super_auth 0.3.3 → 0.7.0

data/lib/super_auth/edge.rb

@@ -8,6 +8,11 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
   many_to_one :resource
 
   class << self
+    # The five strategies are UNIONed positionally. A column that is a real
+    # text column in one strategy and CAST(NULL AS ...) in another must be cast
+    # in every strategy: on MySQL the table collation and the connection
+    # collation can differ, and a column meeting a NULL cast at the same
+    # coercibility raises "Illegal mix of collations for operation 'UNION'".
     def string_cast_type
       case SuperAuth.db.database_type
       when :mysql, :mysql2
@@ -36,44 +41,24 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
 
     def users_groups_roles_permissions_resources
       cast_type = string_cast_type
-      users_groups_roles_ds = SuperAuth::User.join(:super_auth_edges, user_id: :id).
-        select_all(:super_auth_users).
-        join(SuperAuth::Group.from(SuperAuth::Group.trees).as(:groups), Sequel.function(:concat, ',', Sequel[:groups][:group_path], ',').like(Sequel.function(:concat, '%,', Sequel[:groups][:id], ',%'))).
-      select(
-        Sequel[:super_auth_users][:id].as(:user_id),
-        Sequel[:super_auth_users][:name].as(:user_name),
-        Sequel[:super_auth_users][:external_id].as(:user_external_id),
-        Sequel[:super_auth_users][:external_type].as(:user_external_type),
-        Sequel[:super_auth_users][:created_at].as(:user_created_at),
-        Sequel[:super_auth_users][:updated_at].as(:user_updated_at),
-        Sequel[:groups][:id].as(:group_id),
-        Sequel[:groups][:name].as(:group_name),
-        Sequel[:super_auth_edges][:id].as(:edge_id),
-        Sequel[:super_auth_edges][:permission_id].as(:edge_permission_id),
-        Sequel[:super_auth_edges][:group_id].as(:edge_group_id),
-        Sequel[:super_auth_edges][:user_id].as(:edge_user_id),
-        Sequel[:super_auth_edges][:role_id].as(:edge_role_id),
-        Sequel[:groups][:group_path],
-        Sequel[:groups][:group_name_path],
-        Sequel[:groups][:parent_id],
-        Sequel[:groups][:created_at].cast(cast_type).as(:group_created_at),
-        Sequel[:groups][:updated_at].cast(cast_type).as(:group_updated_at),
-      ).join(Sequel[:super_auth_edges].as(:group_role_edges), Sequel[:group_role_edges][:group_id] => Sequel[:groups][:id]).select_append(
-        Sequel[:group_role_edges][:id].as(:group_role_edge_id),
-        Sequel[:group_role_edges][:permission_id].as(:group_role_edge_permission_id),
-        Sequel[:group_role_edges][:group_id].as(:group_role_edge_group_id),
-        Sequel[:group_role_edges][:user_id].as(:group_role_edge_user_id),
-        Sequel[:group_role_edges][:role_id].as(:group_role_edge_role_id),
-      ).join(:super_auth_roles, id: Sequel[:group_role_edges][:role_id])
-
-      SuperAuth::Edge.from(
-        SuperAuth::Edge.from(
-          SuperAuth::Group.cte(SuperAuth::Group.where(id: users_groups_roles_ds.select(Sequel[:groups][:id])).select(:id)).select { [id.as(:group_id), name.as(:group_name), parent_id.as(:group_parent_id), group_path, group_name_path, created_at.cast(cast_type).as(:group_created_at), updated_at.as(:group_updated_at)] },
-          SuperAuth::Role.cte(users_groups_roles_ds.select(Sequel[:group_role_edges][:role_id])).select { [id.as(:role_id), name.as(:role_name), parent_id.as(:role_parent_id), role_path, role_name_path, created_at.as(:role_created_at), updated_at.as(:role_updated_at) ] }
-        ).as(:users_groups_roles_permissions_resources)
-      ).join(Sequel[:super_auth_edges].as(:user_edges), Sequel[:user_edges][:group_id] => Sequel[:users_groups_roles_permissions_resources][:group_id])
-       .join(Sequel[:super_auth_users], id: Sequel[:user_edges][:user_id])
-       .select(
+      # Join users to their group via edges. group_ancestors pairs that group with itself and
+      # every ancestor, so a group -> role edge on any of them applies. role_descendants then
+      # expands the granted role to its whole subtree. Each step is correlated to the previous
+      # one, so a role held by one group never reaches members of an unrelated group. The tree
+      # CTEs (user_groups, granted_roles) are joined by id only to supply the path columns.
+      SuperAuth::User.db[:super_auth_users].
+        join(Sequel[:super_auth_edges].as(:user_edges), user_id: :id).
+        join(SuperAuth::Group.ancestor_pairs.as(:group_ancestors), descendant_id: Sequel[:user_edges][:group_id]).
+        join(Sequel[:super_auth_edges].as(:group_role_edges), group_id: Sequel[:group_ancestors][:ancestor_id]).
+        where(Sequel.~(Sequel[:group_role_edges][:role_id] => nil)).
+        join(SuperAuth::Role.descendant_pairs.as(:role_descendants), ancestor_id: Sequel[:group_role_edges][:role_id]).
+        join(SuperAuth::Group.from(SuperAuth::Group.trees).as(:user_groups), Sequel[:user_groups][:id] => Sequel[:user_edges][:group_id]).
+        join(SuperAuth::Role.from(SuperAuth::Role.trees).as(:granted_roles), Sequel[:granted_roles][:id] => Sequel[:role_descendants][:descendant_id]).
+        join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:granted_roles][:id]).
+        join(Sequel[:super_auth_permissions], id: Sequel[:permission_edges][:permission_id]).
+        join(Sequel[:super_auth_edges].as(:resource_edges), Sequel[:resource_edges][:permission_id] => Sequel[:super_auth_permissions][:id]).
+        join(Sequel[:super_auth_resources], id: Sequel[:resource_edges][:resource_id]).
+        select(
           Sequel[:super_auth_users][:id].as(:user_id),
           Sequel[:super_auth_users][:name].as(:user_name),
           Sequel[:super_auth_users][:external_id].as(:user_external_id),
@@ -81,24 +66,24 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel[:super_auth_users][:created_at].cast(cast_type).as(:user_created_at),
           Sequel[:super_auth_users][:updated_at].cast(cast_type).as(:user_updated_at),
 
-          Sequel[:users_groups_roles_permissions_resources][:group_id],
-          Sequel[:users_groups_roles_permissions_resources][:group_name],
-          Sequel[:users_groups_roles_permissions_resources][:group_path],
-          Sequel[:users_groups_roles_permissions_resources][:group_name_path],
-          Sequel[:users_groups_roles_permissions_resources][:group_parent_id],
-          Sequel[:users_groups_roles_permissions_resources][:group_created_at].cast(cast_type).as(:group_created_at),
-          Sequel[:users_groups_roles_permissions_resources][:group_updated_at].cast(cast_type).as(:group_updated_at),
+          Sequel[:user_groups][:id].as(:group_id),
+          Sequel[:user_groups][:name].cast(cast_type).as(:group_name),
+          Sequel[:user_groups][:group_path],
+          Sequel[:user_groups][:group_name_path].cast(cast_type).as(:group_name_path),
+          Sequel[:user_groups][:parent_id].as(:group_parent_id),
+          Sequel[:user_groups][:created_at].cast(cast_type).as(:group_created_at),
+          Sequel[:user_groups][:updated_at].cast(cast_type).as(:group_updated_at),
 
-          Sequel[:users_groups_roles_permissions_resources][:role_id],
-          Sequel[:users_groups_roles_permissions_resources][:role_name],
-          Sequel[:users_groups_roles_permissions_resources][:role_path],
-          Sequel[:users_groups_roles_permissions_resources][:role_name_path],
-          Sequel[:users_groups_roles_permissions_resources][:role_parent_id],
-          Sequel[:users_groups_roles_permissions_resources][:role_created_at].cast(cast_type).as(:role_created_at),
-          Sequel[:users_groups_roles_permissions_resources][:role_updated_at].cast(cast_type).as(:role_updated_at),
+          Sequel[:granted_roles][:id].as(:role_id),
+          Sequel[:granted_roles][:name].cast(cast_type).as(:role_name),
+          Sequel[:granted_roles][:role_path],
+          Sequel[:granted_roles][:role_name_path].cast(cast_type).as(:role_name_path),
+          Sequel[:granted_roles][:parent_id].as(:role_parent_id),
+          Sequel[:granted_roles][:created_at].cast(cast_type).as(:role_created_at),
+          Sequel[:granted_roles][:updated_at].cast(cast_type).as(:role_updated_at),
 
           Sequel[:super_auth_permissions][:id].as(:permission_id),
-          Sequel[:super_auth_permissions][:name].as(:permission_name),
+          Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
           Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
           Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 
@@ -106,27 +91,20 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel[:super_auth_resources][:name].as(:resource_name),
           Sequel[:super_auth_resources][:external_id].as(:resource_external_id),
           Sequel[:super_auth_resources][:external_type].as(:resource_external_type)
-        )
-       .join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:users_groups_roles_permissions_resources][:role_id])
-       .join(Sequel[:super_auth_permissions], id: Sequel[:permission_edges][:permission_id])
-       .join(Sequel[:super_auth_edges].as(:resource_edges), Sequel[:resource_edges][:permission_id] => Sequel[:permission_edges][:permission_id])
-       .join(Sequel[:super_auth_resources], id: Sequel[:resource_edges][:resource_id])
-       .distinct
+        ).
+        distinct
     end
 
     def users_groups_permissions_resources
       cast_type = string_cast_type
-      # Join users to their group via edges, then to the group CTE to get the user's group_path.
-      # Use group_path to find all ancestor groups (any group whose id appears in the user's group_path).
-      # Then join permission edges on those ancestor groups.
+      # Join users to their group via edges. group_ancestors pairs that group with itself and
+      # every ancestor, so a group -> permission edge on any of them applies. user_groups (the
+      # tree) is joined by id only to supply the path columns.
       SuperAuth::User.db[:super_auth_users].
         join(Sequel[:super_auth_edges].as(:user_edges), user_id: :id).
+        join(SuperAuth::Group.ancestor_pairs.as(:group_ancestors), descendant_id: Sequel[:user_edges][:group_id]).
+        join(Sequel[:super_auth_edges].as(:group_edges), group_id: Sequel[:group_ancestors][:ancestor_id]).
         join(SuperAuth::Group.from(SuperAuth::Group.trees).as(:user_groups), Sequel[:user_groups][:id] => Sequel[:user_edges][:group_id]).
-        join(Sequel[:super_auth_edges].as(:group_edges),
-          Sequel.function(:concat, ',', Sequel[:user_groups][:group_path], ',').like(
-            Sequel.function(:concat, '%,', Sequel[:group_edges][:group_id].cast(cast_type), ',%')
-          )
-        ).
         join(Sequel[:super_auth_permissions], id: Sequel[:group_edges][:permission_id]).
         join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:permission_id] => Sequel[:super_auth_permissions][:id]).
         join(Sequel[:super_auth_resources], id: Sequel[:permission_edges][:resource_id]).
@@ -139,9 +117,9 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel[:super_auth_users][:updated_at].cast(cast_type).as(:user_updated_at),
 
           Sequel[:user_groups][:id].as(:group_id),
-          Sequel[:user_groups][:name].as(:group_name),
+          Sequel[:user_groups][:name].cast(cast_type).as(:group_name),
           Sequel[:user_groups][:group_path],
-          Sequel[:user_groups][:group_name_path],
+          Sequel[:user_groups][:group_name_path].cast(cast_type).as(:group_name_path),
           Sequel[:user_groups][:parent_id].as(:group_parent_id),
           Sequel[:user_groups][:created_at].cast(cast_type).as(:group_created_at),
           Sequel[:user_groups][:updated_at].cast(cast_type).as(:group_updated_at),
@@ -155,7 +133,7 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel.cast(nil, string_cast_type).as(:role_updated_at),
 
           Sequel[:super_auth_permissions][:id].as(:permission_id),
-          Sequel[:super_auth_permissions][:name].as(:permission_name),
+          Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
           Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
           Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 
@@ -170,26 +148,13 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
     def users_roles_permissions_resources
       cast_type = string_cast_type
 
-      # Step 1: Find which roles users are directly linked to via edges
-      user_role_ids_ds = SuperAuth::Edge.where(Sequel.~(user_id: nil) & Sequel.~(role_id: nil)).select(:role_id)
-
-      # Step 2: Expand those roles to all descendants via CTE
-      role_cte = SuperAuth::Role.cte(user_role_ids_ds).select {
-        [id.as(:role_id), name.as(:role_name), parent_id.as(:role_parent_id), role_path, role_name_path, created_at.as(:role_created_at), updated_at.as(:role_updated_at)]
-      }
-
-      # Step 3: Build the query from the expanded role tree
-      SuperAuth::Edge.from(role_cte.as(:users_roles_permissions_resources)).
-      # Join user_edges — match users who link to any role in the expanded CTE
-      # The user's edge links to an ancestor role, but the CTE path contains that ancestor
-      # We use the role_path to check: the role_path of the CTE row starts with the user's linked role
-      join(Sequel[:super_auth_edges].as(:user_edges),
-        Sequel.function(:concat, ',', Sequel[:users_roles_permissions_resources][:role_path], ',').like(
-          Sequel.function(:concat, '%,', Sequel[:user_edges][:role_id].cast(cast_type), ',%')
-        )
-      ).
-      where(Sequel.~(Sequel[:user_edges][:user_id] => nil) & Sequel.~(Sequel[:user_edges][:role_id] => nil)).
-      join(Sequel[:super_auth_users], id: Sequel[:user_edges][:user_id]).
+      # Join users to the roles they hold directly. role_descendants expands each held role to
+      # its whole subtree; granted_roles (the tree) is joined by id only to supply the path columns.
+      SuperAuth::User.db[:super_auth_users].
+      join(Sequel[:super_auth_edges].as(:user_edges), user_id: :id).
+      where(Sequel.~(Sequel[:user_edges][:role_id] => nil)).
+      join(SuperAuth::Role.descendant_pairs.as(:role_descendants), ancestor_id: Sequel[:user_edges][:role_id]).
+      join(SuperAuth::Role.from(SuperAuth::Role.trees).as(:granted_roles), Sequel[:granted_roles][:id] => Sequel[:role_descendants][:descendant_id]).
       select(
         Sequel[:super_auth_users][:id].as(:user_id),
         Sequel[:super_auth_users][:name].as(:user_name),
@@ -206,16 +171,16 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
         Sequel.cast(nil, string_cast_type).as(:group_created_at),
         Sequel.cast(nil, string_cast_type).as(:group_updated_at),
 
-        Sequel[:users_roles_permissions_resources][:role_id],
-        Sequel[:users_roles_permissions_resources][:role_name],
-        Sequel[:users_roles_permissions_resources][:role_path],
-        Sequel[:users_roles_permissions_resources][:role_name_path],
-        Sequel[:users_roles_permissions_resources][:role_parent_id],
-        Sequel[:users_roles_permissions_resources][:role_created_at].cast(cast_type).as(:role_created_at),
-        Sequel[:users_roles_permissions_resources][:role_updated_at].cast(cast_type).as(:role_updated_at),
+        Sequel[:granted_roles][:id].as(:role_id),
+        Sequel[:granted_roles][:name].cast(cast_type).as(:role_name),
+        Sequel[:granted_roles][:role_path],
+        Sequel[:granted_roles][:role_name_path].cast(cast_type).as(:role_name_path),
+        Sequel[:granted_roles][:parent_id].as(:role_parent_id),
+        Sequel[:granted_roles][:created_at].cast(cast_type).as(:role_created_at),
+        Sequel[:granted_roles][:updated_at].cast(cast_type).as(:role_updated_at),
 
         Sequel[:super_auth_permissions][:id].as(:permission_id),
-        Sequel[:super_auth_permissions][:name].as(:permission_name),
+        Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
         Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
         Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 
@@ -225,7 +190,7 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
         Sequel[:super_auth_resources][:external_type].as(:resource_external_type),
       ).
       # Join permission and resource edges on the expanded role
-      join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:users_roles_permissions_resources][:role_id]).
+      join(Sequel[:super_auth_edges].as(:permission_edges), Sequel[:permission_edges][:role_id] => Sequel[:granted_roles][:id]).
       join(Sequel[:super_auth_permissions], id: Sequel[:permission_edges][:permission_id]).
       join(Sequel[:super_auth_edges].as(:resource_edges), Sequel[:resource_edges][:permission_id] => Sequel[:super_auth_permissions][:id]).
       join(Sequel[:super_auth_resources], id: Sequel[:resource_edges][:resource_id]).
@@ -261,7 +226,7 @@ class SuperAuth::Edge < Sequel::Model(:super_auth_edges)
           Sequel.cast(nil, string_cast_type).as(:role_updated_at),
 
           Sequel[:super_auth_permissions][:id].as(:permission_id),
-          Sequel[:super_auth_permissions][:name].as(:permission_name),
+          Sequel[:super_auth_permissions][:name].cast(cast_type).as(:permission_name),
           Sequel[:super_auth_permissions][:created_at].cast(cast_type).as(:permission_created_at),
           Sequel[:super_auth_permissions][:updated_at].cast(cast_type).as(:permission_updated_at),
 

data/lib/super_auth/editor/cli.rb

@@ -0,0 +1,91 @@
+require "optparse"
+require "super_auth/editor"
+
+module SuperAuth
+  class Editor
+    # Boots the editor from the command line: connect, optionally migrate and
+    # seed, then serve on loopback. See exe/super_auth-editor.
+    module CLI
+      DEFAULTS = { host: "127.0.0.1", port: 4666, migrate: false, seed: false }.freeze
+      LOOPBACK_BINDS = %w[127.0.0.1 localhost ::1].freeze
+      # Host headers accepted when bound to loopback (DNS-rebinding defence).
+      LOOPBACK_HOSTS = %w[localhost 127.0.0.1 [::1]].freeze
+      WARNING = "WARNING: the editor has no authentication. " \
+                "Anyone who can reach this port can rewrite the authorization graph.".freeze
+
+      module_function
+
+      def parse(argv, out: $stdout)
+        options = DEFAULTS.dup
+        parser = OptionParser.new do |o|
+          o.banner = "Usage: super_auth-editor [options]"
+          o.on("-H", "--host HOST", "bind address (default #{DEFAULTS[:host]})") { |v| options[:host] = v }
+          o.on("-p", "--port PORT", Integer, "port (default #{DEFAULTS[:port]})") { |v| options[:port] = v }
+          o.on("--migrate", "run the super_auth Sequel migrations before starting") { options[:migrate] = true }
+          o.on("--seed", "replace the whole graph with the Acme Cloud sample (destructive)") { options[:seed] = true }
+          o.on("-v", "--version", "print the version") do
+            out.puts SuperAuth::VERSION
+            exit
+          end
+          o.on("-h", "--help", "show this help") do
+            out.puts o
+            out.puts "Reads SUPER_AUTH_DATABASE_URL (required)."
+            out.puts WARNING
+            exit
+          end
+        end
+        parser.parse!(argv.dup)
+        options
+      rescue OptionParser::ParseError => e
+        raise SuperAuth::Error, "#{e.message}\n#{parser}"
+      end
+
+      def run(argv, env: ENV, err: $stderr)
+        options = parse(argv)
+        url = env["SUPER_AUTH_DATABASE_URL"].to_s.strip
+        if url.empty?
+          raise SuperAuth::Error, "SUPER_AUTH_DATABASE_URL is not set. Point it at the database that holds " \
+                                  "the super_auth tables, e.g. postgres://user:password@localhost/app_development"
+        end
+
+        # First Sequel::Database in the process: the models bind to it.
+        begin
+          SuperAuth.db = Sequel.connect(url)
+        rescue Sequel::AdapterNotFound => e
+          raise SuperAuth::Error, "#{e.message}. Install the adapter gem for this URL (pg, mysql2 or sqlite3)."
+        end
+
+        SuperAuth.install_migrations if options[:migrate]
+        begin
+          SuperAuth.load
+        rescue Sequel::DatabaseError => e
+          raise SuperAuth::Error, "super_auth tables not found at #{redact(url)} (#{e.message.lines.first.to_s.strip}). " \
+                                  "Run with --migrate to create them, or run your application's migrations."
+        end
+
+        if options[:seed]
+          require "super_auth/editor/seed"
+          counts = SuperAuth::Editor::Seed.run!
+          err.puts "Seeded the Acme Cloud sample graph: #{counts.map { |k, v| "#{v} #{k}" }.join(', ')}."
+        end
+
+        begin
+          require "rackup"
+        rescue LoadError
+          raise SuperAuth::Error, "The editor needs a Rack server: gem install rackup webrick (puma also works)."
+        end
+
+        loopback = LOOPBACK_BINDS.include?(options[:host])
+        err.puts WARNING
+        err.puts "Bound to #{options[:host]}, which other machines can reach." unless loopback
+        err.puts "Editor at http://#{options[:host]}:#{options[:port]}"
+        app = SuperAuth::Editor.new(hosts: loopback ? LOOPBACK_HOSTS : nil)
+        Rackup::Server.start(app: app, Host: options[:host], Port: options[:port], environment: "deployment")
+      end
+
+      def redact(url)
+        url.sub(%r{//([^:/@]+):[^@]*@}, '//\1:***@')
+      end
+    end
+  end
+end