rhino-rails 4.7.2 → 4.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 632861555ee3e2508a90ec546b6cb0412368bc141a7d387b2f92698531605b86
-  data.tar.gz: 91b3ad79b1c0b0b492f1f3003e906ce11e9f3fa62e81b067ecfb9c0b7740a025
+  metadata.gz: c7f50b9ced877e5d2fc1b304798f7c2c6372e89754ea1c7c9efd296c8f478c33
+  data.tar.gz: cca1fbd5f280df7e94a1fa9a69c1ca338fdfff6b76d35158afdc16fd07ef4309
 SHA512:
-  metadata.gz: 2c5fee208f22ae88b0531f4075e6183d6d0a17137c43423e7f491dbf341848764ce16418feca131b13c45c4295f6b4a3507eebb52e1e30b2f887dcbcfdd624c1
-  data.tar.gz: 83468b5afe671a2b0313778e57c2f053747129156d643bb85d5543513ea2d02aa6c2b63c4b70bb5f04613cb79bbb21544ba142bb4f127ebf56247581aab4c079
+  metadata.gz: 43e7ae4d3e346c984ab8452c8dbc2f3ceb7199f35f8e3eba3f971931aed8539e752f9744393f2429125cb94b6d092358c070d719b634fa95b0cd9e314ea362e1
+  data.tar.gz: d03e920444bfcdfc0c42ddfa0d494ac180aae4fc499acd852aafc1ca6486aeccaecdff54decf4e64f65e21e5c7cb0f078ea81b3426518d7495b7e8bc3a4bc7de

data/lib/rhino/context.rb

@@ -30,20 +30,24 @@ module Rhino
       end
     end
 
-    # The route group serving the current request, as stashed into RequestStore
-    # by Rhino's own controllers and by Rhino::RouteGroupContext in custom ones.
-    # Nil outside a request or when the route carries no group.
+    # The active route group: the explicit override if one is in effect (set by
+    # Rhino.in_route_group), else the group stashed into RequestStore by Rhino's
+    # own controllers and by Rhino::RouteGroupContext in custom ones.
+    #
+    # Unlike user/organization, an override never *erases* the request's group —
+    # +with+ only installs a non-nil one — so Rhino.for_user(u).query(M) inside a
+    # non-tenant request keeps that request's group.
     def route_group
-      return nil unless defined?(RequestStore)
+      value = store[:rhino_route_group]
+      value = RequestStore.store[:rhino_route_group] if value.nil? && defined?(RequestStore)
 
-      value = RequestStore.store[:rhino_route_group]
-      value.nil? || value.to_s.empty? ? nil : value
+      value.nil? || value.to_s.empty? ? nil : value.to_s
     end
 
     # Run +block+ with the given user/organization installed into RequestStore.
     # Snapshots the prior RequestStore user+org, sets the new ones, yields, and
     # restores the snapshot in an ensure. Returns the block's value.
-    def with(user:, organization:)
+    def with(user:, organization:, route_group: nil)
       return yield unless defined?(RequestStore)
 
       had_user = RequestStore.store.key?(:rhino_current_user)
@@ -51,6 +55,13 @@ module Rhino
       prev_user = RequestStore.store[:rhino_current_user]
       prev_org  = RequestStore.store[:rhino_organization]
 
+      # A route group is only ever ADDED, never cleared: with no explicit group
+      # the request's own one (if any) stays in effect.
+      had_group  = RequestStore.store.key?(:rhino_route_group)
+      prev_group = RequestStore.store[:rhino_route_group]
+      had_override_group  = store.key?(:rhino_route_group)
+      prev_override_group = store[:rhino_route_group]
+
       # Track the active override so Context.user/organization prefer it even when
       # the passed value is nil (distinguishing "explicitly nil" from "absent").
       had_override_user = store.key?(:rhino_current_user)
@@ -63,6 +74,11 @@ module Rhino
       store[:rhino_current_user] = user
       store[:rhino_organization] = organization
 
+      if route_group
+        RequestStore.store[:rhino_route_group] = route_group.to_s
+        store[:rhino_route_group] = route_group.to_s
+      end
+
       begin
         yield
       ensure
@@ -87,6 +103,20 @@ module Rhino
         else
           store.delete(:rhino_organization)
         end
+
+        if route_group
+          if had_group
+            RequestStore.store[:rhino_route_group] = prev_group
+          else
+            RequestStore.store.delete(:rhino_route_group)
+          end
+
+          if had_override_group
+            store[:rhino_route_group] = prev_override_group
+          else
+            store.delete(:rhino_route_group)
+          end
+        end
       end
     end
 

data/lib/rhino/query.rb

@@ -21,9 +21,10 @@ module Rhino
     #
     # Fail closed: an org-scopable model with no org context RAISES
     # Rhino::MissingTenantContext rather than returning an unscoped relation —
-    # unless the request is served by a route group declared non-tenant
-    # (`tenant: false`), where a query legitimately spans every organization. An
-    # explicit organization is always honored, in every group.
+    # unless the query belongs to a route group declared non-tenant
+    # (`tenant: false`), either because the request is served by that group or
+    # because the caller said so with Rhino.in_route_group(...). An explicit
+    # organization is always honored, in every group.
     def query(model_class)
       org = Rhino::Context.organization
 
@@ -53,6 +54,20 @@ module Rhino
       Rhino::PendingScopedContext.new(user: user)
     end
 
+    # Begin an explicit context that acts as the named route group, for use
+    # where no request resolves one — an Active Job, a rake task, the console,
+    # a test.
+    #
+    # The group's own configuration still decides the boundary: naming a group
+    # declared +tenant: false+ lets the query span every organization, while
+    # naming any other group keeps failing closed.
+    #
+    #   Rhino.in_route_group(:admin).query(Task)
+    #   Rhino.for_user(user).in_route_group(:admin).run { ... }
+    def in_route_group(route_group)
+      Rhino::PendingScopedContext.new(user: nil, route_group: route_group)
+    end
+
     # The ambient context resolver.
     def context
       Rhino::Context
@@ -89,9 +104,10 @@ module Rhino
   # Fluent explicit-context builder. Holds a user (and, once chained, an org) and
   # resolves queries with that context installed into RequestStore at build time.
   class PendingScopedContext
-    def initialize(user:, organization: nil)
+    def initialize(user:, organization: nil, route_group: nil)
       @user = user
       @organization = organization
+      @route_group = route_group
     end
 
     def in_organization(organization)
@@ -99,6 +115,18 @@ module Rhino
       self
     end
 
+    # Act as the named route group for this context (see Rhino.in_route_group).
+    def in_route_group(route_group)
+      @route_group = route_group
+      self
+    end
+
+    # Set the explicit user for this context.
+    def for_user(user)
+      @user = user
+      self
+    end
+
     # Build a fully-baked relation for +model_class+ under this explicit context.
     #
     # Because Rails default_scopes bake at BUILD time, we install the user+org into
@@ -106,14 +134,14 @@ module Rhino
     # The org+user are baked into the returned relation — no stickiness, fully
     # isolated: a later Rhino.query with no context still fails closed.
     def query(model_class)
-      Rhino::Context.with(user: @user, organization: @organization) do
+      Rhino::Context.with(user: @user, organization: @organization, route_group: @route_group) do
         Rhino.query(model_class)
       end
     end
 
     # Build a fully-baked, named-scoped relation under this explicit context.
     def scoped_query(model_class, scope_name = nil)
-      Rhino::Context.with(user: @user, organization: @organization) do
+      Rhino::Context.with(user: @user, organization: @organization, route_group: @route_group) do
         Rhino.scoped_query(model_class, scope_name)
       end
     end
@@ -122,7 +150,7 @@ module Rhino
     # inside the block see the context; RequestStore is restored afterward.
     # Returns the block's value.
     def run(&block)
-      Rhino::Context.with(user: @user, organization: @organization, &block)
+      Rhino::Context.with(user: @user, organization: @organization, route_group: @route_group, &block)
     end
   end
 end

data/lib/rhino/templates/rhino.rb

@@ -58,8 +58,14 @@ Rhino.configure do |config|
   # Custom (non-Rhino) controllers publish their group by including
   # Rhino::RouteGroupContext and declaring `rhino_route_group :admin`, or by
   # tagging the route with `defaults: { route_group: 'admin' }`. Outside a
-  # request (jobs, rake tasks) no group resolves and the resolver keeps failing
-  # closed.
+  # request (jobs, rake tasks, console) no group resolves, so the caller names
+  # the one it is acting as:
+  #
+  #   Rhino.in_route_group(:admin).query(Task)
+  #   Rhino.for_user(operator).in_route_group(:admin).run { ... }
+  #
+  # The group's own `tenant:` still decides: naming a tenant group there changes
+  # nothing, the query still fails closed.
 
   # config.route_group :default, prefix: '', middleware: [], models: :all
 

data/lib/rhino/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rhino
-  VERSION = "4.7.2"
+  VERSION = "4.7.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rhino-rails
 version: !ruby/object:Gem::Version
-  version: 4.7.2
+  version: 4.7.3
 platform: ruby
 authors:
 - Bruno Cipolla