ruby_ability_graph 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4ce5898e9ed11483ad4f291171ed863f3970738fae36bc25cd55d8d26c71036
-  data.tar.gz: a2b269d8d48075ff220c25cf921b2f588e7126375b3d593cefe298404a4b3150
+  metadata.gz: 69091644aaeaacfb2c587e3e11ed70e0b27b575b1678f762f73fc39bec024406
+  data.tar.gz: ef060d9a0dea3f181596c4dd459c8fc847749ea1e06c30fe02cb6824d06b94bb
 SHA512:
-  metadata.gz: 427d696904a000b007da7708227185fe6ce7daaa74582e59230c26f9d874f3c39e9beb68c4383dcfb6c83bb017d2cfa65327d30320363d8fc1cdbbbfddefed3e
-  data.tar.gz: d1f77d2c37b35e6e3cb1f590e2858b521d6e2a30de2b6a388c1788a685115e9522a2b42077d3ea0493c6cd8e4bf0387a08ea681d9b3aa69814917d652c428f48
+  metadata.gz: fcd1d55fc2808d10063b16d67942a62458d2b183027214573d9dd3d8ec348a8cdbc9eb5da60a83b9c63ffa174f451130de17b1a872224c82c9a2058e0b0f3737
+  data.tar.gz: 44a8503733fad18260454e043be5d0053490e0a0aeca2b22ebaaef4671f064e8fce0d8a9d772eac5480c201662f4aaf669aebef1753112532522543458b8dbae

data/README.md

@@ -1,15 +1,32 @@
 # ruby_ability_graph
 
+[![Gem Version](https://img.shields.io/gem/v/ruby_ability_graph)](https://rubygems.org/gems/ruby_ability_graph)
+[![CI](https://github.com/m1gd0n-dev/ruby-ability-graph/actions/workflows/ci.yml/badge.svg)](https://github.com/m1gd0n-dev/ruby-ability-graph/actions/workflows/ci.yml)
+[![License: AGPL v3](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue.svg)](LICENSE.txt)
+
 Loads a Rails app's [CanCanCan](https://github.com/CanCanCommunity/cancancan) `Ability` class in isolation and reports raw `can?`/`cannot?` results across every role x action x model combination -- so you can see who can access what without booting the full app or hand-tracing every conditional.
 
 **Status:** Each result is classified `resolved` (structured condition captured) or `unsupported` (declared but not analyzed, with a reason and source pointer). `scan` prints a human-readable table by default, a versioned JSON schema on request, can diff results against a simple policy file, and can render an interactive HTML graph of the whole thing.
 
+Dogfooded against 4 real-world open-source Rails apps using CanCanCan:
+
+| App | Resolved |
+|---|---|
+| [Fat Free CRM](https://github.com/fatfreecrm/fat_free_crm) | 88.9% |
+| [Dradis CE](https://github.com/dradis/dradis-ce) | 86.4% |
+| [Consul](https://github.com/consul/consul) | 99.5% |
+| [Solidus](https://github.com/solidusio/solidus) | 96.8% |
+
 ## Installation
 
-Not on RubyGems yet -- point Bundler at the repo instead:
+```
+gem install ruby_ability_graph
+```
+
+Or add it to your Gemfile:
 
 ```ruby
-gem "ruby_ability_graph", github: "m1gd0n-dev/ruby-ability-graph"
+gem "ruby_ability_graph"
 ```
 
 Requires Ruby >= 4.0 and a C compiler to install -- `prism` compiles a native extension at install time. The Rails app you're scanning doesn't need to be on Ruby 4, though -- point `--ruby-bin` at whatever Ruby that app runs on and the analysis subprocess uses that instead.
@@ -130,6 +147,8 @@ ruby-ability-graph scan APP_PATH --html-report report.html
 
 Writes a single, self-contained HTML file -- inlined CSS/JS, no server, no CDN assets, nothing fetched over the network -- showing an interactive role → action → resource graph. Hover a role to trace everything it can reach; hover an edge for the underlying condition and confidence. Edges are solid green where `resolved`, dashed amber where `unsupported`, and solid red where a `--policy-file` check (if given) found a violation. A coverage line at the top mirrors the table's resolved/total summary. Only `allowed: true` results become edges -- it's a "who can access what" diagram, not a dump of every denial.
 
+![Example HTML report graph](docs/images/html-report.png)
+
 Combine it with `--policy-file` to get violations highlighted directly on the graph, not just listed in the table/JSON output. The file opens straight from disk (`file://`) in any browser -- no need to serve it.
 
 ## Security
@@ -137,3 +156,7 @@ Combine it with `--policy-file` to get violations highlighted directly on the gr
 `scan` executes code in `APP_PATH` -- it loads your `Ability` class (and anything that file requires) in a subprocess. Only run it against apps you trust. `inspect` is static analysis only (via Prism) and never executes the target.
 
 `--html-report` makes no network requests, ever -- everything it needs is inlined into the one file it writes. It does embed your role names, action names, model names, and raw condition values into that file, though, so treat the generated report itself with the same care as the scan results: don't publish it somewhere untrusted people can read it if that data is sensitive.
+
+## License
+
+AGPL-3.0-or-later. This is a CLI/library you run against your own `Ability` class as part of your own tooling (CI, local scans) -- it isn't a network service your users interact with, even when that pipeline runs in production. AGPL's network-copyleft clause (§13) is about modifying the program and offering the modified version to outside users over a network; running it, unmodified or modified, to scan your own codebase doesn't do that.

data/lib/ruby_ability_graph/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyAbilityGraph
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_ability_graph
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Jessica Grider
@@ -26,8 +26,7 @@ dependencies:
 description: |
   ruby_ability_graph loads a Rails app's CanCanCan Ability class in isolation,
   enumerates roles x actions x models, and reports resolved permissions --
-  distinguishing patterns it can fully resolve from ones it honestly flags as
-  unsupported rather than guessing.
+  distinguishing patterns it can fully resolve from ones it doesn't support.
 executables:
 - ruby-ability-graph
 extensions: []
@@ -73,6 +72,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.16
 specification_version: 4
-summary: Maps CanCanCan authorization rules into a visual, queryable 'who can access
-  what' model.
+summary: Maps CanCanCan authorization rules into a visual 'who can access what' model.
 test_files: []