rowstile 0.1.0-alpha.2 → 0.1.0-alpha.3

package/command/authzlib/__init__.py

@@ -10,7 +10,7 @@ class Compiler(TestMixin, DevMixin, OutputMixin):
     """A policy compiled: each part of the output is one of its bases (OutputMixin assembles them)."""
 
 
-__version__ = "0.1.0-alpha.2"   # set with packaging/version.py (the packages copy it); authz.policy_versions records it on each apply
+__version__ = "0.1.0-alpha.3"   # set with packaging/version.py (the packages copy it); authz.policy_versions records it on each apply
 
 
 def _build() -> str:

package/command/authzlib/base.py

@@ -182,4 +182,5 @@ GENERATED_FUNCTIONS = ("act_as", "can", "list", "perms", "perms_of", "share", "u
                        "create_api_key", "list_api_keys", "revoke_api_key", "login_key", "login_jwt", "view_as",
                        "sync_members", "changes_since", "trim_changes", "trim_audit", "request_access", "pending_requests", "decide_request",
                        "cancel_request", "break_glass", "start_review", "review_items", "review_decide",
-                       "close_review", "check_invariants", "lint", "connection_check", "explain_rule", "who_among")
+                       "close_review", "check_invariants", "lint", "connection_check", "explain_rule", "who_among",
+                       "list_links", "revoke_link")

package/command/authzlib/compiler.py

@@ -135,7 +135,7 @@ def once(items: Sequence[Expr]) -> list[Expr]:
 # for one read grows with every permission named more than once on the way (Core.expansions counts them).
 VIEW_BODY = re.compile(r'CREATE VIEW authz_int\.("(?:[^"]|"")+"|\w+) AS\n(.*?);(?=\nCREATE VIEW authz_gen|\Z)', re.S)
 VIEW_NAME = re.compile(r'authz_(?:int|gen)\.("(?:[^"]|"")+"|\w+)')
-# the policies here stay under 15; from about 70, planning a read takes a tenth of a second and more
+# the policies here stay under 25; from about 70, planning a read can take a tenth of a second and more
 MANY_EXPANSIONS = 50
 
 
@@ -1278,7 +1278,11 @@ class Core:
         header = f"-- {t.name}.{perm.name} ({perm.loc}): {perm.src}\n"
         key = self.recursive.get((t.name, perm.name))
         if key is None:
-            sql = self.set_sql(t, perm.expr, perm.loc)
+            # as the row checks do (row_sql): the permissions of its type written out in place, so a lookup
+            # another one covers is dropped. view names parent.view and, through edit, parent.edit, which
+            # parent.view includes: named as views, each would be written out again at every level above
+            items = self.prune(t, self.flat_items(t, perm, views=True))
+            sql = union([self.set_sql(t, i, perm.loc) for i in items])
         else:
             members = self.scc_members[key]
             edges = self.scc_edges(key)
@@ -1476,14 +1480,17 @@ class Core:
         return f"SELECT {rid} AS id FROM {tbl} r\n  WHERE " + "\n    AND ".join(where)
 
     # --- policies: flatten same-type permissions, drop redundant lookups ---
-    def flat_items(self, t: Type, perm: Perm, stack: tuple[Name, ...] = ()) -> list[Expr]:
+    def flat_items(self, t: Type, perm: Perm, stack: tuple[Name, ...] = (), views: bool = False) -> list[Expr]:
+        """t.perm's operands, with the permissions of its type it names written out in place. views: for the
+        permission's view, where one that inherits stays a name (its view walks a tree, which its operands
+        written out here would not)."""
         key = (t.name, perm.name)
         if key in stack:
             fail(perm.loc, f"{t.name}.{perm.name} depends on itself", "AZ302")
         out = []
         for item in self.top_items(perm):
-            if isinstance(item, Ref) and item.name in t.perms:
-                out += self.flat_items(t, t.perms[item.name], (*stack, key))
+            if isinstance(item, Ref) and item.name in t.perms and not (views and (t.name, item.name) in self.recursive):
+                out += self.flat_items(t, t.perms[item.name], (*stack, key), views)
             else:
                 out.append(item)
         return out
@@ -1507,11 +1514,14 @@ class Core:
             conds = [x for x in item.items if isinstance(x, Cond)]
             if len(arrows) == 1 and len(conds) == 1:
                 item, cond = arrows[0], conds[0].sql
-        if isinstance(item, Arrow) and item.rel in t.relations and len(t.relations[item.rel].subjects()) == 1:
+        if (isinstance(item, Arrow) and item.rel in t.relations
+                and all(not sr for _, sr in t.relations[item.rel].subjects())):
             return (item.rel, item.perm, cond)
         return None
 
     def prune(self, t: Type, items: list[Expr]) -> list[Expr]:
+        """items (the operands of an or) without those said twice, and without a lookup another one covers:
+        parent.edit beside parent.view, when view includes edit on every type parent points at (reach)."""
         keep = []
         for i, item in enumerate(items):
             if item in items[:i]:
@@ -1519,12 +1529,17 @@ class Core:
             ki = self.lookup_key(t, item)
             covered = False
             if ki:
-                target = self.T(t.relations[ki[0]].subjects()[0][0])
+                targets = [self.T(st) for st, _ in t.relations[ki[0]].subjects()]
+
+                def within(inner: str, outer: str, targets: list[Type] = targets) -> bool:
+                    return bool(targets) and all(inner in self.reach(target, outer) for target in targets)
+
                 for j, other in enumerate(items):
                     kj = self.lookup_key(t, other)
                     if j == i or not kj or kj[0] != ki[0] or kj[2] != ki[2]:
                         continue
-                    if ki[1] in self.reach(target, kj[1]) and not (kj[1] in self.reach(target, ki[1]) and j > i):
+                    # (two that include each other say the same: the first stays)
+                    if within(ki[1], kj[1]) and not (within(kj[1], ki[1]) and j > i):
                         covered = True
                         break
             if not covered:

package/command/authzlib/devtools.py

@@ -252,6 +252,13 @@ export function authz(db: Queryable) {{
     /** A share with anyone holding the returned token (shown once; only its hash is stored). */
     createLink: async <T extends SharedType>(type: T, id: Id, relation: SharedRelation<T>, expiresAt?: Date): Promise<string> =>
       (await db.query("SELECT authz.create_link($1, $2::text, $3, $4) AS token", [type, s(id), relation, expiresAt ?? null])).rows[0].token,
+    /** The links on an object (id, relation, created_by, created_at, expires_at), for those who can share it or may
+     *  make such links. */
+    listLinks: async <T extends ObjectType>(type: T, id: Id): Promise<any[]> =>
+      (await db.query("SELECT * FROM authz.list_links($1, $2::text)", [type, s(id)])).rows,
+    /** Turns a link off, by its id in listLinks (not its token). */
+    revokeLink: async <T extends ObjectType>(type: T, id: Id, linkId: string) =>
+      db.query("SELECT authz.revoke_link($1, $2::text, $3)", [type, s(id), linkId]),
     /** Link tokens the request presents, for this transaction. */
     useLinks: async (tokens: string[]) => db.query("SELECT set_config('authz_ctx.links', $1, true)", [tokens.join(",")]),
     cancelRequest: async (requestId: Id) => db.query("SELECT authz.cancel_request($1::bigint)", [s(requestId)]),
@@ -537,6 +544,15 @@ class Authz:
             raise ValueError(f"{{type_}}.{{relation}} is not shared in the policy")
         return str(self._one("SELECT authz.create_link(%s, %s::text, %s, %s)", (type_, _id(id_), relation, expires_at)))
 
+    def list_links(self, type_: ObjectType, id_: Id) -> Sequence[Row]:
+        """The links on an object (id, relation, created_by, created_at, expires_at), for those who can share it
+        or may make such links."""
+        return self._rows("SELECT * FROM authz.list_links(%s, %s::text)", (type_, _id(id_)))
+
+    def revoke_link(self, type_: ObjectType, id_: Id, link_id: str) -> None:
+        """Turns a link off, by its id in list_links (not its token)."""
+        self._one("SELECT authz.revoke_link(%s, %s::text, %s)", (type_, _id(id_), link_id))
+
     def use_links(self, tokens: Sequence[str]) -> None:
         """Link tokens the request presents, for this transaction (SET LOCAL authz_ctx.links)."""
         self._one("SELECT set_config('authz_ctx.links', %s, true)", (",".join(tokens),))

package/command/authzlib/errors.py

@@ -553,8 +553,9 @@ CODES = {
     "AZ705": Code(
         "Not allowed",
         "The signed-in person asked an `authz.*` function for something the policy doesn't let them do: share or "
-        "unshare this object, give a role, manage roles or keys, see who has access or the shares, decide a request "
-        "or a review, break the glass. The message says what; `authz.explain(type, id, perm)` says why. Answer 403.",
+        "unshare this object, give a role, manage roles or keys, see who has access, the shares or the links, turn "
+        "a link off, decide a request or a review, break the glass. The message says what; "
+        "`authz.explain(type, id, perm)` says why. Answer 403.",
         when="runtime"),
     "AZ706": Code(
         "The policy doesn't allow this share",
@@ -571,7 +572,7 @@ CODES = {
     "AZ708": Code(
         "No such thing",
         "The call names something that isn't there: the subject to share with, an active user to view as, a "
-        "pending request, an item of a review, an API key of yours. Answer 404.",
+        "pending request, an item of a review, an API key of yours, a link on the object. Answer 404.",
         when="runtime"),
     "AZ709": Code(
         "A write refused by a rule",

package/command/authzlib/hardening.py

@@ -80,6 +80,7 @@ SELECT p.oid::regprocedure::text, gw.who, a.privilege_type,
                 "authz.unshare(text, bigint, text, text, bigint, text)",
                 "authz.unshare(text, bigint, text, text, text, text)",
                 "authz.create_link(text, text, text, timestamptz)", "authz.create_link(text, bigint, text, timestamptz)",
+                "authz.list_links(text, text)", "authz.revoke_link(text, text, text)",
                 "authz.create_role(text, text, text, text, text[])", "authz.create_role(text, bigint, text, text, text[])",
                 "authz.set_role_permissions(bigint, text[])", "authz.delete_role(bigint)", "authz.roles_of(text, text)",
                 "authz.roles_of(text, bigint)",
@@ -97,7 +98,8 @@ SELECT p.oid::regprocedure::text, gw.who, a.privilege_type,
                      "authz.review_items(bigint)",
                      "authz.review_decide(bigint, integer, boolean)", "authz.close_review(bigint, boolean)"]
         executes += [f"authz.{fn}(text, {pt}{args})" for pt in sorted({t.pktype for t in typed})
-                     for fn, args in (("who", ", text"), ("explain", ", text, text"), ("list_shares", ""))]
+                     for fn, args in (("who", ", text"), ("explain", ", text, text"), ("list_shares", ""), ("list_links", ""),
+                                      ("revoke_link", ", text"))]
         executes += [f"authz.can(text, {pt}, text)" for pt in sorted({t.pktype for t in typed})]
         executes += [f"authz.who_among(text, {pt}, text, text[], text)" for pt in sorted({t.pktype for t in typed})]
         executes += [f"authz.perms(text, {pt})" for pt in sorted({t.pktype for t in typed})]

package/command/authzlib/output.py

@@ -28,6 +28,8 @@ DEFINER = "SECURITY DEFINER SET search_path = pg_catalog, pg_temp"
 # for functions that run the policy's own SQL: the path applying vetted (search_path_sql), as views and policies resolve it
 DEFINER_FROM_CURRENT = "SECURITY DEFINER SET search_path FROM CURRENT"
 PT = "pg_catalog.current_setting('authz.principal_type', true)"   # the signed-in principal's type ('': a user)
+# a link's id, from its share g: the start of its token's hash (enough to name it among an object's links)
+LINK_ID = "left(g.subject_id, 16)"
 
 
 def subject_key(st: str, sr: str | None) -> str:
@@ -395,6 +397,13 @@ END $f$;
 CREATE TRIGGER authz_role_gone AFTER DELETE ON authz.roles
   REFERENCING OLD TABLE AS old_rows FOR EACH STATEMENT EXECUTE FUNCTION authz_int.role_gone();"""
 
+        link_columns = "id text, relation text, created_by text, created_at timestamptz, expires_at timestamptz"
+        link_overloads = "\n".join(
+            f"CREATE FUNCTION authz.list_links(p_type text, p_id {pt}) RETURNS TABLE ({link_columns}) LANGUAGE sql STABLE AS\n"
+            f"  $$ SELECT * FROM authz.list_links(p_type, p_id::text) $$;\n"
+            f"CREATE FUNCTION authz.revoke_link(p_type text, p_id {pt}, p_link text) RETURNS void LANGUAGE sql AS\n"
+            f"  $$ SELECT authz.revoke_link(p_type, p_id::text, p_link) $$;"
+            for pt in sorted({t.pktype for t in self.types.values()} - {"text"}))
         api = f"""-- Share: needs the relation's 'shared by' permission on the object, and every permission
 -- the relation grants (you can't grant more than you hold); the subject must exist
 CREATE FUNCTION authz.share(p_type text, p_id text, p_relation text,
@@ -552,6 +561,63 @@ END $f$;
 CREATE FUNCTION authz.create_link(p_type text, p_id bigint, p_relation text, p_expires_at timestamptz DEFAULT NULL)
 RETURNS text LANGUAGE sql AS $$ SELECT authz.create_link(p_type, p_id::text, p_relation, p_expires_at) $$;
 
+-- The relations whose links on an object the caller may see: every one it has links of if they may inspect it
+-- (they can share it, or are an administrator), else those they may share with a link. NULL: none
+CREATE FUNCTION authz_int.link_relations(p_type text, p_id text) RETURNS text[]
+LANGUAGE plpgsql STABLE {DEFINER} AS $f$
+BEGIN
+  IF authz_int.may_inspect(p_type, p_id) THEN
+    RETURN coalesce((SELECT array_agg(DISTINCT g.relation) FROM authz.shares g
+                     WHERE g.object_type = p_type AND g.object_id = p_id AND g.subject_type = 'link'), '{{}}');
+  END IF;
+  RETURN (SELECT array_agg(s.relation) FROM authz_int.shared_relations s
+          WHERE s.object_type = p_type AND s.subject = 'link'
+            AND authz_int.may_manage(p_type, p_id, s.relation, 'link'));
+END $f$;
+-- The links on an object: SELECT * FROM authz.list_links('folder', 3). For those who can share it, or may make
+-- such links. A link's id names it for authz.revoke_link: it is not the token, and opens nothing.
+CREATE FUNCTION authz.list_links(p_type text, p_id text)
+RETURNS TABLE (id text, relation text, created_by text, created_at timestamptz, expires_at timestamptz)
+LANGUAGE plpgsql STABLE {DEFINER} AS $f$
+DECLARE v_relations text[];
+BEGIN
+  p_id := authz_int.canon(p_type, p_id);
+  v_relations := authz_int.link_relations(p_type, p_id);
+  IF v_relations IS NULL THEN
+    RAISE EXCEPTION 'you cannot see the links of % %', p_type, p_id USING ERRCODE = 'insufficient_privilege', HINT = 'rowstile help AZ705';
+  END IF;
+  RETURN QUERY SELECT {LINK_ID}, g.relation, g.created_by, g.created_at, g.expires_at
+  FROM authz.shares g WHERE g.object_type = p_type AND g.object_id = p_id AND g.subject_type = 'link'
+    AND g.relation = ANY (v_relations) ORDER BY g.created_at, g.subject_id;
+END $f$;
+-- Turn a link off, by its id in authz.list_links: needs what unsharing it needs
+CREATE FUNCTION authz.revoke_link(p_type text, p_id text, p_link text) RETURNS void
+LANGUAGE plpgsql {DEFINER} AS $f$
+DECLARE v_relations text[]; v record; v_found boolean := false;
+BEGIN
+  PERFORM authz_int.check_writable();
+  p_id := authz_int.canon(p_type, p_id);
+  v_relations := authz_int.link_relations(p_type, p_id);
+  IF v_relations IS NULL THEN
+    RAISE EXCEPTION 'you cannot turn off the links of % %', p_type, p_id USING ERRCODE = 'insufficient_privilege', HINT = 'rowstile help AZ705';
+  END IF;
+  FOR v IN SELECT g.relation, g.subject_id FROM authz.shares g
+           WHERE g.object_type = p_type AND g.object_id = p_id AND g.subject_type = 'link'
+             AND g.relation = ANY (v_relations) AND {LINK_ID} = p_link LOOP
+    IF NOT authz_int.may_manage(p_type, p_id, v.relation, 'link') THEN
+      RAISE EXCEPTION 'you cannot turn off link % of % % (you could not unshare it)', p_link, p_type, p_id
+        USING ERRCODE = 'insufficient_privilege', HINT = 'rowstile help AZ705';
+    END IF;
+    DELETE FROM authz.shares g WHERE g.object_type = p_type AND g.object_id = p_id AND g.relation = v.relation
+      AND g.subject_type = 'link' AND g.subject_id = v.subject_id;
+    v_found := true;
+  END LOOP;
+  IF NOT v_found THEN
+    RAISE EXCEPTION 'no link % on % %', p_link, p_type, p_id USING HINT = 'rowstile help AZ708';
+  END IF;
+END $f$;
+{link_overloads}
+
 -- Custom roles: defined per owner (e.g. an org) by people with 'manage_roles' there
 CREATE FUNCTION authz.create_role(p_owner_type text, p_owner_id text, p_object_type text, p_name text,
   p_permissions text[]) RETURNS bigint LANGUAGE plpgsql {DEFINER} AS $f$

package/command/cli/pgwire.py

@@ -604,6 +604,7 @@ def _tls(sock: socket.socket, host: str, sslmode: str, sslrootcert: str | None)
         context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         context.check_hostname = False
         context.verify_mode = ssl.CERT_NONE         # encrypted, the server not checked: what require means
+    context.minimum_version = ssl.TLSVersion.TLSv1_2    # Python's default since 3.10, said for code scanners
     try:
         return context.wrap_socket(sock, server_hostname=host)
     except ssl.SSLError as e:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rowstile",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Access rules for Postgres: the rowstile command (policies compiled to row-level security, shipped as migrations), with its own Python",
   "license": "Apache-2.0",
   "repository": {
@@ -20,12 +20,12 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@rowstile/cli-linux-x64": "0.1.0-alpha.2",
-    "@rowstile/cli-linux-arm64": "0.1.0-alpha.2",
-    "@rowstile/cli-linux-x64-musl": "0.1.0-alpha.2",
-    "@rowstile/cli-linux-arm64-musl": "0.1.0-alpha.2",
-    "@rowstile/cli-darwin-x64": "0.1.0-alpha.2",
-    "@rowstile/cli-darwin-arm64": "0.1.0-alpha.2",
-    "@rowstile/cli-win32-x64": "0.1.0-alpha.2"
+    "@rowstile/cli-linux-x64": "0.1.0-alpha.3",
+    "@rowstile/cli-linux-arm64": "0.1.0-alpha.3",
+    "@rowstile/cli-linux-x64-musl": "0.1.0-alpha.3",
+    "@rowstile/cli-linux-arm64-musl": "0.1.0-alpha.3",
+    "@rowstile/cli-darwin-x64": "0.1.0-alpha.3",
+    "@rowstile/cli-darwin-arm64": "0.1.0-alpha.3",
+    "@rowstile/cli-win32-x64": "0.1.0-alpha.3"
   }
 }