vetra 0.1.0.pre.alpha.4 → 0.1.0.pre.alpha.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b86b8c6c0b5d01eaa87aef9034e0237fbb29bf0e154fe44fecd5adb3b3101890
-  data.tar.gz: '0880a89f19a9ad570a34b38b2434de8e2c979b1607bc5709c685be932faeac63'
+  metadata.gz: 1d2dd87928b914db9b1144b0f5e17c356c7ad3aaaf473fe3c58f08fd37400527
+  data.tar.gz: a6236f38b853eb0c37b2a99f6087cb6150655c4f0f60a1ab74c94e4cb17b7727
 SHA512:
-  metadata.gz: a26b289cefeed49b0aadd23d0016e7b51adff2fbfad8c7d3d818ecf3a3bb8d7e3e9d0196e60d4b4aa2bae8d2df48784b5b4bce6aaf7fa521a1ac4aa038f7337d
-  data.tar.gz: 280011e13348cf28bfdaf77aff685b9ad004ad3571a379ab9a804bb5bb3d6bce104506148d5fcceccdd9a216243f498ff05ee72fe1512c769176a3f22e43bfbb
+  metadata.gz: c2006e7dbef28ac026b4cfda4babbe68809b96700a66b4e106d5e8ede0bd18c8c580d1a38f94f1dea737bd1bf0125906608ac4c91900f9436b4e0c4b15eff979
+  data.tar.gz: 39938ef9de395d7bc988ecbe3a916aabd86e8da5f49bb662edf06c53c20fdbaaf03d789aeed4c9580ad9f62354dee4dea911619cf0816f298f320ca51b5566c6

data/lib/vetra/cli.rb

@@ -6,20 +6,35 @@ module Vetra
     def self.run(arguments, out: $stdout, err: $stderr)
       options = { root: Dir.pwd, sources: false, format: nil, fail_on_breaking: false }
       parser = OptionParser.new do |flags|
-        flags.banner = "Uso: vetra graph:build|graph:check|graph:link [--root diretório]\n     vetra graph:validate [arquivo] [--root diretório] [--sources]\n     vetra graph:diff ANTERIOR POSTERIOR [--root diretório] [--format text|json] [--fail-on-breaking]"
+        flags.banner = "Uso: vetra graph:build|graph:check|graph:link [--root diretório]\n     vetra graph:validate [arquivo] [--root diretório] [--sources]\n     vetra graph:diff ANTERIOR POSTERIOR [--root diretório] [--format text|json] [--fail-on-breaking]\n     vetra db:authz:sql [--root diretório] [--sql-schema nome] [--owner-role nome] [--app-role nome]"
         flags.on('--root PATH', 'Raiz da aplicação') { |value| options[:root] = value }
         flags.on('--sources', 'Também verificar manifesto em graph:validate') { options[:sources] = true }
         flags.on('--format FORMAT', %w[text json], 'Formato de graph:diff: text ou json') { |value| options[:format] = value }
         flags.on('--fail-on-breaking', 'Sair com código 3 se o diff apontar quebra potencial') { options[:fail_on_breaking] = true }
+        flags.on('--sql-schema NAME', 'Schema novo do SQL de revisão de autorização') { |value| options[:schema] = value }
+        flags.on('--owner-role NAME', 'Papel proprietário já existente') { |value| options[:owner_role] = value }
+        flags.on('--app-role NAME', 'Papel da aplicação já existente') { |value| options[:app_role] = value }
         flags.on('-h', '--help', 'Mostrar ajuda') { out.puts(flags); return 0 }
         flags.on('--version', 'Mostrar versão do protótipo') { out.puts(VERSION); return 0 }
       end
       args = parser.parse(arguments.dup)
       command = args.shift
-      unless %w[graph:build graph:check graph:validate graph:diff graph:link].include?(command)
+      unless %w[graph:build graph:check graph:validate graph:diff graph:link db:authz:sql].include?(command)
         err.puts(parser)
         return 2
       end
+      sql_options = options.slice(:schema, :owner_role, :app_role)
+      if command == 'db:authz:sql'
+        unless args.empty? && !options[:sources] && !options[:format] && !options[:fail_on_breaking]
+          raise OptionParser::InvalidArgument, 'db:authz:sql aceita somente --root e opções de schema/papéis'
+        end
+        result = Graph::Compiler.new(root: options[:root]).read_artifact
+        generated = SQL::Authorization.new(result.document, **sql_options).generate
+        generated.warnings.each { |diagnostic| err.puts(diagnostic) }
+        out.write(generated.sql)
+        return 0
+      end
+      raise OptionParser::InvalidArgument, 'opções de SQL exigem db:authz:sql' unless sql_options.empty?
       if command == 'graph:diff'
         raise OptionParser::InvalidArgument, 'graph:diff exige duas entradas e não aceita --sources' unless args.size == 2 && !options[:sources]
         source = Graph::DiffSource.new(root: options[:root])

data/lib/vetra/graph/compiler.rb

@@ -65,10 +65,10 @@ module Vetra
         root.join('.vetra/graph.json')
       end
 
-      def link
+      def read_artifact
         bytes = artifact_bytes
         document = Canonical.parse(bytes)
-        Validator.new.validate!(document)
+        warnings = Validator.new.validate!(document)
         unless bytes == "#{Canonical.dump(document)}\n"
           raise Error.single('graph_not_canonical', 'O artefato deve usar JSON canônico seguido de LF; execute graph:build no pipeline.')
         end
@@ -78,7 +78,16 @@ module Vetra
         end
         manifest = Manifest.new(root)
         manifest.verify!(document)
-        Data.freeze(document)
+        unless artifact_bytes == bytes
+          raise Error.single('graph_changed', 'O artefato mudou durante a leitura; use um pacote imutável.')
+        end
+        Data.freeze(Result.new(document: document, warnings: warnings, implementation_ids: []))
+      end
+
+      def link
+        result = read_artifact
+        document, bytes = result.document, result.bytes
+        manifest = Manifest.new(root)
 
         # Registration is needed to recreate Ruby closures in this process. The
         # normalized declaration is an audit only: it never replaces the artifact.

data/lib/vetra/sql/authorization.rb

@@ -0,0 +1,192 @@
+require 'digest'
+
+module Vetra
+  module SQL
+    class Authorization
+      Result = Struct.new(:sql, :tables, :warnings, keyword_init: true)
+
+      def initialize(document, schema: 'vetra', owner_role: 'vetra_owner', app_role: 'vetra_app')
+        @document = Graph::Data.copy(document)
+        @schema, @owner, @app = schema, owner_role, app_role
+      end
+
+      def generate
+        warnings = Graph::Validator.new.validate!(@document)
+        [@schema, @owner, @app].each { |name| identifier!(name) }
+        if @owner == @app || @schema.start_with?('pg_') || @schema == 'information_schema'
+          raise Graph::Error.single('authz_roles', 'Use papéis distintos e um schema de infraestrutura fora dos schemas reservados.')
+        end
+        tenant = @document.dig('app', 'tenant', 'entity', 'id')
+        raise Graph::Error.single('authz_tenant', 'O bootstrap de revisão exige tenant explícito; aplicações globais ainda não são suportadas.', pointer: '/app/tenant') unless tenant
+        entities = @document['nodes'].select { |node| node['kind'] == 'entity' }.to_h { |node| [node['id'], node] }
+        @root = entities.fetch(tenant)
+        ids = [tenant] + @document['nodes'].select { |node| node['kind'] == 'policy' }.flat_map { |node| node['reads'].map { |ref| ref['id'] } }
+        tables = ids.uniq.sort.map do |id|
+          entity = entities.fetch(id)
+          column = if id == tenant
+            'id'
+          elsif entity.dig('tenant', 'entity', 'id') == tenant
+            entity.dig('tenant', 'field')
+          end
+          unless column
+            raise Graph::Error.single('authz_scope', "#{id} é uma dependência global de autorização; falta definir sua chave de revisão.", source: entity['source'])
+          end
+          storage = entity['storage']
+          [storage['schema'], storage['table'], column].each { |name| identifier!(name) }
+          { 'entity' => id, 'schema' => storage['schema'], 'table' => storage['table'], 'tenant_column' => column }
+        end
+        if @root.dig('storage', 'primary_key') != ['id'] || tables.any? { |table| table['schema'] == @schema } || tables.map { |table| table.values_at('schema', 'table') }.uniq.size != tables.size
+          raise Graph::Error.single('authz_storage', 'Use raiz com PK id, tabelas físicas distintas e schema de infraestrutura separado das tabelas da aplicação.')
+        end
+        @tables = tables.sort_by { |table| table.values_at('schema', 'table') }
+        sql = [header, 'BEGIN;', "SET LOCAL lock_timeout = '3s';", 'SET LOCAL search_path = pg_catalog, pg_temp;', role_guards,
+               "LOCK TABLE #{@tables.map { |table| "ONLY #{relation(table)}" }.join(', ')} IN SHARE ROW EXCLUSIVE MODE;",
+               storage_guards, infrastructure, *@tables.map { |table| triggers(table) }, privilege_guards,
+               "-- Varredura da raiz do tenant para preencher revisões iniciais.",
+               "INSERT INTO #{revisions} (tenant_id, revision) SELECT #{quote('id')}::text, 0 FROM #{root_relation};", 'COMMIT;', ''].join("\n")
+        Graph::Data.freeze(Result.new(sql: sql, tables: @tables, warnings: warnings))
+      end
+
+      private
+
+      def identifier!(name)
+        unless name.is_a?(String) && name.match?(/\A[a-z][a-z0-9_]*\z/) && name.bytesize <= 63
+          raise Graph::Error.single('authz_identifier', 'Identificadores SQL exigem letras minúsculas, números ou sublinhado, começam por letra e têm até 63 bytes.')
+        end
+      end
+
+      def quote(name)
+        %Q{"#{name}"}
+      end
+
+      def literal(value)
+        "'#{value.gsub("'", "''")}'"
+      end
+
+      def relation(table)
+        "#{quote(table['schema'])}.#{quote(table['table'])}"
+      end
+
+      def root_relation
+        relation(@root['storage'])
+      end
+
+      def revisions
+        "#{quote(@schema)}.#{quote('authz_revisions')}"
+      end
+
+      def header
+        (["-- Vetra: bootstrap de revisão de autorização; SQL para revisão, sem aplicação automática.",
+          "-- Grafo #{@document['digest']}; aplicação #{JSON.generate(@document.dig('app', 'name'))}.",
+          '-- Requer PostgreSQL 17+, tabelas existentes, papéis existentes e schema de infraestrutura novo.',
+          '-- Instalação: bloqueia escritas com SHARE ROW EXCLUSIVE; lock_timeout = 3s; lê os IDs da raiz.'] +
+          @tables.map { |table| "-- #{table['entity']}: #{relation(table)}; tenant pela coluna #{quote(table['tenant_column'])}." }).join("\n")
+      end
+
+      def role_guards
+        <<~SQL
+          DO $vetra_roles$
+          BEGIN
+            IF current_setting('server_version_num')::integer < 170000 THEN
+              RAISE EXCEPTION 'Vetra exige PostgreSQL 17 ou superior';
+            END IF;
+            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = #{literal(@owner)} AND NOT rolcanlogin AND NOT rolsuper AND NOT rolbypassrls AND NOT rolcreaterole) THEN
+              RAISE EXCEPTION 'Proprietário deve existir, sem LOGIN, SUPERUSER, BYPASSRLS ou CREATEROLE';
+            END IF;
+            IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = #{literal(@app)} AND NOT rolsuper AND NOT rolbypassrls AND NOT rolcreaterole) THEN
+              RAISE EXCEPTION 'Aplicação deve existir, sem SUPERUSER, BYPASSRLS ou CREATEROLE';
+            END IF;
+            IF pg_has_role(#{literal(@app)}, #{literal(@owner)}, 'MEMBER') THEN
+              RAISE EXCEPTION 'Aplicação não pode pertencer ao papel proprietário';
+            END IF;
+          END $vetra_roles$;
+        SQL
+      end
+
+      def storage_guards
+        checks = @tables.map do |table|
+          path = literal(relation(table))
+          column = literal(table['tenant_column'])
+          <<~SQL
+            IF NOT EXISTS (SELECT 1 FROM pg_class WHERE oid = #{path}::regclass AND relkind = 'r' AND NOT relispartition)
+               OR EXISTS (SELECT 1 FROM pg_inherits WHERE inhrelid = #{path}::regclass OR inhparent = #{path}::regclass) THEN
+              RAISE EXCEPTION 'Tabelas particionadas ou herdadas não são suportadas: %', #{path};
+            END IF;
+            IF NOT EXISTS (SELECT 1 FROM pg_attribute a JOIN pg_attribute root ON root.attrelid = #{literal(root_relation)}::regclass AND root.attname = 'id'
+              WHERE a.attrelid = #{path}::regclass AND a.attname = #{column} AND NOT a.attisdropped AND NOT root.attisdropped
+                AND a.attnotnull AND root.attnotnull AND a.atttypid = root.atttypid AND a.atttypmod = root.atttypmod
+                AND root.atttypid IN ('uuid'::regtype, 'text'::regtype, 'varchar'::regtype, 'bpchar'::regtype, 'int2'::regtype, 'int4'::regtype, 'int8'::regtype)) THEN
+              RAISE EXCEPTION 'Coluna de tenant ausente, nula ou de tipo incompatível: %.%', #{path}, #{column};
+            END IF;
+            IF EXISTS (SELECT 1 FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE c.oid = #{path}::regclass
+              AND (pg_has_role(#{literal(@app)}, c.relowner, 'MEMBER') OR pg_has_role(#{literal(@app)}, n.nspowner, 'MEMBER'))) THEN
+              RAISE EXCEPTION 'Aplicação não pode possuir tabela protegida ou seu schema: %', #{path};
+            END IF;
+          SQL
+        end
+        <<~SQL
+          DO $vetra_tables$
+          BEGIN
+            IF NOT EXISTS (SELECT 1 FROM pg_index i JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attname = 'id'
+              WHERE i.indrelid = #{literal(root_relation)}::regclass AND i.indisprimary AND i.indnatts = 1 AND i.indkey[0] = a.attnum) THEN
+              RAISE EXCEPTION 'Raiz do tenant deve ter chave primária simples em id';
+            END IF;
+          #{checks.join}
+          END $vetra_tables$;
+        SQL
+      end
+
+      def infrastructure
+        <<~SQL
+          CREATE SCHEMA #{quote(@schema)} AUTHORIZATION #{quote(@owner)};
+          CREATE TABLE #{revisions} (tenant_id text PRIMARY KEY, revision bigint NOT NULL CHECK (revision >= 0));
+          ALTER TABLE #{revisions} OWNER TO #{quote(@owner)};
+          REVOKE ALL ON #{revisions} FROM PUBLIC, #{quote(@app)};
+          GRANT USAGE ON SCHEMA #{quote(@schema)} TO #{quote(@app)};
+          GRANT SELECT ON #{revisions} TO #{quote(@app)};
+        SQL
+      end
+
+      def triggers(table)
+        suffix = Digest::SHA256.hexdigest([@document.dig('app', 'name'), table['entity']].join("\0"))[0, 24]
+        column = quote(table['tenant_column'])
+        {
+          'insert' => ['NEW TABLE AS vt_new', "SELECT DISTINCT #{column}::text AS tenant_id FROM vt_new ORDER BY tenant_id"],
+          'delete' => ['OLD TABLE AS vt_old', "SELECT DISTINCT #{column}::text AS tenant_id FROM vt_old ORDER BY tenant_id"],
+          'update' => ['OLD TABLE AS vt_old NEW TABLE AS vt_new', "SELECT #{column}::text AS tenant_id FROM vt_old UNION SELECT #{column}::text AS tenant_id FROM vt_new ORDER BY tenant_id"]
+        }.map do |event, (references, tenants)|
+          name = quote("vt_authz_#{suffix}_#{event}")
+          function = "#{quote(@schema)}.#{name}"
+          <<~SQL
+            CREATE FUNCTION #{function}() RETURNS trigger LANGUAGE plpgsql
+              SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $vetra_authz$
+            DECLARE affected_tenant text;
+            BEGIN
+              FOR affected_tenant IN #{tenants} LOOP
+                INSERT INTO #{revisions} AS stored (tenant_id, revision) VALUES (affected_tenant, 1)
+                  ON CONFLICT (tenant_id) DO UPDATE SET revision = stored.revision + 1;
+                PERFORM pg_notify('vetra_authz', affected_tenant);
+              END LOOP;
+              RETURN NULL;
+            END $vetra_authz$;
+            ALTER FUNCTION #{function}() OWNER TO #{quote(@owner)};
+            REVOKE ALL ON FUNCTION #{function}() FROM PUBLIC, #{quote(@app)};
+            CREATE TRIGGER #{name} AFTER #{event.upcase} ON #{relation(table)}
+              REFERENCING #{references} FOR EACH STATEMENT EXECUTE FUNCTION #{function}();
+          SQL
+        end.join + "REVOKE TRUNCATE, TRIGGER ON #{relation(table)} FROM PUBLIC, #{quote(@app)};\n"
+      end
+
+      def privilege_guards
+        checks = @tables.map do |table|
+          <<~SQL
+            IF has_table_privilege(#{literal(@app)}, #{literal(relation(table))}, 'TRUNCATE,TRIGGER') THEN
+              RAISE EXCEPTION 'Privilégios herdados de TRUNCATE/TRIGGER ainda permitem alterar a invalidação';
+            END IF;
+          SQL
+        end
+        "DO $vetra_privileges$\nBEGIN\n#{checks.join}END $vetra_privileges$;\n"
+      end
+    end
+  end
+end

data/lib/vetra/version.rb

@@ -1,3 +1,3 @@
 module Vetra
-  VERSION = "0.1.0-alpha.4"
+  VERSION = "0.1.0-alpha.5"
 end

data/lib/vetra.rb

@@ -18,6 +18,7 @@ require_relative "vetra/graph/linker"
 require_relative "vetra/graph/compiler"
 require_relative "vetra/graph/diff_source"
 require_relative "vetra/graph/diff"
+require_relative "vetra/sql/authorization"
 
 module Vetra
   def self.app(name, &block)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vetra
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.alpha.4
+  version: 0.1.0.pre.alpha.5
 platform: ruby
 authors:
 - Denilson Silva
@@ -85,6 +85,11 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '13.2'
+description: Protótipo da fase 0 do Vetra, um framework web para Ruby 4 e PostgreSQL
+  que descreve a aplicação como um grafo verificável. Compila o DSL de entidades,
+  comandos, consultas, permissões e eventos numa IR versionada, valida o artefato,
+  compara versões e vincula os blocos Ruby. Ainda não executa operações nem serve
+  HTTP.
 executables:
 - vetra
 extensions: []
@@ -117,10 +122,16 @@ files:
 - lib/vetra/graph/registry.rb
 - lib/vetra/graph/schema.rb
 - lib/vetra/graph/validator.rb
+- lib/vetra/sql/authorization.rb
 - lib/vetra/version.rb
+homepage: https://github.com/vetra-framework/vetra
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/vetra-framework/vetra
+  documentation_uri: https://github.com/vetra-framework/vetra/blob/main/docs/fase-0.md
+  bug_tracker_uri: https://github.com/vetra-framework/vetra/issues
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib