Class: Pgsqlarbiter::Arbiter

Inherits:
Object
  • Object
show all
Defined in:
lib/pgsqlarbiter/arbiter.rb

Overview

Reusable query permission checker with pre-configured whitelists.

Use this class when you need to check multiple queries against the same set of allowed statement types, tables, and functions. For one-off checks, see allow?.

Constant Summary collapse

VALID_STATEMENT_TYPES =

Returns the set of valid statement type symbols.

Returns:

  • (Set<Symbol>) —

    the set of valid statement type symbols

Set[:select, :insert, :update, :delete, :merge, :values].freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(allowed_statement_types:, allowed_tables:, allowed_functions: Pgsqlarbiter::DEFAULT_QUERY_FUNCTIONS) ⇒ Arbiter

Create a new Arbiter with the given whitelists.

Parameters:

  • allowed_statement_types (Array<Symbol>) —

    allowed statement types. Valid values: :select, :insert, :update, :delete, :merge, :values

  • allowed_tables (Array<String>) —

    allowed table and view names

  • allowed_functions (Array<String>, Set<String>) (defaults to: Pgsqlarbiter::DEFAULT_QUERY_FUNCTIONS) —

    allowed function names (default: DEFAULT_QUERY_FUNCTIONS)

Raises:



30
31
32
33
34
 
# File 'lib/pgsqlarbiter/arbiter.rb', line 30

def initialize(allowed_statement_types:, allowed_tables:, allowed_functions: Pgsqlarbiter::DEFAULT_QUERY_FUNCTIONS)
  @allowed_statement_types = validate_statement_types(allowed_statement_types)
  @allowed_tables = Set.new(allowed_tables).freeze
  @allowed_functions = Set.new(allowed_functions).freeze
end

Instance Attribute Details

#allowed_functions ⇒ Set<String> (readonly)

Returns allowed function names.

Returns:

  • (Set<String>) —

    allowed function names



20
21
22
 
# File 'lib/pgsqlarbiter/arbiter.rb', line 20

def allowed_functions
  @allowed_functions
end

#allowed_statement_types ⇒ Set<Symbol> (readonly)

Returns allowed statement types.

Returns:

  • (Set<Symbol>) —

    allowed statement types



16
17
18
 
# File 'lib/pgsqlarbiter/arbiter.rb', line 16

def allowed_statement_types
  @allowed_statement_types
end

#allowed_tables ⇒ Set<String> (readonly)

Returns allowed table and view names.

Returns:

  • (Set<String>) —

    allowed table and view names



18
19
20
 
# File 'lib/pgsqlarbiter/arbiter.rb', line 18

def allowed_tables
  @allowed_tables
end

Instance Method Details

#allow?(sql) ⇒ Boolean

Check whether a SQL query is allowed under this arbiter's rules.

Parameters:

  • sql (String) —

    the SQL query to check

Returns:

  • (Boolean) —

    true if the statement type, all tables, and all functions are within the configured whitelists

Raises:



68
69
70
 
# File 'lib/pgsqlarbiter/arbiter.rb', line 68

def allow?(sql)
  judge(sql).allowed?
end

#judge(sql) ⇒ Verdict

Judge a SQL query against this arbiter's rules, returning a Verdict that explains which checks passed or failed.

Parameters:

  • sql (String) —

    the SQL query to judge

Returns:

Raises:



45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/pgsqlarbiter/arbiter.rb', line 45

def judge(sql)
  result = Pgsqlarbiter.analyze(sql)
  stmt_ok = @allowed_statement_types.include?(result.statement_type)
  bad_tables = result.tables.reject { |t| @allowed_tables.include?(t) }.freeze
  bad_functions = result.functions.reject { |f| @allowed_functions.include?(f) }.freeze

  Verdict.new(
    allowed: stmt_ok && bad_tables.empty? && bad_functions.empty?,
    statement_type_allowed: stmt_ok,
    statement_type: result.statement_type,
    disallowed_tables: bad_tables,
    disallowed_functions: bad_functions
  )
end