super_auth 0.3.3 → 0.7.0

data/lib/super_auth.rb

@@ -22,6 +22,43 @@ module SuperAuth
     @missing_user_behavior = behavior
   end
 
+  # Column type for the external id columns (users.external_id,
+  # resources.external_id and their copies on authorizations). Set it to your
+  # application's primary key type (:bigint, :uuid, :string, ...) BEFORE
+  # running the super_auth migrations — the columns are then created with the
+  # matching type and every comparison against your tables' pks is natively
+  # typed, with no casting anywhere. Default :string.
+  def self.external_id_type
+    @external_id_type || :string
+  end
+
+  def self.external_id_type=(type)
+    @external_id_type = type
+  end
+
+  # Sequel migrations take the Ruby String class for varchar; anything else
+  # passes through as the literal database type name.
+  def self.sequel_external_id_type
+    external_id_type == :string ? String : external_id_type
+  end
+
+  # The human name of the application record behind a node, by convention
+  # rather than configuration: a model says it explicitly with
+  # `super_auth_label`, otherwise `name` then `title` are tried, and a model
+  # with none of them has no label. This is also the name of the column the
+  # derivation is stored in, since `label` is a name applications want for
+  # themselves. Deliberately never `to_s` — the label sits where the editor
+  # otherwise renders `Type#id`, and "#<Claim:0x000055…>" is worse than the id
+  # it would replace.
+  def self.label_for(record)
+    %i[super_auth_label name title].each do |method|
+      next unless record.respond_to?(method)
+      value = record.public_send(method)
+      return value.to_s unless value.nil? || value.to_s.empty?
+    end
+    nil
+  end
+
   def self.load
     require "super_auth/authorization"
     require "super_auth/edge"
@@ -30,6 +67,7 @@ module SuperAuth
     require "super_auth/permission"
     require "super_auth/railtie"
     require "super_auth/resource"
+    require "super_auth/rls"
     require "super_auth/role"
     require "super_auth/user"
     require "super_auth/active_record" if defined?(ActiveRecord::Base)
@@ -40,6 +78,25 @@ module SuperAuth
     require "pathname"
     path = Pathname.new(__FILE__).parent.parent.join("db", "migrate")
     Sequel::Migrator.run(SuperAuth.db, path)
+    refresh_model_schemas
+  end
+
+  # Both ORMs cache column types per model class; after (re)installing the
+  # migrations those caches can describe a previous schema (e.g. a different
+  # external_id_type) and silently miscast assigned values.
+  def self.refresh_model_schemas
+    models = %w[User Group Permission Role Resource Edge Authorization]
+    if defined?(SuperAuth::ActiveRecord::User)
+      models.each do |name|
+        SuperAuth::ActiveRecord.const_get(name).reset_column_information
+      end
+    end
+    if defined?(SuperAuth::User) && SuperAuth::User.respond_to?(:set_dataset)
+      models.each do |name|
+        model = SuperAuth.const_get(name)
+        model.set_dataset(model.dataset)
+      end
+    end
   end
 
   def self.uninstall_migrations
@@ -55,6 +112,33 @@ module SuperAuth
     raise Error, "Failed to uninstall migrations: #{e.message}"
   end
 
+  # Run the block as `user` in both layers: SuperAuth.current_user, which the
+  # ByCurrentUser scope reads, and the database identity the RLS policies read
+  # (see SuperAuth::RLS.as). Both are restored on the way out, whether the
+  # block returns, raises, or was nested inside another `as`. Passing nil runs
+  # the block with no user in either layer. Postgres only, since the database
+  # half is. Keyword options (auto_savepoint:, ...) go to SuperAuth::RLS.as.
+  # current_user is assigned inside the transaction, after the database
+  # identity, so an application that hooks the writer to re-assert does so on
+  # the connection that holds the transaction.
+  def self.as(user, db: SuperAuth.db, **options)
+    previous = current_user
+    SuperAuth::RLS.as(user, db: db, **options) do
+      self.current_user = user
+      yield
+    end
+  ensure
+    self.current_user = previous
+  end
+
+  # Both user models are internal: their id is the user_id that the policies
+  # and ByCurrentUser match on. Anything else is an application object,
+  # matched by id and class name.
+  def self.internal_user?(user)
+    (defined?(SuperAuth::ActiveRecord::User) && user.is_a?(SuperAuth::ActiveRecord::User)) ||
+      (defined?(SuperAuth::User) && user.is_a?(SuperAuth::User))
+  end
+
   def self.current_user=(user)
     Thread.current[:super_auth_current_user] = user
   end
@@ -128,4 +212,5 @@ module SuperAuth
   end
 end
 
+require "super_auth/rls"
 require "super_auth/railtie" if defined?(Rails::Railtie)

data/lib/tasks/super_auth_tasks.rake

@@ -6,6 +6,34 @@ namespace :super_auth do
     puts "Done"
   end
 
+  namespace :labels do
+    desc "Re-derive super_auth_resources.super_auth_label from the application records"
+    task backfill: :environment do
+      SuperAuth.load
+      backfill = lambda do
+        changed = 0
+        SuperAuth::ActiveRecord::Resource.where.not(external_id: nil).find_each do |resource|
+          before = resource.super_auth_label
+          resource.refresh_label!
+          changed += 1 if resource.super_auth_label != before
+        end
+        changed
+      end
+
+      # The application tables this reads are the ones RLS protects, so a run
+      # with no identity derives nil for exactly the rows that matter most and
+      # then reports success. Assert the system identity where RLS is
+      # installed; where it is not, there is nothing to assert.
+      changed =
+        if SuperAuth::RLS.installed?
+          SuperAuth.as(SuperAuth::ActiveRecord::User.system) { backfill.call }
+        else
+          backfill.call
+        end
+      puts "Labelled #{changed} resources"
+    end
+  end
+
   task :rollback => :environment do
     raise "You must define SUPER_AUTH_DATABASE_URL in your environment for this to work" if ENV['SUPER_AUTH_DATABASE_URL'].nil? || ENV['SUPER_AUTH_DATABASE_URL'].empty?
     SuperAuth.uninstall_migrations

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: super_auth
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.7.0
 platform: ruby
 authors:
 - Jonathan Frias
-bindir: bin
+bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
@@ -40,7 +40,8 @@ dependencies:
 description: Simple, yet super powerful authorization for you application
 email:
 - jonathan@gofrias.com
-executables: []
+executables:
+- super_auth-editor
 extensions: []
 extra_rdoc_files: []
 files:
@@ -53,10 +54,8 @@ files:
 - README.md
 - Rakefile
 - USAGE.md
-- VISUALIZATION.md
-- app/controllers/super_auth/graph_controller.rb
-- app/views/super_auth/graph/index.html.erb
 - config/routes.rb
+- db/migrate/10_add_super_auth_label_to_resources.rb
 - db/migrate/1_users.rb
 - db/migrate/2_groups.rb
 - db/migrate/3_permissions.rb
@@ -74,11 +73,15 @@ files:
 - db/migrate_activerecord/20250101000006_create_super_auth_edges.rb
 - db/migrate_activerecord/20250101000007_create_super_auth_authorizations.rb
 - db/migrate_activerecord/20250101000009_add_by_current_user_index_to_super_auth_authorizations.rb
+- db/migrate_activerecord/20250101000010_add_super_auth_label_to_super_auth_resources.rb
 - db/seeds/sample_data.rb
+- exe/super_auth-editor
 - lib/basic_loader.rb
 - lib/generators/super_auth/install/install_generator.rb
 - lib/generators/super_auth/install/templates/README
 - lib/generators/super_auth/install/templates/super_auth.rb
+- lib/generators/super_auth/rls/rls_generator.rb
+- lib/generators/super_auth/rls/templates/migration.rb.erb
 - lib/super_auth.rb
 - lib/super_auth/active_record.rb
 - lib/super_auth/active_record/authorization.rb
@@ -91,20 +94,23 @@ files:
 - lib/super_auth/active_record/user.rb
 - lib/super_auth/authorization.rb
 - lib/super_auth/edge.rb
+- lib/super_auth/editor.rb
+- lib/super_auth/editor/cli.rb
+- lib/super_auth/editor/index.html
+- lib/super_auth/editor/seed.rb
 - lib/super_auth/group.rb
 - lib/super_auth/nestable.rb
 - lib/super_auth/permission.rb
 - lib/super_auth/railtie.rb
 - lib/super_auth/resource.rb
+- lib/super_auth/rls.rb
 - lib/super_auth/role.rb
 - lib/super_auth/user.rb
 - lib/super_auth/version.rb
 - lib/tasks/super_auth_tasks.rake
-- super_auth.gemspec
-- visualization.html
 homepage: https://github.com/JonathanFrias/super_auth
 licenses:
-- MIT
+- GPL-2.0
 metadata:
   homepage_uri: https://github.com/JonathanFrias/super_auth
   source_code_uri: https://github.com/JonathanFrias/super_auth

data/VISUALIZATION.md

@@ -1,58 +0,0 @@
-# SuperAuth Graph Visualization
-
-SuperAuth includes an interactive graph visualization tool that helps you understand and debug your authorization rules.
-
-## Setup
-
-### 1. Run the Installer
-
-Generate the initializer and install migrations:
-
-```bash
-rails generate super_auth:install
-```
-
-This will:
-- Create `config/initializers/super_auth.rb`
-- Install SuperAuth database migrations
-- Show you the next steps
-
-### 2. Mount the Engine
-
-Add the following to your `config/routes.rb`:
-
-```ruby
-Rails.application.routes.draw do
-  mount SuperAuth::Engine => '/super_auth'
-
-  # Your other routes...
-end
-```
-
-## Features
-
-### Interactive Graph
-
-- **Nodes**: Color-coded by type (Users, Groups, Roles, Permissions, Resources)
-- **Edges**: Solid lines for authorization relationships, dashed for hierarchy
-- **Zoom & Pan**: Navigate large graphs easily
-- **Click nodes**: View node details
-
-### Authorization Query
-
-1. Select a user from the dropdown
-2. Select a resource from the dropdown
-3. Click "Find Authorization Paths"
-4. View all paths that grant access
-5. See the first path highlighted on the graph
-
-### Statistics Panel
-
-Real-time counts of:
-- Users
-- Groups (with hierarchical relationships)
-- Roles (with hierarchical relationships)
-- Permissions
-- Resources
-- Authorization edges
-