super_auth 0.3.3 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a2db33b2e48f7e542d54f3b5cef127f51c09fe19896b4ec6644a65ffa424c91
-  data.tar.gz: 87a7b993edea7bab1ca6c3298805f17e62ce0cd8b67de9114167cdb868316d7d
+  metadata.gz: 8d15415f81b29b08a690f0223fe01fd888177085f479adb902ab5103002e7292
+  data.tar.gz: 6bc43afccfc699cbf2f8d67c6af32226cfa8989f2e188bbe919835529b488a43
 SHA512:
-  metadata.gz: 62f14629c43e5dae082d3884803dae6559a91c58118479fc1fc6e4496dec27036c35cf8011e859b16f0e5a30d9c977244d2c39d005936a015796ddd1845b87ee
-  data.tar.gz: ee2cfaa0d1d3d4b8e3ba56130bc47cdbcb491982fac339bcde956a555b267dc8b39c82da284427f4b7e0baeb6382a5532766135d96922ecd1170079a0333c2f5
+  metadata.gz: 8fc62a59a8291668b01d3a4a012422f764302534f5acc7be6d5954e2dfa4427cd69d7b5f81d65fb96a9be77f1c3c328ce4785071ba2310e7c2cbecf1c1174f9f
+  data.tar.gz: c5012e5e5fdebb90c46326ed8438e939b4c37562730aa33078eecc9dd74debb07c0154509c90549c4dbc783aa4f14e7d2353e63d814571e22e018f45439d3991

data/CHANGELOG.md

@@ -1,5 +1,26 @@
 ## [Unreleased]
 
+## [0.4.0] - 2026-09-02
+
+### Security
+
+- Fix: path strategy 1 (users <-> groups <-> roles <-> permissions <-> resources) granted every role held by any group to the members of every group that held a role. `SuperAuth::Edge.users_groups_roles_permissions_resources` built one set of all role-holding groups and one set of all group-held roles and cross-joined them with nothing correlating a group to its own role. The role lookup is now joined through the member's own group ancestry, so a role attached to one group never reaches members of an unrelated group. Affects `SuperAuth::Edge.authorizations` and anything compiled from it (`SuperAuth::ActiveRecord::Authorization.compile!`); recompile authorizations after upgrading.
+
+### Added
+
+- Postgres row-level security enforcement (`SuperAuth::RLS`, `rails g super_auth:rls Model ...`). Identity is anchored to the transaction by the `super_auth_become()` SQL function, exposed in Ruby as `SuperAuth.as(user) { ... }`, so non-Ruby clients get the same enforcement.
+- Permission-gated subclass loading: a `ByCurrentUser` subclass is its own resource type, so privileged methods can live on a subclass whose access must be granted explicitly. A grant on the base class does not flow down.
+- `SuperAuth.external_id_type` types the external id columns at install time instead of casting at query time.
+
+### Changed
+
+- Relicensed from MIT to GPL-2.0.
+- Path strategies 1, 2 and 3 join group ancestry and role subtrees on integer pairs from two new recursive CTEs (`Group.ancestor_pairs`, `Role.descendant_pairs`) instead of LIKE-matching ids inside the comma-separated path strings, which no planner can index. Output is unchanged. On a 10,000-user graph the full `authorizations` union went from 10.4 s to 2.5 s on Postgres 16; on MySQL 8 a 500-user graph went from 9.9 s to 0.08 s, and on SQLite strategy 1 alone went from over 400 s to 0.01 s.
+
+### Fixed
+
+- MySQL 8 support. `SuperAuth::Edge.authorizations` raised "Illegal mix of collations for operation 'UNION'" whenever the connection collation differed from the table collation, which it does under ActiveRecord's defaults, so `compile!` could never run on MySQL. The recursive tree CTEs typed their path columns from the anchor row, so any `group_path` or `role_path` over 11 characters, or name path over 255, failed with "Data too long". Migration 8 no longer adds edge indexes on MySQL, where InnoDB already indexes foreign keys and refuses to drop them, which had broken `uninstall_migrations`. CI now runs the suite against real MySQL instead of silently falling back to SQLite.
+
 ## [0.3.3] - 2026-04-29
 
 - Fix: detect PostgreSQL/SQLite/Mysql2 adapter subclasses (e.g. PostGIS, Makara) when bootstrapping the Sequel connection from ActiveRecord. Previously only the exact stock adapter classes were recognized, leaving `SuperAuth.db` unset for apps using a subclassed adapter.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    super_auth (0.3.3)
+    super_auth (0.4.0)
       sequel
 
 GEM

data/README.md

@@ -2,16 +2,23 @@
 
 [![Build Status](https://github.com/JonathanFrias/super_auth/actions/workflows/main.yml/badge.svg?branch=main)](https://github.com/JonathanFrias/super_auth/actions)
 
-Super auth is turn-key authorization gem that makes unauthorized access unrepresentable. **Stop writing tests for authorization with confidence**
+Super auth is a turn-key authorization engine that makes unauthorized access unrepresentable — enforced in your database, so the same rules protect every client, in any language, that touches your data. **Stop writing authorization tests; enforce access with confidence.**
 
-The intent is to use with ruby applications, as well as centralize authorization for multiple applications. If you look at the [OWASP top vulnerabilty](https://owasp.org/Top10/A01_2021-Broken_Access_Control/), broken
-access control is the NUMBER 1 most common security risk in modern applications today. super_auth provides a authentication strategy that allows you to completely de-risk your application, solving this issue once confidently.
+The intent is to centralize authorization for one application or many, in any language. If you look at the [OWASP top vulnerability](https://owasp.org/Top10/A01_2021-Broken_Access_Control/), broken
+access control is the NUMBER 1 most common security risk in modern applications today. super_auth provides an authorization model that lets you de-risk your application, solving this issue once, confidently.
 
 
 ## Installation
 
+SuperAuth enforces authorization in the database, so any language can participate. The reference client is the Ruby gem:
+
     gem "super_auth"
 
+## Supported databases
+
+PostgreSQL 13+, MySQL 8.0+, and SQLite 3.44+. The group and role trees are recursive
+CTEs and the path columns use `concat()`, which sets those floors. CI runs the full
+suite against each of the three. Row-level security is Postgres only.
 
 ## Docs
 
@@ -47,6 +54,124 @@ Then visit: `http://localhost:3000/super_auth/visualization`
 
 See [VISUALIZATION.md](VISUALIZATION.md) for complete documentation.
 
+## Postgres Row-Level Security (optional)
+
+The `ByCurrentUser` scope enforces authorization at the ORM layer. On Postgres you can
+additionally enforce the same rules inside the database itself, so raw SQL, `unscoped`,
+background jobs, and any other client on the same database are subject to them too —
+unauthorized rows become invisible at the connection level. Enforcement is pure SQL:
+participating apps don't load this gem, or Ruby, at all. The gem's role is
+administrative — define the graph, compile authorizations, enable the policies — which
+is what makes super_auth usable as a central authorization service for apps in any
+language.
+
+### The contract (any language)
+
+Identity is asserted per transaction by calling the `super_auth_become` function that
+`SuperAuth::RLS.enable` installs:
+
+```sql
+BEGIN;
+SELECT super_auth_become(user_external_id => '42', user_external_type => 'AppUser');
+-- run normal queries; rows the user isn't authorized for don't exist --
+COMMIT;  -- identity dies with the transaction; there is nothing to clear
+```
+
+For a user managed inside super_auth, pass `user_id => '7'` instead; `system => true`
+bypasses the policies (migrations, seeds, admin jobs).
+
+The assertion is anchored to the calling transaction: `super_auth_become` sets
+transaction-local identity settings plus a stamp of the current transaction id, and
+every policy requires a stamp from the current transaction. Outside a transaction the
+settings have already reverted, and identity smuggled in as session settings carries a
+dead transaction's stamp — either way queries return no rows and writes are rejected.
+Misuse fails closed, and the scheme works unchanged behind transaction-pooling proxies
+like pgbouncer, because a transaction is exactly what they keep on one server
+connection.
+
+### Setup (Rails)
+
+**1. Match column types to your primary keys — before your first migration.**
+The policies compare `super_auth_authorizations.resource_external_id` directly
+against your tables' pks with no casting, so the columns must share a type:
+
+```ruby
+# config/initializers/super_auth.rb
+SuperAuth.setup do |config|
+  config.external_id_type = :bigint   # Rails' default pk type; use :uuid, :string, ... to match yours
+end
+```
+
+If super_auth is already migrated with the wrong type, alter the four external id
+columns (`super_auth_users.external_id`, `super_auth_resources.external_id`,
+`super_auth_authorizations.user_external_id`, `super_auth_authorizations.resource_external_id`)
+in a migration of your own.
+
+**2. Enable RLS on the tables you want protected:**
+
+```bash
+rails generate super_auth:rls Document Invoice
+rails db:migrate
+```
+
+This creates one migration calling `SuperAuth::RLS.enable(:documents, resource_type: "Document")`
+per model — you can also call that directly for tables outside Rails. `resource_type`
+must match the `resource_external_type` used in your authorization rows (the model's
+class name when you use the AR integration).
+
+**3. Connect as a role RLS applies to.** Superusers and `BYPASSRLS` roles skip
+policies entirely, so the app must not connect as one (owning the tables is fine —
+the policies use `FORCE ROW LEVEL SECURITY`). The role needs `SELECT` on
+`super_auth_authorizations`, which the policies read; `EXECUTE` on
+`super_auth_become` is granted to `PUBLIC` by default, so no extra grant is needed:
+
+```sql
+CREATE ROLE app_runtime LOGIN PASSWORD '...';
+GRANT SELECT, INSERT, UPDATE, DELETE ON documents, invoices TO app_runtime;
+GRANT SELECT ON super_auth_authorizations TO app_runtime;
+```
+
+> ⚠️ **This is the one step that, if skipped, silently disables all protection.**
+> PostgreSQL *always* lets **superusers** and roles with the **`BYPASSRLS`** attribute
+> bypass row-level security. `FORCE ROW LEVEL SECURITY` only subjects the table *owner*
+> to the policies — it does **not** constrain a superuser. So if your app connects to
+> Postgres as a superuser (the default in many local setups and some managed hosts), the
+> policies apply to nobody and every row stays visible, while everything *looks* like it
+> is working. Always connect as a dedicated non-superuser, non-`BYPASSRLS` role such as
+> `app_runtime` above. SuperAuth's language-specific clients check this on startup and
+> warn you when the connection is able to bypass RLS.
+
+**4. Wrap work in an identity assertion.** In Ruby:
+
+```ruby
+SuperAuth.as(current_user) do
+  # every query in here is enforced by the database
+end
+```
+
+`SuperAuth.as` opens a transaction and calls `super_auth_become` for you — use it in
+an `around_action` (or around a job) to cover a whole request. Non-Ruby apps use the
+SQL contract directly. Each policy checks `super_auth_authorizations` with the same
+semantics as `ByCurrentUser`: type-level authorizations (`resource_external_id IS NULL`)
+act as a wildcard, per-record authorizations match on id, `system?` users bypass.
+
+### Notes
+
+- Queries with no identity asserted see nothing, and writes are rejected — fail
+  closed, by design. A client that has never heard of super_auth cannot accidentally
+  reach protected rows.
+- Creating rows requires a type-level authorization for that resource type (or system
+  context): the policy is `FOR ALL` with no `WITH CHECK`, so Postgres reuses its
+  `USING` expression as the implicit `WITH CHECK` for INSERTs and UPDATEs.
+- The transaction stamp calls `pg_current_xact_id()`, which assigns a real transaction
+  id even to read-only transactions — one extra xid per protected transaction.
+  Negligible for almost everyone; revisit with a virtual-xid variant only if
+  transaction id churn ever matters at extreme read volume.
+- One `external_id_type` covers the whole install, so every protected table across
+  every participating app needs the same pk type.
+- Postgres 13+ only (`pg_current_xact_id`). On other databases `SuperAuth::RLS`
+  raises, and the ORM scope remains the enforcement layer.
+
 ## Configuration
 
 ```ruby
@@ -55,12 +180,18 @@ SuperAuth.setup do |config|
   # Raise an error when a query runs without a current user set.
   # Default is :none (returns empty results silently).
   config.missing_user_behavior = :raise
+
+  # Column type for external id columns, applied when the migrations run. Set
+  # it to your application's primary key type (:bigint, :uuid, :string, ...) so
+  # authorization comparisons are natively typed. Default is :string.
+  config.external_id_type = :bigint
 end
 ```
 
 | Option | Values | Default | Description |
 |--------|--------|---------|-------------|
 | `missing_user_behavior` | `:none`, `:raise` | `:none` | Controls what happens when `SuperAuth.current_user` is blank. `:none` returns an empty result set. `:raise` raises `SuperAuth::Error`. |
+| `external_id_type` | `:string`, `:bigint`, `:uuid`, ... | `:string` | Column type for the external id columns, applied when the migrations run. Set it to your application's primary key type so every comparison against your tables' pks is natively typed — no casting anywhere. |
 
 ## Usage
 
@@ -75,6 +206,9 @@ SuperAuth is a rules engine engine that works on 5 different authorization conce
 The basis for how this works is that the rules engine is trying to match a user with a resource to determine access.
 The engine determines if it can find an authorization route betewen a user and a resource. It does so by looking at users, groups, roles, permissions.
 
+                          +---+           +---+
+                          |   |           |   |      (Group nests within Group,
+                          |   v           |   v       Role nests within Role)
                          +-------+       +------+
                          | Group |<----->| Role |
                          +-------+\    / +------+
@@ -92,7 +226,9 @@ The engine determines if it can find an authorization route betewen a user and a
 
 
 The lines between the boxes are called [edges](https://en.wikipedia.org/wiki/Glossary_of_graph_theory#edge).
-Note that `Group` and `Role` trees.
+The self-loops on `Group` and `Role` mean each nests within itself: a `Group` can contain
+child `Group`s and a `Role` can contain child `Role`s, recursively. Grants on a parent
+flow to every descendant — which is why `Group` and `Role` are described as *trees*.
 
 In general the super_auth has 5 different pathing strategies to search for access.
 
@@ -210,6 +346,68 @@ Since the path is stored with the record, it trivial to audit access permissions
 
 TODO: Write usage instructions here
 
+## Permission-Gated Models
+
+Every class is authorized by its own name — nothing is derived, and a grant on one class never flows to another. That makes a subclass the natural home for privileged methods: it shares the base class's table and rows, but loading it requires its own, explicitly approved grant. If you can't load the object, you can't call its methods.
+
+```ruby
+class Resource < ApplicationRecord
+  super_auth
+  # Loadable by users granted the "Resource" resource type.
+
+  class ResourceRestartPermission < Resource
+    # Loadable ONLY by users granted "Resource::ResourceRestartPermission".
+    def restart!
+      # dangerous restart operation
+    end
+  end
+end
+```
+
+Approve access to the subclass the same way as any other resource — register it by its class name and draw edges to it:
+
+```ruby
+restartable = SuperAuth::Resource.create(
+  name: "restartable servers",
+  external_type: "Resource::ResourceRestartPermission"
+)
+restart = SuperAuth::Permission.create(name: "restart")
+SuperAuth::Edge.create(user: sa_user, permission: restart)
+SuperAuth::Edge.create(permission: restart, resource: restartable)
+SuperAuth::ActiveRecord::Authorization.compile!
+
+Resource.find(id)                            # needs a "Resource" grant
+Resource::ResourceRestartPermission.find(id) # needs its own explicit approval
+```
+
+Grants are per class in both directions: a `"Resource"` grant does not unlock the subclass, and a `"Resource::ResourceRestartPermission"` grant does not unlock the base class.
+
+## Row-Level Security for permission-gated models
+
+For defense in depth on Postgres (13+), enable a policy on the table. It is keyed by a single resource type — the base class's name — and enforces *row visibility* using the same [contract described above](#postgres-row-level-security-optional):
+
+```ruby
+SuperAuth::RLS.enable(:resources, resource_type: "Resource")
+```
+
+`enable` turns on `ROW LEVEL SECURITY` (with `FORCE`, so the table owner is covered too) and installs a policy that derives visibility from `super_auth_authorizations`. Identity is asserted **per transaction, not per connection**: wrap the work in `SuperAuth.as`, which opens a transaction and calls `super_auth_become` for you (see the contract above). Every query inside is filtered, and the identity dies with the transaction:
+
+```ruby
+SuperAuth.as(current_user) do
+  SuperAuth.db[:resources].all   # only rows current_user holds a grant on
+end
+# outside the block there is no asserted identity, so the policy matches nothing
+```
+
+Works with `SuperAuth::User` records (matched by `user_id`) or your own user objects (matched by `user_external_id` / `user_external_type`); type-level wildcard grants (`resource_external_id IS NULL`) and the system user behave exactly as they do in the ActiveRecord scope. `SuperAuth::RLS.disable(:resources)` removes the policy.
+
+Because a policy sees only the table, not which Ruby class issued the query, row-level security enforces access to the **base** resource type: a `"Resource"` grant makes the row visible in the database, but the policy cannot distinguish the `"Resource::ResourceRestartPermission"` subclass. Per-class (capability) enforcement therefore stays with the ORM scope — the database is the row-visibility backstop, the client gates the capability.
+
+Notes:
+
+- With no `SuperAuth.as` assertion in effect, the policy matches nothing (deny by default) and writes are rejected — fail closed.
+- Postgres superusers and `BYPASSRLS` roles bypass row-level security entirely — run your application as a regular role (see the setup guide above).
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
@@ -222,4 +420,4 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/Jonath
 
 ## License
 
-The gem is available as open source under the terms of the [GPL](https://www.gnu.org/licenses/quick-guide-gplv3.html).
+The gem is available as open source under the terms of the [GPL v2](https://www.gnu.org/licenses/old-licenses/gpl-2.0.html).

data/USAGE.md

@@ -436,6 +436,29 @@ SuperAuth.current_user = SuperAuth::User.system
 Post.all  # Returns all posts
 ```
 
+### Permission-gated subclasses
+
+Every class is authorized by its own name, so privileged methods belong on a subclass: it shares the base class's table and rows, but loading it requires its own explicitly approved grant — access never flows between base and subclass in either direction:
+
+```ruby
+class Post < ApplicationRecord
+  super_auth
+
+  class PostPublishPermission < Post
+    def publish!
+      update!(published: true)
+    end
+  end
+end
+
+Post.find(id)                        # needs a "Post" grant
+Post::PostPublishPermission.find(id) # needs a "Post::PostPublishPermission" grant
+```
+
+Approve the subclass like any other resource — register a `SuperAuth::Resource` with `external_type: "Post::PostPublishPermission"` and draw edges to it, then recompile with `SuperAuth::ActiveRecord::Authorization.compile!`.
+
+For database-side enforcement of the same rules see "Postgres Row-Level Security" in the README (`SuperAuth::RLS.enable` — visibility is derived automatically from `SuperAuth.current_user`).
+
 ### Linking to your app's models
 
 Connect SuperAuth entities to your ActiveRecord models via `external_id` and `external_type`:
@@ -616,4 +639,4 @@ auths = SuperAuth::Edge.authorizations.all
 
 ## License
 
-SuperAuth is available as open source under the [GPL License](https://www.gnu.org/licenses/quick-guide-gplv3.html).
+SuperAuth is available as open source under the [GPL v2 License](https://www.gnu.org/licenses/old-licenses/gpl-2.0.html).

data/db/migrate/1_users.rb

@@ -2,7 +2,7 @@ Sequel.migration do
   up do
     create_table(:super_auth_users) do
       primary_key :id
-      String :external_id # , null: false
+      column :external_id, SuperAuth.sequel_external_id_type # , null: false
       String :external_type # , null: false
       String :name
       DateTime :created_at, null: false, default: Sequel::CURRENT_TIMESTAMP

data/db/migrate/5_resources.rb

@@ -3,7 +3,7 @@ Sequel.migration do
     create_table(:super_auth_resources) do
       primary_key :id
       String :name
-      String :external_id # , null: false
+      column :external_id, SuperAuth.sequel_external_id_type # , null: false
       String :external_type # , null: false
       DateTime :created_at, null: false, default: Sequel::CURRENT_TIMESTAMP
       DateTime :updated_at, null: false, default: Sequel::CURRENT_TIMESTAMP

data/db/migrate/7_authorization.rb

@@ -3,7 +3,7 @@ Sequel.migration do
     create_table(:super_auth_authorizations) do
       Integer :user_id, null: true
       String :user_name, null: true
-      String :user_external_id, null: true
+      column :user_external_id, SuperAuth.sequel_external_id_type, null: true
       String :user_external_type, null: true
       DateTime :user_created_at, null: true
       DateTime :user_updated_at, null: true
@@ -28,7 +28,7 @@ Sequel.migration do
       DateTime :permission_updated_at, null: true
       Integer :resource_id, null: true
       String :resource_name, null: true
-      String :resource_external_id, null: true
+      column :resource_external_id, SuperAuth.sequel_external_id_type, null: true
       String :resource_external_type, null: true
       DateTime :created_at, null: false, default: Sequel::CURRENT_TIMESTAMP
       DateTime :updated_at, null: false, default: Sequel::CURRENT_TIMESTAMP

data/db/migrate/8_add_indexes_to_edges.rb

@@ -1,5 +1,10 @@
 Sequel.migration do
+  # InnoDB already creates an index for every foreign key column, and will not
+  # drop one a constraint depends on, so on MySQL these indexes are redundant
+  # and their removal would fail. Skip them there.
   up do
+    next if [:mysql, :mysql2].include?(database_type)
+
     add_index :super_auth_edges, :user_id
     add_index :super_auth_edges, :group_id
     add_index :super_auth_edges, :role_id
@@ -8,6 +13,8 @@ Sequel.migration do
   end
 
   down do
+    next if [:mysql, :mysql2].include?(database_type)
+
     drop_index :super_auth_edges, :user_id
     drop_index :super_auth_edges, :group_id
     drop_index :super_auth_edges, :role_id

data/db/migrate_activerecord/20250101000001_create_super_auth_users.rb

@@ -1,7 +1,7 @@
 class CreateSuperAuthUsers < ActiveRecord::Migration[7.0]
   def change
     create_table :super_auth_users do |t|
-      t.string :external_id
+      t.column :external_id, SuperAuth.external_id_type
       t.string :external_type
       t.string :name
       t.timestamps default: -> { "CURRENT_TIMESTAMP" }

data/db/migrate_activerecord/20250101000005_create_super_auth_resources.rb

@@ -2,7 +2,7 @@ class CreateSuperAuthResources < ActiveRecord::Migration[7.0]
   def change
     create_table :super_auth_resources do |t|
       t.string :name
-      t.string :external_id
+      t.column :external_id, SuperAuth.external_id_type
       t.string :external_type
       t.timestamps default: -> { "CURRENT_TIMESTAMP" }
     end

data/db/migrate_activerecord/20250101000007_create_super_auth_authorizations.rb

@@ -3,7 +3,7 @@ class CreateSuperAuthAuthorizations < ActiveRecord::Migration[7.0]
     create_table :super_auth_authorizations do |t|
       t.integer :user_id
       t.string :user_name
-      t.string :user_external_id
+      t.column :user_external_id, SuperAuth.external_id_type
       t.string :user_external_type
       t.datetime :user_created_at
       t.datetime :user_updated_at
@@ -32,7 +32,7 @@ class CreateSuperAuthAuthorizations < ActiveRecord::Migration[7.0]
 
       t.integer :resource_id
       t.string :resource_name
-      t.string :resource_external_id
+      t.column :resource_external_id, SuperAuth.external_id_type
       t.string :resource_external_type
 
       t.timestamps default: -> { "CURRENT_TIMESTAMP" }

data/lib/generators/super_auth/install/templates/super_auth.rb

@@ -2,8 +2,19 @@
 # The SuperAuth Railtie automatically connects to your database and loads all
 # models on boot. Use this file for any additional configuration.
 #
-# SuperAuth.setup do |config|
-#   # Raise an error when a query runs without a current user set.
-#   # Default is :none (returns empty results silently).
-#   # config.missing_user_behavior = :raise
-# end
+SuperAuth.setup do |config|
+  # Column type for external id columns, created when the migrations run.
+  # Match your application's primary key type (:bigint, :uuid, :string, ...)
+  # so comparisons against your tables' pks are natively typed. Rails
+  # defaults to bigint pks. Must be set before running super_auth migrations.
+  config.external_id_type = :bigint
+
+  # Raise an error when a query runs without a current user set.
+  # Default is :none (returns empty results silently).
+  # config.missing_user_behavior = :raise
+
+  # Postgres row-level security: enable it per table with
+  #   rails generate super_auth:rls Model ...
+  # then wrap request work in SuperAuth.as(current_user) { ... } wherever
+  # database-level enforcement should apply.
+end

data/lib/generators/super_auth/rls/rls_generator.rb

@@ -0,0 +1,22 @@
+require 'rails/generators'
+require 'rails/generators/active_record'
+
+module SuperAuth
+  module Generators
+    class RlsGenerator < Rails::Generators::Base
+      include ActiveRecord::Generators::Migration
+
+      source_root File.expand_path('templates', __dir__)
+
+      # The model class names typed on the command line, verbatim:
+      # `rails g super_auth:rls Document Invoice` => ["Document", "Invoice"]
+      argument :model_names, type: :array, banner: "Model Model ..."
+
+      desc "Creates a migration enabling Postgres row-level security for the given models"
+
+      def create_migration_file
+        migration_template 'migration.rb.erb', 'db/migrate/enable_super_auth_rls.rb'
+      end
+    end
+  end
+end

data/lib/generators/super_auth/rls/templates/migration.rb.erb

@@ -0,0 +1,13 @@
+class EnableSuperAuthRls < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def up
+<% model_names.each do |model| -%>
+    SuperAuth::RLS.enable(:<%= model.tableize.tr('/', '_') %>, resource_type: "<%= model.camelize %>")
+<% end -%>
+  end
+
+  def down
+<% model_names.each do |model| -%>
+    SuperAuth::RLS.disable(:<%= model.tableize.tr('/', '_') %>)
+<% end -%>
+  end
+end

data/lib/super_auth/active_record/by_current_user.rb

@@ -1,4 +1,24 @@
 module SuperAuth::ActiveRecord::ByCurrentUser
+  # Records are filtered to those the current user holds an authorization for,
+  # keyed by the querying class's name. Because a subclass is its own resource
+  # type, privileged methods can be placed on a subclass whose access must be
+  # approved explicitly — a grant on the base class does not flow down:
+  #
+  #   class Resource < ApplicationRecord
+  #     super_auth
+  #
+  #     class ResourceRestartPermission < Resource
+  #       def restart!
+  #         # dangerous restart operation
+  #       end
+  #     end
+  #   end
+  #
+  # Resource::ResourceRestartPermission shares the base class's table and rows,
+  # but loading it requires an authorization whose resource_external_type is
+  # "Resource::ResourceRestartPermission" (edges to a SuperAuth::Resource
+  # registered with that external_type). If you can't load the object, you
+  # can't call the method.
   def self.included(base)
     base.send(:default_scope, **{all_queries: true}) do
       if SuperAuth.current_user.blank?
@@ -26,7 +46,10 @@ module SuperAuth::ActiveRecord::ByCurrentUser
         if type_level.exists?
           self
         else
-          # Per-record authorization: filter to specific records the user can access.
+          # Per-record authorization: filter to specific records the user can
+          # access. No type handling here: the external id columns are created
+          # with the app's pk type (SuperAuth.external_id_type at install
+          # time), so the comparison is natively typed.
           where(
             id: SuperAuth::ActiveRecord::Authorization
                 .where(**user_where, resource_external_type: resource_type)
@@ -36,7 +59,4 @@ module SuperAuth::ActiveRecord::ByCurrentUser
       end
     end
   end
-
-  module ClassMethods
-  end
 end

data/lib/super_auth/edge.rb

@@ -8,6 +8,11 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
   many_to_one :resource
 
   class << self
+    # The five strategies are UNIONed positionally. A column that is a real
+    # text column in one strategy and CAST(NULL AS ...) in another must be cast
+    # in every strategy: on MySQL the table collation and the connection
+    # collation can differ, and a column meeting a NULL cast at the same
+    # coercibility raises "Illegal mix of collations for operation 'UNION'".
     def string_cast_type
       case SuperAuth.db.database_type
       when :mysql, :mysql2
@@ -36,44 +41,24 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
 
     def users_groups_roles_permissions_resources
       cast_type = string_cast_type
-      users_groups_roles_ds = SuperAuth::User.join(:super_auth_edges, user_id: :id).
-        select_all(:super_auth_users).
-        join(SuperAuth::Group.from(SuperAuth::Group.trees).as(:groups), Sequel.function(:concat, ',', Sequel[:groups][:group_path], ',').like(Sequel.function(:concat, '%,', Sequel[:groups][:id], ',%'))).
-      select(
-        Sequel[:super_auth_users][:id].as(:user_id),
-        Sequel[:super_auth_users][:name].as(:user_name),
-        Sequel[:super_auth_users][:external_id].as(:user_external_id),
-        Sequel[:super_auth_users][:external_type].as(:user_external_type),
-        Sequel[:super_auth_users][:created_at].as(:user_created_at),
-        Sequel[:super_auth_users][:updated_at].as(:user_updated_at),
-        Sequel[:groups][:id].as(:group_id),
-        Sequel[:groups][:name].as(:group_name),
-        Sequel[:super_auth_edges][:id].as(:edge_id),
-        Sequel[:super_auth_edges][:permission_id].as(:edge_permission_id),
-        Sequel[:super_auth_edges][:group_id].as(:edge_group_id),
-        Sequel[:super_auth_edges][:user_id].as(:edge_user_id),
-        Sequel[:super_auth_edges][:role_id].as(:edge_role_id),
-        Sequel[:groups][:group_path],
-        Sequel[:groups][:group_name_path],
-        Sequel[:groups][:parent_id],
-        Sequel[:groups][:created_at].cast(cast_type).as(:group_created_at),
-        Sequel[:groups][:updated_at].cast(cast_type).as(:group_updated_at),
-      ).join(Sequel[:super_auth_edges].as(:group_role_edges), Sequel[:group_role_edges][:group_id] => Sequel[:groups][:id]).select_append(
-        Sequel[:group_role_edges][:id].as(:group_role_edge_id),
-        Sequel[:group_role_edges][:permission_id].as(:group_role_edge_permission_id),
-        Sequel[:group_role_edges][:group_id].as(:group_role_edge_group_id),
-        Sequel[:group_role_edges][:user_id].as(:group_role_edge_user_id),
-        Sequel[:group_role_edges][:role_id].as(:group_role_edge_role_id),
-      ).join(:super_auth_roles, id: Sequel[:group_role_edges][:role_id])
-
-      SuperAuth::Edge.from(
-        SuperAuth::Edge.from(
-          SuperAuth::Group.cte(SuperAuth::Group.where(id: users_groups_roles_ds.select(Sequel[:groups][:id])).select(:id)).select { [id.as(:group_id), name.as(:group_name), parent_id.as(:group_parent_id), group_path, group_name_path, created_at.cast(cast_type).as(:group_created_at), updated_at.as(:group_updated_at)] },
-          SuperAuth::Role.cte(users_groups_roles_ds.select(Sequel[:group_role_edges][:role_id])).select { [id.as(:role_id), name.as(:role_name), parent_id.as(:role_parent_id), role_path, role_name_path, created_at.as(:role_created_at), updated_at.as(:role_updated_at) ] }
-        ).as(:users_groups_roles_permissions_resources)
-      ).join(Sequel[:super_auth_edges].as(:user_edges), Sequel[:user_edges][:group_id] => Sequel[:users_groups_roles_permissions_resources][:group_id])
-       .join(Sequel[:super_auth_users], id: Sequel[:user_edges][:user_id])
-       .select(
+      # Join users to their group via edges. group_ancestors pairs that group with itself and
+      # every ancestor, so a group -> role edge on any of them applies. role_descendants then
+      # expands the granted role to its whole subtree. Each step is correlated to the previous
+      # one, so a role held by one group never reaches members of an unrelated group. The tree
+      # CTEs (user_groups, granted_roles) are joined by id only to supply the path columns.
+      SuperAuth::User.db[:super_auth_users].
+        join(Sequel[:super_auth_edges].as(:user_edges), user_id: :id).
+        join(SuperAuth::Group.ancestor_pairs.as(:group_ancestors), descendant_id: Sequel[:user_edges][:group_id]).
+        join(Sequel[:super_auth_edges].as(:group_role_edges), group_id: Sequel[:group_ancestors][:ancestor_id]).
+        where(Sequel.~(Sequel[:group_role_edges][:role_id] => nil)).
+        join(SuperAuth::Role.descendant_pairs.as(:role_descendants), ancestor_id: Sequel[:group_role_edges][:role_id]).
+        join(SuperAuth::Group.from(SuperAuth::Group.trees).as(:user_groups), Sequel[:user_groups][:id] => Sequel[:user_edges][:group_id]).
+        join(SuperAuth::Role.from(SuperAuth::Role.trees).as(:granted_roles), Sequel[:granted_roles][:id] => Sequel[:role_descendants][:descendant_id]).
+        join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:granted_roles][:id]).
+        join(Sequel[:super_auth_permissions], id: Sequel[:permission_edges][:permission_id]).
+        join(Sequel[:super_auth_edges].as(:resource_edges), Sequel[:resource_edges][:permission_id] => Sequel[:super_auth_permissions][:id]).
+        join(Sequel[:super_auth_resources], id: Sequel[:resource_edges][:resource_id]).
+        select(
           Sequel[:super_auth_users][:id].as(:user_id),
           Sequel[:super_auth_users][:name].as(:user_name),
           Sequel[:super_auth_users][:external_id].as(:user_external_id),
@@ -81,24 +66,24 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel[:super_auth_users][:created_at].cast(cast_type).as(:user_created_at),
           Sequel[:super_auth_users][:updated_at].cast(cast_type).as(:user_updated_at),
 
-          Sequel[:users_groups_roles_permissions_resources][:group_id],
-          Sequel[:users_groups_roles_permissions_resources][:group_name],
-          Sequel[:users_groups_roles_permissions_resources][:group_path],
-          Sequel[:users_groups_roles_permissions_resources][:group_name_path],
-          Sequel[:users_groups_roles_permissions_resources][:group_parent_id],
-          Sequel[:users_groups_roles_permissions_resources][:group_created_at].cast(cast_type).as(:group_created_at),
-          Sequel[:users_groups_roles_permissions_resources][:group_updated_at].cast(cast_type).as(:group_updated_at),
+          Sequel[:user_groups][:id].as(:group_id),
+          Sequel[:user_groups][:name].cast(cast_type).as(:group_name),
+          Sequel[:user_groups][:group_path],
+          Sequel[:user_groups][:group_name_path].cast(cast_type).as(:group_name_path),
+          Sequel[:user_groups][:parent_id].as(:group_parent_id),
+          Sequel[:user_groups][:created_at].cast(cast_type).as(:group_created_at),
+          Sequel[:user_groups][:updated_at].cast(cast_type).as(:group_updated_at),
 
-          Sequel[:users_groups_roles_permissions_resources][:role_id],
-          Sequel[:users_groups_roles_permissions_resources][:role_name],
-          Sequel[:users_groups_roles_permissions_resources][:role_path],
-          Sequel[:users_groups_roles_permissions_resources][:role_name_path],
-          Sequel[:users_groups_roles_permissions_resources][:role_parent_id],
-          Sequel[:users_groups_roles_permissions_resources][:role_created_at].cast(cast_type).as(:role_created_at),
-          Sequel[:users_groups_roles_permissions_resources][:role_updated_at].cast(cast_type).as(:role_updated_at),
+          Sequel[:granted_roles][:id].as(:role_id),
+          Sequel[:granted_roles][:name].cast(cast_type).as(:role_name),
+          Sequel[:granted_roles][:role_path],
+          Sequel[:granted_roles][:role_name_path].cast(cast_type).as(:role_name_path),
+          Sequel[:granted_roles][:parent_id].as(:role_parent_id),
+          Sequel[:granted_roles][:created_at].cast(cast_type).as(:role_created_at),
+          Sequel[:granted_roles][:updated_at].cast(cast_type).as(:role_updated_at),
 
           Sequel[:super_auth_permissions][:id].as(:permission_id),
-          Sequel[:super_auth_permissions][:name].as(:permission_name),
+          Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
           Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
           Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 
@@ -106,27 +91,20 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel[:super_auth_resources][:name].as(:resource_name),
           Sequel[:super_auth_resources][:external_id].as(:resource_external_id),
           Sequel[:super_auth_resources][:external_type].as(:resource_external_type)
-        )
-       .join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:users_groups_roles_permissions_resources][:role_id])
-       .join(Sequel[:super_auth_permissions], id: Sequel[:permission_edges][:permission_id])
-       .join(Sequel[:super_auth_edges].as(:resource_edges), Sequel[:resource_edges][:permission_id] => Sequel[:permission_edges][:permission_id])
-       .join(Sequel[:super_auth_resources], id: Sequel[:resource_edges][:resource_id])
-       .distinct
+        ).
+        distinct
     end
 
     def users_groups_permissions_resources
       cast_type = string_cast_type
-      # Join users to their group via edges, then to the group CTE to get the user's group_path.
-      # Use group_path to find all ancestor groups (any group whose id appears in the user's group_path).
-      # Then join permission edges on those ancestor groups.
+      # Join users to their group via edges. group_ancestors pairs that group with itself and
+      # every ancestor, so a group -> permission edge on any of them applies. user_groups (the
+      # tree) is joined by id only to supply the path columns.
       SuperAuth::User.db[:super_auth_users].
         join(Sequel[:super_auth_edges].as(:user_edges), user_id: :id).
+        join(SuperAuth::Group.ancestor_pairs.as(:group_ancestors), descendant_id: Sequel[:user_edges][:group_id]).
+        join(Sequel[:super_auth_edges].as(:group_edges), group_id: Sequel[:group_ancestors][:ancestor_id]).
         join(SuperAuth::Group.from(SuperAuth::Group.trees).as(:user_groups), Sequel[:user_groups][:id] => Sequel[:user_edges][:group_id]).
-        join(Sequel[:super_auth_edges].as(:group_edges),
-          Sequel.function(:concat, ',', Sequel[:user_groups][:group_path], ',').like(
-            Sequel.function(:concat, '%,', Sequel[:group_edges][:group_id].cast(cast_type), ',%')
-          )
-        ).
         join(Sequel[:super_auth_permissions], id: Sequel[:group_edges][:permission_id]).
         join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:permission_id] => Sequel[:super_auth_permissions][:id]).
         join(Sequel[:super_auth_resources], id: Sequel[:permission_edges][:resource_id]).
@@ -139,9 +117,9 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel[:super_auth_users][:updated_at].cast(cast_type).as(:user_updated_at),
 
           Sequel[:user_groups][:id].as(:group_id),
-          Sequel[:user_groups][:name].as(:group_name),
+          Sequel[:user_groups][:name].cast(cast_type).as(:group_name),
           Sequel[:user_groups][:group_path],
-          Sequel[:user_groups][:group_name_path],
+          Sequel[:user_groups][:group_name_path].cast(cast_type).as(:group_name_path),
           Sequel[:user_groups][:parent_id].as(:group_parent_id),
           Sequel[:user_groups][:created_at].cast(cast_type).as(:group_created_at),
           Sequel[:user_groups][:updated_at].cast(cast_type).as(:group_updated_at),
@@ -155,7 +133,7 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel.cast(nil, string_cast_type).as(:role_updated_at),
 
           Sequel[:super_auth_permissions][:id].as(:permission_id),
-          Sequel[:super_auth_permissions][:name].as(:permission_name),
+          Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
           Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
           Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 
@@ -170,26 +148,13 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
     def users_roles_permissions_resources
       cast_type = string_cast_type
 
-      # Step 1: Find which roles users are directly linked to via edges
-      user_role_ids_ds = SuperAuth::Edge.where(Sequel.~(user_id: nil) & Sequel.~(role_id: nil)).select(:role_id)
-
-      # Step 2: Expand those roles to all descendants via CTE
-      role_cte = SuperAuth::Role.cte(user_role_ids_ds).select {
-        [id.as(:role_id), name.as(:role_name), parent_id.as(:role_parent_id), role_path, role_name_path, created_at.as(:role_created_at), updated_at.as(:role_updated_at)]
-      }
-
-      # Step 3: Build the query from the expanded role tree
-      SuperAuth::Edge.from(role_cte.as(:users_roles_permissions_resources)).
-      # Join user_edges — match users who link to any role in the expanded CTE
-      # The user's edge links to an ancestor role, but the CTE path contains that ancestor
-      # We use the role_path to check: the role_path of the CTE row starts with the user's linked role
-      join(Sequel[:super_auth_edges].as(:user_edges),
-        Sequel.function(:concat, ',', Sequel[:users_roles_permissions_resources][:role_path], ',').like(
-          Sequel.function(:concat, '%,', Sequel[:user_edges][:role_id].cast(cast_type), ',%')
-        )
-      ).
-      where(Sequel.~(Sequel[:user_edges][:user_id] => nil) & Sequel.~(Sequel[:user_edges][:role_id] => nil)).
-      join(Sequel[:super_auth_users], id: Sequel[:user_edges][:user_id]).
+      # Join users to the roles they hold directly. role_descendants expands each held role to
+      # its whole subtree; granted_roles (the tree) is joined by id only to supply the path columns.
+      SuperAuth::User.db[:super_auth_users].
+      join(Sequel[:super_auth_edges].as(:user_edges), user_id: :id).
+      where(Sequel.~(Sequel[:user_edges][:role_id] => nil)).
+      join(SuperAuth::Role.descendant_pairs.as(:role_descendants), ancestor_id: Sequel[:user_edges][:role_id]).
+      join(SuperAuth::Role.from(SuperAuth::Role.trees).as(:granted_roles), Sequel[:granted_roles][:id] => Sequel[:role_descendants][:descendant_id]).
       select(
         Sequel[:super_auth_users][:id].as(:user_id),
         Sequel[:super_auth_users][:name].as(:user_name),
@@ -206,16 +171,16 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
         Sequel.cast(nil, string_cast_type).as(:group_created_at),
         Sequel.cast(nil, string_cast_type).as(:group_updated_at),
 
-        Sequel[:users_roles_permissions_resources][:role_id],
-        Sequel[:users_roles_permissions_resources][:role_name],
-        Sequel[:users_roles_permissions_resources][:role_path],
-        Sequel[:users_roles_permissions_resources][:role_name_path],
-        Sequel[:users_roles_permissions_resources][:role_parent_id],
-        Sequel[:users_roles_permissions_resources][:role_created_at].cast(cast_type).as(:role_created_at),
-        Sequel[:users_roles_permissions_resources][:role_updated_at].cast(cast_type).as(:role_updated_at),
+        Sequel[:granted_roles][:id].as(:role_id),
+        Sequel[:granted_roles][:name].cast(cast_type).as(:role_name),
+        Sequel[:granted_roles][:role_path],
+        Sequel[:granted_roles][:role_name_path].cast(cast_type).as(:role_name_path),
+        Sequel[:granted_roles][:parent_id].as(:role_parent_id),
+        Sequel[:granted_roles][:created_at].cast(cast_type).as(:role_created_at),
+        Sequel[:granted_roles][:updated_at].cast(cast_type).as(:role_updated_at),
 
         Sequel[:super_auth_permissions][:id].as(:permission_id),
-        Sequel[:super_auth_permissions][:name].as(:permission_name),
+        Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
         Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
         Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 
@@ -225,7 +190,7 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
         Sequel[:super_auth_resources][:external_type].as(:resource_external_type),
       ).
       # Join permission and resource edges on the expanded role
-      join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:users_roles_permissions_resources][:role_id]).
+      join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:granted_roles][:id]).
       join(Sequel[:super_auth_permissions], id: Sequel[:permission_edges][:permission_id]).
       join(Sequel[:super_auth_edges].as(:resource_edges), Sequel[:resource_edges][:permission_id] => Sequel[:super_auth_permissions][:id]).
       join(Sequel[:super_auth_resources], id: Sequel[:resource_edges][:resource_id]).
@@ -261,7 +226,7 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel.cast(nil, string_cast_type).as(:role_updated_at),
 
           Sequel[:super_auth_permissions][:id].as(:permission_id),
-          Sequel[:super_auth_permissions][:name].as(:permission_name),
+          Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
           Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
           Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 

data/lib/super_auth/nestable.rb

@@ -35,6 +35,44 @@ module SuperAuth::Nestable
       end
     end
 
+    # Cast type for the anchor row of the path CTEs. MySQL types a recursive
+    # CTE's columns from the anchor SELECT alone, so a bare CAST(id AS CHAR)
+    # makes the path column varchar(11) and every deeper level overflows it
+    # ("Data too long for column"). :text is unbounded elsewhere.
+    def path_cast_type
+      case SuperAuth.db.database_type
+      when :mysql, :mysql2
+        "char(4000)"
+      else
+        :text
+      end
+    end
+
+    # Every node paired with itself and each of its ancestors, as
+    # (descendant_id, ancestor_id). The path strategies join these integer
+    # pairs on equality; matching ids inside the comma-separated path strings
+    # with LIKE forced a nested loop no planner could index, and compile time
+    # grew roughly cubically with the graph.
+    def ancestor_pairs
+      table = pluralize
+      name = :"#{singularize}_ancestor_pairs"
+      anchor = db[table].select(Sequel[:id].as(:descendant_id), Sequel[:id].as(:ancestor_id))
+      step = db[name].join(table, id: :ancestor_id).exclude(Sequel[table][:parent_id] => nil).
+        select(Sequel[name][:descendant_id], Sequel[table][:parent_id])
+      db.from(name).with_recursive(name, anchor, step, args: [:descendant_id, :ancestor_id])
+    end
+
+    # Every node paired with itself and each of its descendants, as
+    # (ancestor_id, descendant_id). Granting a role grants its whole subtree.
+    def descendant_pairs
+      table = pluralize
+      name = :"#{singularize}_descendant_pairs"
+      anchor = db[table].select(Sequel[:id].as(:ancestor_id), Sequel[:id].as(:descendant_id))
+      step = db[name].join(table, parent_id: :descendant_id).
+        select(Sequel[name][:ancestor_id], Sequel[table][:id])
+      db.from(name).with_recursive(name, anchor, step, args: [:ancestor_id, :descendant_id])
+    end
+
     def cte(id = nil, direction = :desc)
       model = self
       cte_name = model.cte_name
@@ -69,8 +107,8 @@ module SuperAuth::Nestable
     def with_descending_paths(base_ds, recursive_ds, cte_name)
       [
         base_ds.select_append(
-          Sequel[table_name][:id].cast(string_cast_type).as(base_path)
-        ).select_append(Sequel[table_name][:name].as(base_name_path)),
+          Sequel[table_name][:id].cast(path_cast_type).as(base_path)
+        ).select_append(Sequel[table_name][:name].cast(path_cast_type).as(base_name_path)),
 
         recursive_ds.select_append(
           Sequel.function(:concat,
@@ -90,7 +128,7 @@ module SuperAuth::Nestable
 
     def with_ascending_paths(base_ds, recursive_ds, cte_name)
       [
-        base_ds.select_append(Sequel[table_name][:id].cast(string_cast_type).as(base_path)).select_append(Sequel[table_name][:name].as(base_name_path)),
+        base_ds.select_append(Sequel[table_name][:id].cast(path_cast_type).as(base_path)).select_append(Sequel[table_name][:name].cast(path_cast_type).as(base_name_path)),
         recursive_ds.select_append(
           Sequel.function(:concat,
             Sequel[table_name][:id].cast(string_cast_type),

data/lib/super_auth/rls.rb

@@ -0,0 +1,126 @@
+# Postgres Row-Level Security enforcement.
+#
+# ByCurrentUser filters queries at the ORM layer; RLS enforces the same rule
+# inside Postgres, so raw SQL, `unscoped`, and non-Ruby clients are subject
+# to it too — enforcing apps don't load this gem at all. Identity is
+# asserted per transaction by the super_auth_become() SQL function
+# (installed by `enable`): it sets transaction-local identity settings plus
+# a stamp of the current transaction id, and every policy requires a stamp
+# from the current transaction. Identity therefore cannot outlive its
+# transaction or leak across pooled connections — a query without a fresh
+# assertion sees no rows.
+module SuperAuth
+  module RLS
+    POLICY = "super_auth".freeze
+
+    class << self
+      # Enable RLS on an app table with a policy mirroring ByCurrentUser:
+      # type-level authorization rows (resource_external_id IS NULL) act as a
+      # wildcard, per-record rows match on id, and system users bypass.
+      #
+      # One deliberate divergence: INSERTs are also gated. The policy is
+      # FOR ALL with no WITH CHECK, so Postgres reuses its USING expression
+      # as the implicit WITH CHECK for new rows. Creating rows therefore
+      # requires a type-level authorization for the resource type, or
+      # system context.
+      def enable(table, resource_type:, db: SuperAuth.db)
+        postgres!(db)
+        create_become_function(db)
+        t = db.literal(Sequel.identifier(table.to_s))
+        db.run "ALTER TABLE #{t} ENABLE ROW LEVEL SECURITY"
+        # FORCE: apply the policy even when the app connects as the table owner
+        db.run "ALTER TABLE #{t} FORCE ROW LEVEL SECURITY"
+        db.run "DROP POLICY IF EXISTS #{POLICY} ON #{t}"
+        db.run <<~SQL
+          CREATE POLICY #{POLICY} ON #{t}
+          USING (
+            current_setting('super_auth.xid', true) = pg_current_xact_id()::text
+            AND (
+              COALESCE(current_setting('super_auth.system', true), '') = 'true'
+              OR EXISTS (
+                SELECT 1 FROM super_auth_authorizations a
+                WHERE a.resource_external_type = #{db.literal(resource_type.to_s)}
+                  AND (a.resource_external_id IS NULL OR a.resource_external_id = #{t}.id)
+                  AND (
+                    a.user_id::text = NULLIF(current_setting('super_auth.user_id', true), '')
+                    OR (
+                      a.user_external_id::text = NULLIF(current_setting('super_auth.user_external_id', true), '')
+                      AND a.user_external_type = NULLIF(current_setting('super_auth.user_external_type', true), '')
+                    )
+                  )
+              )
+            )
+          )
+        SQL
+      end
+
+      # Drops the table's policy; the shared super_auth_become function is
+      # left in place (other tables may still be protected, and it is
+      # harmless on its own).
+      def disable(table, db: SuperAuth.db)
+        postgres!(db)
+        t = db.literal(Sequel.identifier(table.to_s))
+        db.run "DROP POLICY IF EXISTS #{POLICY} ON #{t}"
+        db.run "ALTER TABLE #{t} NO FORCE ROW LEVEL SECURITY"
+        db.run "ALTER TABLE #{t} DISABLE ROW LEVEL SECURITY"
+      end
+
+      # Run the block with `user`'s identity asserted for one transaction —
+      # the Ruby face of the SQL contract
+      # (BEGIN; SELECT super_auth_become(...); queries; COMMIT). Sequel and
+      # ActiveRecord queries inside the block share the transaction's
+      # connection, so the policies see the identity; it dies with the
+      # transaction. In nested calls the innermost assertion wins for the
+      # rest of the outer transaction.
+      def as(user, db: SuperAuth.db)
+        postgres!(db)
+        internal_id = external_id = external_type = nil
+        system = user.respond_to?(:system?) && !!user.system?
+        if user && internal_user?(user)
+          internal_id = user.id.to_s
+        elsif user
+          external_id = user.id.to_s
+          external_type = user.class.name
+        end
+        db.transaction do
+          db.get(Sequel.function(:super_auth_become, external_id, external_type, internal_id, system))
+          yield
+        end
+      end
+
+      private
+
+      # One shared function per database; clients assert identity by calling
+      # it inside their transaction. CREATE OR REPLACE keeps enable
+      # idempotent.
+      def create_become_function(db)
+        db.run <<~SQL
+          CREATE OR REPLACE FUNCTION super_auth_become(
+            user_external_id text DEFAULT NULL,
+            user_external_type text DEFAULT NULL,
+            user_id text DEFAULT NULL,
+            system boolean DEFAULT false
+          ) RETURNS void LANGUAGE plpgsql AS $$
+          BEGIN
+            PERFORM set_config('super_auth.user_id',            COALESCE(user_id, ''), true),
+                    set_config('super_auth.user_external_id',   COALESCE(user_external_id, ''), true),
+                    set_config('super_auth.user_external_type', COALESCE(user_external_type, ''), true),
+                    set_config('super_auth.system',             CASE WHEN system THEN 'true' ELSE '' END, true),
+                    set_config('super_auth.xid',                pg_current_xact_id()::text, true);
+          END
+          $$;
+        SQL
+      end
+
+      def internal_user?(user)
+        (defined?(SuperAuth::ActiveRecord::User) && user.is_a?(SuperAuth::ActiveRecord::User)) ||
+          (defined?(SuperAuth::User) && user.is_a?(SuperAuth::User))
+      end
+
+      def postgres!(db)
+        return if db.database_type == :postgres
+        raise SuperAuth::Error, "SuperAuth::RLS requires Postgres (got #{db.database_type})"
+      end
+    end
+  end
+end

data/lib/super_auth/version.rb

@@ -1,3 +1,3 @@
 module SuperAuth
-  VERSION = "0.3.3"
+  VERSION = "0.4.0"
 end

data/lib/super_auth.rb

@@ -22,6 +22,26 @@ module SuperAuth
     @missing_user_behavior = behavior
   end
 
+  # Column type for the external id columns (users.external_id,
+  # resources.external_id and their copies on authorizations). Set it to your
+  # application's primary key type (:bigint, :uuid, :string, ...) BEFORE
+  # running the super_auth migrations — the columns are then created with the
+  # matching type and every comparison against your tables' pks is natively
+  # typed, with no casting anywhere. Default :string.
+  def self.external_id_type
+    @external_id_type || :string
+  end
+
+  def self.external_id_type=(type)
+    @external_id_type = type
+  end
+
+  # Sequel migrations take the Ruby String class for varchar; anything else
+  # passes through as the literal database type name.
+  def self.sequel_external_id_type
+    external_id_type == :string ? String : external_id_type
+  end
+
   def self.load
     require "super_auth/authorization"
     require "super_auth/edge"
@@ -30,6 +50,7 @@ module SuperAuth
     require "super_auth/permission"
     require "super_auth/railtie"
     require "super_auth/resource"
+    require "super_auth/rls"
     require "super_auth/role"
     require "super_auth/user"
     require "super_auth/active_record" if defined?(ActiveRecord::Base)
@@ -40,6 +61,25 @@ module SuperAuth
     require "pathname"
     path = Pathname.new(__FILE__).parent.parent.join("db", "migrate")
     Sequel::Migrator.run(SuperAuth.db, path)
+    refresh_model_schemas
+  end
+
+  # Both ORMs cache column types per model class; after (re)installing the
+  # migrations those caches can describe a previous schema (e.g. a different
+  # external_id_type) and silently miscast assigned values.
+  def self.refresh_model_schemas
+    models = %w[User Group Permission Role Resource Edge Authorization]
+    if defined?(SuperAuth::ActiveRecord::User)
+      models.each do |name|
+        SuperAuth::ActiveRecord.const_get(name).reset_column_information
+      end
+    end
+    if defined?(SuperAuth::User) && SuperAuth::User.respond_to?(:set_dataset)
+      models.each do |name|
+        model = SuperAuth.const_get(name)
+        model.set_dataset(model.dataset)
+      end
+    end
   end
 
   def self.uninstall_migrations
@@ -55,6 +95,13 @@ module SuperAuth
     raise Error, "Failed to uninstall migrations: #{e.message}"
   end
 
+  # Run the block with `user`'s identity asserted inside a database
+  # transaction, so RLS policies (see SuperAuth::RLS) enforce authorization
+  # for every query in the block. Postgres only.
+  def self.as(user, db: SuperAuth.db, &block)
+    SuperAuth::RLS.as(user, db: db, &block)
+  end
+
   def self.current_user=(user)
     Thread.current[:super_auth_current_user] = user
   end
@@ -128,4 +175,5 @@ module SuperAuth
   end
 end
 
+require "super_auth/rls"
 require "super_auth/railtie" if defined?(Rails::Railtie)

data/super_auth.gemspec

@@ -9,7 +9,7 @@ Gem::Specification.new do |spec|
   spec.summary = "Make Unauthenticated State Unrepresentable"
   spec.description = "Simple, yet super powerful authorization for you application"
   spec.homepage = "https://github.com/JonathanFrias/super_auth"
-  spec.license = "MIT"
+  spec.license = "GPL-2.0"
   spec.required_ruby_version = ">= 2.6.0"
 
   spec.metadata["homepage_uri"] = spec.homepage

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: super_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.0
 platform: ruby
 authors:
 - Jonathan Frias
@@ -79,6 +79,8 @@ files:
 - lib/generators/super_auth/install/install_generator.rb
 - lib/generators/super_auth/install/templates/README
 - lib/generators/super_auth/install/templates/super_auth.rb
+- lib/generators/super_auth/rls/rls_generator.rb
+- lib/generators/super_auth/rls/templates/migration.rb.erb
 - lib/super_auth.rb
 - lib/super_auth/active_record.rb
 - lib/super_auth/active_record/authorization.rb
@@ -96,6 +98,7 @@ files:
 - lib/super_auth/permission.rb
 - lib/super_auth/railtie.rb
 - lib/super_auth/resource.rb
+- lib/super_auth/rls.rb
 - lib/super_auth/role.rb
 - lib/super_auth/user.rb
 - lib/super_auth/version.rb
@@ -104,7 +107,7 @@ files:
 - visualization.html
 homepage: https://github.com/JonathanFrias/super_auth
 licenses:
-- MIT
+- GPL-2.0
 metadata:
   homepage_uri: https://github.com/JonathanFrias/super_auth
   source_code_uri: https://github.com/JonathanFrias/super_auth