rhino-rails 4.7.0 → 4.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3da378b6f647733a88cb598ff3b23e06462f6c61494ebbc322fed024e9ba33a9
-  data.tar.gz: e3dec4fcb82201e652e76e01ff7b5d8fa25c1ec61dde9d3b58f688f9a0d4ceb2
+  metadata.gz: c7f50b9ced877e5d2fc1b304798f7c2c6372e89754ea1c7c9efd296c8f478c33
+  data.tar.gz: cca1fbd5f280df7e94a1fa9a69c1ca338fdfff6b76d35158afdc16fd07ef4309
 SHA512:
-  metadata.gz: a37303c3543f0e140bc5f00371c1d8d8d310a30645a0ef2c3b9bd218d5cebe74e83c3f500f413792ce7496b764832219044739422f4a13f7be1b3dd1fe63bdec
-  data.tar.gz: fc60726be3e23b1da9ddcccc4fc884857608fb412125211b48cad5bfb51596d4986f6db13ed2728b70644f1d2c3a4be2e2e9a5fac5093ba6746783923fc01681
+  metadata.gz: 43e7ae4d3e346c984ab8452c8dbc2f3ceb7199f35f8e3eba3f971931aed8539e752f9744393f2429125cb94b6d092358c070d719b634fa95b0cd9e314ea362e1
+  data.tar.gz: d03e920444bfcdfc0c42ddfa0d494ac180aae4fc499acd852aafc1ca6486aeccaecdff54decf4e64f65e21e5c7cb0f078ea81b3426518d7495b7e8bc3a4bc7de

data/lib/rhino/concerns/route_group_context.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Rhino
+  # Places a custom (non-Rhino) controller into a Rhino route group, so the
+  # resource-scope resolver knows whether the request has a tenant boundary.
+  #
+  # Rhino's own generated controllers already publish their group; a controller
+  # you write yourself is outside that chain, so include this concern in it:
+  #
+  #   class Admin::DashboardController < ApplicationController
+  #     include Rhino::RouteGroupContext
+  #     rhino_route_group :admin
+  #
+  #     def summary
+  #       # :admin is declared `tenant: false`, so this spans every organization
+  #       # instead of raising Rhino::MissingTenantContext.
+  #       render json: { tasks: Rhino.query(Task).count }
+  #     end
+  #   end
+  #
+  # Without an explicit `rhino_route_group`, the group is read from the route's
+  # own `route_group` default:
+  #
+  #   get "/api/admin/dashboard", to: "admin/dashboard#summary",
+  #                               defaults: { route_group: "admin" }
+  module RouteGroupContext
+    extend ActiveSupport::Concern
+
+    included do
+      # Inheritable, so a base controller can declare the group for a whole
+      # namespace and subclasses may override it.
+      class_attribute :rhino_route_group_name, instance_writer: false, default: nil
+
+      before_action :rhino_set_route_group
+    end
+
+    class_methods do
+      # Declare the route group this controller's actions belong to.
+      def rhino_route_group(name)
+        self.rhino_route_group_name = name.to_s
+      end
+    end
+
+    private
+
+    # Publish the group for Rhino::Context (and therefore for Rhino.query, the
+    # policies and the permission resolver) for the rest of this request.
+    def rhino_set_route_group
+      return unless defined?(RequestStore)
+
+      # An explicit declaration wins; otherwise fall back to the route's own
+      # `route_group` default, which only exists once a request is bound.
+      resolved = rhino_route_group_name.presence
+      resolved ||= params[:route_group].presence if request
+
+      RequestStore.store[:rhino_route_group] = resolved
+    end
+  end
+end

data/lib/rhino/configuration.rb

@@ -62,7 +62,15 @@ module Rhino
     # captures the subdomain and feeds organization resolution exactly like the
     # path-prefix ":organization" does. Groups without a domain (nil/blank)
     # match any host (default, fully backward compatible).
-    def route_group(name, prefix: "", domain: nil, middleware: [], models: :all, auth: false, hooks: nil)
+    #
+    # The optional `tenant:` keyword declares whether the group has a tenant
+    # boundary. It defaults to true: Rhino.query inside the group fails closed,
+    # raising Rhino::MissingTenantContext when an organization-scopable model is
+    # queried with no organization resolved. Pass `tenant: false` for a group
+    # that legitimately spans every organization — a back office or admin group
+    # whose operators see all tenants' rows.
+    def route_group(name, prefix: "", domain: nil, middleware: [], models: :all, auth: false, hooks: nil,
+                    tenant: true)
       normalized_domain = domain.to_s.strip
       normalized_domain = nil if normalized_domain.empty?
 
@@ -72,10 +80,26 @@ module Rhino
         middleware: Array(middleware),
         models: models,
         auth: !!auth,
-        hooks: hooks
+        hooks: hooks,
+        tenant: tenant != false
       }
     end
 
+    # Whether the named route group has a tenant boundary, i.e. whether
+    # Rhino.query must fail closed inside it. Only a group that explicitly
+    # declares `tenant: false` does not; every other answer — an unknown group,
+    # an untagged route, or no group at all (jobs, rake tasks, console) — is
+    # true, so the resolver keeps failing closed wherever the group is not
+    # provably non-tenant.
+    def group_tenant?(name)
+      return true if name.nil? || name.to_s.empty?
+
+      group = @route_groups[name.to_sym]
+      return true unless group
+
+      group.fetch(:tenant, true) != false
+    end
+
     # Resolve a model class from its slug
     def resolve_model(slug)
       klass_name = @models[slug.to_sym]

data/lib/rhino/context.rb

@@ -30,10 +30,24 @@ module Rhino
       end
     end
 
+    # The active route group: the explicit override if one is in effect (set by
+    # Rhino.in_route_group), else the group stashed into RequestStore by Rhino's
+    # own controllers and by Rhino::RouteGroupContext in custom ones.
+    #
+    # Unlike user/organization, an override never *erases* the request's group —
+    # +with+ only installs a non-nil one — so Rhino.for_user(u).query(M) inside a
+    # non-tenant request keeps that request's group.
+    def route_group
+      value = store[:rhino_route_group]
+      value = RequestStore.store[:rhino_route_group] if value.nil? && defined?(RequestStore)
+
+      value.nil? || value.to_s.empty? ? nil : value.to_s
+    end
+
     # Run +block+ with the given user/organization installed into RequestStore.
     # Snapshots the prior RequestStore user+org, sets the new ones, yields, and
     # restores the snapshot in an ensure. Returns the block's value.
-    def with(user:, organization:)
+    def with(user:, organization:, route_group: nil)
       return yield unless defined?(RequestStore)
 
       had_user = RequestStore.store.key?(:rhino_current_user)
@@ -41,6 +55,13 @@ module Rhino
       prev_user = RequestStore.store[:rhino_current_user]
       prev_org  = RequestStore.store[:rhino_organization]
 
+      # A route group is only ever ADDED, never cleared: with no explicit group
+      # the request's own one (if any) stays in effect.
+      had_group  = RequestStore.store.key?(:rhino_route_group)
+      prev_group = RequestStore.store[:rhino_route_group]
+      had_override_group  = store.key?(:rhino_route_group)
+      prev_override_group = store[:rhino_route_group]
+
       # Track the active override so Context.user/organization prefer it even when
       # the passed value is nil (distinguishing "explicitly nil" from "absent").
       had_override_user = store.key?(:rhino_current_user)
@@ -53,6 +74,11 @@ module Rhino
       store[:rhino_current_user] = user
       store[:rhino_organization] = organization
 
+      if route_group
+        RequestStore.store[:rhino_route_group] = route_group.to_s
+        store[:rhino_route_group] = route_group.to_s
+      end
+
       begin
         yield
       ensure
@@ -77,6 +103,20 @@ module Rhino
         else
           store.delete(:rhino_organization)
         end
+
+        if route_group
+          if had_group
+            RequestStore.store[:rhino_route_group] = prev_group
+          else
+            RequestStore.store.delete(:rhino_route_group)
+          end
+
+          if had_override_group
+            store[:rhino_route_group] = prev_override_group
+          else
+            store.delete(:rhino_route_group)
+          end
+        end
       end
     end
 

data/lib/rhino/engine.rb

@@ -22,6 +22,7 @@ module Rhino
       require "rhino/concerns/hidable_columns"
       require "rhino/concerns/has_uuid"
       require "rhino/concerns/has_auto_scope"
+      require "rhino/concerns/route_group_context"
 
       # Policies
       require "rhino/policies/resource_policy"

data/lib/rhino/missing_tenant_context.rb

@@ -4,5 +4,14 @@ module Rhino
   # Raised by Rhino.query (and the explicit builder) when an organization-scopable
   # model is queried with no organization context available. Fail-closed: the
   # resolver never returns an unscoped relation for a tenant-scopable model.
-  class MissingTenantContext < StandardError; end
+  class MissingTenantContext < StandardError
+    def initialize(model_class = nil)
+      super(
+        "Rhino.query(#{model_class}) requires an organization context but none is set. " \
+        "Use Rhino.for_user(...).in_organization(...) outside a tenant request, or declare " \
+        "the route group serving this request non-tenant with `tenant: false` if it " \
+        "legitimately spans every organization."
+      )
+    end
+  end
 end

data/lib/rhino/query.rb

@@ -20,7 +20,11 @@ module Rhino
     # (BelongsToOrganization / HasAutoScope read RequestStore at BUILD time).
     #
     # Fail closed: an org-scopable model with no org context RAISES
-    # Rhino::MissingTenantContext rather than returning an unscoped relation.
+    # Rhino::MissingTenantContext rather than returning an unscoped relation —
+    # unless the query belongs to a route group declared non-tenant
+    # (`tenant: false`), either because the request is served by that group or
+    # because the caller said so with Rhino.in_route_group(...). An explicit
+    # organization is always honored, in every group.
     def query(model_class)
       org = Rhino::Context.organization
 
@@ -28,9 +32,11 @@ module Rhino
       relation = model_class.all
 
       if Rhino::ScopesToOrganization.organization_scoped?(model_class)
-        raise Rhino::MissingTenantContext, model_class.name unless org
-
-        relation = Rhino::ScopesToOrganization.scope_to_organization(relation, model_class, org, strict: true)
+        if org
+          relation = Rhino::ScopesToOrganization.scope_to_organization(relation, model_class, org, strict: true)
+        elsif Rhino.config.group_tenant?(Rhino::Context.route_group)
+          raise Rhino::MissingTenantContext, model_class.name
+        end
       end
 
       relation
@@ -48,6 +54,20 @@ module Rhino
       Rhino::PendingScopedContext.new(user: user)
     end
 
+    # Begin an explicit context that acts as the named route group, for use
+    # where no request resolves one — an Active Job, a rake task, the console,
+    # a test.
+    #
+    # The group's own configuration still decides the boundary: naming a group
+    # declared +tenant: false+ lets the query span every organization, while
+    # naming any other group keeps failing closed.
+    #
+    #   Rhino.in_route_group(:admin).query(Task)
+    #   Rhino.for_user(user).in_route_group(:admin).run { ... }
+    def in_route_group(route_group)
+      Rhino::PendingScopedContext.new(user: nil, route_group: route_group)
+    end
+
     # The ambient context resolver.
     def context
       Rhino::Context
@@ -84,9 +104,10 @@ module Rhino
   # Fluent explicit-context builder. Holds a user (and, once chained, an org) and
   # resolves queries with that context installed into RequestStore at build time.
   class PendingScopedContext
-    def initialize(user:, organization: nil)
+    def initialize(user:, organization: nil, route_group: nil)
       @user = user
       @organization = organization
+      @route_group = route_group
     end
 
     def in_organization(organization)
@@ -94,6 +115,18 @@ module Rhino
       self
     end
 
+    # Act as the named route group for this context (see Rhino.in_route_group).
+    def in_route_group(route_group)
+      @route_group = route_group
+      self
+    end
+
+    # Set the explicit user for this context.
+    def for_user(user)
+      @user = user
+      self
+    end
+
     # Build a fully-baked relation for +model_class+ under this explicit context.
     #
     # Because Rails default_scopes bake at BUILD time, we install the user+org into
@@ -101,14 +134,14 @@ module Rhino
     # The org+user are baked into the returned relation — no stickiness, fully
     # isolated: a later Rhino.query with no context still fails closed.
     def query(model_class)
-      Rhino::Context.with(user: @user, organization: @organization) do
+      Rhino::Context.with(user: @user, organization: @organization, route_group: @route_group) do
         Rhino.query(model_class)
       end
     end
 
     # Build a fully-baked, named-scoped relation under this explicit context.
     def scoped_query(model_class, scope_name = nil)
-      Rhino::Context.with(user: @user, organization: @organization) do
+      Rhino::Context.with(user: @user, organization: @organization, route_group: @route_group) do
         Rhino.scoped_query(model_class, scope_name)
       end
     end
@@ -117,7 +150,7 @@ module Rhino
     # inside the block see the context; RequestStore is restored afterward.
     # Returns the block's value.
     def run(&block)
-      Rhino::Context.with(user: @user, organization: @organization, &block)
+      Rhino::Context.with(user: @user, organization: @organization, route_group: @route_group, &block)
     end
   end
 end

data/lib/rhino/templates/rhino.rb

@@ -44,6 +44,28 @@ Rhino.configure do |config|
   # the path prefix ':organization' does. Groups without a domain match any host.
   # config.route_group :admin, prefix: '', domain: 'admin.example.com', models: :all
   # config.route_group :tenant, prefix: '', domain: '{organization}.example.com', models: :all
+  #
+  # The optional `tenant:` keyword declares whether a group has a tenant
+  # boundary. It defaults to true: Rhino.query inside the group fails closed,
+  # raising Rhino::MissingTenantContext when an organization-scopable model is
+  # queried with no organization resolved. Pass `tenant: false` for a group that
+  # legitimately spans every organization — a back office whose operators see all
+  # tenants' rows. There, Rhino.query applies no organization filter and does not
+  # raise; the models' own scopes and the policies still apply, and an explicit
+  # Rhino.for_user(u).in_organization(org) still scopes.
+  # config.route_group :admin, prefix: 'admin', tenant: false, models: :all
+  #
+  # Custom (non-Rhino) controllers publish their group by including
+  # Rhino::RouteGroupContext and declaring `rhino_route_group :admin`, or by
+  # tagging the route with `defaults: { route_group: 'admin' }`. Outside a
+  # request (jobs, rake tasks, console) no group resolves, so the caller names
+  # the one it is acting as:
+  #
+  #   Rhino.in_route_group(:admin).query(Task)
+  #   Rhino.for_user(operator).in_route_group(:admin).run { ... }
+  #
+  # The group's own `tenant:` still decides: naming a tenant group there changes
+  # nothing, the query still fails closed.
 
   # config.route_group :default, prefix: '', middleware: [], models: :all
 

data/lib/rhino/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rhino
-  VERSION = "4.7.0"
+  VERSION = "4.7.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rhino-rails
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.7.3
 platform: ruby
 authors:
 - Bruno Cipolla
@@ -215,6 +215,7 @@ files:
 - lib/rhino/concerns/has_uuid.rb
 - lib/rhino/concerns/has_validation.rb
 - lib/rhino/concerns/hidable_columns.rb
+- lib/rhino/concerns/route_group_context.rb
 - lib/rhino/configuration.rb
 - lib/rhino/context.rb
 - lib/rhino/controllers/auth_controller.rb