or a dot at the start)',
+      unjoinable_association: 'names %<association>s, an association of %<model>s that a rule cannot join',
+      unjoinable_invalid_definition: 'names %<association>s, an association of %<model>s whose :through, :source ' \
+                                     'or inverse_of names an association that is not there',
+      unjoinable_polymorphic: 'names %<association>s, a polymorphic association of %<model>s: a rule cannot join it',
+      unjoinable_record_dependent_scope: 'names %<association>s, an association of %<model>s whose scope (or one ' \
+                                         'along its :through) takes the record: a rule cannot join it',
+      unjoinable_class_not_loadable: 'names %<association>s, an association of %<model>s whose class cannot be loaded',
+      unknown_column: 'names %<name>s, which is not a column of %<model>s',
+      unknown_table: 'names %<name>s, which is no table of this database',
+      foreign_table: 'names %<name>s, a table that is not %<model>s\'s: a filter rule compares its own table. For a column ' \
+                     'of another table, use a join rule (a join type and the relationship path)',
+      invalid_operator: 'is not a valid operator',
+      invalid_join_type: 'is not a valid join type',
+      encrypted_column: 'names %<name>s, an encrypted attribute of %<model>s: the database holds its ciphertext, so a ' \
+                        'rule can only check whether it is empty (is_null, is_not_null)',
+      pattern_on_non_text: 'matches text only, and %<model>s.%<name>s is a column of type %<type>s: use a condition ' \
+                           'that compares values',
+      unusable_value: 'is not a value %<model>s.%<name>s can hold'
+    }.freeze
+
+    # Why a saved rule matches nothing: the one taxonomy of a "broken" rule
+    # ({KINDS}), which the model's validations, the applier's `none`
+    # (Services::PermissionRuleApplier), the audit (Services::SecurityAudit's
+    # rule check), the admin's Home ("Rules that match nothing"), the admin's
+    # rule sentences and the RLS policy's `FALSE` all read.
+    #
+    # - :unknown_join_type — a join type none of PermissionRuleApplier::JOIN_METHODS;
+    #   `name` is the join type as stored;
+    # - :unknown_association / :unjoinable_association — a join rule whose
+    #   association path cannot be followed ({RulePath#broken?}); `name` is
+    #   the segment, `model` the model it was looked up in, `cause` why
+    #   ({RulePath#cause}: :empty_segment, or one of
+    #   RulePath::UNJOINABLE_CAUSES);
+    # - :unknown_operator — an operator the Registry does not have; `name`
+    #   is the operator as stored;
+    # - :missing_column — a field_name that is no column of its table
+    #   ({RuleColumn#missing?}), or not a name at all ({RuleColumn#malformed?});
+    #   `name` is the column as written, `model` the model whose table lacks it;
+    # - :unknown_table — a field_name qualified with a name that is none of
+    #   the rule's tables, none its join gives and no table of the database
+    #   ({RuleColumn#unresolvable?}); `name` is the qualifier;
+    # - :foreign_table — a filter rule's field_name qualified with a real
+    #   table of another model ({RuleColumn#foreign?}): a filter rule compares
+    #   its model's own table; `name` is the qualifier;
+    # - :encrypted_column — a built-in operator that takes a value, on a
+    #   column that holds ciphertext ({RuleColumn#encrypted?}: an attribute
+    #   declared with `encrypts`); `name` is the column. Refused for a new
+    #   rule and when its column, path, join type or model changes or its
+    #   operator moves off the null checks (on `field_name`);
+    # - :pattern_on_non_text — a LIKE operator (contains, starts_with, ...) on
+    #   a column no pattern can be matched against ({RuleColumn#pattern?}: a
+    #   json column, and on PostgreSQL every column that is not text);
+    #   `name` is the column, `column_type` its SQL type. Refused like a
+    #   value (on `operator`);
+    # - :unusable_value — a value the column cannot hold ({ValueTyping::UNUSABLE});
+    #   `name` is the column, `value` the value as stored. Refused for a new
+    #   or changed rule (on `field_value`); a stored one is listed and denied.
+    #
+    # The kinds are checked in the order the applier decides them, so a rule
+    # with several problems is named by the one that denies it first. A rule
+    # PermissionSetRule refuses on save never gets here; one saved before the
+    # check, or written past the model, does. Whatever cannot be told — a
+    # Resource named after no model, a model file that raises while it loads
+    # — is no column or value problem here (see RuleColumn.for_rule): the
+    # admin and the audit describe, they never fail on a model the
+    # application cannot load. An operator or join type is judged whatever
+    # the model.
+    #
+    # @example
+    #   problem = RuleProblem.for(rule)
+    #   problem&.kind  # => :missing_column
+    #   problem&.name  # => "stauts"
+    #   problem&.key   # => :missing_column
+    class RuleProblem < Data.define(:kind, :name, :model, :cause, :value, :column_type)
+      # Every kind, in the order the applier decides them. A new kind needs a
+      # fixture in test/support/rule_problem_fixtures.rb, an entry in
+      # RULE_PROBLEM_MESSAGES (or MESSAGE_KEYS), one in REMEDIES, and the
+      # message and the `ui.rules.problems` sentence in en, sq and mk.
+      #
+      # The value kinds come last and in ValueTyping.problem's order: an
+      # encrypted column or a LIKE on a column that is not text makes every
+      # value UNUSABLE, so they are told apart before :unusable_value.
+      KINDS = %i[unknown_join_type unknown_association unjoinable_association unknown_operator missing_column
+                 unknown_table foreign_table encrypted_column pattern_on_non_text unusable_value].freeze
+      # What the admin changes to correct the rule, by kind — the rule
+      # builder's control (`permission_set_rules.builder.problem_fixes.<remedy>`):
+      # the join type (Advanced), the relationship, the condition, the field,
+      # or the value.
+      REMEDIES = { unknown_join_type: :join, unknown_association: :path, unjoinable_association: :path,
+                   unknown_operator: :operator, missing_column: :field, unknown_table: :field,
+                   foreign_table: :path, encrypted_column: :field, pattern_on_non_text: :operator,
+                   unusable_value: :value }.freeze
+      # The kinds that are the rule's association path (not its column or value).
+      PATH_KINDS = %i[unknown_association unjoinable_association].freeze
+      # The kinds whose `name` is a name that is not there, shown as stored.
+      VERBATIM_KINDS = %i[missing_column unknown_association unknown_operator unknown_join_type unknown_table foreign_table].freeze
+      # key => the validations.permission_set_rule.* message, where it is not the key itself.
+      MESSAGE_KEYS = { missing_column: :unknown_column, unknown_operator: :invalid_operator,
+                       unknown_join_type: :invalid_join_type }.freeze
+      # What `current_user` is typed as when a stored value is judged: an id
+      # is a number, a uuid or the text of either, whoever the user is — never
+      # a boolean, a date, an address or an enum label. The value is unusable
+      # only when it is for every one of them.
+      ANY_USER_IDS = [0, '00000000-0000-0000-0000-000000000000'].freeze
+
+      # `cause`, `value` and `column_type` are optional: a column problem has
+      # no cause, only a value problem a value, only a LIKE on a column that
+      # is not text a column type.
+      OPTIONAL = { cause: nil, value: nil, column_type: nil }.freeze
+      private_constant :OPTIONAL
+
+      def initialize(kind:, name:, model:, **optional)
+        super(kind:, name:, model:, **OPTIONAL, **optional)
+      end
+
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @return [RuleProblem, nil]
+      def self.for(rule)
+        of_join_type(rule) || of_path(rule) || of_operator(rule) || of_column_or_value(rule)
+      end
+
+      # A join rule whose join type is none the applier joins by.
+      #
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @return [RuleProblem, nil]
+      def self.of_join_type(rule)
+        return unless rule.join_rule?
+
+        join_type = rule.join_type.to_s
+        return if Services::PermissionRuleApplier::JOIN_METHODS.key?(join_type)
+
+        new(kind: :unknown_join_type, name: join_type, model: RuleColumn.rule_model(rule))
+      end
+
+      # The rule's path problem, nil when it has none (a filter rule never
+      # has one: its path is not joined).
+      #
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @return [RuleProblem, nil]
+      def self.of_path(rule)
+        model = RuleColumn.rule_model(rule)
+        return unless model && rule.join_rule?
+
+        path = RulePath.follow(model, RuleColumn.path_segments(rule.field_accessor_path))
+        new(kind: path.reason, name: path.segment, model: path.owner, cause: path.cause) if path.broken?
+      rescue *RuleColumn::UNTELLABLE
+        nil
+      end
+
+      # An operator the Registry does not have.
+      #
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @return [RuleProblem, nil]
+      def self.of_operator(rule)
+        operator = rule.operator.to_s
+        return if Registry.strategies.key?(operator)
+
+        new(kind: :unknown_operator, name: operator, model: RuleColumn.rule_model(rule))
+      end
+
+      # The rule's column problem, else its value problem — the column looked up once.
+      #
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @return [RuleProblem, nil]
+      def self.of_column_or_value(rule)
+        column = RuleColumn.for_rule(rule)
+        of_column(rule, column) || of_value(rule, column)
+      end
+
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @param column [RuleColumn, nil] the rule's column (RuleColumn.for_rule)
+      # @return [RuleProblem, nil]
+      def self.of_column(rule, column = RuleColumn.for_rule(rule))
+        return unless column
+
+        field_name = rule.field_name.to_s
+        return new(kind: :missing_column, name: field_name.split('.').last, model: column.model) if column.missing?
+
+        kind = column_kind(rule, column)
+        new(kind: kind, name: kind == :missing_column ? field_name : field_name.split('.')[-2], model: RuleColumn.rule_model(rule)) if kind
+      end
+
+      # The kind of a column problem named after the rule's own model: a
+      # name that is none, a qualifier naming no table, or — on a filter
+      # rule — another model's table.
+      def self.column_kind(rule, column)
+        if column.malformed? then :missing_column
+        elsif column.unresolvable? then :unknown_table
+        elsif column.foreign? && !rule.join_rule? then :foreign_table
+        end
+      end
+
+      # Why the rule's value is UNUSABLE for its column, as the applier types
+      # it (ValueTyping.problem; `current_user` as each of ANY_USER_IDS): an
+      # encrypted column, a LIKE operator on a column that is not text, or a
+      # value the column cannot hold. Only for a column that was found: the
+      # column's own problem comes first. The first two do not depend on the
+      # value; a blank value is no value problem (the presence validation's
+      # business; a rule being built has none yet).
+      #
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @param column [RuleColumn, nil] the rule's column (RuleColumn.for_rule)
+      # @return [RuleProblem, nil]
+      def self.of_value(rule, column = RuleColumn.for_rule(rule))
+        return unless column_found?(column)
+
+        kind = value_kind(rule, column) or return
+        name = rule.field_name.to_s.split('.').last
+        model = column.model || RuleColumn.rule_model(rule)
+        return new(kind: kind, name: name, model: model, value: rule.field_value) if kind == :unusable_value
+
+        new(kind: kind, name: name, model: model, column_type: column.column&.sql_type)
+      end
+
+      def self.column_found?(column)
+        !column.nil? && !column.malformed? && !column.missing? && !column.unresolvable?
+      end
+
+      # The kind every reading of the value gives (ValueTyping.problem), or nil.
+      def self.value_kind(rule, column)
+        operator = rule.operator.to_s
+        value = rule.field_value
+        return ValueTyping.operator_problem(operator, column) if value.blank?
+
+        values = ValueTyping.current_user?(operator, value) ? ANY_USER_IDS : [value]
+        kinds = values.map { |typed| ValueTyping.problem(operator, typed, column) }
+        kinds.first if kinds.all?
+      rescue *RuleColumn::UNTELLABLE
+        nil
+      end
+      private_class_method :column_found?, :value_kind, :column_kind
+
+      # The rule's path and field name as stored (a filter rule's path is not joined).
+      #
+      # @param rule [PermissionForge::PermissionSetRule]
+      # @return [String] e.g. "ownr.owner_id"
+      def self.written_field(rule)
+        path = rule.field_accessor_path.presence if rule.join_rule?
+        [path, rule.field_name].compact.join('.')
+      end
+
+      # Whether the problem is the rule's association path (not its column,
+      # operator, join type or value).
+      def path? = PATH_KINDS.include?(kind)
+
+      # What the admin changes to correct it (REMEDIES): :join, :path,
+      # :operator, :field or :value.
+      #
+      # @return [Symbol]
+      def remedy = REMEDIES.fetch(kind)
+
+      # Whether `name` is shown as stored (`onwer_id`, `ownr`, `regex`,
+      # `inner`, `nosuch`): a name that is not there has no label — humanized
+      # it would read like a real field.
+      def verbatim? = VERBATIM_KINDS.include?(kind)
+
+      # The admin's sentence for it, under `ui.rules.problems`: the key, by
+      # cause where it has one; `_html` where the name or the value is drawn
+      # as stored (in code).
+      #
+      # @return [Symbol]
+      def ui_key
+        return key if cause
+
+        :"#{kind}#{'_html' if verbatim? || value}"
+      end
+
+      # What the problem is called in the locale files: the kind, keyed by
+      # its cause where it has one — :missing_column, :unknown_association,
+      # :empty_association, :unjoinable_polymorphic, ... (the admin's
+      # `ui.rules.problems.<key>`, the model's validation message).
+      #
+      # @return [Symbol]
+      def key
+        return :empty_association if cause == :empty_segment
+        return kind unless kind == :unjoinable_association && cause
+
+        :"unjoinable_#{cause}"
+      end
+
+      # The `permission_forge.validations.permission_set_rule.*` key of the
+      # validation message: the key, or the message the attribute's own
+      # validator gives (an operator or join type that is not one).
+      #
+      # @return [Symbol]
+      def message_key
+        MESSAGE_KEYS.fetch(key, key)
+      end
+
+      # The validation error PermissionSetRule adds for it, in the current locale.
+      #
+      # @return [String]
+      def validation_message
+        I18n.t("permission_forge.validations.permission_set_rule.#{message_key}",
+               association: name, name: name, model: model&.name, value: value, type: column_type,
+               default: RULE_PROBLEM_MESSAGES.fetch(message_key))
+      end
+    end
+  end
+end

data/lib/permission_forge/operators/rule_sources.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  module Operators
+    # The names a rule's query gives its tables, as a field_name can be
+    # qualified with: the FROM table and each JOIN's table — its alias where
+    # ActiveRecord assigned one (a table joined twice), as the database then
+    # knows it by the alias alone. Read from the relation's Arel join
+    # sources, the aliases ActiveRecord actually assigns — never from the SQL
+    # text, in which a column of an ON clause (`"customers"."supplier_id"`)
+    # reads like a table. A join written as SQL (a host's `joins('INNER JOIN
+    # ...')`) gives the table or alias each of its JOINs names.
+    #
+    # RuleColumn.find compares a qualifier with them: the applier with its
+    # real query (the default scope's and the host's joins included), the
+    # model's validation and the audit with the rule's own join ({.of_join}).
+    # Each name comes with the table it stands for ({.tables}): an alias is
+    # resolved to the model it joins, so an encrypted column reached through
+    # one is seen (RuleColumn).
+    #
+    # @example
+    #   RuleSources.of(Customer.joins(:supplier)) # => ["customers", "suppliers"]
+    #   RuleSources.tables(PfRulePathRecord.joins(:parent))
+    #   # => { "pf_rule_path_records" => "pf_rule_path_records", "parents_pf_rule_path_records" => "pf_rule_path_records" }
+    #
+    # @api private
+    module RuleSources
+      # A word that ends a JOIN's table where an alias would stand.
+      JOIN_KEYWORDS = %w[ON USING INNER LEFT RIGHT FULL CROSS NATURAL JOIN OUTER WHERE LATERAL].freeze
+      # One identifier, bare or quoted the way any adapter quotes one.
+      IDENTIFIER = /"[^"]+"|`[^`]+`|\[[^\]]+\]|[A-Za-z_][\w$]*/
+      # A JOIN of SQL text: its table (possibly qualified) and its alias.
+      STRING_JOIN = /\bJOIN\s+(?<table>(?:#{IDENTIFIER})(?:\s*\.\s*(?:#{IDENTIFIER}))*)(?:\s+(?:AS\s+)?(?<alias>#{IDENTIFIER}))?/i
+
+      class << self
+        # @param relation [ActiveRecord::Relation]
+        # @return [Array<String>]
+        def of(relation)
+          tables(relation).keys
+        end
+
+        # Each name the query gives a table, with the table it stands for (a
+        # table's own name stands for itself; nil when it cannot be told: a
+        # subquery's alias).
+        #
+        # @param relation [ActiveRecord::Relation]
+        # @return [Hash{String => String, nil}]
+        def tables(relation)
+          arel = relation.arel
+          [arel.source.left, *arel.join_sources].flat_map { |node| sources_of(node) }.uniq(&:first).to_h
+        end
+
+        # The names a rule's own join gives (its model's query, the rule's
+        # path joined as the applier joins it), with their tables ({.tables}).
+        #
+        # @param model [Class] the rule's model
+        # @param join_type [String] the rule's join type (an unknown one reads as `joins`)
+        # @param association_chain [Array<String>] the rule's path, split
+        # @return [Hash{String => String, nil}]
+        def of_join(model, join_type, association_chain)
+          join_method = Services::PermissionRuleApplier::JOIN_METHODS.fetch(join_type.to_s, :joins)
+          tables(RulePath.join(model.unscoped, join_method, association_chain))
+        end
+
+        private
+
+        # [[name, table]] for one node of the FROM or a JOIN.
+        def sources_of(node)
+          case node
+          when Arel::Nodes::StringJoin then string_join_sources(node.left.to_s)
+          when Arel::Nodes::Join then sources_of(node.left)
+          when Arel::Table then [[(node.table_alias || node.name).to_s, node.name.to_s]]
+          when Arel::Nodes::TableAlias then [[node.name.to_s, aliased_table(node.relation)]]
+          else []
+          end
+        end
+
+        def aliased_table(relation)
+          relation.name.to_s if relation.is_a?(Arel::Table)
+        end
+
+        def string_join_sources(sql)
+          sql.scan(STRING_JOIN).map do |table, alias_name|
+            name = unquote(table.split('.').last.strip)
+            named = alias_name && !JOIN_KEYWORDS.include?(alias_name.upcase) ? unquote(alias_name.strip) : name
+            [named, name]
+          end
+        end
+
+        def unquote(identifier)
+          identifier.match?(/\A(["`\[]).*["`\]]\z/) ? identifier[1..-2] : identifier
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/operators/value_casters/postgresql_types.rb

@@ -0,0 +1,237 @@
+# frozen_string_literal: true
+
+require 'ipaddr'
+require 'concurrent/map'
+
+module PermissionForge
+  module Operators
+    module ValueCasters
+      # Casters for the column types only PostgreSQL has: `uuid`, `inet`,
+      # `cidr` and native enum types (`CREATE TYPE ... AS ENUM`). PostgreSQL
+      # raises on text it cannot read as such a type (`invalid input syntax
+      # for type uuid: "banana"`), so a value that is not one is UNUSABLE —
+      # the rule matches nothing — instead of failing every holder's query.
+      # The notations taken are narrower than PostgreSQL's own input, so that
+      # what is typed here is always read by it.
+      #
+      # None of these types has a LIKE operator in PostgreSQL ({.pattern?}).
+      module PostgresqlTypes
+        # The text of a UUID as RFC 4122 writes it: 32 hex digits in groups of
+        # 8-4-4-4-12, in either case. The version and variant digits are not
+        # looked at (the nil UUID and newer versions are UUIDs to PostgreSQL).
+        UUID_FORMAT = /\A\h{8}-\h{4}-\h{4}-\h{4}-\h{12}\z/
+
+        # An IPv4 or IPv6 address, then optionally a prefix length — the
+        # notation PostgreSQL's inet and cidr input share (no netmask, no zone).
+        NETWORK_FORMAT = %r{\A[\h:.]+(?:/\d{1,3})?\z}
+
+        # The other notations PostgreSQL's uuid input takes, each read as the
+        # 32 digits it holds: in braces, after `urn:uuid:`, without hyphens.
+        UUID_NOTATIONS = [/\A\{(?<digits>\h{8}-\h{4}-\h{4}-\h{4}-\h{12})\}\z/, /\Aurn:uuid:(?<digits>\h{8}-\h{4}-\h{4}-\h{4}-\h{12})\z/i,
+                          /\A\{?(?<digits>\h{32})\}?\z/].freeze
+
+        # A UUID in lower case, in RFC 4122 notation; anything else — text
+        # that is no UUID, the Integer id `current_user` stands for — is UNUSABLE.
+        UUID = lambda do |value|
+          text = value.is_a?(String) ? value.strip : nil
+          next UNUSABLE unless text
+          next text.downcase if text.match?(UUID_FORMAT)
+
+          digits = UUID_NOTATIONS.lazy.filter_map { |notation| notation.match(text)&.[](:digits) }.first&.delete('-')&.downcase
+          digits ? [digits[0, 8], digits[8, 4], digits[12, 4], digits[16, 4], digits[20, 12]].join('-') : UNUSABLE
+        end
+
+        # An address IPAddr reads, with an optional prefix length, as written.
+        INET = ->(value) { PostgresqlTypes.network(value) || UNUSABLE }
+
+        # A network: no bits set right of the prefix length (PostgreSQL
+        # raises on `10.0.0.5/24` for a cidr column).
+        CIDR = lambda do |value|
+          text = PostgresqlTypes.network(value)
+          next UNUSABLE unless text
+
+          address = text.split('/').first
+          IPAddr.new(text).to_i == IPAddr.new(address).to_i ? text : UNUSABLE
+        end
+
+        # The casters a LIKE pattern means nothing to.
+        PATTERNLESS = [UUID, INET, CIDR].freeze
+
+        # @param value [Object] a rule value
+        # @return [String, nil] the address as written, when IPAddr reads it
+        def self.network(value)
+          text = value.is_a?(String) ? value.strip : nil
+          return unless text&.match?(NETWORK_FORMAT)
+
+          IPAddr.new(text)
+          text
+        rescue IPAddr::Error
+          nil
+        end
+
+        # A native enum type's caster: one of the type's labels, exactly as
+        # the database has it (surrounding spaces aside), else UNUSABLE. The
+        # labels are read from the database (PermissionForge::SchemaRead,
+        # read again once before a label is called missing: one added by a
+        # migration while the process runs). Without the model the labels
+        # cannot be read, and no value is usable.
+        class NativeEnum
+          # @param column [ActiveRecord::ConnectionAdapters::Column] a column of a native enum type
+          # @param model [Class, nil] the model whose table the column is in
+          # @return [NativeEnum]
+          def self.of(column, model)
+            new(column.sql_type, model)
+          end
+
+          # @param type [String] the column's SQL type: the enum type's name
+          # @param model [Class, nil]
+          def initialize(type, model)
+            @type = type
+            @model = model
+          end
+
+          def call(value)
+            return UNUSABLE unless @model && value.is_a?(String)
+
+            [value, value.strip].uniq.find { |label| SchemaRead.enum_label?(@model, @type, label) } || UNUSABLE
+          end
+        end
+
+        # Text PostgreSQL reads itself: a column type no caster here knows
+        # (hstore, money, interval, macaddr, bit, ...) and date and time
+        # text in a notation Temporal does not recognise (`today`, `31 Jan
+        # 2026`). PostgreSQL raises on text it cannot read as the column's
+        # type — for every holder, on every query — so the text is asked of
+        # PostgreSQL once (a CAST in a savepoint) and the answer kept for the
+        # process and database: what it reads is handed over as written,
+        # anything else is UNUSABLE and the rule matches nothing. The caster
+        # wrapped, when there is one, is tried first (a recognised date costs
+        # no query).
+        #
+        # Only a type PostgreSQL can compare is read back: one with a default
+        # btree operator class whose family has `=` and `<`
+        # (SchemaRead.ordered_type?). Reading a value is not comparing it —
+        # `CAST('<a/>' AS xml)` succeeds, but xml, point, polygon and path
+        # have no `=`, hstore no `<` — so a value of any other type is
+        # UNUSABLE (the null checks take none and still work).
+        #
+        # Only a refusal of the value itself is kept: an error of SQLSTATE
+        # class 22 (data exception: invalid input). Any other error — a
+        # statement or lock timeout, a lost connection, an aborted
+        # transaction — denies this read only and is asked again next time.
+        class ReadBack
+          # Answers kept per process before the memo starts over.
+          LIMIT = 4096
+
+          # Builds the caster for one column (ValueCasters.for calls `of`).
+          Factory = Struct.new(:inner) do
+            # @param column [ActiveRecord::ConnectionAdapters::Column]
+            # @param model [Class, nil]
+            # @return [ReadBack]
+            def of(column, model) = ReadBack.new(inner, column.sql_type, model)
+          end
+
+          @answers = Concurrent::Map.new
+
+          class << self
+            # @param inner [#call, nil] the caster tried first
+            # @return [Factory]
+            def wrapping(inner) = Factory.new(inner)
+
+            # Whether PostgreSQL reads `text` as a value of `sql_type`; asked
+            # once per process, database and type.
+            #
+            # @param model [Class] a model on the connection
+            # @param sql_type [String] the column's SQL type, from the schema
+            # @param text [String]
+            # @return [Boolean]
+            def reads?(model, sql_type, text)
+              key = [model.connection_db_config.name, sql_type, text]
+              known = @answers[key]
+              return known unless known.nil?
+
+              answer = cast(model, sql_type, text)
+              return false if answer.nil?
+
+              @answers.clear if @answers.size >= LIMIT
+              @answers[key] = answer
+            end
+
+            # @param value [Object] a rule value
+            # @param numbers [Boolean] whether a number is asked as its text
+            # @return [String, nil] the text PostgreSQL is asked to read
+            def text_of(value, numbers:)
+              return value if value.is_a?(String)
+
+              value.to_s if numbers && value.is_a?(Numeric)
+            end
+
+            # Whether the error is PostgreSQL refusing the value itself
+            # (SQLSTATE class 22, PG::DataException and its subclasses).
+            #
+            # @param error [ActiveRecord::StatementInvalid]
+            # @return [Boolean]
+            def refused_value?(error)
+              defined?(::PG::DataException) ? error.cause.is_a?(::PG::DataException) : false
+            end
+
+            # Forgets the answers (tests).
+            #
+            # @return [void]
+            def reset!
+              @answers.clear
+            end
+
+            private
+
+            # true, false (the value refused: kept), or nil (any other
+            # failure: not kept). A failed statement aborts a PostgreSQL
+            # transaction: the CAST runs in a savepoint of its own.
+            def cast(model, sql_type, text)
+              model.connection_pool.with_connection do |connection|
+                connection.transaction(requires_new: true) do
+                  connection.select_value("SELECT CAST(#{connection.quote(text)} AS #{sql_type})")
+                end
+              end
+              true
+            rescue ActiveRecord::StatementInvalid => e
+              refused_value?(e) ? false : nil
+            end
+          end
+
+          # @param inner [#call, nil]
+          # @param sql_type [String]
+          # @param model [Class, nil] without one PostgreSQL cannot be asked: UNUSABLE
+          def initialize(inner, sql_type, model)
+            @inner = inner
+            @sql_type = sql_type
+            @model = model
+          end
+
+          def call(value)
+            typed = @inner ? @inner.call(value) : UNUSABLE
+            typed.equal?(UNUSABLE) ? read_back(value) : typed
+          end
+
+          private
+
+          # Unless a caster is wrapped (what it refuses as no text stays
+          # refused), a number — the id `current_user` stands for — is asked as its text.
+          def read_back(value)
+            text = ReadBack.text_of(value, numbers: @inner.nil?)
+            return UNUSABLE unless text && @model && SchemaRead.ordered_type?(@model, @sql_type)
+
+            ReadBack.reads?(@model, @sql_type, text) ? value : UNUSABLE
+          end
+        end
+
+        # @param caster [#call] a caster of ValueCasters
+        # @return [Boolean] whether a LIKE pattern can be matched against a
+        #   column of the caster's type
+        def self.pattern?(caster)
+          PATTERNLESS.none? { |patternless| patternless.equal?(caster) } && !caster.is_a?(NativeEnum)
+        end
+      end
+    end
+  end
+end