sequel-privacy 0.5.6 → 0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b47c85175a70082489fe5307e91094ea6a60dfde2d7f28ee814206a3029a892
-  data.tar.gz: a14f83b40de9d66df9390b5d2e797356bebd98f7f4c03947123b910fa0290f11
+  metadata.gz: 6aa19c5eda5b7d5be5a491fd8aa877037c1b79014245d2a400f647fb7aa2d174
+  data.tar.gz: f29f6df4a6418febe64508727df1cb8e2e611b31ea02ae3b8dda9516cdc5fd90
 SHA512:
-  metadata.gz: 941314443e93f294bb0de8017ca4abf7181b9298de65ab4b020f2811c48b6f486dc65514c442b764a03f2c6138e51b5ac52a3bb1cf66b0fa976be7bb081ad075
-  data.tar.gz: 372ca5512a9a8a215ab354ab4fa878334aef8edfec000524b40b36d8a9cac690af2e44ed0a9e0e7e9a0d539a843f9b34a9ad422b283c49a0a45aa2e0e202dc3b
+  metadata.gz: 9a466793f9a3ddb2c3938f6434a56a7262569820ae3a9c8fb752c0f7d163f3b8bdfad3d09f9750fe4771d28fbb8171a780e9569963429dda2edc5e0f2b2ac68a
+  data.tar.gz: bf7059897a808ff8466b2054f632a682bbf5e8201995760999259baaac3753d7116f6fe1159ec868ca1dfc40d5166697982a47f4b8dc494615c0337fdad14f2f

data/lib/sequel/plugins/privacy.rb

@@ -43,10 +43,15 @@ module Sequel
         model.instance_variable_set(:@privacy_association_policies, {})
         model.instance_variable_set(:@privacy_finalized, false)
         model.instance_variable_set(:@allow_unsafe_access, false)
+        model.instance_variable_set(:@privacy_wrapped_association_reflections, {})
       end
 
       sig { params(model: T.class_of(Sequel::Model), opts: T::Hash[Symbol, T.untyped]).void }
-      def self.configure(model, opts = {}); end
+      def self.configure(model, opts = {})
+        model.all_association_reflections.each do |reflection|
+          model.send(:_setup_privacy_association_readers, reflection[:type], reflection[:name], true)
+        end
+      end
 
       class AssociationPrivacyDSL
         extend T::Sig
@@ -146,6 +151,7 @@ module Sequel
           :@privacy_policies => :dup,
           :@privacy_fields => :dup,
           :@privacy_association_policies => :dup,
+          :@privacy_wrapped_association_reflections => :dup,
           :@privacy_finalized => nil,
           :@allow_unsafe_access => nil
         )
@@ -350,15 +356,7 @@ module Sequel
           opts = _inject_privacy_eager_block(opts)
           result = super
 
-          case type
-          when :many_to_one, :one_to_one
-            _override_singular_association(name)
-            _override_association_dataset(name)
-          when :one_to_many, :many_to_many
-            _override_plural_association(name)
-            _override_association_dataset(name)
-            setup_association_privacy(name) if privacy_association_policies[name]
-          end
+          _setup_privacy_association_readers(type, name, false)
 
           result
         end
@@ -368,7 +366,11 @@ module Sequel
         # DatasetMethods#post_load). Preserves any user-supplied block.
         sig { params(opts: T::Hash[Symbol, T.untyped]).returns(T::Hash[Symbol, T.untyped]) }
         def _inject_privacy_eager_block(opts)
-          original = opts[:eager_block]
+          opts.merge(eager_block: _privacy_eager_block(opts[:eager_block]))
+        end
+
+        sig { params(original: T.untyped).returns(Proc) }
+        def _privacy_eager_block(original)
           wrapped = proc do |ds|
             ds = original.call(ds) if original
             vc = Thread.current[DatasetMethods::EAGER_VC_KEY]
@@ -378,11 +380,40 @@ module Sequel
               ds
             end
           end
-          opts.merge(eager_block: wrapped)
+          wrapped
         end
 
         private
 
+        sig { params(type: Symbol, name: Symbol, inject_eager_block: T::Boolean).void }
+        def _setup_privacy_association_readers(type, name, inject_eager_block)
+          reflection = association_reflection(name)
+          return unless reflection
+
+          @privacy_wrapped_association_reflections ||= T.let(
+            {},
+            T.nilable(T::Hash[Symbol, T.untyped])
+          )
+          wrapped = @privacy_wrapped_association_reflections
+          return if wrapped[name].equal?(reflection)
+
+          if inject_eager_block
+            reflection[:eager_block] = _privacy_eager_block(reflection[:eager_block])
+          end
+
+          case type
+          when :many_to_one, :one_to_one
+            _override_singular_association(name)
+            _override_association_dataset(name)
+          when :one_to_many, :many_to_many
+            _override_plural_association(name)
+            _override_association_dataset(name)
+            setup_association_privacy(name) if privacy_association_policies[name]
+          end
+
+          wrapped[name] = reflection
+        end
+
         sig { params(name: Symbol).void }
         def _override_association_dataset(name)
           dataset_method = :"#{name}_dataset"

data/lib/sequel/privacy/enforcer.rb

@@ -61,7 +61,7 @@ module Sequel
 
           # Fail-secure: every chain ends with AlwaysDeny.
           unless policies.last == BuiltInPolicies::AlwaysDeny
-            logger&.warn { 'Policy chain should end with AlwaysDeny. Appending it.' }
+            logger&.debug { 'Policy chain should end with AlwaysDeny. Appending it.' }
             policies = policies.dup << BuiltInPolicies::AlwaysDeny
           end
 

data/lib/sequel/privacy/version.rb

@@ -3,6 +3,6 @@
 
 module Sequel
   module Privacy
-    VERSION = '0.5.6'
+    VERSION = '0.6'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sequel-privacy
 version: !ruby/object:Gem::Version
-  version: 0.5.6
+  version: '0.6'
 platform: ruby
 authors:
 - Austin Bales
@@ -138,7 +138,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.15
 specification_version: 4
 summary: Privacy enforcement plugin for Sequel models
 test_files: []