phi_attrs 0.4.2 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 28560c0910d408f722f837687ac660a43aa3e708c10366603490270a9bfa3aaf
-  data.tar.gz: 9c58fa96bbff3aecf4d7f63defd5bbdba40e72ddea6073dc3f02337b4b9a4b36
+  metadata.gz: 40fc413631692c1e040f09c38e551985342b0555f0268f61d7ffcddf79522f2c
+  data.tar.gz: e0354aaf9093ae6125ae8a8d227459c59ce19bfd29b2255c1caaece063bf42ea
 SHA512:
-  metadata.gz: 639da1bdf5990baacfd20d427690c2ff7fb4445461ab150aafea3f2b9e611074fc1e6dd3a32198e50de18a5002095e818c38a3deec50c3ac3f75560ad3fe831f
-  data.tar.gz: 0b1efe76204b467c5ea51c48d5df7153e7cf63df3fa89530e2d331d8f9e9b5813673f0feb01443d90ea67bae87eee47ff267e7b319588588f619782e087858ac
+  metadata.gz: acea49a6c616147fcee57e5ea929acd4ee1902d21551c21f76b1c485149005cea09acd4cfe9ad5639e661150604e4b4947d56c3897329f181c74d74c33f60236
+  data.tar.gz: e60d3558f57e9cb626f13b1d3d14669fba2ca9e15503c51be061f1ae797fe270485129134a54d38ddd7c0a5920d2884c6aaa3a79cb2291255341a205ec59f30a

data/README.md

@@ -443,7 +443,7 @@ It is recommended to use the provided `docker-compose` environment for developme
 
 ### Tests
 
-Tests are written using [RSpec](https://rspec.info/) and are setup to use [Appraisal](https://github.com/thoughtbot/appraisal) to run tests over multiple Rails versions. Supported runtimes are Ruby 3.2+ and Rails 7.0 through 8.0.
+Tests are written using [RSpec](https://rspec.info/) and are setup to use [Appraisal](https://github.com/thoughtbot/appraisal) to run tests over multiple Rails versions. Supported runtimes are Ruby 3.2+ and Rails 7.0 through 8.1.
 
     $ bin/run_tests
     or for individual tests:

data/lib/phi_attrs/phi_record.rb

@@ -2,7 +2,7 @@
 
 # Namespace for classes and modules that handle PHI Attribute Access Logging
 module PhiAttrs
-  PhiStackEntry = Struct.new(:phi_access_allowed, :user_id, :reason, :logged, :uuid, keyword_init: true)
+  PhiStackEntry = Struct.new(:phi_access_allowed, :user_id, :reason, :logged, :uuid)
 
   # Module for extending ActiveRecord models to handle PHI access logging
   # and restrict access to attributes.
@@ -12,6 +12,14 @@ module PhiAttrs
   module PhiRecord
     extend ActiveSupport::Concern
 
+    # Serializes method wrapping. Wrapping runs from `after_initialize`, so the
+    # first instances of a model built concurrently on different threads would
+    # otherwise race through the check-then-alias steps below. A thread that
+    # loses that race aliases the unwrapped name to the wrapper, and every later
+    # call recurses until SystemStackError. A Monitor (not a Mutex) is used so
+    # the same thread can take the lock again if building one record builds another.
+    PHI_WRAP_LOCK = Monitor.new
+
     included do
       class_attribute :__phi_exclude_methods
       class_attribute :__phi_include_methods
@@ -73,21 +81,21 @@ module PhiAttrs
       #   Foo.allow_phi!('user@example.com', 'viewing patient record')
       #
       def allow_phi!(user_id = nil, reason = nil)
-        raise ArgumentError, 'block not allowed. use allow_phi with block' if block_given?
+        raise ArgumentError, "block not allowed. use allow_phi with block" if block_given?
 
         user_id ||= current_user
         reason ||= i18n_reason
-        raise ArgumentError, 'user_id and reason cannot be blank' if user_id.blank? || reason.blank?
+        raise ArgumentError, "user_id and reason cannot be blank" if user_id.blank? || reason.blank?
 
         user_id = user_id.to_s.gsub(/[\r\n]/, " ")
         reason = reason.to_s.gsub(/[\r\n]/, " ")
         uuid = SecureRandom.uuid
         __phi_stack.push(PhiStackEntry.new(
-                            phi_access_allowed: true,
-                            user_id: user_id,
-                            reason: reason,
-                            uuid: uuid
-                         ))
+          phi_access_allowed: true,
+          user_id: user_id,
+          reason: reason,
+          uuid: uuid
+        ))
 
         PhiAttrs::Logger.tagged(PHI_ACCESS_LOG_TAG, name, uuid) do
           PhiAttrs::Logger.info("PHI Access Enabled for '#{user_id}': #{reason}")
@@ -137,12 +145,12 @@ module PhiAttrs
       #   end
       #
       def get_phi(user_id = nil, reason = nil, allow_only: nil)
-        raise ArgumentError, 'block required' unless block_given?
+        raise ArgumentError, "block required" unless block_given?
 
         if allow_only.present?
-          raise ArgumentError, 'allow_only must be iterable with each' unless allow_only.respond_to?(:each)
+          raise ArgumentError, "allow_only must be iterable with each" unless allow_only.respond_to?(:each)
           raise ArgumentError, "allow_only must all be `#{name}` objects" unless allow_only.all? { |t| t.is_a?(self) }
-          raise ArgumentError, 'allow_only must all have `allow_phi!` methods' unless allow_only.all? { |t| t.respond_to?(:allow_phi!) }
+          raise ArgumentError, "allow_only must all have `allow_phi!` methods" unless allow_only.all? { |t| t.respond_to?(:allow_phi!) }
         end
 
         # Save this so we don't revoke access previously extended outside the block
@@ -197,7 +205,7 @@ module PhiAttrs
       #   end
       #   # PHI Access Allowed Again
       def disallow_phi
-        raise ArgumentError, 'block required. use disallow_phi! without block' unless block_given?
+        raise ArgumentError, "block required. use disallow_phi! without block" unless block_given?
 
         __phi_stack.push(PhiStackEntry.new(phi_access_allowed: false))
         begin
@@ -213,10 +221,10 @@ module PhiAttrs
       #   Foo.disallow_phi!
       #
       def disallow_phi!
-        raise ArgumentError, 'block not allowed. use disallow_phi with block' if block_given?
+        raise ArgumentError, "block not allowed. use disallow_phi with block" if block_given?
 
         uuid = __uuid_string(__phi_stack)
-        message = __phi_stack.present? ? "PHI access disabled for #{__user_id_string(__phi_stack)}" : 'PHI access disabled. No class level access was granted.'
+        message = __phi_stack.present? ? "PHI access disabled for #{__user_id_string(__phi_stack)}" : "PHI access disabled. No class level access was granted."
 
         __reset_phi_stack
 
@@ -231,11 +239,11 @@ module PhiAttrs
       #   Foo.disallow_last_phi!
       #
       def disallow_last_phi!
-        raise ArgumentError, 'block not allowed' if block_given?
+        raise ArgumentError, "block not allowed" if block_given?
 
         removed_access = __phi_stack.pop
         uuid = __uuid_string(removed_access)
-        message = removed_access.present? ? "PHI access disabled for #{removed_access.user_id}" : 'PHI access disabled. No class level access was granted.'
+        message = removed_access.present? ? "PHI access disabled for #{removed_access.user_id}" : "PHI access disabled. No class level access was granted."
 
         PhiAttrs::Logger.tagged(PHI_ACCESS_LOG_TAG, name, uuid) do
           PhiAttrs::Logger.info(message)
@@ -269,12 +277,12 @@ module PhiAttrs
 
       def __user_id_string(access_list)
         access_list ||= []
-        access_list.map { |c| "'#{c.user_id}'" }.join(',')
+        access_list.map { |c| "'#{c.user_id}'" }.join(",")
       end
 
       def __uuid_string(access_list)
         access_list ||= []
-        Array.wrap(access_list).map(&:uuid).join(',').presence || 'none'
+        Array.wrap(access_list).map(&:uuid).join(",").presence || "none"
       end
 
       def current_user
@@ -289,7 +297,7 @@ module PhiAttrs
 
         i18n_path = [PhiAttrs.translation_prefix] + __path_to_controller_and_action(controller, action)
         i18n_path.push(*__path_to_class)
-        i18n_key = i18n_path.join('.')
+        i18n_key = i18n_path.join(".")
 
         return I18n.t(i18n_key) if I18n.exists?(i18n_key)
 
@@ -299,16 +307,16 @@ module PhiAttrs
       end
 
       def __path_to_controller_and_action(controller, action)
-        module_paths = controller.underscore.split('/')
-        class_name_parts = module_paths.pop.split('_')
-        class_name_parts.pop if class_name_parts[-1] == 'controller'
-        module_paths.push(class_name_parts.join('_'), action)
+        module_paths = controller.underscore.split("/")
+        class_name_parts = module_paths.pop.split("_")
+        class_name_parts.pop if class_name_parts[-1] == "controller"
+        module_paths.push(class_name_parts.join("_"), action)
       end
 
       def __path_to_class
-        module_paths = name.underscore.split('/')
-        class_name_parts = module_paths.pop.split('_')
-        module_paths.push(class_name_parts.join('_'))
+        module_paths = name.underscore.split("/")
+        class_name_parts = module_paths.pop.split("_")
+        module_paths.push(class_name_parts.join("_"))
       end
     end
 
@@ -341,21 +349,21 @@ module PhiAttrs
     #   foo.allow_phi!('user@example.com', 'viewing patient record')
     #
     def allow_phi!(user_id = nil, reason = nil)
-      raise ArgumentError, 'block not allowed. use allow_phi with block' if block_given?
+      raise ArgumentError, "block not allowed. use allow_phi with block" if block_given?
 
       user_id ||= self.class.current_user
       reason ||= self.class.i18n_reason
-      raise ArgumentError, 'user_id and reason cannot be blank' if user_id.blank? || reason.blank?
+      raise ArgumentError, "user_id and reason cannot be blank" if user_id.blank? || reason.blank?
 
       user_id = user_id.to_s.gsub(/[\r\n]/, " ")
       reason = reason.to_s.gsub(/[\r\n]/, " ")
       uuid = SecureRandom.uuid
       @__phi_access_stack.push(PhiStackEntry.new(
-                                 phi_access_allowed: true,
-                                 user_id: user_id,
-                                 reason: reason,
-                                 uuid: uuid,
-                               ))
+        phi_access_allowed: true,
+        user_id: user_id,
+        reason: reason,
+        uuid: uuid
+      ))
 
       PhiAttrs::Logger.tagged(*phi_log_keys, uuid) do
         PhiAttrs::Logger.info("PHI Access Enabled for '#{user_id}': #{reason}")
@@ -398,7 +406,7 @@ module PhiAttrs
     #   end
     #
     def get_phi(user_id = nil, reason = nil)
-      raise ArgumentError, 'block required' unless block_given?
+      raise ArgumentError, "block required" unless block_given?
 
       extended_instances = @__phi_relations_extended.clone
       begin
@@ -419,7 +427,7 @@ module PhiAttrs
     #   foo.disallow_phi!
     #
     def disallow_phi!
-      raise ArgumentError, 'block not allowed. use disallow_phi with block' if block_given?
+      raise ArgumentError, "block not allowed. use disallow_phi with block" if block_given?
 
       removed_access_for_uuid = self.class.__uuid_string(@__phi_access_stack)
 
@@ -429,7 +437,7 @@ module PhiAttrs
         revoke_extended_phi!
         @__phi_access_stack = []
 
-        message = removed_access_for.present? ? "PHI access disabled for #{removed_access_for}" : 'PHI access disabled. No instance level access was granted.'
+        message = removed_access_for.present? ? "PHI access disabled for #{removed_access_for}" : "PHI access disabled. No instance level access was granted."
         PhiAttrs::Logger.info(message)
       end
     end
@@ -449,7 +457,7 @@ module PhiAttrs
     #   # PHI Access Disallowed Here
     #
     def disallow_phi
-      raise ArgumentError, 'block required. use disallow_phi! without block' unless block_given?
+      raise ArgumentError, "block required. use disallow_phi! without block" unless block_given?
 
       add_disallow_flag!
       add_disallow_flag_to_extended_phi!
@@ -468,14 +476,14 @@ module PhiAttrs
     #   foo.disallow_last_phi!
     #
     def disallow_last_phi!(preserve_extensions: false)
-      raise ArgumentError, 'block not allowed' if block_given?
+      raise ArgumentError, "block not allowed" if block_given?
 
       removed_access = @__phi_access_stack.pop
       uuid = removed_access&.uuid
 
       PhiAttrs::Logger.tagged(*phi_log_keys, uuid) do
         revoke_extended_phi! unless preserve_extensions
-        message = removed_access.present? ? "PHI access disabled for #{removed_access.user_id}" : 'PHI access disabled. No instance level access was granted.'
+        message = removed_access.present? ? "PHI access disabled for #{removed_access.user_id}" : "PHI access disabled. No instance level access was granted."
         PhiAttrs::Logger.info(message)
       end
     end
@@ -486,7 +494,7 @@ module PhiAttrs
     # @return [String] the user_id passed in to allow_phi!
     #
     def phi_allowed_by
-      return '__new_record__' if new_record?
+      return "__new_record__" if new_record?
 
       phi_context&.user_id
     end
@@ -497,7 +505,7 @@ module PhiAttrs
     # @return [String] the reason passed in to allow_phi!
     #
     def phi_access_reason
-      return 'new record' if new_record?
+      return "new record" if new_record?
 
       phi_context&.reason
     end
@@ -523,10 +531,10 @@ module PhiAttrs
     #   end
     #
     def require_phi!
-      raise PhiAttrs::Exceptions::PhiAccessException, 'PHI Access required, please call allow_phi or allow_phi! first' unless phi_allowed?
+      raise PhiAttrs::Exceptions::PhiAccessException, "PHI Access required, please call allow_phi or allow_phi! first" unless phi_allowed?
     end
 
-    def reload
+    def reload(options = nil)
       @__phi_relations_extended.clear
       super
     end
@@ -605,7 +613,7 @@ module PhiAttrs
     def all_phi_allowed_by
       ids = (@__phi_access_stack || []).filter_map { |c| "'#{c.user_id}'" }
       ids.concat(self.class.__phi_stack.filter_map { |c| "'#{c.user_id}'" })
-      ids.join(',')
+      ids.join(",")
     end
 
     def all_phi_context_logged?
@@ -657,6 +665,18 @@ module PhiAttrs
       end
       return if self.class.__phi_methods_wrapped.include? method_name
 
+      PHI_WRAP_LOCK.synchronize { phi_wrap_method!(method_name) }
+    end
+
+    # Does the wrapping for `phi_wrap_method`. Must be called with
+    # PHI_WRAP_LOCK held.
+    #
+    # @private
+    #
+    def phi_wrap_method!(method_name)
+      # Another thread may have wrapped this method while we waited for the lock.
+      return if self.class.__phi_methods_wrapped.include? method_name
+
       wrapped_method = :"__#{method_name}_phi_wrapped"
       unwrapped_method = :"__#{method_name}_phi_unwrapped"
 
@@ -696,6 +716,18 @@ module PhiAttrs
       raise NameError, "Undefined relationship in `extend_phi_access`: #{method_name}" unless respond_to?(method_name)
       return if self.class.__phi_methods_to_extend.include? method_name
 
+      PHI_WRAP_LOCK.synchronize { phi_wrap_extension!(method_name) }
+    end
+
+    # Does the wrapping for `phi_wrap_extension`. Must be called with
+    # PHI_WRAP_LOCK held.
+    #
+    # @private
+    #
+    def phi_wrap_extension!(method_name)
+      # Another thread may have wrapped this method while we waited for the lock.
+      return if self.class.__phi_methods_to_extend.include? method_name
+
       wrapped_method = wrapped_extended_name(method_name)
       unwrapped_method = unwrapped_extended_name(method_name)
 
@@ -704,7 +736,7 @@ module PhiAttrs
           relation = send(unwrapped_method, *args, **kwargs, &block)
 
           access_context = phi_context
-          if access_context&.phi_access_allowed && relation.present? && relation_klass(relation).included_modules.include?(PhiRecord)
+          if access_context&.phi_access_allowed && relation.present? && relation_klass(relation).include?(PhiRecord)
             relations = relation.is_a?(Enumerable) ? relation : [relation]
             relations.each do |r|
               next if @__phi_relations_extended.include?(r) && r.phi_allowed?
@@ -730,7 +762,7 @@ module PhiAttrs
     def revoke_extended_phi!(relations = nil)
       relations ||= @__phi_relations_extended
       relations.each do |relation|
-        relation.disallow_last_phi! if relation.present? && relation_klass(relation).included_modules.include?(PhiRecord)
+        relation.disallow_last_phi! if relation.present? && relation_klass(relation).include?(PhiRecord)
       end
       @__phi_relations_extended.subtract(relations)
     end
@@ -739,7 +771,7 @@ module PhiAttrs
     def add_disallow_flag_to_extended_phi!(relations = nil)
       relations ||= @__phi_relations_extended
       relations.each do |relation|
-        relation.add_disallow_flag! if relation.present? && relation_klass(relation).included_modules.include?(PhiRecord)
+        relation.add_disallow_flag! if relation.present? && relation_klass(relation).include?(PhiRecord)
       end
     end
 
@@ -747,7 +779,7 @@ module PhiAttrs
     def remove_disallow_flag_from_extended_phi!(relations = nil)
       relations ||= @__phi_relations_extended
       relations.each do |relation|
-        relation.remove_disallow_flag! if relation.present? && relation_klass(relation).included_modules.include?(PhiRecord)
+        relation.remove_disallow_flag! if relation.present? && relation_klass(relation).include?(PhiRecord)
       end
     end
 

data/lib/phi_attrs/rspec.rb

@@ -27,7 +27,7 @@ RSpec::Matchers.define :allow_phi_access do
     @reason = reason
   end
 
-  # :nocov:
+  # simplecov:disable
   failure_message do |result|
     msgs = []
 
@@ -41,5 +41,5 @@ RSpec::Matchers.define :allow_phi_access do
   failure_message_when_negated do |result|
     "PHI access was allowed by '#{result.phi_allowed_by}', because '#{result.phi_access_reason}'"
   end
-  # :nocov:
+  # simplecov:enable
 end

data/lib/phi_attrs/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PhiAttrs
-  VERSION = "0.4.2"
+  VERSION = "0.5.0"
 end

data/lib/phi_attrs.rb

@@ -1,17 +1,18 @@
 # frozen_string_literal: true
 
-require 'rails'
-require 'active_support'
-require 'request_store'
-require 'securerandom'
-
-require 'phi_attrs/version'
-require 'phi_attrs/configure'
-require 'phi_attrs/railtie' if defined?(Rails)
-require 'phi_attrs/formatter'
-require 'phi_attrs/logger'
-require 'phi_attrs/exceptions'
-require 'phi_attrs/phi_record'
+require "rails"
+require "active_support"
+require "request_store"
+require "securerandom"
+require "monitor"
+
+require "phi_attrs/version"
+require "phi_attrs/configure"
+require "phi_attrs/railtie" if defined?(Rails)
+require "phi_attrs/formatter"
+require "phi_attrs/logger"
+require "phi_attrs/exceptions"
+require "phi_attrs/phi_record"
 
 module PhiAttrs
   def self.log_phi_access(user, message)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: phi_attrs
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.5.0
 platform: ruby
 authors:
 - Wyatt Kirby