permission_forge 0.14.1

data/lib/tasks/permission_forge_audit_events.rake

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+namespace :permission_forge do
+  namespace :audit_events do
+    desc 'Delete audit events older than config.audit_retention_period (DRY_RUN=1 counts only). ACTOR= names who ran it.'
+    task purge: :environment do
+      task_name = 'permission_forge:audit_events:purge'
+      dry_run = %w[1 true].include?(ENV.fetch('DRY_RUN', nil))
+      purge = -> { PermissionForge::Services::AuditEventPurger.call(dry_run: dry_run) }
+      result = begin
+        dry_run ? purge.call : PermissionForge::RakeAudit.changing(task_name, &purge)
+      rescue PermissionForge::ConfigurationError => e
+        warn "Refused: #{e.message}"
+        PermissionForge::RakeAudit.log(task_name, "refused: #{e.message}")
+        exit 1
+      end
+      PermissionForge::RakeAudit.log(task_name, result.to_json)
+
+      if !result[:retention_configured]
+        puts 'Retention is not configured (config.audit_retention_period is nil): nothing was deleted.'
+      elsif dry_run
+        puts "Dry run — #{result[:purged]} audit event(s) older than #{result[:cutoff].iso8601} would be deleted."
+      else
+        puts "Deleted #{result[:purged]} audit event(s) older than #{result[:cutoff].iso8601}."
+      end
+    end
+  end
+end

data/lib/tasks/permission_forge_cache.rake

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+namespace :permission_forge do
+  namespace :cache do
+    desc 'Remove every cached permission hash of every user (by key pattern, or every user through the bulk ' \
+         'invalidation) — once the last process of the previous release is gone (0.14), or to revoke everything ' \
+         'cached at once; the cache is cold afterwards. ACTOR=, REASON='
+    task clear: :environment do
+      task_name = 'permission_forge:cache:clear'
+      result = PermissionForge::RakeAudit.changing(task_name) { PermissionForge::Services::PermissionCacheClearer.call }
+      PermissionForge::RakeAudit.log(task_name, result.map { |key, value| "#{key}=#{value.inspect}" }.join(' '))
+      unconfirmed = result[:unconfirmed].positive? ? " (#{result[:unconfirmed]} not confirmed by the cache store)" : ''
+      done = if result[:strategy] == :pattern
+               'Removed every cached permission hash by key pattern (users not counted)'
+             else
+               "Invalidated the cached permissions of #{result[:users]} user visit(s) in #{result[:tenants]} tenant(s)"
+             end
+      puts "#{done}#{unconfirmed}. The cache is cold: each user rebuilds on their next request."
+      if PermissionForge.cache.process_local?
+        puts 'Only the cache store of this rake process was cleared: an in-memory store (cache_backend :memory, or ' \
+             ':memory_store) lives in each process, so the web and job processes keep their entries until they ' \
+             'restart or the entries expire (cache_ttl). Invalidate the users from inside those processes, or restart them.'
+      end
+    end
+  end
+end

data/lib/tasks/permission_forge_expiration.rake

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+namespace :permission_forge do
+  desc 'Remove expired permission set assignments and invalidate affected users\' cached permissions'
+  task cleanup_expired_assignments: :environment do
+    task_name = 'permission_forge:cleanup_expired_assignments'
+    result = PermissionForge::RakeAudit.changing(task_name) { PermissionForge::Services::ExpiredAssignmentCleaner.call }
+    PermissionForge::RakeAudit.log(task_name, "removed #{result[:removed]}, invalidated #{result[:invalidated]}")
+    if result[:removed].zero?
+      puts 'No expired assignments found.'
+    else
+      puts "Removed #{result[:removed]} expired assignment(s), invalidated #{result[:invalidated]} user(s)."
+    end
+  end
+
+  desc 'Show expired permission set assignments without removing (dry run)'
+  task expired_assignments: :environment do
+    result = PermissionForge::RakeAudit.reporting(
+      'permission_forge:expired_assignments',
+      counts: ->(r) { { expired: r[:expired_count], users: r[:affected_user_ids].size } }
+    ) { PermissionForge::Services::ExpiredAssignmentCleaner.call(dry_run: true) }
+    if result[:expired_count].zero?
+      puts 'No expired assignments found.'
+    else
+      puts "Found #{result[:expired_count]} expired assignment(s) affecting #{result[:affected_user_ids].size} user(s)."
+      puts "User IDs: #{result[:affected_user_ids].join(', ')}"
+      puts 'Run `rake permission_forge:cleanup_expired_assignments` to remove them.'
+    end
+  end
+end

data/lib/tasks/permission_forge_gdpr.rake

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+namespace :permission_forge do
+  desc 'Find permanent permission assignments not reviewed within threshold (default: 90 days)'
+  task stale_assignments: :environment do
+    threshold = ENV.fetch('THRESHOLD_DAYS', 90).to_i
+    result = PermissionForge::RakeAudit.reporting(
+      'permission_forge:stale_assignments',
+      counts: ->(r) { { stale: r[:stale_count], users: r[:affected_user_ids].size, threshold_days: threshold } }
+    ) { PermissionForge::Services::StaleAssignmentAuditor.call(threshold_days: threshold) }
+
+    if result[:stale_count].zero?
+      puts "No stale assignments found (threshold: #{threshold} days)."
+    else
+      puts "Found #{result[:stale_count]} stale assignment(s) affecting #{result[:affected_user_ids].size} user(s):"
+      result[:assignments].each do |a|
+        puts "  User #{a[:user_id]} — #{a[:permission_set] || '(set not found)'} (#{a[:days_stale]} days since last review or grant)"
+      end
+      puts "\nConsider reviewing these assignments or setting expires_at for time-bound access."
+      exit 1
+    end
+  end
+
+  # Supports a GDPR Art. 17 erasure request (Services::DataSubjectErasure).
+  # Removes the person's assignments and group memberships and their cached
+  # permissions, and clears their name labels in the audit log. Run with no
+  # tenant (as here), the labels go in every tenant. What stays: the ids, ip,
+  # request id, reason and data of every audit event, the *_by_id columns on
+  # rows the person created, edited or reviewed, and the person's own record
+  # in the app. Assignments in other tenants stay when a tenant is current.
+  desc "Remove a user's assignments, group memberships and cached permissions, and clear their name labels " \
+       'in the audit log (supports GDPR Art. 17). Ids and other event data stay. USER_ID required; DRY_RUN=true ' \
+       'by default.'
+  task erasure: :environment do
+    user_id = ENV.fetch('USER_ID', nil)
+    dry_run = ENV.fetch('DRY_RUN', 'true') == 'true'
+
+    abort 'USER_ID is required. Usage: rake permission_forge:erasure USER_ID=123' if user_id.blank?
+
+    user = PermissionForge.configuration.user_model.find_by(id: user_id)
+    abort "User not found with ID: #{user_id}" if user.nil?
+
+    task_name = 'permission_forge:erasure'
+    # a dry run changes nothing and writes no event, so it needs no actor
+    result = if dry_run
+               PermissionForge::Services::DataSubjectErasure.call(user: user, dry_run: true)
+             else
+               PermissionForge::RakeAudit.changing(task_name) do
+                 PermissionForge::Services::DataSubjectErasure.call(user: user)
+               end
+             end
+    PermissionForge::RakeAudit.log(task_name, "user #{user_id}, dry_run=#{dry_run}: #{result.except(:permission_sets).to_json}")
+
+    if dry_run
+      puts "Dry run — would remove for user #{user_id}:"
+      puts "  Permission set assignments: #{result[:assignments_count]}"
+      puts "  Group assignments: #{result[:group_assignments_count]}"
+      puts "  Permission sets: #{result[:permission_sets].join(', ')}" if result[:permission_sets].any?
+      puts "\nRun with DRY_RUN=false to execute."
+    else
+      puts "Erasure complete for user #{user_id}:"
+      puts "  Assignments removed: #{result[:assignments_removed]}"
+      puts "  Group assignments removed: #{result[:group_assignments_removed]}"
+      puts "  Cache cleared: #{result[:cache_cleared]}"
+      puts "  Assignments remaining in other tenants: #{result[:assignments_remaining_elsewhere]}"
+      puts '  Kept: audit event ids, ip, request id, reason and data; *_by_id columns; the user record itself.'
+    end
+  end
+end

data/lib/tasks/permission_forge_rls.rake

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+namespace :permission_forge do
+  namespace :rls do
+    desc 'Generate and install Postgres RLS policies from the current rule state (drop + recreate)'
+    task sync: :environment do
+      results = PermissionForge::RLS.sync!
+      results.each do |result|
+        skipped = result[:skipped_rules].size
+        suffix = skipped.positive? ? " (#{skipped} untranslatable rule(s) skipped — see log)" : ''
+        puts "Synced RLS policies for #{result[:table]} (digest #{result[:digest][0, 12]}…)#{suffix}"
+      end
+      puts "#{results.size} table(s) synced."
+    end
+
+    desc 'Report per-table RLS policy drift (rules changed since last sync / policies missing)'
+    task status: :environment do
+      reports = PermissionForge::RLS.drift_report
+      reports.each do |report|
+        state = if report[:in_sync]
+                  'in sync'
+                elsif report[:stored].nil?
+                  'NOT INSTALLED'
+                else
+                  'STALE — run permission_forge:rls:sync'
+                end
+        puts "#{report[:table]}: #{state}"
+      end
+      exit 1 unless reports.all? { |report| report[:in_sync] }
+    end
+
+    desc 'Remove PermissionForge RLS policies and disable row-level security on protected tables'
+    task remove: :environment do
+      PermissionForge::RLS.remove!
+      puts 'RLS policies removed and row-level security disabled on protected tables.'
+    end
+  end
+end