sequel-privacy 0.5.4 → 0.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 54198780e9744c541e3915d3ac5722ccb16b119a77729b5013b854e698604511
-  data.tar.gz: 5219bec34c9542ce88f928bc39c1998586e6ed2c15637296dead03d958e12db1
+  metadata.gz: 2b47c85175a70082489fe5307e91094ea6a60dfde2d7f28ee814206a3029a892
+  data.tar.gz: a14f83b40de9d66df9390b5d2e797356bebd98f7f4c03947123b910fa0290f11
 SHA512:
-  metadata.gz: 8673ccf1e4e6cb592299c9a930ee7ff779e0343e66753a245f71f4aa26d21906c486dc1435d55af53c1c8b09c8166f24fec2e8036ce3f962598df4d8a29cadf9
-  data.tar.gz: 34bc11e989421e4cd7d5207fc531d7bcf17cf681c8b10c3104918c12d5d2a9eb8cdf68274dd64397c8b49ba51b6c59b3de4fd4ef73e8acbf06b1fdd671039cce
+  metadata.gz: 941314443e93f294bb0de8017ca4abf7181b9298de65ab4b020f2811c48b6f486dc65514c442b764a03f2c6138e51b5ac52a3bb1cf66b0fa976be7bb081ad075
+  data.tar.gz: 372ca5512a9a8a215ab354ab4fa878334aef8edfec000524b40b36d8a9cac690af2e44ed0a9e0e7e9a0d539a843f9b34a9ad422b283c49a0a45aa2e0e202dc3b

data/README.md

@@ -180,6 +180,33 @@ policy :MyPolicy, ->() { ... },
 
 **`allow_anonymous: true`**: Skip the auto-deny for nil actor. Use for state-gate policies that examine only the subject (e.g. "post is published").
 
+### Policy Factories
+
+Use `policy_factory` when a policy needs definition-time arguments, while still receiving the normal runtime policy arguments (`actor`, `subject`, `direct_object`) during enforcement.
+
+```ruby
+module P
+  extend Sequel::Privacy::PolicyDSL
+
+  policy_factory :AllowIfActorMeetsFieldVisibility, ->(visibility_field) {
+    ->(actor, subject) {
+      allow if actor.meets_visibility?(subject.public_send(visibility_field))
+    }
+  }
+end
+
+class Member < Sequel::Model
+  plugin :privacy
+
+  privacy do
+    can :view, P::AllowMembers
+    field :phone, P::AllowIfActorMeetsFieldVisibility(:phone_visibility)
+  end
+end
+```
+
+Policy factories accept the same options as `policy`. The factory must return a Proc, and each call returns a concrete `Policy` instance with its own cache identity.
+
 ### Policy Combinators
 
 Use `all()` to require multiple conditions:

data/lib/sequel/plugins/privacy.rb

@@ -126,6 +126,8 @@ module Sequel
             case p
             when Sequel::Privacy::Policy, Proc
               p
+            when Sequel::Privacy::PolicyFactory
+              Kernel.raise ArgumentError, "Policy factory #{p.factory_name} must be called with arguments"
             else
               Kernel.raise ArgumentError, "Invalid policy: #{p.inspect}"
             end
@@ -148,17 +150,24 @@ module Sequel
           :@allow_unsafe_access => nil
         )
 
-        # Allows the model to be accessed without a ViewerContext,
-        # useful when you're migrating an existing codebase or adopting gradually.
-        sig { void }
-        def allow_unsafe_access!
+        # Allows the model to be accessed without a ViewerContext, useful when
+        # you're migrating an existing codebase or adopting gradually.
+        # You can prevent this from applying to certain fields or associations by
+        # passing `except:`.
+        sig { params(except: T::Array[Symbol]).void }
+        def allow_unsafe_access!(except: [])
           @allow_unsafe_access = T.let(true, T.nilable(T::Boolean))
+          @unsafe_access_except = T.let(except.map(&:to_sym), T.nilable(T::Array[Symbol]))
           Sequel::Privacy.logger&.warn("#{self} allows unsafe access - migrate to use for_vc()")
         end
 
-        sig { returns(T::Boolean) }
-        def allow_unsafe_access?
-          @allow_unsafe_access == true
+        # Checks if the model or a field/association allows unsafe access.
+        sig { params(name: T.nilable(Symbol)).returns(T::Boolean) }
+        def allow_unsafe_access?(name = nil)
+          return false unless @allow_unsafe_access == true
+          return true if name.nil?
+
+          !(@unsafe_access_except || []).include?(name)
         end
 
         # Per-class thread-local key carrying the current VC during row
@@ -246,7 +255,7 @@ module Sequel
             vc = instance_variable_get(:@viewer_context)
 
             unless vc
-              return original_method.bind(self).() if T.unsafe(self.class).allow_unsafe_access?
+              return original_method.bind(self).() if T.unsafe(self.class).allow_unsafe_access?(field)
 
               Kernel.raise Sequel::Privacy::MissingViewerContext,
                            "#{self.class}##{field} requires a ViewerContext"
@@ -406,6 +415,12 @@ module Sequel
 
           define_method(name) do
             vc = instance_variable_get(:@viewer_context)
+
+            if vc.nil? && !T.unsafe(self.class).allow_unsafe_access?(name)
+              Kernel.raise Sequel::Privacy::MissingViewerContext,
+                           "#{self.class}##{name} requires a ViewerContext"
+            end
+
             assoc_class ||= assoc_reflection.associated_class
 
             obj = if vc && assoc_class.respond_to?(:privacy_vc_key)
@@ -444,6 +459,12 @@ module Sequel
 
           define_method(name) do
             vc = instance_variable_get(:@viewer_context)
+
+            if vc.nil? && !T.unsafe(self.class).allow_unsafe_access?(name)
+              Kernel.raise Sequel::Privacy::MissingViewerContext,
+                           "#{self.class}##{name} requires a ViewerContext"
+            end
+
             assoc_class ||= assoc_reflection.associated_class
 
             objs = if vc && assoc_class.respond_to?(:privacy_vc_key)
@@ -475,8 +496,8 @@ module Sequel
           end
         end
 
-        sig { params(_assoc_name: Symbol, singular_name: Symbol, policies: T::Array[T.untyped]).void }
-        def _wrap_association_add(_assoc_name, singular_name, policies)
+        sig { params(assoc_name: Symbol, singular_name: Symbol, policies: T::Array[T.untyped]).void }
+        def _wrap_association_add(assoc_name, singular_name, policies)
           method_name = :"add_#{singular_name}"
           original = instance_method(method_name)
 
@@ -484,7 +505,7 @@ module Sequel
             vc = instance_variable_get(:@viewer_context)
 
             unless vc
-              return original.bind(self).(obj) if T.unsafe(self.class).allow_unsafe_access?
+              return original.bind(self).(obj) if T.unsafe(self.class).allow_unsafe_access?(assoc_name)
 
               Kernel.raise Sequel::Privacy::MissingViewerContext,
                            "Cannot #{method_name} without a viewer context"
@@ -506,8 +527,8 @@ module Sequel
           end
         end
 
-        sig { params(_assoc_name: Symbol, singular_name: Symbol, policies: T::Array[T.untyped]).void }
-        def _wrap_association_remove(_assoc_name, singular_name, policies)
+        sig { params(assoc_name: Symbol, singular_name: Symbol, policies: T::Array[T.untyped]).void }
+        def _wrap_association_remove(assoc_name, singular_name, policies)
           method_name = :"remove_#{singular_name}"
           original = instance_method(method_name)
 
@@ -515,7 +536,7 @@ module Sequel
             vc = instance_variable_get(:@viewer_context)
 
             unless vc
-              return original.bind(self).(obj) if T.unsafe(self.class).allow_unsafe_access?
+              return original.bind(self).(obj) if T.unsafe(self.class).allow_unsafe_access?(assoc_name)
 
               Kernel.raise Sequel::Privacy::MissingViewerContext,
                            "Cannot #{method_name} without a viewer context"
@@ -537,8 +558,8 @@ module Sequel
           end
         end
 
-        sig { params(_assoc_name: Symbol, plural_name: Symbol, policies: T::Array[T.untyped]).void }
-        def _wrap_association_remove_all(_assoc_name, plural_name, policies)
+        sig { params(assoc_name: Symbol, plural_name: Symbol, policies: T::Array[T.untyped]).void }
+        def _wrap_association_remove_all(assoc_name, plural_name, policies)
           method_name = :"remove_all_#{plural_name}"
           original = instance_method(method_name)
 
@@ -546,7 +567,7 @@ module Sequel
             vc = instance_variable_get(:@viewer_context)
 
             unless vc
-              return original.bind(self).() if T.unsafe(self.class).allow_unsafe_access?
+              return original.bind(self).() if T.unsafe(self.class).allow_unsafe_access?(assoc_name)
 
               Kernel.raise Sequel::Privacy::MissingViewerContext,
                            "Cannot #{method_name} without a viewer context"

data/lib/sequel/privacy/policy_dsl.rb

@@ -50,6 +50,35 @@ module Sequel
         )
         const_set(name, p)
       end
+
+      sig do
+        params(
+          name: Symbol,
+          factory: Proc,
+          comment: T.nilable(String),
+          cacheable: T::Boolean,
+          single_match: T::Boolean,
+          cache_by: T.nilable(T.any(Symbol, T::Array[Symbol])),
+          allow_anonymous: T::Boolean
+        ).void
+      end
+      def policy_factory(name, factory, comment = nil, cacheable: true, single_match: false, cache_by: nil,
+                         allow_anonymous: false)
+        policy_factory = PolicyFactory.new(
+          name,
+          factory,
+          comment: comment,
+          cacheable: cacheable,
+          single_match: single_match,
+          cache_by: cache_by,
+          allow_anonymous: allow_anonymous
+        )
+
+        const_set(name, policy_factory)
+        define_singleton_method(name) do |*args|
+          policy_factory.call(*args)
+        end
+      end
     end
   end
 end

data/lib/sequel/privacy/policy_factory.rb

@@ -0,0 +1,68 @@
+# typed: true
+# frozen_string_literal: true
+
+module Sequel
+  module Privacy
+    # A PolicyFactory captures definition-time arguments and returns concrete
+    # Policy instances that can be registered in a privacy policy chain.
+    class PolicyFactory
+      extend T::Sig
+
+      sig { returns(String) }
+      attr_reader :factory_name
+
+      sig do
+        params(
+          factory_name: Symbol,
+          factory: Proc,
+          comment: T.nilable(String),
+          cacheable: T::Boolean,
+          single_match: T::Boolean,
+          cache_by: T.nilable(T.any(Symbol, T::Array[Symbol])),
+          allow_anonymous: T::Boolean
+        ).void
+      end
+      def initialize(factory_name, factory, comment: nil, cacheable: true, single_match: false, cache_by: nil,
+                     allow_anonymous: false)
+        @factory_name = T.let(factory_name.to_s, String)
+        @factory = T.let(factory, Proc)
+        @comment = T.let(comment, T.nilable(String))
+        @cacheable = T.let(cacheable, T::Boolean)
+        @single_match = T.let(single_match, T::Boolean)
+        @cache_by = T.let(cache_by, T.nilable(T.any(Symbol, T::Array[Symbol])))
+        @allow_anonymous = T.let(allow_anonymous, T::Boolean)
+      end
+
+      sig { params(args: T.untyped).returns(Policy) }
+      def call(*args)
+        lam = T.unsafe(@factory).call(*args)
+        unless lam.is_a?(Proc)
+          Kernel.raise ArgumentError,
+                       "Policy factory #{@factory_name} must return a Proc, got #{lam.inspect}"
+        end
+
+        T.cast(
+          Policy.create(
+            policy_name_for(args),
+            lam,
+            @comment,
+            cacheable: @cacheable,
+            single_match: @single_match,
+            cache_by: @cache_by,
+            allow_anonymous: @allow_anonymous
+          ),
+          Policy
+        )
+      end
+
+      private
+
+      sig { params(args: T::Array[T.untyped]).returns(Symbol) }
+      def policy_name_for(args)
+        return @factory_name.to_sym if args.empty?
+
+        :"#{@factory_name}(#{args.map(&:inspect).join(', ')})"
+      end
+    end
+  end
+end

data/lib/sequel/privacy/version.rb

@@ -3,6 +3,6 @@
 
 module Sequel
   module Privacy
-    VERSION = '0.5.4'
+    VERSION = '0.5.6'
   end
 end

data/lib/sequel-privacy.rb

@@ -20,6 +20,7 @@ require_relative 'sequel/privacy/version'
 require_relative 'sequel/privacy/errors'
 require_relative 'sequel/privacy/i_actor'
 require_relative 'sequel/privacy/policy'
+require_relative 'sequel/privacy/policy_factory'
 require_relative 'sequel/privacy/cache'
 require_relative 'sequel/privacy/actions'
 require_relative 'sequel/privacy/viewer_context'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sequel-privacy
 version: !ruby/object:Gem::Version
-  version: 0.5.4
+  version: 0.5.6
 platform: ruby
 authors:
 - Austin Bales
@@ -114,6 +114,7 @@ files:
 - lib/sequel/privacy/i_actor.rb
 - lib/sequel/privacy/policy.rb
 - lib/sequel/privacy/policy_dsl.rb
+- lib/sequel/privacy/policy_factory.rb
 - lib/sequel/privacy/version.rb
 - lib/sequel/privacy/viewer_context.rb
 homepage: https://github.com/arbales/sequel-privacy