Class: Json2sql::QueryPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/json2sql/query_policy.rb

Overview

children: nested hash of allowed/denied child tables with their own config. nil or absent = no restriction on children. In :deny mode: a child relation is removed only when all its columns are denied (result is empty array). parents: nested hash of allowed/denied parent tables with their own config. nil or absent = no restriction on parents. In :deny mode: same rules as children. where: server-side conditions merged into "and". Forced keys overwrite user-supplied values — primary IDOR guard.

Usage:

policy = Json2sql::QueryPolicy.new(
mode:   :allow,
tables: {
  orders: {
    columns:  %w[id total status],
    children: { order_items: { columns: %w[id price] } },
    parents:  { users: { columns: %w[id name] } },
    where:    { "and" => { "user_id" => 42 } }
  }
}
)
safe_input = policy.apply(raw_params)
sql = Json2sql::SelectRunner.build(safe_input)

Instance Method Summary collapse

Constructor Details

#initialize(mode: :allow, tables: {}) ⇒ QueryPolicy

Returns a new instance of QueryPolicy.



45
46
47
48
49
50
 
# File 'lib/json2sql/query_policy.rb', line 45

def initialize(mode: :allow, tables: {})

  @mode = mode

  @tables = Json2sql.normalize(tables)
end

Instance Method Details

#apply(input) ⇒ Object

Returns a sanitized copy of input ready to pass to any Runner. Runners remain unmodified — they receive only the clean Hash.



55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/json2sql/query_policy.rb', line 55

def apply(input)

  input = Json2sql.normalize(input)
  
  filter_tables(input, @tables)

  input.each { |table, params| sanitize_table(params, @tables[table]) }

  input.reject! { |_, params| empty_columns?(params) }

  input
end