warrant 0.1.3 → 1.0.0

data/lib/warrant/models/warrant.rb

@@ -2,14 +2,224 @@
 
 module Warrant
     class Warrant
-        attr_reader :id, :object_type, :object_id, :relation, :user
+        attr_reader :id, :object_type, :object_id, :relation, :subject
 
-        def initialize(id, object_type, object_id, relation, user)
-            @id = id
+        # @!visibility private
+        def initialize(object_type, object_id, relation, subject)
             @object_type = object_type
             @object_id = object_id
             @relation = relation
-            @user = Userset.new(user['objectType'], user['objectId'], user['relation'])
+            @subject = subject
+        end
+
+        # Create a new warrant that associates an object (object_type and object_id) to a subject via a relation.
+        #
+        # @option params [String] :object_type The type of object. Must be one of your system's existing object types.
+        # @option params [String] :object_id The id of the specific object.
+        # @option params [String] :relation The relation for this object to subject association. The relation must be valid as per the object type definition.
+        # @option params [Hash] :subject The specific subject (object, user etc.) to be associated with the object. A subject can either be a specific object (by id) or a group of objects defined by a set containing an objectType, objectId and relation.
+        #   * :object_type (String) - The type of object. Must be one of your system's existing object types.
+        #   * :object_id (String) - The id of the specific object.
+        #   * :relation (String) - The relation for this object to subject association. The relation must be valid as per the object type definition. (optional)
+        #
+        # @return [Warrant] created warrant
+        #
+        # @raise [Warrant::DuplicateRecordError]
+        # @raise [Warrant::InternalError]
+        # @raise [Warrant::InvalidParameterError]
+        # @raise [Warrant::InvalidRequestError]
+        # @raise [Warrant::MissingRequiredParameterError]
+        # @raise [Warrant::NotFoundError]
+        # @raise [Warrant::UnauthorizedError]
+        # @raise [Warrant::WarrantError]
+        def self.create(params = {})
+            res = APIOperations.post(URI.parse("#{::Warrant.config.api_base}/v1/warrants"), Util.normalize_params(params))
+            res_json = JSON.parse(res.body)
+
+            case res
+            when Net::HTTPSuccess
+                subject = Subject.new(res_json['subject']['objectType'], res_json['subject']['objectId'])
+                Warrant.new(res_json['objectType'], res_json['objectId'], res_json['relation'], subject)
+            else
+                APIOperations.raise_error(res)
+            end
+        end
+
+        # Deletes a warrant specified by the combination of object_type, object_id, relation, and subject.
+        #
+        # @option params [String] :object_type The type of object. Must be one of your system's existing object types.
+        # @option params [String] :object_id The id of the specific object.
+        # @option params [String] :relation The relation for this object to subject association. The relation must be valid as per the object type definition.
+        # @option params [Hash] :subject The specific subject (object, user etc.) to be associated with the object. A subject can either be a specific object (by id) or a group of objects defined by a set containing an objectType, objectId and relation.
+        #   * :object_type [String] The type of object. Must be one of your system's existing object types.
+        #   * :object_id [String] The id of the specific object.
+        #   * :relation [String] The relation for this object to subject association. The relation must be valid as per the object type definition. (optional)
+        #
+        # @return [nil] if delete was successful
+        #
+        # @raise [Warrant::InternalError]
+        # @raise [Warrant::InvalidParameterError]
+        # @raise [Warrant::InvalidRequestError]
+        # @raise [Warrant::MissingRequiredParameterError]
+        # @raise [Warrant::NotFoundError]
+        # @raise [Warrant::UnauthorizedError]
+        # @raise [Warrant::WarrantError]
+        def self.delete(params = {})
+            res = APIOperations.delete(URI.parse("#{::Warrant.config.api_base}/v1/warrants"), Util.normalize_params(params))
+
+            case res
+            when Net::HTTPSuccess
+                return
+            else
+                APIOperations.raise_error(res)
+            end
+        end
+
+        # List all warrants for your organization.
+        #
+        # @option filters [String] :object_type The type of object. Must be one of your system's existing object types. (optional)
+        # @option filters [String] :object_id The id of the specific object. (optional)
+        # @option filters [String] :relation The relation for this object to subject association. The relation must be valid as per the object type definition. (optional)
+        #
+        # @return [Array<Warrant>] list of all warrants with provided filters
+        #
+        # @raise [Warrant::InternalError]
+        # @raise [Warrant::InvalidRequestError]
+        # @raise [Warrant::NotFoundError]
+        # @raise [Warrant::UnauthorizedError]
+        # @raise [Warrant::WarrantError]
+        def self.list(filters = {})
+            res = APIOperations.get(URI.parse("#{::Warrant.config.api_base}/v1/warrants"), filters)
+
+            case res
+            when Net::HTTPSuccess
+                warrants = JSON.parse(res.body)
+                warrants.map{ |warrant|
+                    subject = Subject.new(warrant['subject']['objectType'], warrant['subject']['objectId'])
+                    Warrant.new(warrant['objectType'], warrant['objectId'], warrant['relation'], subject)
+                }
+            else
+                APIOperations.raise_error(res)
+            end
+        end
+
+        # Checks whether a specified access check is authorized or not.
+        # If you would like to check only one warrant, then you can exclude the op param and provide an array with one warrant.
+        #
+        # @param op [String] Logical operator to perform on warrants. Can be 'anyOf' or 'allOf'. (optional)
+        # @param warrants [Array] Array of warrants to check access for.
+        #   * object_type (String) - The type of object. Must be one of your system's existing object types.
+        #   * object_id (String) - The id of the specific object.
+        #   * relation (String) - The relation to check for this object to subject association. The relation must be valid as per the object type definition.
+        #   * subject (Hash) - The specific subject for which access will be checked. Can be a specific object by id or an objectType, objectId and relation set.
+        #       * object_type (String) - The type of object. Must be one of your system's existing object types.
+        #       * object_id (String) - The id of the specific object.
+        #       * relation (String) - The relation for this object to subject association. The relation must be valid as per the object type definition. (optional)
+        # @param consistentRead [Boolean] Boolean flag indicating whether or not to enforce strict consistency for this access check. Defaults to false. (optional)
+        # @param debug [Boolean] Boolean flag indicating whether or not to return debug information for this access check. Defaults to false. (optional)
+        #
+        # @return [Boolean] whether or not the given access check is authorized
+        #
+        # @example Check whether user "5djfs6" can view the report with id "avk2837"
+        #   Warrant::Warrant.is_authorized?(warrants: [{ object_type: "report", object_id: "avk2837", relation: "viewer", subject: { object_type: "user", object_id: "5djfs6" } }])
+        #
+        # @example Check whether user "5djfs6" can view both report id "report-1" and report id "report-2"
+        #   Warrant::Warrant.is_authorized?(
+        #       op: "allOf",
+        #       warrants: [
+        #           { object_type: "report", object_id: "report-1", relation: "viewer", subject: { object_type: "user", object_id: "5djfs6" } }
+        #           { object_type: "report", object_id: "report-2", relation: "viewer", subject: { object_type: "user", object_id: "5djfs6" } }
+        #       ]
+        #   )
+        #
+        # @raise [Warrant::InternalError]
+        # @raise [Warrant::InvalidParameterError]
+        # @raise [Warrant::InvalidRequestError]
+        # @raise [Warrant::MissingRequiredParameterError]
+        # @raise [Warrant::NotFoundError]
+        # @raise [Warrant::UnauthorizedError]
+        # @raise [Warrant::WarrantError]
+        def self.is_authorized?(params = {})
+            unless ::Warrant.config.authorize_endpoint.nil?
+                return edge_authorize?(params)
+            end
+
+            return authorize?(params)
+        end
+
+        # Checks whether a given user has a given permission.
+        #
+        # @param user_id [String] Id of the user to check
+        # @param permission_id [String] Id of the permission to check on the user
+        # @param consistentRead [Boolean] Boolean flag indicating whether or not to enforce strict consistency for this access check. Defaults to false. (optional)
+        # @param debug [Boolean] Boolean flag indicating whether or not to return debug information for this access check. Defaults to false. (optional)
+        #
+        # @return [Boolean] whether or not the user has the given permission
+        #
+        # @raise [Warrant::InternalError]
+        # @raise [Warrant::InvalidParameterError]
+        # @raise [Warrant::InvalidRequestError]
+        # @raise [Warrant::MissingRequiredParameterError]
+        # @raise [Warrant::NotFoundError]
+        # @raise [Warrant::UnauthorizedError]
+        # @raise [Warrant::WarrantError]
+        def self.user_has_permission?(params = {})
+            return is_authorized?(
+                warrants: [{
+                    object_type: "permission",
+                    object_id: params[:permission_id],
+                    relation: "member",
+                    subject: {
+                        object_type: "user",
+                        object_id: params[:user_id]
+                    }
+                }],
+                consistentRead: params[:consistentRead],
+                debug: params[:debug]
+            )
+        end
+
+        private
+
+        def self.authorize?(params = {})
+            res = APIOperations.post(URI.parse("#{::Warrant.config.api_base}/v2/authorize"), Util.normalize_params(params))
+            res_json = JSON.parse(res.body)
+
+            case res
+            when Net::HTTPSuccess
+                if res_json['result'] === "Authorized"
+                    return true
+                elsif res_json['result'] === "Not Authorized"
+                    return false
+                else
+                    return res_json
+                end
+            else
+                APIOperations.raise_error(res)
+            end
+        end
+
+        def self.edge_authorize?(params = {})
+            request_url = URI.parse("#{::Warrant.config.authorize_endpoint}/v2/authorize")
+            res = APIOperations.post(request_url, Util.normalize_params(params), request_url.scheme === "https")
+            res_json = JSON.parse(res.body)
+
+            case res
+            when Net::HTTPSuccess
+                if res_json['result'] === "Authorized"
+                    return true
+                elsif res_json['result'] === "Not Authorized"
+                    return false
+                else
+                    return res_json
+                end
+            else
+                if res_json['code'] === "cache_not_ready"
+                    return authorize(params)
+                end
+
+                APIOperations.raise_error(res)
+            end
         end
     end
 end

data/lib/warrant/util.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 module Warrant
+    # @!visibility private
     class Util
         class << self
             def camelcase(str)
@@ -8,6 +9,12 @@ module Warrant
                 str.sub(str[0], str[0].downcase)
             end
 
+            def snake_case(str)
+                str.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+                    .gsub(/([a-z\d])([A-Z])/, '\1_\2')
+                    .downcase
+            end
+
             def normalize_options(opts)
                 new_opts = opts.each_with_object({}) do |(k, v), new_opts|
                     new_key = Util.camelcase(k.to_s)
@@ -15,6 +22,21 @@ module Warrant
                     new_opts[new_key] = v
                 end
             end
+
+            def normalize_params(params)
+                new_opts = params.each_with_object({}) do |(k, v), new_opts|
+                    new_key = Util.camelcase(k.to_s)
+
+                    case v
+                    when Hash
+                        new_opts[new_key] = normalize_params(v)
+                    when Array
+                        new_opts[new_key] = v.map { |i| normalize_params(i) }
+                    else
+                        new_opts[new_key] = v
+                    end
+                end
+            end
         end
     end
 end

data/lib/warrant/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Warrant
-  VERSION = "0.1.3"
+  VERSION = "1.0.0"
 end

data/lib/warrant/warrant_configuration.rb

@@ -1,13 +1,16 @@
 # frozen_string_literal: true
 
 module Warrant
+    # @!visibility private
     class WarrantConfiguration
         attr_accessor :api_key
+        attr_accessor :authorize_endpoint
 
-        attr_reader :api_base
+        attr_reader :api_base, :self_service_dash_url_base
 
         def initialize
             @api_base = "https://api.warrant.dev"
+            @self_service_dash_url_base = "https://self-serve.warrant.dev"
         end
     end
 end

data/lib/warrant.rb

@@ -6,15 +6,17 @@ require "net/http"
 require "json"
 require "forwardable"
 
+require "warrant/api_operations"
+require "warrant/errors"
 require "warrant/models/permission"
 require "warrant/models/role"
+require "warrant/models/session"
+require "warrant/models/subject"
 require "warrant/models/tenant"
 require "warrant/models/user"
-require "warrant/models/userset"
 require "warrant/models/warrant"
 require "warrant/util"
 require "warrant/warrant_configuration"
-require "warrant/warrant_client"
 
 module Warrant
     @config = ::Warrant::WarrantConfiguration.new
@@ -24,6 +26,6 @@ module Warrant
 
         attr_reader :config
 
-        def_delegators :@config, :api_key, :api_key=
+        def_delegators :@config, :api_key, :api_key=, :authorize_endpoint, :authorize_endpoint=
     end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: warrant
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 1.0.0
 platform: ruby
 authors:
 - Warrant
-autorequire:
+autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-05-09 00:00:00.000000000 Z
+date: 2022-07-14 00:00:00.000000000 Z
 dependencies: []
 description: Ruby library for the Warrant API at https://warrant.dev.
 email: hello@warrant.dev
@@ -26,15 +26,17 @@ files:
 - bin/console
 - bin/setup
 - lib/warrant.rb
+- lib/warrant/api_operations.rb
+- lib/warrant/errors.rb
 - lib/warrant/models/permission.rb
 - lib/warrant/models/role.rb
+- lib/warrant/models/session.rb
+- lib/warrant/models/subject.rb
 - lib/warrant/models/tenant.rb
 - lib/warrant/models/user.rb
-- lib/warrant/models/userset.rb
 - lib/warrant/models/warrant.rb
 - lib/warrant/util.rb
 - lib/warrant/version.rb
-- lib/warrant/warrant_client.rb
 - lib/warrant/warrant_configuration.rb
 homepage: https://github.com/warrant-dev/warrant-ruby
 licenses:
@@ -44,7 +46,7 @@ metadata:
   source_code_uri: https://github.com/warrant-dev/warrant-ruby
   changelog_uri: https://github.com/warrant-dev/warrant-ruby/CHANGELOG.md
   documentation_uri: https://docs.warrant.dev/
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -59,8 +61,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.11
-signing_key:
+rubygems_version: 3.2.14
+signing_key: 
 specification_version: 4
 summary: Warrant Ruby Library
 test_files: []

data/lib/warrant/warrant_client.rb

@@ -1,285 +0,0 @@
-# frozen_string_literal: true
-
-module Warrant
-    class WarrantClient
-        class << self
-            def create_tenant(tenant_id = '')
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/tenants")
-                params = {
-                    tenantId: tenant_id
-                }
-                res = post(uri, params)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    Tenant.new(res_json['tenantId'])
-                else
-                    res_json
-                end
-            end
-
-            def create_user(email, user_id = '', tenant_id = '')
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/users")
-                params = {
-                    tenantId: tenant_id,
-                    userId: user_id,
-                    email: email
-                }
-                res = post(uri, params)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    User.new(res_json['tenantId'], res_json['userId'], res_json['email'])
-                else
-                    res_json
-                end
-            end
-
-            def create_role(role_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/roles")
-                params = {
-                    roleId: role_id
-                }
-                res = post(uri, params)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    Role.new(res_json['roleId'])
-                else
-                    res_json
-                end
-            end
-
-            def delete_role(role_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/roles/#{role_id}")
-                res = delete(uri)
-
-                case res
-                when Net::HTTPSuccess
-                    return
-                else
-                    res_json
-                end
-            end
-
-            def create_permission(permission_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/permissions")
-                params = {
-                    permissionId: permission_id
-                }
-                res = post(uri, params)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    Permission.new(res_json['permissionId'])
-                else
-                    res_json
-                end
-            end
-
-            def delete_permission(permission_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/permissions/#{permission_id}")
-                res = delete(uri)
-
-                case res
-                when Net::HTTPSuccess
-                    return
-                else
-                    res_json
-                end
-            end
-
-            def create_warrant(object_type, object_id, relation, user)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/warrants")
-                params = {
-                    objectType: object_type,
-                    objectId: object_id,
-                    relation: relation,
-                    user: user
-                }
-                res = post(uri, params)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    Warrant.new(res_json['id'], res_json['objectType'], res_json['objectId'], res_json['relation'], res_json['user'])
-                else
-                    res_json
-                end
-            end
-
-            def delete_warrant(warrant_id)
-                uri = URI.parse("#{Warrant.config.api_base}/v1/warrants/#{warrant_id}")
-                res = delete(uri)
-
-                case res
-                when Net::HTTPSuccess
-                    return
-                else
-                    res_json
-                end
-            end
-
-            def list_warrants(filters = {})
-                query_string = ""
-                unless filters.empty?
-                    new_filters = Util.normalize_options(filters.compact)
-
-                    query_string = URI.encode_www_form(new_filters) 
-                end
-
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/warrants?#{query_string}")
-
-                res = get(uri)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    res_json.map do |warrant|
-                        Warrant.new(warrant['id'], warrant['objectType'], warrant['objectId'], warrant['relation'], warrant['user'])
-                    end
-                else
-                    res_json
-                end
-            end
-
-            def assign_role_to_user(user_id, role_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/users/#{user_id}/roles/#{role_id}")
-                res = post(uri)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    Role.new(res_json['roleId'])
-                else
-                    res_json
-                end
-            end
-
-            def remove_role_from_user(user_id, role_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/users/#{user_id}/roles/#{role_id}")
-                res = delete(uri)
-
-                case res
-                when Net::HTTPSuccess
-                    return
-                else
-                    res_json
-                end
-            end
-
-            def assign_permission_to_user(user_id, permission_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/users/#{user_id}/permissions/#{permission_id}")
-                res = post(uri)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    Permission.new(res_json['permissionId'])
-                else
-                    res_json
-                end
-            end
-
-            def remove_permission_from_user(user_id, permission_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/users/#{user_id}/permissions/#{permission_id}")
-                res = delete(uri)
-
-                case res
-                when Net::HTTPSuccess
-                    return
-                else
-                    res_json
-                end
-            end
-
-            def create_session(user_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/users/#{user_id}/sessions")
-                res = post(uri)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    res_json['token']
-                else
-                    res_json
-                end
-            end
-
-            def create_self_service_session(user_id, redirect_url)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/sessions")
-                params = {
-                    type: "ssdash",
-                    userId: user_id,
-                    redirectUrl: redirect_url
-                }
-                res = post(uri, params)
-                res_json = JSON.parse(res.body)
-
-                case res
-                when Net::HTTPSuccess
-                    res_json['url']
-                else
-                    res_json
-                end
-            end
-
-            def is_authorized(object_type, object_id, relation, user_id)
-                uri = URI.parse("#{::Warrant.config.api_base}/v1/authorize")
-                params = {
-                    objectType: object_type,
-                    objectId: object_id,
-                    relation: relation,
-                    user: {
-                        userId: user_id
-                    }
-                }
-                res = post(uri, params)
-                res_json = JSON.parse(res.body)
-
-                if res.is_a? Net::HTTPSuccess
-                    true
-                else
-                    false
-                end
-            end
-
-            def has_permission(permission_id, user_id)
-                return is_authorized("permission", permission_id, "member", user_id)
-            end
-
-            private
-
-            def post(uri, params = {})
-                http = Net::HTTP.new(uri.host, uri.port)
-                http.use_ssl = true
-                headers = {
-                    "Authorization": "ApiKey #{::Warrant.config.api_key}"
-                }
-                http.post(uri.path, params.to_json, headers)
-            end
-
-            def delete(uri)
-                http = Net::HTTP.new(uri.host, uri.port)
-                http.use_ssl = true
-                headers = {
-                    "Authorization": "ApiKey #{::Warrant.config.api_key}"
-                }
-                http.delete(uri.path, headers)
-            end
-
-            def get(uri, params = {})
-                http = Net::HTTP.new(uri.host, uri.port)
-                http.use_ssl = true
-                headers = {
-                    "Authorization": "ApiKey #{::Warrant.config.api_key}"
-                }
-                http.get(uri, headers)
-            end
-        end
-    end
-end