rls_multi_tenant 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8fab0710fc915514adcd0f8ba409b24557b5cafe0f1f0bdc4084b24d25b2fba5
-  data.tar.gz: 6359b5afdeb5493f4e56482682d6e82ff4a9e6aafd36adbfdf8998630b715525
+  metadata.gz: 9380863d6f5f1f68de3a4beaa1569cd6ad94bb5536604e0a444822628b946feb
+  data.tar.gz: eecebe1cecb827ed406b161f566de19d3effb7e8a96d73ebd497209b158e1c8b
 SHA512:
-  metadata.gz: a5079b1e2b6d73d30197ffd65042468301bc80afb36a573f2f6edcbf9663a320dca71354828f839bdbcac1d35ee72fcc70bd060ef9ee379ffe028740f99ac2f7
-  data.tar.gz: 89af2331b8b0f91f844e2a994e40f7d5162ea739a744d41a0e3d02675b5ca89a5c3d1f53f79b6ab0f8ab07e17d229893b937bb4fb2c2c2d4e2499ee504788dd5
+  metadata.gz: faeb27cf2559a330bf13294cea3b114d017cb77d9c6e9af95acba26572bbf2016f6ffe2f8fb0dc67b1e731205f34f4ff0c69a4a592a91d6ec5d8b2c68127a211
+  data.tar.gz: 3fb38ae302313ed9845e86f3120c267ae88ad3e8eea793355f36db359ad316f6eaaac11805d21696a0b940ce54ba755cf5b4c5fdb7741066f1bd5b60fc236726

data/.rubocop.yml

@@ -36,6 +36,11 @@ Metrics/BlockLength:
 Metrics/MethodLength:
   Max: 25
 
+Metrics/ModuleLength:
+  Max: 120
+  Exclude:
+    - 'spec/**/*'
+
 RSpec/ExampleLength:
   Max: 20
 
@@ -51,5 +56,16 @@ RSpec/DescribeClass:
 RSpec/DescribeMethod:
   Enabled: false
 
+# The integration suite uses plain ActiveRecord models (no ApplicationRecord)
+# and scenario-named spec files rather than one-file-per-class.
+Rails/ApplicationRecord:
+  Exclude:
+    - 'spec/**/*'
+
+RSpec/SpecFilePathFormat:
+  Exclude:
+    - 'spec/integration/**/*'
+    - 'spec/generators/**/*'
+
 Gemspec/DevelopmentDependencies:
   Enabled: false

data/CHANGELOG.md

@@ -5,6 +5,49 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] - 2026-06-04
+
+### Added
+
+- **Apartment-style switching by a unique field.** `Tenant.switch_by(value)`
+  resolves the tenant by a unique column (defaulting to the configured
+  `subdomain_field`) and switches context for the block; pass `attribute:` to
+  use another column (e.g. `switch_by('acme', attribute: :slug)`). A permanent
+  `switch_by!` variant is also available. Both raise `RlsMultiTenant::Error`
+  when no tenant matches. Instance-level delegators are provided too.
+
+## [0.3.1] - 2026-06-04
+
+Corrects two bugs in the 0.3.0 security work, both uncovered by a new
+real-PostgreSQL integration suite.
+
+### Fixed
+
+- **Security validator no longer rejects valid roles.** 0.3.0 used `pg_has_role`
+  to flag BYPASSRLS inherited through role membership, but PostgreSQL does not
+  inherit the SUPERUSER or BYPASSRLS role attributes through membership — only
+  privileges (GRANTs). A role that merely belongs to a BYPASSRLS group does not
+  bypass RLS unless it explicitly `SET ROLE`s to it. The validator now checks
+  only `current_user`'s own `rolsuper` / `rolbypassrls`, which is what actually
+  governs RLS enforcement. Verified empirically against PostgreSQL 16.
+- **Tenant context restore no longer masks an aborted-transaction error.** When
+  a `switch` block hit a database error that aborts the transaction (e.g. a
+  WITH CHECK policy violation), the ensure clause ran `SET LOCAL` to restore the
+  previous tenant and raised `PG::InFailedSqlTransaction`, hiding the original
+  error. The restore now ignores `ActiveRecord::StatementInvalid`; the rollback
+  clears the `SET LOCAL` anyway.
+
+### Internal
+
+- Added a real-PostgreSQL integration suite (provisions privileged/unprivileged
+  roles, schema and the RLS policy) covering tenant isolation, WITH CHECK
+  enforcement, context lifecycle and the security validator; the suite
+  auto-skips when no database is reachable.
+- Replaced mocked-only and tautological specs with behavior-driven unit specs,
+  real generator invocations, SimpleCov coverage, per-example configuration
+  isolation, randomized order, and a CI Ruby×Rails matrix with a Postgres
+  service.
+
 ## [0.3.0] - 2026-06-04
 
 Security-focused release. Hardens tenant isolation and SQL handling.

data/README.md

@@ -152,6 +152,29 @@ Tenant.reset! # Reset context
 current_tenant = Tenant.current
 ```
 
+#### Switching by a unique field (Apartment-style)
+
+Instead of a tenant object or id, switch by any unique column. The attribute
+defaults to the configured `subdomain_field`:
+
+```ruby
+# Switch by subdomain (default field) for a block
+Tenant.switch_by("company-a") do
+  User.create!(name: "User from Company A")
+end
+
+# Switch by another unique column
+Tenant.switch_by("acme-inc", attribute: :slug) do
+  # ...
+end
+
+# Permanent variant (until reset!)
+Tenant.switch_by!("company-a")
+Tenant.reset!
+```
+
+`switch_by` raises `RlsMultiTenant::Error` when no tenant matches the value.
+
 ### Automatic Subdomain-Based Tenant Switching
 
 The gem includes middleware that automatically switches tenants based on the request subdomain. This is enabled by default and works seamlessly with your tenant model.

data/lib/rls_multi_tenant/concerns/tenant_context.rb

@@ -42,7 +42,7 @@ module RlsMultiTenant
             begin
               yield
             ensure
-              apply_tenant_context(previous_tenant_id, local: true)
+              restore_tenant_context(previous_tenant_id)
             end
           end
         end
@@ -60,6 +60,20 @@ module RlsMultiTenant
           apply_tenant_context(tenant_id, local: false)
         end
 
+        # Switch tenant context for a block, identifying the tenant by a unique
+        # field (Apartment-style). Defaults to the configured subdomain field.
+        #
+        #   Tenant.switch_by('acme') { ... }              # by subdomain
+        #   Tenant.switch_by('acme', attribute: :slug) { } # by another column
+        def switch_by(value, attribute: RlsMultiTenant.subdomain_field, &block)
+          switch(find_tenant_by!(attribute, value), &block)
+        end
+
+        # Permanent variant of switch_by (until reset). Same caveats as switch!.
+        def switch_by!(value, attribute: RlsMultiTenant.subdomain_field)
+          switch!(find_tenant_by!(attribute, value))
+        end
+
         # Reset tenant context
         def reset!
           connection.execute format(RESET_TENANT_ID_SQL, tenant_session_var)
@@ -81,6 +95,26 @@ module RlsMultiTenant
 
         private
 
+        # Look up a tenant by a unique attribute, raising if none matches.
+        def find_tenant_by!(attribute, value)
+          tenant = RlsMultiTenant.tenant_class.find_by(attribute => value)
+          return tenant if tenant
+
+          raise RlsMultiTenant::Error,
+                "#{RlsMultiTenant.tenant_class_name} with #{attribute}=#{value.inspect} not found"
+        end
+
+        # Restore the previous context on the way out of a `switch` block.
+        # If the block aborted the transaction (e.g. a policy violation), any
+        # further statement raises until rollback; that rollback will clear the
+        # SET LOCAL anyway, so the failure is safe to ignore and we must not let
+        # it mask the original error escaping the block.
+        def restore_tenant_context(previous_tenant_id)
+          apply_tenant_context(previous_tenant_id, local: true)
+        rescue ActiveRecord::StatementInvalid
+          nil
+        end
+
         # Apply (or clear, when tenant_id is blank) the tenant context.
         # local: true uses SET LOCAL (transaction-scoped); false uses session SET.
         def apply_tenant_context(tenant_id, local:)
@@ -131,8 +165,14 @@ module RlsMultiTenant
         self.class.switch(tenant_or_id, &block)
       end
 
+      def switch_by(value, attribute: RlsMultiTenant.subdomain_field, &block)
+        self.class.switch_by(value, attribute: attribute, &block)
+      end
+
       delegate :switch!, to: :class
 
+      delegate :switch_by!, to: :class
+
       delegate :reset!, to: :class
     end
   end

data/lib/rls_multi_tenant/security_validator.rb

@@ -13,7 +13,7 @@ module RlsMultiTenant
           username = role && role['username']
 
           ensure_not_superuser!(role, username)
-          ensure_no_bypassrls!(username)
+          ensure_no_bypassrls!(role, username)
 
           Rails.logger&.info "✅ RLS Multi-tenant security check passed: Using user '#{username}' " \
                              'without SUPERUSER or BYPASSRLS privileges'
@@ -25,8 +25,10 @@ module RlsMultiTenant
 
       private
 
-      # Inspect the actual connected role (current_user), not the configured
-      # username, so the check reflects what PostgreSQL really enforces and
+      # Inspect the actual connected role (current_user). Only this role's own
+      # attributes determine whether RLS is enforced: PostgreSQL does NOT
+      # inherit SUPERUSER or BYPASSRLS through role membership, so checking the
+      # current role is both correct and sufficient. Using current_user also
       # avoids interpolating a config value into SQL.
       def current_role
         ActiveRecord::Base.connection.execute(<<~SQL.squish).first
@@ -45,26 +47,14 @@ module RlsMultiTenant
                              'non-privileged, non-superuser role for RLS Multi-tenant.'
       end
 
-      # BYPASSRLS can also be inherited through role membership, so check the
-      # effective privilege across every role the user is a member of.
-      def ensure_no_bypassrls!(username)
-        return unless bypassrls_effective?
+      def ensure_no_bypassrls!(role, username)
+        return unless truthy?(role && role['rolbypassrls'])
 
-        raise SecurityError, "Database user '#{username}' has BYPASSRLS privilege " \
-                             '(directly or through an inherited role). ' \
+        raise SecurityError, "Database user '#{username}' has BYPASSRLS privilege. " \
                              'In order to use RLS Multi-tenant, you must use a non-privileged user ' \
                              'without BYPASSRLS privilege.'
       end
 
-      def bypassrls_effective?
-        result = ActiveRecord::Base.connection.execute(<<~SQL.squish).first
-          SELECT bool_or(rolbypassrls) AS bypass
-          FROM pg_roles WHERE pg_has_role(current_user, oid, 'USAGE')
-        SQL
-
-        truthy?(result && result['bypass'])
-      end
-
       # PostgreSQL boolean columns may come back as true/false or 't'/'f'
       # depending on the adapter/decoder configuration.
       def truthy?(value)

data/lib/rls_multi_tenant/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RlsMultiTenant
-  VERSION = '0.3.0'
+  VERSION = '0.4.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rls_multi_tenant
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Coding Ways