ruby_ability_graph 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69091644aaeaacfb2c587e3e11ed70e0b27b575b1678f762f73fc39bec024406
-  data.tar.gz: ef060d9a0dea3f181596c4dd459c8fc847749ea1e06c30fe02cb6824d06b94bb
+  metadata.gz: 9bd1d62067dae4acb3905ddcd4fc1b47833a4135dd6131cc91911098a28d46cb
+  data.tar.gz: 1d1d37df3d8ee78d1a08f850619ef08d7fc798eebac8680d40525c17f07dc432
 SHA512:
-  metadata.gz: fcd1d55fc2808d10063b16d67942a62458d2b183027214573d9dd3d8ec348a8cdbc9eb5da60a83b9c63ffa174f451130de17b1a872224c82c9a2058e0b0f3737
-  data.tar.gz: 44a8503733fad18260454e043be5d0053490e0a0aeca2b22ebaaef4671f064e8fce0d8a9d772eac5480c201662f4aaf669aebef1753112532522543458b8dbae
+  metadata.gz: 44c8aa407082a81a668d572969e640395c564743e649aed7919fd8e03040451eb9836bfadda369281a426f7ac152cf48f7971eb3d05552a26683b69e67de7f73
+  data.tar.gz: 10260b71a1e46489661c61db10f0c4e7239df8201b74a2cc5b1bf9f2da84c6ad5068bb3c24cf5a37b1a82ab46f659a94f2f6245c4b6b0535928ad07373cd57b4

data/README.md

@@ -145,7 +145,7 @@ Note: a policy check is only as trustworthy as the underlying result's `confiden
 ruby-ability-graph scan APP_PATH --html-report report.html
 ```
 
-Writes a single, self-contained HTML file -- inlined CSS/JS, no server, no CDN assets, nothing fetched over the network -- showing an interactive role → action → resource graph. Hover a role to trace everything it can reach; hover an edge for the underlying condition and confidence. Edges are solid green where `resolved`, dashed amber where `unsupported`, and solid red where a `--policy-file` check (if given) found a violation. A coverage line at the top mirrors the table's resolved/total summary. Only `allowed: true` results become edges -- it's a "who can access what" diagram, not a dump of every denial.
+Writes a single, self-contained HTML file -- inlined CSS/JS, no server, no CDN assets, nothing fetched over the network -- showing an interactive role → action → resource graph. Hover a role to trace everything it can reach; hover an edge for the underlying condition and confidence. Each edge bundles many underlying rows (a role→action edge spans every model that pair touches), so its color reflects the fraction resolved: solid green at 100%, solid amber-to-green gradient in between, dashed amber at 0% (`unsupported`), and solid red wherever a `--policy-file` check (if given) found a violation. A coverage line at the top mirrors the table's resolved/total summary. Only `allowed: true` results become edges -- it's a "who can access what" diagram, not a dump of every denial.
 
 ![Example HTML report graph](docs/images/html-report.png)
 

data/lib/ruby_ability_graph/html_report.rb

@@ -73,6 +73,7 @@ module RubyAbilityGraph
         #legend span { display: inline-flex; align-items: center; gap: 6px; }
         .swatch { display: inline-block; width: 22px; height: 0; border-top-width: 3px; border-top-style: solid; }
         .swatch.resolved { border-color: var(--good); border-top-style: solid; }
+        .swatch.partial { height: 3px; border-top: none; background: linear-gradient(to right, var(--warning), var(--good)); }
         .swatch.unsupported { border-color: var(--warning); border-top-style: dashed; }
         .swatch.violation { border-color: var(--critical); border-top-style: solid; }
         main {
@@ -123,6 +124,7 @@ module RubyAbilityGraph
           </div>
           <div id="legend">
             <span><span class="swatch resolved"></span> Resolved</span>
+            <span><span class="swatch partial"></span> Bundled edge, partially resolved -- color shows % resolved</span>
             <span><span class="swatch unsupported"></span> Unsupported -- not analyzed</span>
             <span><span class="swatch violation"></span> Policy violation</span>
           </div>
@@ -165,9 +167,30 @@ module RubyAbilityGraph
             return map;
           }
 
-          function edgeStatus(rows) {
-            if (rows.some(function (r) { return r.violation; })) { return "violation"; }
-            return rows.every(function (r) { return r.confidence === "resolved"; }) ? "resolved" : "unsupported";
+          // Aggregated edges bundle many rows (e.g. a role->action edge spans every
+          // model that pair touches). A single boolean verdict for the whole bundle
+          // is misleading at scale: one unsupported row among sixty resolved ones
+          // painted the entire edge amber. Color proportionally instead, so an
+          // edge that's mostly resolved reads as mostly green.
+          var COLOR_WARNING = [250, 178, 25]; // --warning, #fab219
+          var COLOR_GOOD = [12, 163, 12]; // --good, #0ca30c
+
+          function resolvedFraction(rows) {
+            var resolved = rows.filter(function (r) { return r.confidence === "resolved"; }).length;
+            return resolved / rows.length;
+          }
+
+          function mixColor(fraction) {
+            var rgb = COLOR_WARNING.map(function (c, i) { return Math.round(c + (COLOR_GOOD[i] - c) * fraction); });
+            return "rgb(" + rgb.join(",") + ")";
+          }
+
+          function edgeAppearance(rows) {
+            if (rows.some(function (r) { return r.violation; })) { return { cls: "violation" }; }
+            var fraction = resolvedFraction(rows);
+            if (fraction === 1) { return { cls: "resolved" }; }
+            if (fraction === 0) { return { cls: "unsupported" }; }
+            return { cls: "partial", style: "stroke:" + mixColor(fraction) + ";" };
           }
 
           function groupBy(rows, keyFn, shapeFn) {
@@ -240,10 +263,13 @@ module RubyAbilityGraph
 
             function drawEdge(x1, y1, x2, y2, statusRows, store, key) {
               var midX = (x1 + x2) / 2;
-              var path = svgEl("path", {
-                "class": "edge " + edgeStatus(statusRows),
+              var appearance = edgeAppearance(statusRows);
+              var attrs = {
+                "class": "edge " + appearance.cls,
                 d: "M " + x1 + "," + y1 + " C " + midX + "," + y1 + " " + midX + "," + y2 + " " + x2 + "," + y2
-              });
+              };
+              if (appearance.style) { attrs.style = appearance.style; }
+              var path = svgEl("path", attrs);
               svg.appendChild(path);
               store[key] = path;
               return path;
@@ -353,14 +379,22 @@ module RubyAbilityGraph
               return bits.join(" ");
             }
 
+            function edgeHeader(a, b, rows) {
+              var resolved = rows.filter(function (r) { return r.confidence === "resolved"; }).length;
+              var header = a + " → " + b + " -- " + resolved + "/" + rows.length + " resolved";
+              var violationCount = rows.filter(function (r) { return r.violation; }).length;
+              if (violationCount) { header += ", " + violationCount + " violation(s)"; }
+              return header;
+            }
+
             function raTooltip(edge) {
-              return [edge.role + " → " + edge.action]
+              return [edgeHeader(edge.role, edge.action, edge.rows)]
                 .concat(edge.rows.map(function (r) { return rowLine(r.model, r); }))
                 .join("\n");
             }
 
             function amTooltip(edge) {
-              return [edge.action + " → " + edge.model]
+              return [edgeHeader(edge.action, edge.model, edge.rows)]
                 .concat(edge.rows.map(function (r) { return rowLine(r.role, r); }))
                 .join("\n");
             }

data/lib/ruby_ability_graph/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyAbilityGraph
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby_ability_graph
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Jessica Grider
@@ -25,8 +25,8 @@ dependencies:
         version: '1.0'
 description: |
   ruby_ability_graph loads a Rails app's CanCanCan Ability class in isolation,
-  enumerates roles x actions x models, and reports resolved permissions --
-  distinguishing patterns it can fully resolve from ones it doesn't support.
+  enumerates roles x actions x models, and reports resolved permissions.
+  Distinguishes patterns it can fully resolve from ones it doesn't support.
 executables:
 - ruby-ability-graph
 extensions: []