super_auth 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0e93633206ab371d51eb0519bc0afccf33a028bd1025d66ee2fc1fb17df19c20
-  data.tar.gz: f99edcddc159742adee9fcf5888d8bc438beaad627d58f8576204e695a3436fa
+  metadata.gz: c87faea517d56f8cb6a8cc8753e6cac508d2065dfd06e4042d56a9da102d8763
+  data.tar.gz: 02dcddf01c47ca4a3e371e4a90d0b091f750faf22674a950c57cb1836573d540
 SHA512:
-  metadata.gz: cedd01d07d249b8b49840915eed87eb68a0f7a16a2900dad8f93168338efc12c457b8c86ea910d5fd99def2844945abd8f148bd5bb360b476b22a3942eda8b7d
-  data.tar.gz: 6158c6a1b379d27364ae97f570899fe1690ac172a9bf16732932058bf62504fd03180719fdce24974571b262ec5dfd4444d1c6dd967408e08892491791a45a6d
+  metadata.gz: cf5e6a02d96541c2ea2ddb838f757c8442594c03c8e90382dae230be0586bef8772e7805ac875afc8ef897e7f0ec9bc2bb6ee66ca8e6164da8ebb00cff3869cf
+  data.tar.gz: 037ab89f3f6fae85981c5b4789481a439f74d34209f1c402c8732564435bfca6acd56944595c59278594bfa01e75ef1ecc902f2f82a5272032dac12dd36d2c27

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    super_auth (0.1.5)
+    super_auth (0.2.0)
       sequel
 
 GEM

data/db/migrate/9_add_by_current_user_index.rb

@@ -0,0 +1,12 @@
+Sequel.migration do
+  up do
+    add_index :super_auth_authorizations,
+      [:user_external_id, :resource_external_type, :resource_external_id],
+      name: :idx_sa_auth_by_current_user
+  end
+  down do
+    drop_index :super_auth_authorizations,
+      [:user_external_id, :resource_external_type, :resource_external_id],
+      name: :idx_sa_auth_by_current_user
+  end
+end

data/db/migrate_activerecord/20250101000009_add_by_current_user_index_to_super_auth_authorizations.rb

@@ -0,0 +1,7 @@
+class AddByCurrentUserIndexToSuperAuthAuthorizations < ActiveRecord::Migration[8.0]
+  def change
+    add_index :super_auth_authorizations,
+      [:user_external_id, :resource_external_type, :resource_external_id],
+      name: :idx_sa_auth_by_current_user
+  end
+end

data/lib/super_auth/active_record/by_current_user.rb

@@ -1,9 +1,7 @@
 module SuperAuth::ActiveRecord::ByCurrentUser
   def self.included(base)
-    base.has_many :super_auth_authorizations
-
     base.send(:default_scope, **{all_queries: true}) do
-      raise "SuperAuth.current_user not set" if SuperAuth.current_user.blank?
+      next none if SuperAuth.current_user.blank?
 
       if SuperAuth.current_user.respond_to?(:system?) && SuperAuth.current_user.system?
         self
@@ -15,25 +13,27 @@ module SuperAuth::ActiveRecord::ByCurrentUser
           { user_external_id: SuperAuth.current_user.id, user_external_type: SuperAuth.current_user.class.name }
         end
 
-        resource_where =
-        if try(:id)
-          { resource_external_id: self.id, resource_external_type: self.class.name }
+        resource_type = self.model.name
+
+        # Type-level authorization (resource_external_id IS NULL) acts as wildcard:
+        # user has access to ALL records of this type (e.g., admin with ADMIN_ACCESS).
+        type_level = SuperAuth::ActiveRecord::Authorization
+          .where(**user_where, resource_external_type: resource_type, resource_external_id: nil)
+
+        if type_level.exists?
+          self
         else
-          { resource_external_type: self.model.name }
+          # Per-record authorization: filter to specific records the user can access.
+          where(
+            id: SuperAuth::ActiveRecord::Authorization
+                .where(**user_where, resource_external_type: resource_type)
+                .where.not(resource_external_id: nil)
+                .select(:resource_external_id))
         end
-
-        # Important:
-        # We use a subquery here instead of a inner join because we don't want
-        # to potentially affect break on queries issue count queries in their app.
-        where(
-          id: SuperAuth::ActiveRecord::Authorization
-              .where(**user_where, **resource_where)
-              .select(:resource_id))
       end
     end
   end
 
   module ClassMethods
   end
-
 end

data/lib/super_auth/version.rb

@@ -1,3 +1,3 @@
 module SuperAuth
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/super_auth.gemspec

@@ -0,0 +1,35 @@
+require_relative "lib/super_auth/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "super_auth"
+  spec.version = SuperAuth::VERSION
+  spec.authors = ["Jonathan Frias"]
+  spec.email = ["jonathan@gofrias.com"]
+
+  spec.summary = "Make Unauthenticated State Unrepresentable"
+  spec.description = "Simple, yet super powerful authorization for you application"
+  spec.homepage = "https://github.com/JonathanFrias/super_auth"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 2.6.0"
+
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = "https://github.com/JonathanFrias/super_auth"
+  spec.metadata["changelog_uri"] = "https://github.com/JonathanFrias/super_auth/blob/main/CHANGELOG.md"
+
+  # Specify which files should be added to the gem when it is released.
+  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      (f == __FILE__) || f.match(%r{\A(?:(?:bin|test|spec|features)/|\.(?:git|circleci)|appveyor)})
+    end
+  end
+  spec.bindir = "bin"
+  spec.executables = spec.files.grep(%r{\Abin/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  # Uncomment to register a new dependency of your gem
+  spec.add_dependency "sequel"
+  spec.add_development_dependency "sqlite3"
+  # For more information and examples about making a new gem, check out our
+  # guide at: https://bundler.io/guides/creating_gem.html
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: super_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Jonathan Frias
@@ -65,6 +65,7 @@ files:
 - db/migrate/6_edge.rb
 - db/migrate/7_authorization.rb
 - db/migrate/8_add_indexes_to_edges.rb
+- db/migrate/9_add_by_current_user_index.rb
 - db/migrate_activerecord/20250101000001_create_super_auth_users.rb
 - db/migrate_activerecord/20250101000002_create_super_auth_groups.rb
 - db/migrate_activerecord/20250101000003_create_super_auth_permissions.rb
@@ -72,6 +73,7 @@ files:
 - db/migrate_activerecord/20250101000005_create_super_auth_resources.rb
 - db/migrate_activerecord/20250101000006_create_super_auth_edges.rb
 - db/migrate_activerecord/20250101000007_create_super_auth_authorizations.rb
+- db/migrate_activerecord/20250101000009_add_by_current_user_index_to_super_auth_authorizations.rb
 - db/seeds/sample_data.rb
 - lib/basic_loader.rb
 - lib/generators/super_auth/install/install_generator.rb
@@ -98,6 +100,7 @@ files:
 - lib/super_auth/user.rb
 - lib/super_auth/version.rb
 - lib/tasks/super_auth_tasks.rake
+- super_auth.gemspec
 - visualization.html
 homepage: https://github.com/JonathanFrias/super_auth
 licenses: