rls_multi_tenant 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8fab0710fc915514adcd0f8ba409b24557b5cafe0f1f0bdc4084b24d25b2fba5
-  data.tar.gz: 6359b5afdeb5493f4e56482682d6e82ff4a9e6aafd36adbfdf8998630b715525
+  metadata.gz: 4e6d7f69028c0e956fc4d5caf7651dd885c4a9da43bed16a2d32e90c8177c7c9
+  data.tar.gz: 5c8d3042cf29d8a21aad002e16db1193d2d0e8b7fea7246e4766116e81d301f9
 SHA512:
-  metadata.gz: a5079b1e2b6d73d30197ffd65042468301bc80afb36a573f2f6edcbf9663a320dca71354828f839bdbcac1d35ee72fcc70bd060ef9ee379ffe028740f99ac2f7
-  data.tar.gz: 89af2331b8b0f91f844e2a994e40f7d5162ea739a744d41a0e3d02675b5ca89a5c3d1f53f79b6ab0f8ab07e17d229893b937bb4fb2c2c2d4e2499ee504788dd5
+  metadata.gz: c35648de09e3f93962337d09fa699edc696a822924e19b046c1a2d6ae47663f4759f8e4c0541f1001c71f11f3b975827a7048e685082838f184c6f2becd33d9c
+  data.tar.gz: f7148ffd7576d6cc20ca513cfa92c6d21c9890dbbcacd9fcd9c42b755deba2ee584d0de8c88e644d019370944451d4797e2cba72e1c09e89866b3b33a779ff6d

data/.rubocop.yml

@@ -36,6 +36,10 @@ Metrics/BlockLength:
 Metrics/MethodLength:
   Max: 25
 
+Metrics/ModuleLength:
+  Exclude:
+    - 'spec/**/*'
+
 RSpec/ExampleLength:
   Max: 20
 
@@ -51,5 +55,16 @@ RSpec/DescribeClass:
 RSpec/DescribeMethod:
   Enabled: false
 
+# The integration suite uses plain ActiveRecord models (no ApplicationRecord)
+# and scenario-named spec files rather than one-file-per-class.
+Rails/ApplicationRecord:
+  Exclude:
+    - 'spec/**/*'
+
+RSpec/SpecFilePathFormat:
+  Exclude:
+    - 'spec/integration/**/*'
+    - 'spec/generators/**/*'
+
 Gemspec/DevelopmentDependencies:
   Enabled: false

data/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] - 2026-06-04
+
+Corrects two bugs in the 0.3.0 security work, both uncovered by a new
+real-PostgreSQL integration suite.
+
+### Fixed
+
+- **Security validator no longer rejects valid roles.** 0.3.0 used `pg_has_role`
+  to flag BYPASSRLS inherited through role membership, but PostgreSQL does not
+  inherit the SUPERUSER or BYPASSRLS role attributes through membership — only
+  privileges (GRANTs). A role that merely belongs to a BYPASSRLS group does not
+  bypass RLS unless it explicitly `SET ROLE`s to it. The validator now checks
+  only `current_user`'s own `rolsuper` / `rolbypassrls`, which is what actually
+  governs RLS enforcement. Verified empirically against PostgreSQL 16.
+- **Tenant context restore no longer masks an aborted-transaction error.** When
+  a `switch` block hit a database error that aborts the transaction (e.g. a
+  WITH CHECK policy violation), the ensure clause ran `SET LOCAL` to restore the
+  previous tenant and raised `PG::InFailedSqlTransaction`, hiding the original
+  error. The restore now ignores `ActiveRecord::StatementInvalid`; the rollback
+  clears the `SET LOCAL` anyway.
+
+### Internal
+
+- Added a real-PostgreSQL integration suite (provisions privileged/unprivileged
+  roles, schema and the RLS policy) covering tenant isolation, WITH CHECK
+  enforcement, context lifecycle and the security validator; the suite
+  auto-skips when no database is reachable.
+- Replaced mocked-only and tautological specs with behavior-driven unit specs,
+  real generator invocations, SimpleCov coverage, per-example configuration
+  isolation, randomized order, and a CI Ruby×Rails matrix with a Postgres
+  service.
+
 ## [0.3.0] - 2026-06-04
 
 Security-focused release. Hardens tenant isolation and SQL handling.

data/lib/rls_multi_tenant/concerns/tenant_context.rb

@@ -42,7 +42,7 @@ module RlsMultiTenant
             begin
               yield
             ensure
-              apply_tenant_context(previous_tenant_id, local: true)
+              restore_tenant_context(previous_tenant_id)
             end
           end
         end
@@ -81,6 +81,17 @@ module RlsMultiTenant
 
         private
 
+        # Restore the previous context on the way out of a `switch` block.
+        # If the block aborted the transaction (e.g. a policy violation), any
+        # further statement raises until rollback; that rollback will clear the
+        # SET LOCAL anyway, so the failure is safe to ignore and we must not let
+        # it mask the original error escaping the block.
+        def restore_tenant_context(previous_tenant_id)
+          apply_tenant_context(previous_tenant_id, local: true)
+        rescue ActiveRecord::StatementInvalid
+          nil
+        end
+
         # Apply (or clear, when tenant_id is blank) the tenant context.
         # local: true uses SET LOCAL (transaction-scoped); false uses session SET.
         def apply_tenant_context(tenant_id, local:)

data/lib/rls_multi_tenant/security_validator.rb

@@ -13,7 +13,7 @@ module RlsMultiTenant
           username = role && role['username']
 
           ensure_not_superuser!(role, username)
-          ensure_no_bypassrls!(username)
+          ensure_no_bypassrls!(role, username)
 
           Rails.logger&.info "✅ RLS Multi-tenant security check passed: Using user '#{username}' " \
                              'without SUPERUSER or BYPASSRLS privileges'
@@ -25,8 +25,10 @@ module RlsMultiTenant
 
       private
 
-      # Inspect the actual connected role (current_user), not the configured
-      # username, so the check reflects what PostgreSQL really enforces and
+      # Inspect the actual connected role (current_user). Only this role's own
+      # attributes determine whether RLS is enforced: PostgreSQL does NOT
+      # inherit SUPERUSER or BYPASSRLS through role membership, so checking the
+      # current role is both correct and sufficient. Using current_user also
       # avoids interpolating a config value into SQL.
       def current_role
         ActiveRecord::Base.connection.execute(<<~SQL.squish).first
@@ -45,26 +47,14 @@ module RlsMultiTenant
                              'non-privileged, non-superuser role for RLS Multi-tenant.'
       end
 
-      # BYPASSRLS can also be inherited through role membership, so check the
-      # effective privilege across every role the user is a member of.
-      def ensure_no_bypassrls!(username)
-        return unless bypassrls_effective?
+      def ensure_no_bypassrls!(role, username)
+        return unless truthy?(role && role['rolbypassrls'])
 
-        raise SecurityError, "Database user '#{username}' has BYPASSRLS privilege " \
-                             '(directly or through an inherited role). ' \
+        raise SecurityError, "Database user '#{username}' has BYPASSRLS privilege. " \
                              'In order to use RLS Multi-tenant, you must use a non-privileged user ' \
                              'without BYPASSRLS privilege.'
       end
 
-      def bypassrls_effective?
-        result = ActiveRecord::Base.connection.execute(<<~SQL.squish).first
-          SELECT bool_or(rolbypassrls) AS bypass
-          FROM pg_roles WHERE pg_has_role(current_user, oid, 'USAGE')
-        SQL
-
-        truthy?(result && result['bypass'])
-      end
-
       # PostgreSQL boolean columns may come back as true/false or 't'/'f'
       # depending on the adapter/decoder configuration.
       def truthy?(value)

data/lib/rls_multi_tenant/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RlsMultiTenant
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rls_multi_tenant
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Coding Ways