permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/record_read_access.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  # Whether a signed-in user's record reads of a model are refused whole,
+  # before any row-level rule: the one definition behind
+  # `config.no_read_access_strategy`, asked by find_by / find_by! /
+  # permission_scoped (PermissionScopedFindable) and the default scope
+  # (AutoPermissionScoping) before they hand the rules to
+  # Services::PermissionRuleApplier.
+  #
+  # Under :rules_only (the default) never: the reads apply the rules of the
+  # user's entries, and a user with no entry, or one that does not grant
+  # read_access, has no rules and gets every row (can_read? is the check).
+  # Under :deny (the strict preset) whenever the user's entries along the
+  # class's Resource chain do not grant read_access
+  # (ResourceChain.readable?): no entry at all, or one of them without read
+  # — whatever took it away (no Permission Set grants it, a Muting
+  # Permission Set, a Resource renamed off its model, a granting set whose
+  # activation conditions do not pass or cannot be judged). View All and
+  # Modify All skip the rules of a readable entry only.
+  #
+  # With nobody signed in nil_user_strategy decides; the rules are lifted
+  # where they always were (the host's without_permission_scope, the
+  # gem's own suspension of the default scope), and this with them.
+  #
+  # @api private
+  module RecordReadAccess
+    # The reason access.denied carries.
+    REASON = :no_read_access
+
+    module_function
+
+    # @param user [#permissions_hash] the signed-in user
+    # @param klass [Class] the model class read
+    # @param configuration [PermissionForge::Configuration]
+    # @return [Boolean]
+    def denied?(user, klass, configuration: PermissionForge.configuration)
+      configuration.deny_record_reads_without_read_access? &&
+        !ResourceChain.readable?(user, ResourceChain.names(klass))
+    end
+
+    # What NotAuthorizedError#failure_messages says for such a denial, in
+    # the current locale.
+    #
+    # @param klass [Class]
+    # @return [String]
+    def failure_message(klass)
+      I18n.t('permission_forge.denials.no_read_access', resource: ResourceChain.names(klass).first || klass.name)
+    end
+  end
+end

data/lib/permission_forge/resource_chain.rb

@@ -42,8 +42,8 @@ module PermissionForge
     # @param resource_name [String, Symbol]
     # @return [Array<Symbol>]
     def names_for(resource_name)
-      klass = resource_name.to_s.safe_constantize
-      klass.is_a?(Class) && klass.respond_to?(:base_class) ? names(klass) : [resource_name.to_sym]
+      klass = ModelLookup.model_for(resource_name)
+      klass ? names(klass) : [resource_name.to_sym]
     end
 
     # The user's resource entries along the chain, nearest first.
@@ -92,6 +92,18 @@ module PermissionForge
       entries(user, names).first&.dig(:permissions, flag) == true
     end
 
+    # Whether the user may read the class's records at all: an entry along
+    # the chain, and every one of them grants read_access — a class cannot
+    # be more readable than an entry it answers to, as for its fields
+    # (#unreadable?). A subclass with no entry of its own reads as its base.
+    # Asked through RecordReadAccess.denied?.
+    #
+    # @return [Boolean]
+    def readable?(user, names)
+      resource_entries = entries(user, names)
+      resource_entries.any? && !unreadable?(resource_entries)
+    end
+
     # @return [Symbol, nil] :view_all or :modify_all when one of them lets
     #   the user past the rules of an entry
     def bypass_reason(permissions)

data/lib/permission_forge/schema_read/ordered_types.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'concurrent/map'
+
+module PermissionForge
+  module SchemaRead
+    # Whether PostgreSQL can compare values of a type as a rule does (`=`,
+    # `<>`, `<`, `>`, `IN`, `BETWEEN`): the type — a domain's base type, a
+    # range through `anyrange` — has a default btree operator class whose
+    # family holds `=` and `<` for it. `xml`, `point`, `polygon` and `path`
+    # have no `=`, `hstore` no `<` (its btree operators are `#<#`...). Asked
+    # once per process, database and type (one catalog query, in a savepoint);
+    # a type the database does not know (`to_regtype` answers NULL) has none.
+    # A failed query answers no for that call only and is asked again next
+    # time.
+    #
+    # @api private
+    module OrderedTypes
+      @answers = Concurrent::Map.new
+
+      class << self
+        # @param model [Class] a model on the connection
+        # @param sql_type [String] the column's SQL type, from the schema
+        # @return [Boolean]
+        def ordered?(model, sql_type)
+          key = [model.connection_db_config.name, sql_type.to_s]
+          known = @answers[key]
+          return known unless known.nil?
+
+          answer = ask(model, sql_type)
+          answer.nil? ? false : (@answers[key] = answer)
+        end
+
+        # Forgets the answers (tests).
+        #
+        # @return [void]
+        def reset!
+          @answers.clear
+        end
+
+        private
+
+        # true / false, or nil when the catalog could not be asked (not kept).
+        def ask(model, sql_type)
+          model.connection_pool.with_connection do |connection|
+            connection.transaction(requires_new: true) do
+              connection.select_value(sql(connection, sql_type), 'SCHEMA') == true
+            end
+          end
+        rescue ActiveRecord::StatementInvalid
+          nil
+        end
+
+        def sql(connection, sql_type)
+          <<~SQL.squish
+            WITH given AS (SELECT COALESCE(NULLIF(t.typbasetype, 0), t.oid) AS oid FROM pg_catalog.pg_type t
+                           WHERE t.oid = to_regtype(#{connection.quote(sql_type.to_s)})),
+                 input AS (SELECT CASE b.typtype WHEN 'r' THEN to_regtype('anyrange')::oid
+                                                 WHEN 'm' THEN to_regtype('anymultirange')::oid ELSE b.oid END AS oid
+                           FROM given JOIN pg_catalog.pg_type b ON b.oid = given.oid)
+            SELECT COUNT(DISTINCT o.oprname) = 2 FROM input
+            JOIN pg_catalog.pg_opclass c ON c.opcintype = input.oid AND c.opcdefault
+            JOIN pg_catalog.pg_am a ON a.oid = c.opcmethod AND a.amname = 'btree'
+            JOIN pg_catalog.pg_amop ao ON ao.amopfamily = c.opcfamily AND ao.amoplefttype = c.opcintype
+                                      AND ao.amoprighttype = c.opcintype
+            JOIN pg_catalog.pg_operator o ON o.oid = ao.amopopr AND o.oprname IN ('=', '<')
+          SQL
+        end
+      end
+    end
+  end
+end

data/lib/permission_forge/schema_read.rb

@@ -0,0 +1,335 @@
+# frozen_string_literal: true
+
+require 'concurrent/map'
+require 'concurrent/atomic/atomic_fixnum'
+
+module PermissionForge
+  # The one place the gem reads a model's columns, and whether a table is
+  # there. Rails keeps both in its schema cache, read once per process (or
+  # loaded from a schema cache dump), so a column a migration added while
+  # the process was up — a running development server, an old process in a
+  # rolling deploy — is not in it: a rule naming it would be refused, Sync
+  # fields would not offer it, its timestamps would not be read-only.
+  #
+  # So a read that answers "no" — the name is not a column of the table, the
+  # table is not there — reads the schema again first: the table's column
+  # names are asked of the database (one metadata query) and, only when they
+  # differ from what the cache holds, the model's column information is reset
+  # (reset_column_information) and the answer asked again. A process whose
+  # schema did not change never resets a model on the request path (a reset
+  # drops the model's generated attribute methods while other threads use
+  # it); the question the builder asks for every `_id` field's `_uuid`
+  # variant costs one query per model and name per process. A name is read
+  # again at most once per process while the table's columns stay as they
+  # were read: a name found missing by a re-read is
+  # *confirmed* missing and costs nothing afterwards, until something else
+  # reads the table again (a reload in development, a migration in the
+  # process, another re-read). A column that is there costs nothing extra:
+  # no query, no lock.
+  #
+  # A list of columns cannot tell what it is missing. The reads that build
+  # rows or reports from one — the field generator, Sync fields, the
+  # admin's model catalog, the GDPR audit, the rule builder's columns — pass
+  # `verify: true`: the column names are asked of the database (one
+  # metadata query, no reset) and the schema is read again when they differ.
+  # That is also how a removed column leaves a process: until such a read, a
+  # column the cache still lists is answered as there (asking the database
+  # on every "yes" would cost a query on the request path); after it, every
+  # reader agrees it is gone, without reading again.
+  #
+  # Columns are the table's, as the database has them (`columns(model)`,
+  # `ignored_columns` included, as a rule's column is resolved) or the
+  # model's (`column_names`, `ignored_columns` excluded), as each caller says.
+  #
+  # @example
+  #   PermissionForge::SchemaRead.column?(Customer, 'region')   # read again once if the cache says no
+  #   PermissionForge::SchemaRead.columns(Customer, verify: true).keys
+  #   PermissionForge::SchemaRead.table?(Customer, 'suppliers')
+  #
+  # @api private
+  module SchemaRead
+    # What the last re-read of a table found: `names` confirmed missing in
+    # the columns identified by `token` (the cached columns hash's
+    # object_id), and the `columns` it read.
+    Confirmed = Data.define(:token, :names, :columns)
+
+    # Seconds a table found missing stays missing before table? asks the
+    # database again.
+    TABLE_RECHECK = 30
+
+    @confirmed = Concurrent::Map.new
+    @claims = Concurrent::Map.new
+    @tables = Concurrent::Map.new
+    @enum_labels = Concurrent::Map.new
+    @enum_claims = Concurrent::Map.new
+    @rereads = Concurrent::AtomicFixnum.new
+
+    class << self
+      # The table's columns by name (`ignored_columns` included).
+      #
+      # @param model [Class] an Active Record model with a table
+      # @param verify [Boolean] compare with the database first (see the module comment)
+      # @return [Hash{String => ActiveRecord::ConnectionAdapters::Column}]
+      def columns(model, verify: false)
+        verify!(model) if verify
+        table_columns(model)
+      end
+
+      # The model's column names (`ignored_columns` excluded).
+      #
+      # @param model [Class]
+      # @param verify [Boolean] compare with the database first
+      # @return [Array<String>]
+      def column_names(model, verify: false)
+        verify!(model) if verify
+        model.column_names
+      end
+
+      # The table's column of that name, read again once when there is none.
+      # A block picks the column out of the table's columns instead of the
+      # exact name (a lookup that ignores case where the database does).
+      #
+      # @param model [Class]
+      # @param name [String, Symbol]
+      # @yieldparam columns [Hash{String => ActiveRecord::ConnectionAdapters::Column}]
+      # @yieldreturn [ActiveRecord::ConnectionAdapters::Column, nil]
+      # @return [ActiveRecord::ConnectionAdapters::Column, nil]
+      def column(model, name, &pick)
+        name = name.to_s
+        pick ||= ->(columns) { columns[name] }
+        pick.call(table_columns(model)) || (pick.call(table_columns(model)) if reread_missing?(model, [name]))
+      end
+
+      # @param model [Class]
+      # @param name [String, Symbol]
+      # @param ignored [Boolean] whether a column the model ignores (`ignored_columns`) counts
+      # @return [Boolean] whether the table has the column (read again once before "no")
+      def column?(model, name, ignored: true)
+        name = name.to_s
+        has?(model, name) { ignored ? table_columns(model).key?(name) : model.column_names.include?(name) }
+      end
+
+      # The names among `names` that are columns of the model
+      # (`ignored_columns` excluded), the table read again once when some are
+      # not.
+      #
+      # @param model [Class]
+      # @param names [Array<String>]
+      # @return [Array<String>] in the order of `names`
+      def columns_among(model, names)
+        names = names.map(&:to_s)
+        found = names & model.column_names
+        return found if found.size == names.size || !reread_missing?(model, names - found)
+
+        names & model.column_names
+      end
+
+      # The block's answer about `name`; when it is "no" and the table has no
+      # such column, the table is read again once and the block asked again.
+      # For a predicate that also counts what is not a column (an attribute,
+      # an alias, a method, a virtual field).
+      #
+      # @param model [Class]
+      # @param name [String, Symbol]
+      # @yieldreturn [Boolean]
+      # @return [Boolean]
+      def has?(model, name)
+        return true if yield
+
+        reread_missing?(model, [name.to_s]) && yield ? true : false
+      end
+
+      # Whether the connection has a data source (a table or a view) named
+      # `table`; a "no" is asked of the database again, at most once every
+      # TABLE_RECHECK seconds per model and name (a table a migration
+      # creates later is found within that interval, and a name that stays
+      # missing — a rule qualified with an alias — costs one query per
+      # interval, never one per call).
+      #
+      # @param model [Class] a model on the connection
+      # @param table [String] the name as written
+      # @return [Boolean]
+      def table?(model, table)
+        table = table.to_s
+        cache = schema_cache(model)
+        return true if cache.data_source_exists?(table)
+
+        claim = [slot(model), table]
+        return false unless table_recheck_due?(claim)
+
+        reread_table?(cache, table, claim)
+      end
+
+      # Whether `label` is one of the labels of the native enum type `type`
+      # (PostgreSQL: `CREATE TYPE ... AS ENUM`), as the database has them.
+      # The labels are read once per process and type (one catalog query);
+      # a label they lack is asked of the database again once, while the
+      # labels stay as they were read: one a migration added while the
+      # process runs (`ALTER TYPE ... ADD VALUE`). A type the database does
+      # not know has no labels.
+      #
+      # @param model [Class] a model on the connection whose table has the column
+      # @param type [String] the column's SQL type: the enum type's name
+      # @param label [String]
+      # @return [Boolean]
+      def enum_label?(model, type, label)
+        key = [model.connection_db_config.name, type.to_s]
+        labels = @enum_labels.compute_if_absent(key) { enum_labels_of(model, type) }
+        return true if labels.include?(label)
+
+        claim = [key, labels.object_id, label]
+        return false unless @enum_claims.put_if_absent(claim, true).nil?
+
+        @rereads.increment
+        (@enum_labels[key] = enum_labels_of(model, type)).include?(label)
+      rescue ActiveRecord::StatementInvalid
+        # The labels could not be read (a timeout, a lost connection): no
+        # for this call only — nothing kept, asked again next time.
+        @enum_claims.delete(claim) if claim
+        false
+      end
+
+      # Whether PostgreSQL can compare values of the type (SchemaRead::OrderedTypes).
+      #
+      # @param model [Class] a model on the connection
+      # @param sql_type [String] the column's SQL type, from the schema
+      # @return [Boolean]
+      def ordered_type?(model, sql_type) = OrderedTypes.ordered?(model, sql_type)
+
+      # @return [Integer] how many times this process read a table's schema again
+      def rereads
+        @rereads.value
+      end
+
+      # Forgets what was confirmed missing (tests).
+      #
+      # @return [void]
+      def reset!
+        [@confirmed, @claims, @tables, @enum_labels, @enum_claims].each(&:clear)
+        OrderedTypes.reset!
+      end
+
+      private
+
+      # The type's labels in their order; none for a type the database does
+      # not know (to_regtype answers NULL where a cast would raise and fail
+      # the statement, and with it the caller's transaction).
+      def enum_labels_of(model, type)
+        model.connection_pool.with_connection do |connection|
+          connection.transaction(requires_new: true) do
+            connection.select_values(<<~SQL.squish, 'SCHEMA').freeze
+              SELECT enumlabel::text FROM pg_catalog.pg_enum
+              WHERE enumtypid = to_regtype(#{connection.quote(type.to_s)}) ORDER BY enumsortorder
+            SQL
+          end
+        end
+      end
+
+      # Claims the re-read of a missing table when none ran in the last
+      # TABLE_RECHECK seconds (one thread wins; the others answer "no").
+      def table_recheck_due?(key)
+        now = Time.now.to_f
+        last = @tables[key]
+        return @tables.put_if_absent(key, now).nil? if last.nil?
+        return false if now - last < TABLE_RECHECK
+
+        @tables.replace_pair(key, last, now)
+      end
+
+      # The table asked of the database again, once per claim. A read that
+      # fails (a timeout, a lost connection) answers no for this call only:
+      # the claim is let go, so the next call asks again.
+      def reread_table?(cache, table, claim)
+        cache.clear_data_source_cache!(table)
+        @rereads.increment
+        cache.data_source_exists?(table)
+      rescue ActiveRecord::StatementInvalid, ActiveRecord::ConnectionNotEstablished
+        @tables.delete(claim)
+        false
+      end
+
+      def table_columns(model)
+        schema_cache(model).columns_hash(model.table_name)
+      end
+
+      # The pool's schema cache, never `model.connection`'s: that reader
+      # leases a connection to the thread for good and, from Rails 7.2,
+      # raises under ActiveRecord.permanent_connection_checkout =
+      # :disallowed. The pool's cache takes a connection only for the read
+      # it makes, and is the one the connection's own cache is. Rails 7.1
+      # has no pool cache (nor :disallowed): the connection's.
+      def schema_cache(model)
+        pool = model.connection_pool
+        pool.respond_to?(:schema_cache) ? pool.schema_cache : model.connection.schema_cache
+      end
+
+      # Reads the table again when one of `names` is no column of it and was
+      # not confirmed missing by the read the cache holds. true when it did.
+      # Two threads asking at once: one reads, the other answers from what
+      # the cache holds (no lock is held while Rails resets the model).
+      def reread_missing?(model, names)
+        columns = table_columns(model)
+        missing = names - columns.keys
+        return false if missing.empty? || confirmed?(model, columns, missing)
+
+        claim = [slot(model), columns.object_id, missing.sort]
+        return false unless @claims.put_if_absent(claim, true).nil?
+
+        begin
+          reread!(model, missing)
+        ensure
+          @claims.delete(claim)
+        end
+        true
+      end
+
+      def confirmed?(model, columns, missing)
+        entry = @confirmed[slot(model)]
+        !entry.nil? && entry.token == columns.object_id && (missing - entry.names).empty?
+      end
+
+      # Confirmed missing after the read: the names asked for now, the ones
+      # confirmed before, and every column an earlier read had (the cache
+      # being dropped, the last re-read) — a removed column among them — that
+      # the new read lacks.
+      def reread!(model, missing, live: live_names(model))
+        known = missing | known_names(model)
+        @rereads.increment
+        model.reset_column_information unless current?(model, live)
+        fresh = table_columns(model)
+        @confirmed[slot(model)] = Confirmed.new(token: fresh.object_id, names: (known - fresh.keys).freeze, columns: fresh.keys.freeze)
+      end
+
+      # The columns the cache and the model hold and, from the last re-read,
+      # the columns it read and the names it confirmed missing.
+      def known_names(model)
+        before = @confirmed[slot(model)]
+        table_columns(model).keys | model.columns_hash.keys | (before ? before.names + before.columns : [])
+      end
+
+      # What the memo is keyed by: the class's object_id, so that a class
+      # reloaded in development (another class) is read again, and the memo
+      # does not keep the old one alive.
+      def slot(model) = model.object_id
+
+      def verify!(model)
+        live = live_names(model)
+        reread!(model, [], live: live) unless current?(model, live)
+      end
+
+      # Whether both reads Rails keeps — the schema cache's columns and the
+      # model's own (`columns_hash`, which DDL run in the process does not
+      # clear) — are the database's `live` names.
+      def current?(model, live)
+        live.sort == table_columns(model).keys.sort &&
+          model.columns_hash.keys.sort == (live - model.ignored_columns.map(&:to_s)).sort
+      end
+
+      # The table's column names as the database has them now (a metadata
+      # query).
+      def live_names(model)
+        model.connection_pool.with_connection { |connection| connection.columns(model.table_name).map(&:name) }
+      end
+    end
+  end
+end

data/lib/permission_forge/secret_columns.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  # The one definition of "a column that holds a secret", which a record rule
+  # never compares: config.rule_secret_column_patterns (default
+  # Configuration::QueryScopingSettings::DEFAULT_RULE_SECRET_COLUMN_PATTERNS —
+  # `*_digest`, `*token*`, `encrypted_*`, `*_secret*`, `*passw*`, `secret*`,
+  # `api_key` / `private_key` / `secret_key` / `access_key`, `crypted_*`,
+  # `*salt`, `otp_*`; `[]` opts out). A rule on such a column turns the rule into an oracle on
+  # the secret (who may read which records tells its value apart), and the
+  # rule's value (stored, shown in the admin and the API) would be a guess at it.
+  #
+  # Unlike SensitiveColumns (personal data, which a rule may well compare:
+  # an owner's email) it judges the column a rule names: the name after the
+  # last dot, in any case. Readers: PermissionSetRule's validation (a new
+  # rule, a change of its column or path, and on a rule stored before a
+  # change of its value or operator), the admin's rule builder (not
+  # offered), the security audit's secret_rule_columns finding and Home's
+  # card for the rules stored before (they keep evaluating as before).
+  #
+  # @api private
+  class SecretColumns
+    # @param configuration [Configuration]
+    def initialize(configuration: PermissionForge.configuration)
+      @configuration = configuration
+    end
+
+    # @param name [String, Symbol, nil] a column name, qualified or not (`table.column`)
+    # @return [Boolean]
+    def secret?(name)
+      !pattern_for(name).nil?
+    end
+
+    # @param name [String, Symbol, nil]
+    # @return [Regexp, nil] the first pattern the column matches
+    def pattern_for(name)
+      column = name.to_s.split('.').last.to_s.downcase
+      return if column.empty?
+
+      Array(@configuration.rule_secret_column_patterns).find { |pattern| column.match?(pattern) }
+    end
+
+    # Whether the column a rule compares holds a secret.
+    #
+    # @param rule [PermissionSetRule]
+    # @return [Boolean]
+    def rule?(rule) = secret?(rule.field_name)
+  end
+end

data/lib/permission_forge/sensitive_columns.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module PermissionForge
+  # The one definition of "this column looks like personal data, and this is
+  # the mask for it". Two sources, in this order: config.gdpr_field_patterns
+  # (pattern => strategy; the alternative that matched names the match) and,
+  # while filter_parameters_integration is on, the host application's
+  # Rails filter_parameters (recommended strategy 'full': what the host hides
+  # from its logs it does not show in the clear either).
+  #
+  # Every reader asks here: the admin's presets, "Sync fields", the Fields
+  # tab and Home's privacy card; the field generator (ResourceFieldGenerator
+  # and so the API's generate_fields and grant_full_access!) under
+  # gdpr_defaults; GdprFieldAuditor (rake permission_forge:audit_masks) and
+  # the security audit's personal_data check; the boot warning about
+  # unmasked personal data. A column one of them calls personal data, they
+  # all do (release_readiness/decision_parity_test.rb).
+  #
+  # @api private
+  class SensitiveColumns
+    # A match: `pattern` names what matched (the alternative of the GDPR
+    # pattern, or 'filter_parameters'), `strategy` the recommended mask,
+    # `source` :gdpr_pattern or :filter_parameters.
+    Match = Struct.new(:pattern, :strategy, :source, keyword_init: true) do
+      def filter_parameter? = source == :filter_parameters
+    end
+
+    FILTER_PARAMETERS = 'filter_parameters'
+
+    # @param configuration [Configuration]
+    # @param filter_parameters [Array, nil] the host's filter_parameters
+    #   (default: Rails.application.config.filter_parameters while the
+    #   integration is on)
+    def initialize(configuration: PermissionForge.configuration, filter_parameters: nil)
+      @configuration = configuration
+      @filter_parameters = filter_parameters
+    end
+
+    # @param column_name [String, Symbol]
+    # @return [Match, nil]
+    def match(column_name)
+      name = column_name.to_s
+      regex, strategy = @configuration.gdpr_field_patterns.find { |pattern, _| name.match?(pattern) }
+      return Match.new(pattern: pattern_label(regex, name), strategy: strategy, source: :gdpr_pattern) if regex
+      return Match.new(pattern: FILTER_PARAMETERS, strategy: 'full', source: :filter_parameters) if filtered_parameter?(name)
+
+      nil
+    end
+
+    # @param column_name [String, Symbol]
+    # @return [Boolean]
+    def sensitive?(column_name)
+      !match(column_name).nil?
+    end
+
+    private
+
+    # Human-ish pattern name for "Matches privacy pattern "email"": the
+    # alternative of the regex that actually matched, stripped of anchors.
+    def pattern_label(regex, name)
+      source = regex.source
+      hit = matching_alternative(source, name) || source.split('|').first
+      hit.to_s.gsub(/\\[Azb]|\.\*|\[[^\]]*\]/, '').delete('^a-z0-9_').delete_prefix('_').delete_suffix('_').presence || source
+    end
+
+    def matching_alternative(source, name)
+      source.split('|').find { |alt| safe_match?(alt, name) }
+    end
+
+    def safe_match?(source, name)
+      name.match?(Regexp.new(source))
+    rescue RegexpError
+      false
+    end
+
+    # A column name is not a request parameter: ActiveSupport::
+    # ParameterFilter matches a String / Symbol entry anywhere in the key,
+    # so Rails' generated `:otp`, `:ssn`, `:salt` would call `footprint`,
+    # `classname`, `persalted` personal data. Here such an entry names a
+    # column when one of the name's segments (split on `_`) starts with it;
+    # a leading or trailing underscore ties it to a segment boundary
+    # (`_key`: a segment after the first starts with `key` — `api_key`, and
+    # also `sort_key`). A Regexp entry matches as it is written; a Proc
+    # entry (it rewrites values) names no column.
+    def filtered_parameter?(name)
+      @filter_patterns ||= host_filter_parameters.filter_map { |entry| filter_pattern(entry) }
+      @filter_patterns.any? { |pattern| name.match?(pattern) }
+    end
+
+    def filter_pattern(entry)
+      case entry
+      when Regexp then entry
+      when String, Symbol then segment_pattern(entry.to_s)
+      end
+    end
+
+    def segment_pattern(entry)
+      core = entry.delete_prefix('_').delete_suffix('_')
+      return if core.empty?
+
+      start = entry.start_with?('_') ? '(?<=_)' : '(?:\\A|(?<=_))'
+      finish = entry.end_with?('_') ? '(?=_)' : ''
+      Regexp.new("#{start}#{Regexp.escape(core)}#{finish}", Regexp::IGNORECASE)
+    end
+
+    def host_filter_parameters
+      return [] unless @configuration.filter_parameters_integration
+      return Array(@filter_parameters) if @filter_parameters
+      return [] unless defined?(Rails) && Rails.application
+
+      Array(Rails.application.config.filter_parameters)
+    end
+  end
+end