shamu 0.0.15 → 0.0.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7de984c9428165d200372dc8eb38e8a9cc48958e
-  data.tar.gz: 87b753cfa2ad1e214a6603cbf7d78d19ce7ada40
+  metadata.gz: f6f49a347f5a63383390bc51b9cba9616d7b7fec
+  data.tar.gz: 732419b2df2e8757cc4772f8e03d59411abbbcbe
 SHA512:
-  metadata.gz: d776c1c5812138503502f9d3f0e8ac0b9f4c1ccf0f14528153da942d1758d11c733e50aba1c6f98d1c94eaed655caf841c883f716b0ab4dd2ed45d0de7ec32a6
-  data.tar.gz: 881b98c5de187f163c58147b5090a7c73b1b9edd8755c5ddde163ba6955d6b097941fd27f435b9ce3f1af2f5795c1cc13cb891d5756285acb7c8277e2a4d128d
+  metadata.gz: 7355e1c846de3a9c53dbcaa6cc301433a0f901464f92f557ca2c0a439fa2385320e7faf53248b895b7364ea17c8ae71fdac828d14b779b0d31b57434c67b016e
+  data.tar.gz: 61c004a0899ae0707d5d6f1a2b21e200cb80622302c9ac0ed77496c79019888d72006e99cd34f5df07d899354066584d04ada782cf8fba1743f0f0c4f1be4500

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shamu (0.0.15)
+    shamu (0.0.17)
       activemodel (>= 5.0)
       activesupport (>= 5.0)
       crc32 (~> 1)

data/lib/shamu/auditing/auditing_service.rb

@@ -12,8 +12,16 @@ module Shamu
     # > {Security::Policy} but delegates the actual reading and writing.
     class AuditingService < Services::Service
 
+      STANDARD_FILTER_KEYS = [
+          :password,
+          :password_confirmation,
+          :access_token,
+          :auth_token,
+          :token
+      ].freeze
+
       def self.create( scorpion, *args )
-        scorpion.fetch Shamu::Auditing::LoggingAuditingService, *args
+        scorpion.fetch Shamu::Auditing::NullAuditingService, *args
       end
 
       # Records an auditable event in persistent storage.
@@ -23,6 +31,24 @@ module Shamu
         fail NotImplementedError
       end
 
+      # @!return [Array<Symbol>] the list of keys that should be filtered in
+      # the logged changes.
+      def filter_keys
+        STANDARD_FILTER_KEYS
+      end
+
+      private
+
+        def filter_changes( changes )
+          filter_keys.each_with_object( changes.dup ) do |key, filtered|
+            filtered[ key ] = "FILTERED" if filter_key?( key )
+          end
+        end
+
+        def filter_key?( key )
+          filter_keys.include?( key.to_sym )
+        end
+
     end
   end
 end

data/lib/shamu/auditing/logging_auditing_service.rb

@@ -2,11 +2,13 @@ module Shamu
   module Auditing
 
     # Writes audit logs to the {Shamu::Logger}.
-    class LoggingAuditingService < Services::Service
+    class LoggingAuditingService < AuditingService
 
-      # (see AuditingService#commit)
+      # Records an auditable event in persistent storage.
+      # @param [Transaction] transaction
+      # @return [AuditRecord] the persisted record.
       def commit( transaction )
-        logger.unknown "AUDIT TRANSACTION action: #{ transaction.action } entity: #{ transaction.entity_path } by user: #{ transaction.user_id_chain } changes: #{ transaction.changes }" # rubocop:disable Metrics/LineLength
+        logger.unknown "AUDIT TRANSACTION action: #{ transaction.action } entity: #{ transaction.entity_path } by user: #{ transaction.user_id_chain } changes: #{ filter_changes( transaction.changes ) }" # rubocop:disable Metrics/LineLength
       end
 
     end

data/lib/shamu/auditing/null_auditing_service.rb

@@ -0,0 +1,13 @@
+module Shamu
+  module Auditing
+
+    # No-op on audit logging requests.
+    class NullAuditingService < Services::Service
+
+      # (see AuditingService#commit)
+      def commit( transaction )
+      end
+
+    end
+  end
+end

data/lib/shamu/auditing/transaction.rb

@@ -10,7 +10,8 @@ module Shamu
       #
 
       # @!attribute
-      # @return [Array<Object>] the chain of user ids making the request.
+      # @return [Array<Object>] the chain of user ids from the
+      # {Security::Principal} in place at the time of the request.
       attribute :user_id_chain, presence: true
 
       # @!attribute
@@ -44,7 +45,7 @@ module Shamu
       # (see Services::Request#apply_to)
       def apply_to( model )
         super.tap do
-          model.changes_json = changes.to_json if changes.present?
+          assign_changes_to_model model
         end
       end
 
@@ -52,6 +53,10 @@ module Shamu
 
         attr_reader :entities
 
+        def assign_changes_to_model( model )
+          model.changes_json = changes.to_json if changes.present?
+        end
+
     end
   end
 end

data/lib/shamu/version.rb

@@ -2,7 +2,7 @@
 
 module Shamu
   # The primary version number
-  VERSION_NUMBER  = "0.0.15"
+  VERSION_NUMBER  = "0.0.17"
 
   # Version suffix such as 'beta' or 'alpha'
   VERSION_SUFFIX  = ""

data/spec/lib/shamu/auditing/logging_auditing_service_spec.rb

@@ -15,4 +15,20 @@ describe Shamu::Auditing::LoggingAuditingService do
 
     service.commit transaction
   end
-end
+
+  it "filters protected keys" do
+    expect( service.logger ).to receive( :unknown ) do |message|
+      expect( message ).not_to match "I'm a secret"
+      expect( message ).to match "Mr Penguin"
+    end
+
+    transaction = Shamu::Auditing::Transaction.new \
+      user_id_chain: [1, 2, 3],
+      action: :change,
+      changes: { name: "Mr Penguin", password: "I'm a secret" }
+
+    transaction.append_entity [ "User", 45 ]
+
+    service.commit transaction
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shamu
 version: !ruby/object:Gem::Version
-  version: 0.0.15
+  version: 0.0.17
 platform: ruby
 authors:
 - Paul Alexander
@@ -242,6 +242,7 @@ files:
 - lib/shamu/auditing/auditing_service.rb
 - lib/shamu/auditing/list_scope.rb
 - lib/shamu/auditing/logging_auditing_service.rb
+- lib/shamu/auditing/null_auditing_service.rb
 - lib/shamu/auditing/support.rb
 - lib/shamu/auditing/transaction.rb
 - lib/shamu/entities.rb