rhino-rails 4.7.0 → 4.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3da378b6f647733a88cb598ff3b23e06462f6c61494ebbc322fed024e9ba33a9
-  data.tar.gz: e3dec4fcb82201e652e76e01ff7b5d8fa25c1ec61dde9d3b58f688f9a0d4ceb2
+  metadata.gz: 632861555ee3e2508a90ec546b6cb0412368bc141a7d387b2f92698531605b86
+  data.tar.gz: 91b3ad79b1c0b0b492f1f3003e906ce11e9f3fa62e81b067ecfb9c0b7740a025
 SHA512:
-  metadata.gz: a37303c3543f0e140bc5f00371c1d8d8d310a30645a0ef2c3b9bd218d5cebe74e83c3f500f413792ce7496b764832219044739422f4a13f7be1b3dd1fe63bdec
-  data.tar.gz: fc60726be3e23b1da9ddcccc4fc884857608fb412125211b48cad5bfb51596d4986f6db13ed2728b70644f1d2c3a4be2e2e9a5fac5093ba6746783923fc01681
+  metadata.gz: 2c5fee208f22ae88b0531f4075e6183d6d0a17137c43423e7f491dbf341848764ce16418feca131b13c45c4295f6b4a3507eebb52e1e30b2f887dcbcfdd624c1
+  data.tar.gz: 83468b5afe671a2b0313778e57c2f053747129156d643bb85d5543513ea2d02aa6c2b63c4b70bb5f04613cb79bbb21544ba142bb4f127ebf56247581aab4c079

data/lib/rhino/concerns/route_group_context.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Rhino
+  # Places a custom (non-Rhino) controller into a Rhino route group, so the
+  # resource-scope resolver knows whether the request has a tenant boundary.
+  #
+  # Rhino's own generated controllers already publish their group; a controller
+  # you write yourself is outside that chain, so include this concern in it:
+  #
+  #   class Admin::DashboardController < ApplicationController
+  #     include Rhino::RouteGroupContext
+  #     rhino_route_group :admin
+  #
+  #     def summary
+  #       # :admin is declared `tenant: false`, so this spans every organization
+  #       # instead of raising Rhino::MissingTenantContext.
+  #       render json: { tasks: Rhino.query(Task).count }
+  #     end
+  #   end
+  #
+  # Without an explicit `rhino_route_group`, the group is read from the route's
+  # own `route_group` default:
+  #
+  #   get "/api/admin/dashboard", to: "admin/dashboard#summary",
+  #                               defaults: { route_group: "admin" }
+  module RouteGroupContext
+    extend ActiveSupport::Concern
+
+    included do
+      # Inheritable, so a base controller can declare the group for a whole
+      # namespace and subclasses may override it.
+      class_attribute :rhino_route_group_name, instance_writer: false, default: nil
+
+      before_action :rhino_set_route_group
+    end
+
+    class_methods do
+      # Declare the route group this controller's actions belong to.
+      def rhino_route_group(name)
+        self.rhino_route_group_name = name.to_s
+      end
+    end
+
+    private
+
+    # Publish the group for Rhino::Context (and therefore for Rhino.query, the
+    # policies and the permission resolver) for the rest of this request.
+    def rhino_set_route_group
+      return unless defined?(RequestStore)
+
+      # An explicit declaration wins; otherwise fall back to the route's own
+      # `route_group` default, which only exists once a request is bound.
+      resolved = rhino_route_group_name.presence
+      resolved ||= params[:route_group].presence if request
+
+      RequestStore.store[:rhino_route_group] = resolved
+    end
+  end
+end

data/lib/rhino/configuration.rb

@@ -62,7 +62,15 @@ module Rhino
     # captures the subdomain and feeds organization resolution exactly like the
     # path-prefix ":organization" does. Groups without a domain (nil/blank)
     # match any host (default, fully backward compatible).
-    def route_group(name, prefix: "", domain: nil, middleware: [], models: :all, auth: false, hooks: nil)
+    #
+    # The optional `tenant:` keyword declares whether the group has a tenant
+    # boundary. It defaults to true: Rhino.query inside the group fails closed,
+    # raising Rhino::MissingTenantContext when an organization-scopable model is
+    # queried with no organization resolved. Pass `tenant: false` for a group
+    # that legitimately spans every organization — a back office or admin group
+    # whose operators see all tenants' rows.
+    def route_group(name, prefix: "", domain: nil, middleware: [], models: :all, auth: false, hooks: nil,
+                    tenant: true)
       normalized_domain = domain.to_s.strip
       normalized_domain = nil if normalized_domain.empty?
 
@@ -72,10 +80,26 @@ module Rhino
         middleware: Array(middleware),
         models: models,
         auth: !!auth,
-        hooks: hooks
+        hooks: hooks,
+        tenant: tenant != false
       }
     end
 
+    # Whether the named route group has a tenant boundary, i.e. whether
+    # Rhino.query must fail closed inside it. Only a group that explicitly
+    # declares `tenant: false` does not; every other answer — an unknown group,
+    # an untagged route, or no group at all (jobs, rake tasks, console) — is
+    # true, so the resolver keeps failing closed wherever the group is not
+    # provably non-tenant.
+    def group_tenant?(name)
+      return true if name.nil? || name.to_s.empty?
+
+      group = @route_groups[name.to_sym]
+      return true unless group
+
+      group.fetch(:tenant, true) != false
+    end
+
     # Resolve a model class from its slug
     def resolve_model(slug)
       klass_name = @models[slug.to_sym]

data/lib/rhino/context.rb

@@ -30,6 +30,16 @@ module Rhino
       end
     end
 
+    # The route group serving the current request, as stashed into RequestStore
+    # by Rhino's own controllers and by Rhino::RouteGroupContext in custom ones.
+    # Nil outside a request or when the route carries no group.
+    def route_group
+      return nil unless defined?(RequestStore)
+
+      value = RequestStore.store[:rhino_route_group]
+      value.nil? || value.to_s.empty? ? nil : value
+    end
+
     # Run +block+ with the given user/organization installed into RequestStore.
     # Snapshots the prior RequestStore user+org, sets the new ones, yields, and
     # restores the snapshot in an ensure. Returns the block's value.

data/lib/rhino/engine.rb

@@ -22,6 +22,7 @@ module Rhino
       require "rhino/concerns/hidable_columns"
       require "rhino/concerns/has_uuid"
       require "rhino/concerns/has_auto_scope"
+      require "rhino/concerns/route_group_context"
 
       # Policies
       require "rhino/policies/resource_policy"

data/lib/rhino/missing_tenant_context.rb

@@ -4,5 +4,14 @@ module Rhino
   # Raised by Rhino.query (and the explicit builder) when an organization-scopable
   # model is queried with no organization context available. Fail-closed: the
   # resolver never returns an unscoped relation for a tenant-scopable model.
-  class MissingTenantContext < StandardError; end
+  class MissingTenantContext < StandardError
+    def initialize(model_class = nil)
+      super(
+        "Rhino.query(#{model_class}) requires an organization context but none is set. " \
+        "Use Rhino.for_user(...).in_organization(...) outside a tenant request, or declare " \
+        "the route group serving this request non-tenant with `tenant: false` if it " \
+        "legitimately spans every organization."
+      )
+    end
+  end
 end

data/lib/rhino/query.rb

@@ -20,7 +20,10 @@ module Rhino
     # (BelongsToOrganization / HasAutoScope read RequestStore at BUILD time).
     #
     # Fail closed: an org-scopable model with no org context RAISES
-    # Rhino::MissingTenantContext rather than returning an unscoped relation.
+    # Rhino::MissingTenantContext rather than returning an unscoped relation —
+    # unless the request is served by a route group declared non-tenant
+    # (`tenant: false`), where a query legitimately spans every organization. An
+    # explicit organization is always honored, in every group.
     def query(model_class)
       org = Rhino::Context.organization
 
@@ -28,9 +31,11 @@ module Rhino
       relation = model_class.all
 
       if Rhino::ScopesToOrganization.organization_scoped?(model_class)
-        raise Rhino::MissingTenantContext, model_class.name unless org
-
-        relation = Rhino::ScopesToOrganization.scope_to_organization(relation, model_class, org, strict: true)
+        if org
+          relation = Rhino::ScopesToOrganization.scope_to_organization(relation, model_class, org, strict: true)
+        elsif Rhino.config.group_tenant?(Rhino::Context.route_group)
+          raise Rhino::MissingTenantContext, model_class.name
+        end
       end
 
       relation

data/lib/rhino/templates/rhino.rb

@@ -44,6 +44,22 @@ Rhino.configure do |config|
   # the path prefix ':organization' does. Groups without a domain match any host.
   # config.route_group :admin, prefix: '', domain: 'admin.example.com', models: :all
   # config.route_group :tenant, prefix: '', domain: '{organization}.example.com', models: :all
+  #
+  # The optional `tenant:` keyword declares whether a group has a tenant
+  # boundary. It defaults to true: Rhino.query inside the group fails closed,
+  # raising Rhino::MissingTenantContext when an organization-scopable model is
+  # queried with no organization resolved. Pass `tenant: false` for a group that
+  # legitimately spans every organization — a back office whose operators see all
+  # tenants' rows. There, Rhino.query applies no organization filter and does not
+  # raise; the models' own scopes and the policies still apply, and an explicit
+  # Rhino.for_user(u).in_organization(org) still scopes.
+  # config.route_group :admin, prefix: 'admin', tenant: false, models: :all
+  #
+  # Custom (non-Rhino) controllers publish their group by including
+  # Rhino::RouteGroupContext and declaring `rhino_route_group :admin`, or by
+  # tagging the route with `defaults: { route_group: 'admin' }`. Outside a
+  # request (jobs, rake tasks) no group resolves and the resolver keeps failing
+  # closed.
 
   # config.route_group :default, prefix: '', middleware: [], models: :all
 

data/lib/rhino/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rhino
-  VERSION = "4.7.0"
+  VERSION = "4.7.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rhino-rails
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.7.2
 platform: ruby
 authors:
 - Bruno Cipolla
@@ -215,6 +215,7 @@ files:
 - lib/rhino/concerns/has_uuid.rb
 - lib/rhino/concerns/has_validation.rb
 - lib/rhino/concerns/hidable_columns.rb
+- lib/rhino/concerns/route_group_context.rb
 - lib/rhino/configuration.rb
 - lib/rhino/context.rb
 - lib/rhino/controllers/auth_controller.rb