super_auth 0.3.3 → 0.7.0

data/lib/super_auth/editor.rb

@@ -0,0 +1,273 @@
+require "json"
+require "super_auth"
+
+module SuperAuth
+  # A small Rack application that edits the authorization graph: five boxes of
+  # records, client-side traversal, node and edge CRUD, and a Recompile button.
+  # Rails-free; it needs only SuperAuth.db to be connected and the tables to
+  # exist. Mount it as `run SuperAuth::Editor` (Rack) or
+  # `mount SuperAuth::Editor => "/super_auth/editor"` (Rails), or run
+  # `super_auth-editor`, which serves it on loopback.
+  #
+  # It has no authentication of its own. Anyone who can reach it can rewrite
+  # the graph, so the host must put its own authentication in front of the
+  # mount. Two stdlib-only guards remain: writes must be application/json (a
+  # cross-origin browser cannot send that without a CORS preflight, which is
+  # never answered) and cross-site fetches are refused; `hosts:` additionally
+  # rejects any other Host header, the DNS-rebinding defence the executable
+  # turns on for loopback.
+  #
+  # Edits change the graph, not runtime access: ByCurrentUser and the RLS
+  # policies read the compiled super_auth_authorizations table, so the UI
+  # shows its row count and offers POST /api/compile.
+  class Editor
+    TYPES = {
+      "user" => :User, "group" => :Group, "role" => :Role,
+      "permission" => :Permission, "resource" => :Resource,
+    }.freeze
+    COLUMNS = {
+      "user" => :user_id, "group" => :group_id, "role" => :role_id,
+      "permission" => :permission_id, "resource" => :resource_id,
+    }.freeze
+    NESTED = %w[group role].freeze
+    # The pairs the path strategies read (see Edge.authorizations), unordered.
+    # The models also accept group->resource and role->resource rows, but no
+    # strategy reads them, so they would grant nothing.
+    ALLOWED_PAIRS = [
+      %w[user group], %w[user role], %w[user permission], %w[user resource],
+      %w[group role], %w[group permission], %w[role permission], %w[permission resource],
+    ].map(&:sort).freeze
+    EMPTY_EDGE = { user_id: nil, group_id: nil, role_id: nil, permission_id: nil, resource_id: nil }.freeze
+    INDEX_HTML = File.read(File.join(__dir__, "editor", "index.html")).freeze
+    MAX_BODY = 64 * 1024
+    ID = /\A\d+\z/
+    NAME_MAX = 255
+
+    def self.call(env)
+      (@default ||= new).call(env)
+    end
+
+    # hosts: host names (port ignored) this app answers to; nil disables the check.
+    def initialize(hosts: nil)
+      @hosts = hosts && hosts.map { |h| h.to_s.downcase }
+    end
+
+    def call(env)
+      return forbidden("host not allowed") if @hosts && !@hosts.include?(host_of(env))
+
+      begin
+        SuperAuth.load unless defined?(SuperAuth::User)
+      rescue Sequel::DatabaseError
+        return json(503, error: "super_auth tables not found; run the migrations (super_auth-editor --migrate, or your application's)")
+      end
+
+      method = env["REQUEST_METHOD"]
+      path = env["PATH_INFO"].to_s
+      path = "/" if path.empty?
+      if %w[POST DELETE].include?(method) && env["HTTP_SEC_FETCH_SITE"] == "cross-site"
+        return forbidden("cross-site requests are not accepted")
+      end
+
+      route(method, path, env)
+    rescue Sequel::Error
+      json(422, error: "the database rejected the change")
+    end
+
+    private
+
+    def route(method, path, env)
+      if method == "GET" && path == "/"
+        html
+      elsif method == "GET" && path == "/api/graph"
+        json(200, graph)
+      elsif method == "POST" && path == "/api/compile"
+        json(200, count: SuperAuth::Authorization.compile!)
+      elsif method == "POST" && path == "/api/edges"
+        with_body(env) { |body| create_edge(body) }
+      elsif method == "DELETE" && (m = path.match(%r{\A/api/edges/([^/]+)\z}))
+        delete_edge(m[1])
+      elsif method == "POST" && (m = path.match(%r{\A/api/nodes/([^/]+)\z}))
+        with_body(env) { |body| create_node(m[1], body) }
+      elsif method == "DELETE" && (m = path.match(%r{\A/api/nodes/([^/]+)/([^/]+)\z}))
+        delete_node(m[1], m[2])
+      else
+        json(404, error: "not found")
+      end
+    end
+
+    # ---- reads ----
+
+    def graph
+      {
+        groups: nodes(:Group, :parent_id),
+        roles: nodes(:Role, :parent_id),
+        users: nodes(:User, :external_id, :external_type),
+        permissions: nodes(:Permission),
+        resources: nodes(:Resource, :external_id, :external_type, :super_auth_label),
+        edges: SuperAuth::Edge.order(:id).map { |e| edge_json(e) },
+        authorizations_count: SuperAuth::Authorization.count,
+      }
+    end
+
+    def nodes(model, *extra)
+      rows = SuperAuth.const_get(model).order(:name, :id).map do |n|
+        row = { id: n.id, name: n.name }
+        extra.each { |column| row[column] = n[column] }
+        row
+      end
+      extra.include?(:parent_id) ? tree_order(rows) : rows
+    end
+
+    # The nested types render as a flat list that fakes the tree with
+    # indentation, so a child has to arrive immediately after its parent or
+    # it reads as nested under whatever happens to sort above it — which is
+    # the one question an auditor opens this editor to answer. Sorting by the
+    # ancestors' [name, id] pairs, outermost first, puts every child under its
+    # own parent and leaves siblings alphabetical. Both node sets are small
+    # enough to order in Ruby, and the client's depthOf is unaffected.
+    #
+    # The key is total, so the order stays defined for broken trees: a row
+    # whose parent_id names a missing row sorts as a root, and a parent cycle
+    # stops at the first repeated id rather than walking forever.
+    def tree_order(rows)
+      by_id = rows.each_with_object({}) { |row, index| index[row[:id]] = row }
+      rows.sort_by do |row|
+        path = []
+        seen = {}
+        node = row
+        while node && !seen[node[:id]]
+          seen[node[:id]] = true
+          path.unshift([node[:name].to_s, node[:id]])
+          node = by_id[node[:parent_id]]
+        end
+        path
+      end
+    end
+
+    # ---- writes ----
+
+    def create_node(type, body)
+      model = model_for(type) or return json(404, error: "unknown node type")
+      name = body["name"].to_s.strip
+      return json(422, error: "name is required") if name.empty?
+      return json(422, error: "name is too long (#{NAME_MAX} characters max)") if name.length > NAME_MAX
+      return json(422, error: "the name \"system\" is reserved") if type == "user" && name == "system"
+
+      attrs = { name: name }
+      parent = body["parent_id"]
+      unless parent.nil?
+        return json(422, error: "#{type} records cannot have a parent") unless NESTED.include?(type)
+        return json(422, error: "parent_id must be an integer") unless integer_id?(parent)
+        return json(422, error: "parent not found") unless model[parent.to_i]
+        attrs[:parent_id] = parent.to_i
+      end
+
+      json(201, node_json(model.create(attrs)))
+    end
+
+    def delete_node(type, id)
+      model = model_for(type) or return json(404, error: "unknown node type")
+      record = integer_id?(id) && model[id.to_i]
+      return json(404, error: "not found") unless record
+
+      SuperAuth.db.transaction do
+        SuperAuth::Edge.where(COLUMNS[type] => record.id).delete
+        # Children become roots: the deny-safe choice, and required before the
+        # delete on MySQL, which checks the self-referencing key row by row.
+        model.where(parent_id: record.id).update(parent_id: nil) if NESTED.include?(type)
+        model.where(id: record.id).delete
+      end
+      json(200, ok: true)
+    end
+
+    def create_edge(body)
+      a_type = body["a_type"].to_s
+      b_type = body["b_type"].to_s
+      return json(422, error: "unknown node type") unless COLUMNS[a_type] && COLUMNS[b_type]
+      return json(422, error: "an edge links two different node types") if a_type == b_type
+      unless ALLOWED_PAIRS.include?([a_type, b_type].sort)
+        return json(422, error: "no path strategy reads #{a_type} -> #{b_type} edges; it would grant nothing")
+      end
+      return json(422, error: "ids must be integers") unless integer_id?(body["a_id"]) && integer_id?(body["b_id"])
+
+      a_id = body["a_id"].to_i
+      b_id = body["b_id"].to_i
+      return json(404, error: "#{a_type} #{a_id} not found") unless model_for(a_type)[a_id]
+      return json(404, error: "#{b_type} #{b_id} not found") unless model_for(b_type)[b_id]
+
+      # The full five-column hash, so a row created here always has exactly two ids.
+      attrs = EMPTY_EDGE.merge(COLUMNS[a_type] => a_id, COLUMNS[b_type] => b_id)
+      if (edge = SuperAuth::Edge.where(attrs).first)
+        json(200, edge_json(edge))
+      else
+        json(201, edge_json(SuperAuth::Edge.create(attrs)))
+      end
+    end
+
+    def delete_edge(id)
+      edge = integer_id?(id) && SuperAuth::Edge[id.to_i]
+      return json(404, error: "not found") unless edge
+
+      edge.delete
+      json(200, ok: true)
+    end
+
+    # ---- helpers ----
+
+    def model_for(type)
+      TYPES[type] && SuperAuth.const_get(TYPES[type])
+    end
+
+    def integer_id?(value)
+      (value.is_a?(Integer) && value >= 0) || (value.is_a?(String) && value.match?(ID))
+    end
+
+    def node_json(record)
+      {
+        id: record.id,
+        name: record.name,
+        parent_id: record.respond_to?(:parent_id) ? record.parent_id : nil,
+        external_id: record.respond_to?(:external_id) ? record.external_id : nil,
+        external_type: record.respond_to?(:external_type) ? record.external_type : nil,
+      }
+    end
+
+    def edge_json(edge)
+      { id: edge.id, user_id: edge.user_id, group_id: edge.group_id, role_id: edge.role_id,
+        permission_id: edge.permission_id, resource_id: edge.resource_id }
+    end
+
+    def with_body(env)
+      media_type = env["CONTENT_TYPE"].to_s.split(";").first.to_s.strip.downcase
+      return json(415, error: "send application/json") unless media_type == "application/json"
+
+      input = env["rack.input"]
+      raw = input ? input.read(MAX_BODY + 1).to_s : ""
+      return json(413, error: "body too large") if raw.bytesize > MAX_BODY
+
+      body = raw.empty? ? nil : JSON.parse(raw)
+      return json(400, error: "body must be a JSON object") unless body.is_a?(Hash)
+
+      yield body
+    rescue JSON::ParserError
+      json(400, error: "body must be a JSON object")
+    end
+
+    def host_of(env)
+      host = env["HTTP_HOST"].to_s.downcase
+      host.start_with?("[") ? host[/\A\[[^\]]*\]/].to_s : host.split(":").first.to_s
+    end
+
+    def json(status, payload)
+      [status, { "content-type" => "application/json; charset=utf-8", "cache-control" => "no-store" }, [JSON.generate(payload)]]
+    end
+
+    def html
+      [200, { "content-type" => "text/html; charset=utf-8", "cache-control" => "no-store", "x-frame-options" => "DENY" }, [INDEX_HTML]]
+    end
+
+    def forbidden(message)
+      json(403, error: message)
+    end
+  end
+end

data/lib/super_auth/nestable.rb

@@ -35,6 +35,44 @@ module SuperAuth::Nestable
       end
     end
 
+    # Cast type for the anchor row of the path CTEs. MySQL types a recursive
+    # CTE's columns from the anchor SELECT alone, so a bare CAST(id AS CHAR)
+    # makes the path column varchar(11) and every deeper level overflows it
+    # ("Data too long for column"). :text is unbounded elsewhere.
+    def path_cast_type
+      case SuperAuth.db.database_type
+      when :mysql, :mysql2
+        "char(4000)"
+      else
+        :text
+      end
+    end
+
+    # Every node paired with itself and each of its ancestors, as
+    # (descendant_id, ancestor_id). The path strategies join these integer
+    # pairs on equality; matching ids inside the comma-separated path strings
+    # with LIKE forced a nested loop no planner could index, and compile time
+    # grew roughly cubically with the graph.
+    def ancestor_pairs
+      table = pluralize
+      name = :"#{singularize}_ancestor_pairs"
+      anchor = db[table].select(Sequel[:id].as(:descendant_id), Sequel[:id].as(:ancestor_id))
+      step = db[name].join(table, id: :ancestor_id).exclude(Sequel[table][:parent_id] => nil).
+        select(Sequel[name][:descendant_id], Sequel[table][:parent_id])
+      db.from(name).with_recursive(name, anchor, step, args: [:descendant_id, :ancestor_id])
+    end
+
+    # Every node paired with itself and each of its descendants, as
+    # (ancestor_id, descendant_id). Granting a role grants its whole subtree.
+    def descendant_pairs
+      table = pluralize
+      name = :"#{singularize}_descendant_pairs"
+      anchor = db[table].select(Sequel[:id].as(:ancestor_id), Sequel[:id].as(:descendant_id))
+      step = db[name].join(table, parent_id: :descendant_id).
+        select(Sequel[name][:ancestor_id], Sequel[table][:id])
+      db.from(name).with_recursive(name, anchor, step, args: [:ancestor_id, :descendant_id])
+    end
+
     def cte(id = nil, direction = :desc)
       model = self
       cte_name = model.cte_name
@@ -69,8 +107,8 @@ module SuperAuth::Nestable
     def with_descending_paths(base_ds, recursive_ds, cte_name)
       [
         base_ds.select_append(
-          Sequel[table_name][:id].cast(string_cast_type).as(base_path)
-        ).select_append(Sequel[table_name][:name].as(base_name_path)),
+          Sequel[table_name][:id].cast(path_cast_type).as(base_path)
+        ).select_append(Sequel[table_name][:name].cast(path_cast_type).as(base_name_path)),
 
         recursive_ds.select_append(
           Sequel.function(:concat,
@@ -90,7 +128,7 @@ module SuperAuth::Nestable
 
     def with_ascending_paths(base_ds, recursive_ds, cte_name)
       [
-        base_ds.select_append(Sequel[table_name][:id].cast(string_cast_type).as(base_path)).select_append(Sequel[table_name][:name].as(base_name_path)),
+        base_ds.select_append(Sequel[table_name][:id].cast(path_cast_type).as(base_path)).select_append(Sequel[table_name][:name].cast(path_cast_type).as(base_name_path)),
         recursive_ds.select_append(
           Sequel.function(:concat,
             Sequel[table_name][:id].cast(string_cast_type),

data/lib/super_auth/railtie.rb

@@ -3,8 +3,6 @@ module SuperAuth
     class Engine < Rails::Engine
       isolate_namespace SuperAuth
 
-      config.paths.add 'app/controllers', eager_load: true
-
       # Use ActiveRecord migrations when in a Rails environment
       if defined?(ActiveRecord)
         config.paths['db/migrate'] = 'db/migrate_activerecord'

data/lib/super_auth/rls.rb

@@ -0,0 +1,256 @@
+# Postgres Row-Level Security enforcement.
+#
+# ByCurrentUser filters queries at the ORM layer; RLS enforces the same rule
+# inside Postgres, so raw SQL, `unscoped`, and non-Ruby clients are subject
+# to it too — enforcing apps don't load this gem at all. Identity is
+# asserted per transaction by two SQL functions installed by `enable`:
+#
+#   super_auth_become(user_external_id, user_external_type, user_id)
+#     asserts a user's identity. Executable by PUBLIC.
+#   super_auth_system()
+#     asserts system context, which bypasses every policy. EXECUTE is
+#     revoked from PUBLIC; `grant_system(role)` hands it to the roles that
+#     may bypass.
+#
+# `enable` also grants every role SELECT on the gem's own tables, which the
+# policies and the user models read, so a runtime role needs privileges on
+# the application's tables and nothing else.
+#
+# Both set transaction-local identity settings plus a stamp of the current
+# transaction id, and every policy requires a stamp from the current
+# transaction. Identity therefore cannot outlive its transaction or leak
+# across pooled connections — a query without a fresh assertion sees no
+# rows. Both raise if the calling role is a superuser or has BYPASSRLS:
+# Postgres exempts those roles from every policy, so an identity assertion
+# from one would protect nothing while looking like it does.
+module SuperAuth
+  module RLS
+    POLICY = "super_auth".freeze
+
+    class << self
+      # Enable RLS on an app table with a policy mirroring ByCurrentUser:
+      # type-level authorization rows (resource_external_id IS NULL) act as a
+      # wildcard, per-record rows match on id, and system context bypasses.
+      #
+      # One deliberate divergence: INSERTs are also gated. The policy is
+      # FOR ALL with no WITH CHECK, so Postgres reuses its USING expression
+      # as the implicit WITH CHECK for new rows. Creating rows therefore
+      # requires a type-level authorization for the resource type, or
+      # system context.
+      def enable(table, resource_type:, db: SuperAuth.db)
+        postgres!(db)
+        create_functions(db)
+        grant_runtime_reads(db)
+        t = db.literal(Sequel.identifier(table.to_s))
+        db.run "ALTER TABLE #{t} ENABLE ROW LEVEL SECURITY"
+        # FORCE: apply the policy even when the app connects as the table owner
+        db.run "ALTER TABLE #{t} FORCE ROW LEVEL SECURITY"
+        db.run "DROP POLICY IF EXISTS #{POLICY} ON #{t}"
+        db.run <<~SQL
+          CREATE POLICY #{POLICY} ON #{t}
+          USING (
+            current_setting('super_auth.xid', true) = pg_current_xact_id()::text
+            AND (
+              COALESCE(current_setting('super_auth.system', true), '') = 'true'
+              OR EXISTS (
+                SELECT 1 FROM super_auth_authorizations a
+                WHERE a.resource_external_type = #{db.literal(resource_type.to_s)}
+                  AND (a.resource_external_id IS NULL OR a.resource_external_id = #{t}.id)
+                  AND (
+                    a.user_id::text = NULLIF(current_setting('super_auth.user_id', true), '')
+                    OR (
+                      a.user_external_id::text = NULLIF(current_setting('super_auth.user_external_id', true), '')
+                      AND a.user_external_type = NULLIF(current_setting('super_auth.user_external_type', true), '')
+                    )
+                  )
+              )
+            )
+          )
+        SQL
+      end
+
+      # Drops the table's policy; the shared functions are left in place
+      # (other tables may still be protected, and they are harmless on their
+      # own).
+      def disable(table, db: SuperAuth.db)
+        postgres!(db)
+        t = db.literal(Sequel.identifier(table.to_s))
+        db.run "DROP POLICY IF EXISTS #{POLICY} ON #{t}"
+        db.run "ALTER TABLE #{t} NO FORCE ROW LEVEL SECURITY"
+        db.run "ALTER TABLE #{t} DISABLE ROW LEVEL SECURITY"
+      end
+
+      # Run the block with `user`'s identity asserted for one transaction —
+      # the Ruby face of the SQL contract
+      # (BEGIN; SELECT super_auth_become(...); queries; COMMIT). Sequel and
+      # ActiveRecord queries inside the block share the transaction's
+      # connection, so the policies see the identity; it dies with the
+      # transaction. A user whose `system?` is true asserts system context
+      # through super_auth_system() instead, which the connection's role
+      # must have been granted EXECUTE on.
+      #
+      # Inside an enclosing transaction (the caller's, or an outer `as`) it
+      # joins that transaction instead of opening one, and it puts the
+      # enclosing identity back when the block ends, however it ends: the
+      # innermost assertion wins inside the block and nothing else afterwards.
+      # This touches only the database settings; SuperAuth.as is the call that
+      # also sets SuperAuth.current_user.
+      #
+      # Transaction options pass through to Sequel's transaction. One matters
+      # for a wrapper that exists only to carry an identity:
+      #   auto_savepoint: true   every nested transaction becomes a savepoint
+      #                          (the ActiveRecord bridge turns this into
+      #                          joinable: false), so a save inside the block
+      #                          commits on its own and its after_commit hooks
+      #                          fire then, not at the end of the block.
+      # Whether a write survives the block raising is the caller's policy, not
+      # this wrapper's: rescue inside the block to keep it, or let the
+      # exception out to roll it back.
+      def as(user, db: SuperAuth.db, **transaction_options)
+        postgres!(db)
+        # Outside a transaction the settings die at COMMIT and there is nothing
+        # to restore; inside one, the enclosing identity must survive the block.
+        enclosing = db.in_transaction? ? identity(db) : nil
+        db.transaction(**transaction_options) do
+          assert(user, db: db)
+          begin
+            yield
+          ensure
+            restore(enclosing, db) if enclosing
+          end
+        end
+      end
+
+      # Assert `user`'s identity in the transaction the caller already holds,
+      # without opening one: the SELECT super_auth_become(...) half of the
+      # contract, or super_auth_system() for a user whose `system?` is true.
+      # For re-asserting mid-transaction, and for code that manages its own
+      # transaction and only needs the identity in it. Outside a transaction
+      # the settings die with the statement, so it protects nothing there.
+      def assert(user, db: SuperAuth.db)
+        postgres!(db)
+        if user.respond_to?(:system?) && user.system?
+          db.get(Sequel.function(:super_auth_system))
+        else
+          db.get(Sequel.function(:super_auth_become, *become_args(user)))
+        end
+      end
+
+      # Whether `enable` has run on this database: both identity functions
+      # exist with their current signatures. One query per call, so a hot
+      # path memoises it. False on a non-Postgres database, where RLS cannot
+      # be installed.
+      def installed?(db: SuperAuth.db)
+        return false unless db.database_type == :postgres
+        db.get(Sequel.lit("to_regprocedure('super_auth_become(text,text,text)') IS NOT NULL AND to_regprocedure('super_auth_system()') IS NOT NULL"))
+      end
+
+      # Allow `role` to assert system context: SuperAuth.as with a user whose
+      # system? is true, or SELECT super_auth_system() directly. enable revokes
+      # this from PUBLIC; grant it to the roles that run migrations, seeds and
+      # admin jobs, and to nothing else.
+      def grant_system(role, db: SuperAuth.db)
+        postgres!(db)
+        db.run "GRANT EXECUTE ON FUNCTION super_auth_system() TO #{db.literal(Sequel.identifier(role.to_s))}"
+      end
+
+      private
+
+      # What any runtime role needs on the gem's own tables: the policies read
+      # super_auth_authorizations as the querying role, and the user models'
+      # system? reads super_auth_users. Granting PUBLIC makes enable the only
+      # setup step; a deployment that wants these tables private can REVOKE
+      # from PUBLIC and grant per role.
+      def grant_runtime_reads(db)
+        db.run "GRANT SELECT ON super_auth_authorizations, super_auth_users TO PUBLIC"
+      end
+
+      # Refuses an identity assertion from a role Postgres exempts from row
+      # security: the policies would apply to nobody while everything looked
+      # enforced. Checks the effective role, so a superuser session that has
+      # SET ROLE to an application role passes.
+      SUPERUSER_GUARD = <<~SQL.freeze
+        IF (SELECT rolsuper OR rolbypassrls FROM pg_roles WHERE rolname = current_user) THEN
+          RAISE EXCEPTION 'super_auth: role % is a superuser or has BYPASSRLS, so row-level security does not apply to it and asserting an identity would protect nothing. Connect as a regular role.', current_user
+            USING ERRCODE = 'invalid_authorization_specification';
+        END IF;
+      SQL
+
+      # Two shared functions per database; clients assert identity by calling
+      # one of them inside their transaction. CREATE OR REPLACE keeps enable
+      # idempotent. The pre-0.5 four-argument super_auth_become carried the
+      # system bypass as its last parameter; a REPLACE with a different
+      # signature would leave that overload in place, so it is dropped.
+      def create_functions(db)
+        db.run "DROP FUNCTION IF EXISTS super_auth_become(text, text, text, boolean)"
+        db.run <<~SQL
+          CREATE OR REPLACE FUNCTION super_auth_become(
+            user_external_id text DEFAULT NULL,
+            user_external_type text DEFAULT NULL,
+            user_id text DEFAULT NULL
+          ) RETURNS void LANGUAGE plpgsql AS $$
+          BEGIN
+            #{SUPERUSER_GUARD}
+            PERFORM set_config('super_auth.user_id',            COALESCE(user_id, ''), true),
+                    set_config('super_auth.user_external_id',   COALESCE(user_external_id, ''), true),
+                    set_config('super_auth.user_external_type', COALESCE(user_external_type, ''), true),
+                    set_config('super_auth.system',             '', true),
+                    set_config('super_auth.xid',                pg_current_xact_id()::text, true);
+          END
+          $$;
+        SQL
+        db.run <<~SQL
+          CREATE OR REPLACE FUNCTION super_auth_system() RETURNS void LANGUAGE plpgsql AS $$
+          BEGIN
+            #{SUPERUSER_GUARD}
+            PERFORM set_config('super_auth.user_id',            '', true),
+                    set_config('super_auth.user_external_id',   '', true),
+                    set_config('super_auth.user_external_type', '', true),
+                    set_config('super_auth.system',             'true', true),
+                    set_config('super_auth.xid',                pg_current_xact_id()::text, true);
+          END
+          $$;
+        SQL
+        # Bypass is opt-in per role: GRANT EXECUTE ON FUNCTION super_auth_system() TO <role>.
+        db.run "REVOKE EXECUTE ON FUNCTION super_auth_system() FROM PUBLIC"
+      end
+
+      # super_auth_become's three arguments for `user`: a SuperAuth user
+      # record goes by user_id, any other object by id and class name, nil by
+      # nothing, an identity no authorization matches.
+      def become_args(user)
+        if user.nil?
+          [nil, nil, nil]
+        elsif SuperAuth.internal_user?(user)
+          [nil, nil, user.id.to_s]
+        else
+          [user.id.to_s, user.class.name, nil]
+        end
+      end
+
+      # The five transaction-local settings the policies read, in one order.
+      SETTINGS = %w[
+        super_auth.user_id super_auth.user_external_id super_auth.user_external_type
+        super_auth.system super_auth.xid
+      ].freeze
+
+      def identity(db)
+        db.dataset.get(SETTINGS.each_with_index.map { |name, i| Sequel.function(:current_setting, name, true).as(:"s#{i}") })
+      end
+
+      # Writes the settings back directly: the values were read from this same
+      # transaction, so the stamp is still the current one, and no role is
+      # granted anything it could not already set.
+      def restore(values, db)
+        db.dataset.get(SETTINGS.zip(values).each_with_index.map { |(name, value), i| Sequel.function(:set_config, name, value.to_s, true).as(:"s#{i}") })
+      rescue Sequel::DatabaseError
+        # The block aborted the transaction; its rollback discards the settings.
+      end
+
+      def postgres!(db)
+        return if db.database_type == :postgres
+        raise SuperAuth::Error, "SuperAuth::RLS requires Postgres (got #{db.database_type})"
+      end
+    end
+  end
+end

data/lib/super_auth/user.rb

@@ -2,7 +2,9 @@ class SuperAuth::User < Sequel::Model(:super_auth_users)
   one_to_many :edges
   one_to_many :resources
 
-  def system? = self.class.system == self
+  # A read: runtime roles only get SELECT on this table. `.system` creates
+  # the row when missing and belongs to migrations, seeds and consoles.
+  def system? = self.class.first(name: "system") == self
   def self.system = find_or_create(name: "system")
 
   dataset_module do

data/lib/super_auth/version.rb

@@ -1,3 +1,3 @@
 module SuperAuth
-  VERSION = "0.3.3"
+  VERSION = "0.7.0"
 end