permission_forge 0.14.1 → 0.15.0

data/lib/permission_forge/services/mask_value.rb

@@ -8,6 +8,14 @@ module PermissionForge
     # They do NOT constitute GDPR-compliant anonymization or pseudonymization.
     # See docs/gdpr_masking_disclaimer.md for details.
     #
+    # A strategy name this app does not know — a field row written past the
+    # model, a custom strategy since removed from `config.custom_mask_strategies`,
+    # a blank — never raises on a read path: {.call} masks fully
+    # ({FALLBACK_STRATEGY}) and reports the name once per process (a warning
+    # and the {UNKNOWN_STRATEGY_EVENT} notification); `rake permission_forge:audit`
+    # lists the rows (`unknown_mask_strategies`). {.call!} is the strict form
+    # for the admin preview and the validation.
+    #
     # @api public
     class MaskValue
       BUILT_IN_STRATEGIES = {
@@ -19,42 +27,95 @@ module PermissionForge
 
       STRATEGIES = BUILT_IN_STRATEGIES.keys.freeze
       MASK_CHAR = '*'.freeze
+      # The strategy applied in place of one this app does not know: the strictest built-in.
+      FALLBACK_STRATEGY = 'full'.freeze
+      # Published once per process for each strategy name this app does not know
+      # (payload: `strategy`, the name as stored; `fallback`, what was applied).
+      UNKNOWN_STRATEGY_EVENT = 'mask_strategy_unknown.permission_forge'.freeze
+
+      REPORTED_MUTEX = Mutex.new
+      @reported = Set.new
 
       # @return [Hash{String => #call}] the built-in strategies merged with `config.custom_mask_strategies`
       def self.strategies
         custom = PermissionForge.configuration.custom_mask_strategies
         return BUILT_IN_STRATEGIES if custom.blank?
 
-        BUILT_IN_STRATEGIES.merge(custom)
+        BUILT_IN_STRATEGIES.merge(custom.transform_keys(&:to_s))
       end
 
-      # Masks a value with a built-in or custom strategy.
+      # Whether `strategy` names a built-in or configured custom strategy.
+      # @param strategy [String, Symbol, nil]
+      # @return [Boolean]
+      def self.known?(strategy)
+        !strategy.nil? && strategies.key?(strategy.to_s)
+      end
+
+      # Masks a value with a built-in or custom strategy. A strategy this app
+      # does not know masks fully and is reported once per process per name:
+      # a read never raises.
       # @param value [Object]
       # @param strategy [String] `full`, `email`, `last4`, `first1_last4` or a custom one
       # @return [Object] the masked value (nil stays nil)
-      def self.call(value, strategy: 'full')
+      def self.call(value, strategy: FALLBACK_STRATEGY)
         return value if value.nil?
 
         str = value.to_s
         return str if str.empty?
 
-        new(str, strategy).call
+        new(str, resolve(strategy)).call
+      end
+
+      # Masks a value, strictly: a strategy this app does not know raises (the
+      # admin preview, the validation — never a read path).
+      # @param value [Object]
+      # @param strategy [String]
+      # @return [Object] the masked value (nil stays nil)
+      # @raise [ArgumentError] for a strategy this app does not know
+      def self.call!(value, strategy: FALLBACK_STRATEGY)
+        raise ArgumentError, unknown_message(strategy) unless known?(strategy)
+
+        call(value, strategy: strategy)
+      end
+
+      # Forgets which unknown strategies were reported (for tests).
+      # @return [void]
+      def self.reset_reports!
+        REPORTED_MUTEX.synchronize { @reported.clear }
+      end
+
+      # The strategy to apply: the name when this app knows it, else the
+      # fallback, the name reported once.
+      def self.resolve(strategy)
+        return strategy.to_s if known?(strategy)
+
+        report_unknown(strategy.to_s)
+        FALLBACK_STRATEGY
+      end
+
+      def self.report_unknown(name)
+        return unless REPORTED_MUTEX.synchronize { @reported.add?(name) }
+
+        Rails.logger&.warn("[PermissionForge] #{unknown_message(name)} Values are masked fully until the field row or " \
+                           'config.custom_mask_strategies is fixed (rake permission_forge:audit lists the rows).')
+        ActiveSupport::Notifications.instrument(UNKNOWN_STRATEGY_EVENT, strategy: name, fallback: FALLBACK_STRATEGY)
       end
 
+      def self.unknown_message(strategy)
+        "Unknown mask strategy: #{strategy.inspect}. Valid strategies: #{strategies.keys.join(', ')}."
+      end
+      private_class_method :resolve, :report_unknown, :unknown_message
+
+      # @param value [String] a non-empty String
+      # @param strategy [String] a known strategy (see .resolve)
       def initialize(value, strategy)
         @value = value
         @strategy = strategy
-        all_strategies = self.class.strategies
-        return if all_strategies.key?(@strategy)
-
-        raise ArgumentError,
-              "Unknown mask strategy: #{strategy.inspect}. Valid strategies: #{all_strategies.keys.join(', ')}"
       end
 
       # @return [Object] the masked value
       def call
-        all_strategies = self.class.strategies
-        strategy_ref = all_strategies[@strategy]
+        strategy_ref = self.class.strategies[@strategy]
 
         if strategy_ref.is_a?(Symbol)
           send(strategy_ref)

data/lib/permission_forge/services/permission_cache_clearer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative '../cache/report'
+
 module PermissionForge
   module Services
     # Removes every cached permission hash — this version's entries, the
@@ -34,17 +36,22 @@ module PermissionForge
     #
     # @example
     #   result = PermissionCacheClearer.call(actor: 'ops: TCK-12', reason: 'deploy 0.14')
-    #   # => { strategy: :enumerated, users: 240, tenants: 2, unconfirmed: 0 }
-    #   # => { strategy: :pattern, users: nil, tenants: 2, unconfirmed: 0 }
+    #   # => { strategy: :enumerated, users: 240, tenants: 2, unconfirmed: 0,
+    #   #      cache: { confirmed: true, process_local: false, unconfirmed: 0 } }
+    #   # => { strategy: :pattern, users: nil, tenants: 2, unconfirmed: 0, cache: { ... } }
     #
     # `users` counts visits (a user once per tenant); `unconfirmed` the ones
     # the cache store did not confirm (each also reported through
-    # `config.on_cache_failure`, and owed). The audit log: one `cache.cleared`
-    # event per tenant, in that tenant with that tenant's counts, plus one
-    # without a tenant with the totals (`across_tenants`); under :pattern
-    # the counts are not known and the events say `counted: false`.
-    # `actor:` and `reason:` as the other housekeeping services (rake:
-    # ACTOR=, REASON=).
+    # `config.on_cache_failure`, and owed); `cache` is the one Cache::Outcome
+    # every cache-touching operation answers (Cache::Report). The audit log:
+    # one `cache.cleared` event per tenant, in that tenant with that tenant's
+    # counts, plus one without a tenant with the totals (`across_tenants`);
+    # under :pattern the counts are not known and the events say
+    # `counted: false`. Every event carries the outcome's keys, and says
+    # `process_local: true` when the store lives in this process only (a
+    # memory store, Cache::Base#process_local?): the clear then did not reach
+    # the web and job processes, and the audit log says so. `actor:` and
+    # `reason:` as the other housekeeping services (rake: ACTOR=, REASON=).
     #
     # @api public
     class PermissionCacheClearer
@@ -57,7 +64,7 @@ module PermissionForge
       #
       # @param actor [Object, nil] who runs it, for the cache.cleared events
       # @param reason [String, nil] why
-      # @return [Hash] strategy:, users:, tenants:, unconfirmed:
+      # @return [Hash] strategy:, users:, tenants:, unconfirmed:, cache:
       def self.call(...) = new(...).call
 
       def initialize(actor: nil, reason: nil)
@@ -65,18 +72,21 @@ module PermissionForge
         @reason = reason
       end
 
-      # @return [Hash] strategy:, users:, tenants:, unconfirmed:
+      # @return [Hash] strategy:, users:, tenants:, unconfirmed:, cache:
       def call
         audited(actor: @actor, reason: @reason) { clear }
       end
 
       private
 
+      # The whole clear is one measured operation (Cache::Report); the
+      # unconfirmed count is this service's own (by slice).
       def clear
-        result = clear_by_pattern || clear_by_enumeration
+        @report = Cache::Report.new
+        result = @report.measure { clear_by_pattern || clear_by_enumeration }.value
         # retire every memo in this process, as an invalidation does
         PermissionForge.bump_permissions_cache_version!
-        result
+        result.merge(cache: @report.outcome(unconfirmed: result[:unconfirmed]).to_h)
       end
 
       # @return [Hash, nil] nil when the store cannot remove by pattern
@@ -160,9 +170,20 @@ module PermissionForge
         defined?(ActsAsTenant) ? ActsAsTenant.without_tenant(&) : yield
       end
 
-      def record(tenant_id, **data)
-        PermissionForge::Audit.record(EVENT, tenant_id: tenant_id,
-                                             data: data.transform_keys(&:to_s).merge('operation' => 'cache_clear'))
+      # With the outcome of its rows (Cache::Outcome#event_data:
+      # `process_local` says the store lives in this process only, so the
+      # clear did not reach the web and job processes).
+      def record(tenant_id, **counts)
+        PermissionForge::Audit.record(EVENT, tenant_id: tenant_id, data: event_data(**counts))
+      end
+
+      def event_data(unconfirmed:, **counts)
+        { 'operation' => 'cache_clear', **counts.transform_keys(&:to_s), **outcome_data(unconfirmed) }
+      end
+
+      # The outcome's keys, `unconfirmed` among them.
+      def outcome_data(unconfirmed)
+        @report.outcome(unconfirmed: unconfirmed).event_data
       end
 
       # The event without a tenant — recorded with none ambient, so it is one.

data/lib/permission_forge/services/permission_hash_builder.rb

@@ -28,10 +28,12 @@ module PermissionForge
 
       # Resources and their rows in id order, in place. The database returns
       # them in whatever order its plan gives, and order decides: the first row
-      # of a name wins a tie (two fields mapping to one variant — "first
-      # mask_strategy wins"), and rules and actions keep it in the hash. The one
-      # definition: Admin::EffectiveAccess sorts the rows it shows with it. An
-      # unsaved row (no id yet) sorts first.
+      # of a name wins a tie between derived variants (two fields mapping to
+      # one name — "first mask_strategy wins"; an explicit row for the name
+      # decides it whatever the order, FieldPermissionMerger.targets_of), and
+      # rules and actions keep it in the hash. The one definition:
+      # Admin::EffectiveAccess sorts the rows it shows with it. An unsaved row
+      # (no id yet) sorts first.
       def self.sort_rows(permission_set)
         resources = sorted(permission_set.association(:resources))
         resources.each { |resource| RESOURCE_ROWS.each { |rows| sorted(resource.association(rows)) } }
@@ -42,6 +44,23 @@ module PermissionForge
       end
       private_class_method :sorted
 
+      # The flags a granting Resource row grants, each only with the
+      # permission it depends on (ValidatesDependency: edit and delete need
+      # read, Modify All needs View All) — a row written past the validation
+      # grants no more than the dependency allows, so `can_edit?` is never
+      # true where `can_read?` is false. The one definition; the admin's
+      # effective-access view follows it.
+      #
+      # @param resource [Resource, #read_access]
+      # @return [Hash{Symbol => Boolean}] RESOURCE_PERMISSION_OPTIONS
+      def self.granted_flags(resource)
+        read = resource.read_access == true
+        view_all = resource.view_all == true
+        { read_access: read, create_access: resource.create_access == true,
+          edit_access: read && resource.edit_access == true, delete_access: read && resource.delete_access == true,
+          view_all: view_all, modify_all: view_all && resource.modify_all == true }
+      end
+
       # Builds a user's permission hash from their permission sets.
       # @param user [Object]
       # @param permission_sets [Enumerable<PermissionSet>]
@@ -123,7 +142,7 @@ module PermissionForge
 
         add_source_permission_set(resource_data[:source_permission_sets], permission_set)
         merge_resource_permissions(resource_data[:permissions], resource)
-        FieldPermissionMerger.call(fields: resource_data[:fields], resource: resource)
+        FieldPermissionMerger.call(fields: resource_data[:fields], resource: resource, variants: field_variants(resource.name))
         merge_resource_actions(resource_data[:actions], resource)
         merge_permission_set_rules(resource_data[:permission_set_rules], resource)
       end
@@ -172,8 +191,8 @@ module PermissionForge
       end
 
       def merge_resource_permissions(permissions, resource)
-        RESOURCE_PERMISSION_OPTIONS.each do |action|
-          permissions[action] ||= resource.send(action)
+        self.class.granted_flags(resource).each do |action, granted|
+          permissions[action] ||= granted
         end
       end
 
@@ -216,30 +235,34 @@ module PermissionForge
       # row naming a subclass reaches that subclass alone.
       def apply_muting_permission_set(data, permission_set)
         permission_set.resources.select(&:is_active).each do |resource|
-          entries_under(data, resource.name).each do |resource_data|
-            apply_muting_resource(resource_data, permission_set, resource)
+          entries_under(data, resource.name).each do |entry|
+            apply_muting_resource(entry, permission_set, resource)
           end
         end
       end
 
-      # The entries whose chain includes the resource name, in hash order;
-      # each entry's chain is worked out once per build.
+      # [entry name, entry] for the entries whose chain includes the resource
+      # name, in hash order; each entry's chain is worked out once per build.
       def entries_under(data, name)
         muted = name.to_sym
         @entry_chains ||= {}
-        data[:resources].filter_map do |entry_name, resource_data|
-          chain = (@entry_chains[entry_name] ||= PermissionForge::ResourceChain.names_for(entry_name))
-          resource_data if chain.include?(muted)
+        data[:resources].select do |entry_name, _|
+          (@entry_chains[entry_name] ||= PermissionForge::ResourceChain.names_for(entry_name)).include?(muted)
         end
       end
 
       # The set is listed once per entry: one with rows for a base and its
-      # subclass reaches the subclass entry twice.
-      def apply_muting_resource(resource_data, permission_set, resource)
+      # subclass reaches the subclass entry twice. `entry`: [entry name,
+      # entry]; the variants muted are the entry's own (FieldVariants of the
+      # entry's model, not of the muting row's Resource): a base row reaching
+      # a subclass entry mutes the variants the subclass has, as the granting
+      # phase wrote them.
+      def apply_muting_resource(entry, permission_set, resource)
+        entry_name, resource_data = entry
         sources = resource_data[:source_permission_sets]
         add_source_permission_set(sources, permission_set) if sources.none? { |source| source[:uuid] == permission_set.uuid }
         mute_resource_permissions(resource_data[:permissions], resource)
-        mute_field_permissions(resource_data[:fields], resource)
+        mute_field_permissions(resource_data[:fields], resource, field_variants(entry_name))
         mute_fields_of_resource(resource_data[:fields], resource)
         mute_resource_actions(resource_data[:actions], resource)
       end
@@ -267,7 +290,7 @@ module PermissionForge
         end
       end
 
-      def mute_field_permissions(fields, resource)
+      def mute_field_permissions(fields, resource, variants)
         resource.resource_fields.select(&:is_active).each do |field|
           next unless field.is_active
 
@@ -275,12 +298,18 @@ module PermissionForge
           # _cents, etc.), matching the variants the granting phase writes — otherwise
           # a muting set that revokes `user_id` would leave `user_uuid` readable.
           mute_single_field(fields, field.name, field)
-          PermissionForge.configuration.field_variants_for(field.name).each do |variant|
+          variants.call(field.name).each do |variant|
             mute_single_field(fields, variant, field)
           end
         end
       end
 
+      # The field variants of an entry's model (FieldVariants), one lookup
+      # per Resource name for the whole build.
+      def field_variants(name)
+        (@field_variants ||= {})[name.to_s] ||= PermissionForge::FieldVariants.new(name.to_s)
+      end
+
       # A row that mutes read mutes edit too: a field nobody may read is not
       # one they may write (the admin UI's Hide writes both flags; the API
       # and code can write read alone, which left the field writable through

data/lib/permission_forge/services/permission_rule_applier.rb

@@ -8,12 +8,22 @@ module PermissionForge
     # a malformed field_name can never reach SQL as a literal even if a rule was
     # created through a path that bypasses model validation.
     #
+    # A stored rule never raises here. A value of a rule row the applier
+    # cannot interpret — a join type or operator this version does not know,
+    # a path that cannot be followed, a field name that is not a name or
+    # names a column its table does not have or a table that is not there, a
+    # value the column cannot hold — makes the rule match nothing: every
+    # holder is denied every record of the resource, never handed an error
+    # (a 500 for every holder, on every query under auto_query_scoping). The
+    # same reading describes such a rule to the admin and the audit
+    # (Operators::RuleProblem).
+    #
     # @api private
     class PermissionRuleApplier
       # join_type => the relation method that makes the join. The model
       # validates join_type, but a rule row can be written past the model (the
       # tables are shared with other applications): the value is looked up
-      # here, never sent to the relation, and anything else raises.
+      # here, never sent to the relation, and anything else matches nothing.
       JOIN_METHODS = {
         PermissionForge::Operators::Constants::JOINS => :joins,
         PermissionForge::Operators::Constants::LEFT_JOINS => :left_joins,
@@ -49,7 +59,30 @@ module PermissionForge
         @operator_registry = operator_registry
       end
 
-      # @return [Array(ActiveRecord::Relation, Array<String>)] query and failure messages
+      # The query, the denial's messages (`[Forbidden by Rule: <name>] with
+      # message: <failure_message>`, one per denying rule) and the denying
+      # rules (the rule hashes themselves, in the same order); both empty when
+      # nothing denied.
+      #
+      # What a rule says when it denies: its `failure_message` as an admin
+      # wrote it, or — for a rule left without one, or holding the install
+      # migration's English default (PermissionForge::GeneratedText: a rule
+      # created before 0.15 without a message) — the gem's own sentence in
+      # the current locale (permission_forge.denials.rule_default). The one
+      # definition: NotAuthorizedError#failure_messages reads it too. The
+      # permission hash keeps the stored text (it is cached per user, not per
+      # locale): the reading happens here, at denial time.
+      #
+      # @param rule [Hash] a rule hash of the permission hash
+      # @return [String]
+      def self.failure_message_for(rule)
+        message = rule[:failure_message].to_s.strip
+        return message unless message.empty? || PermissionForge::GeneratedText.failure_message?(message)
+
+        I18n.t('permission_forge.denials.rule_default')
+      end
+
+      # @return [Array(ActiveRecord::Relation, Array<String>, Array<Hash>)]
       def call
         report_no_rules if @rules.empty?
         query = @rules.reduce(@model_class.where(nil)) { |q, rule| build_rule_query(q, rule) }
@@ -57,11 +90,12 @@ module PermissionForge
         # Happy path is a single existence check: rule constraints are monotonic
         # (each only removes rows), so if the fully-constrained query still matches
         # the target, no individual rule denied it.
-        return [query, []] if @rules.empty? || query.where(*@args).exists?
+        return [query, [], []] if @rules.empty? || matches?(query)
 
-        # Denial path only: attribute the denial to specific rules for the error
-        # message. The extra per-rule queries here run solely when access is denied.
-        [query, denial_messages]
+        # Denial path only: attribute the denial to the rules that deny the
+        # record (one query per rule, solely when access is denied).
+        denying = denying_rules
+        [query, denying.map { |rule| rule_failure_message(rule) }, denying]
       end
 
       private
@@ -73,89 +107,96 @@ module PermissionForge
       end
 
       def rule_failure_message(rule)
-        "[Forbidden by Rule: #{rule[:name]}] with message: #{rule[:failure_message]}"
+        "[Forbidden by Rule: #{rule[:name]}] with message: #{self.class.failure_message_for(rule)}"
+      end
+
+      # The rules that deny the record each on its own: the model's relation,
+      # that one rule and the args — rules combine with AND, so a rule that
+      # keeps the record on its own did not deny it, whatever the others do.
+      # In rule order. Should no single rule deny (an interplay with a default
+      # scope, say), the cumulative attribution — the first rule whose
+      # addition removes the record, and every rule after it — so a denial
+      # never names no rule.
+      def denying_rules
+        denying = @rules.reject { |rule| matches?(build_rule_query(@model_class.where(nil), rule)) }
+        denying.empty? ? cumulatively_denying_rules : denying
       end
 
-      # Rebuilds the query rule-by-rule, blaming each rule whose addition removes
-      # the target from the result set (the first denying rule and every rule
-      # after it, matching the original cumulative semantics).
-      def denial_messages
-        messages = []
+      def cumulatively_denying_rules
+        denying = []
         @rules.reduce(@model_class.where(nil)) do |q, rule|
           next_query = build_rule_query(q, rule)
-          messages << rule_failure_message(rule) unless next_query.where(*@args).exists?
+          denying << rule if denying.any? || !matches?(next_query)
           next_query
         end
-        messages
+        denying
       end
 
+      def matches?(query)
+        query.where(*@args).exists?
+      end
+
+      # A join type that is none of JOIN_METHODS (written past the model, or
+      # by a newer version) matches nothing: it is never sent to the relation.
+      # Neither is a field_name that is not a name (RuleColumn.name?): quoting
+      # one with a NUL byte raises on PostgreSQL.
       def build_rule_query(query, rule)
+        return query.none unless PermissionForge::Operators::RuleColumn.name?(rule[:field_name])
+
         join_type = rule[:join_type].to_s
         return apply_filter(query, rule) if PermissionForge::PermissionSetRule.filter_join_type?(join_type)
 
-        apply_join(query, rule, join_method(join_type))
-      end
-
-      # @raise [PermissionForge::ConfigurationError] for a join_type that is not one
-      def join_method(join_type)
-        JOIN_METHODS.fetch(join_type) do
-          raise PermissionForge::ConfigurationError,
-                "Rule join_type #{join_type.inspect} is not a join type. Allowed: #{JOIN_METHODS.keys.join(', ')}"
-        end
+        join_method = JOIN_METHODS[join_type]
+        join_method ? apply_join(query, rule, join_method) : query.none
       end
 
+      # A filter rule compares its model's own table: a field_name
+      # qualified with another table (RuleColumn::FOREIGN) matches nothing,
+      # whatever the query joins (RuleProblem :foreign_table).
       def apply_filter(query, rule)
-        column = quoted_column(@model_class.table_name, rule[:field_name])
-        build_query(query, column, rule, [@model_class])
+        field_name = rule[:field_name]
+        target = PermissionForge::Operators::RuleColumn.find(field_name, [@model_class])
+        build_query(query, quoted_column(@model_class.table_name, field_name), rule, target)
+      end
+
+      # A path that cannot be followed (Operators::RulePath#broken?: no such
+      # association, a polymorphic one, a class that cannot be loaded...)
+      # matches nothing: ActiveRecord would raise for the join when the query
+      # runs, and every holder would get an error instead of a denial. A
+      # qualifier is compared with the names the joined query gives its
+      # tables (Operators::RuleSources: the aliases ActiveRecord assigns,
+      # the default scope's and the host's joins included); one it does not
+      # give matches nothing (RuleColumn::FOREIGN / UNRESOLVABLE).
+      def apply_join(query, rule, join_method)
+        association_chain = PermissionForge::Operators::RuleColumn.path_segments(rule[:field_accessor_path])
+        models = joinable_models(association_chain)
+        return query.none unless models
+
+        query = PermissionForge::Operators::RulePath.join(query, join_method, association_chain)
+        field_name = rule[:field_name]
+        joined = field_name.to_s.include?('.') ? PermissionForge::Operators::RuleSources.tables(query) : {}
+        target = PermissionForge::Operators::RuleColumn.find(field_name, models, joined: joined)
+        build_query(query, quoted_column(models.last.table_name, field_name), rule, target)
       end
 
-      # A path that cannot be followed leaves no model to type by: the value
-      # goes as it is, and ActiveRecord raises for the join when the query is built.
-      def apply_join(query, rule, join_method)
-        query, models = resolve_join(query, rule, join_method)
-        column = quoted_column((models.last || @model_class).table_name, rule[:field_name])
-        build_query(query, column, rule, models)
+      # The models along a path ActiveRecord can join, or nil (RulePath#broken?).
+      def joinable_models(association_chain)
+        path = PermissionForge::Operators::RulePath.follow(@model_class, association_chain)
+        path.models unless path.broken?
       end
 
       # Quotes a column reference with the connection's identifier quoting.
       # A dotted field_name is treated as already-qualified path segments and
-      # each segment is quoted independently.
+      # each segment is quoted independently. Through the pool, never the
+      # model's `connection` (it raises under Rails 7.2+
+      # `permanent_connection_checkout = :disallowed`).
       def quoted_column(table, field_name)
-        conn = @model_class.connection
         name = field_name.to_s
-        return name.split('.').map { |seg| conn.quote_column_name(seg) }.join('.') if name.include?('.')
-
-        "#{conn.quote_table_name(table)}.#{conn.quote_column_name(name)}"
-      end
-
-      def resolve_join(query, rule, join_method)
-        return [query, [@model_class]] if rule[:field_accessor_path].blank?
-
-        association_chain = rule[:field_accessor_path].split('.')
-        query = apply_join_to_query(query, join_method, association_chain)
-
-        [query, PermissionForge::Operators::RuleColumn.models_along(@model_class, association_chain)]
-      end
-
-      # @param join_method [Symbol] one of JOIN_METHODS — never a rule's own text
-      def apply_join_to_query(query, join_method, association_chain)
-        if association_chain.size > 1
-          query.public_send(join_method, build_nested_joins_structure(association_chain))
-        else
-          query.public_send(join_method, association_chain.first.to_sym)
-        end
-      end
+        @model_class.connection_pool.with_connection do |conn|
+          next name.split('.').map { |seg| conn.quote_column_name(seg) }.join('.') if name.include?('.')
 
-      def build_nested_joins_structure(association_chain)
-        structure = {}
-        current = structure
-
-        association_chain.each_with_index do |assoc, index|
-          current[assoc.to_sym] = {}
-          current = current[assoc.to_sym] unless index == association_chain.length - 1
+          "#{conn.quote_table_name(table)}.#{conn.quote_column_name(name)}"
         end
-
-        structure
       end
 
       # A built-in operator gets its value in the type of the column it is
@@ -163,17 +204,39 @@ module PermissionForge
       # of that column makes the rule match nothing, whatever the database
       # would have made of the comparison. A custom operator's value is passed
       # as it is and its strategy runs. A field_name that is not a name
-      # (Operators::RuleColumn.name?) matches nothing under any operator.
-      def build_query(query, quoted_column, rule, models)
+      # (Operators::RuleColumn.name?) matches nothing under any operator, and
+      # one naming a column its table does not have matches nothing under a
+      # built-in operator (Operators::ValueTyping.no_column?) — the database
+      # would reject the query, and every holder would get an error instead
+      # of a denial. So does one qualified with a table that is not there
+      # (RuleColumn#unresolvable?) or that is none of the rule's query
+      # (RuleColumn#foreign?), and a rule whose operator the registry
+      # does not have (written past the model, or by a newer version).
+      def build_query(query, quoted_column, rule, target)
         operator = rule[:operator]
-        strategy = @operator_registry.fetch(operator)
-        target = PermissionForge::Operators::RuleColumn.find(rule[:field_name], models)
+        strategy = strategy_for(operator)
+        return query.none if strategy.nil? || target.unresolvable? || target.foreign?
+
         value = PermissionForge::Operators::ValueTyping.call(operator, formatted_field_value(rule), target)
         return query.none if value.equal?(PermissionForge::Operators::ValueTyping::UNUSABLE)
 
         strategy.call(query, quoted_column, rule, value)
       end
 
+      # The operator's strategy from the registry — Operators::Registry, or an
+      # injected one: anything answering `strategies` (a Hash of them) or
+      # `fetch(name)` (a Hash, an object of the host's) — and nil for an
+      # operator it does not have, whether it answers nil or raises for one
+      # (ArgumentError as Registry.fetch does, KeyError as a Hash does).
+      def strategy_for(operator)
+        registry = @operator_registry
+        return registry.strategies[operator] if registry.respond_to?(:strategies)
+
+        registry.fetch(operator)
+      rescue ArgumentError, KeyError
+        nil
+      end
+
       # The only magic value is 'current_user', substituted with the current
       # user's id where one value is compared (in a list it is an element like
       # any other). Every other field_value reaches ValueTyping as it is