Class: Parse::ACLScope::Resolution

Inherits:
Struct
  • Object
show all
Defined in:
lib/parse/acl_scope.rb

Overview

Outcome of resolving a single mongo-direct call's auth kwargs.

Instance Attribute Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#client ⇒ Parse::Client?

Returns the client whose authorization context produced this resolution. Carried so a caller about to run the query against a process-global resource can check that the two agree; see MongoDB.verify_client!. Per-client authorization plus a process-global MongoDB connection is safe only when they belong to the same application.

Returns:

  • (Parse::Client, nil) —

    the client whose authorization context produced this resolution. Carried so a caller about to run the query against a process-global resource can check that the two agree; see MongoDB.verify_client!. Per-client authorization plus a process-global MongoDB connection is safe only when they belong to the same application.



77
78
79
80
81
82
 
# File 'lib/parse/acl_scope.rb', line 77

Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, :client, keyword_init: true) do
  def master?; mode == :master; end
  def session?; mode == :session; end
  def public?; mode == :public; end
  def strict_role?; strict_role == true; end
end

#mode ⇒ Symbol

Returns one of :session, :master, :public. :session means the caller passed a valid session_token:; :master means the caller passed master: true; :public means neither was supplied and the path's require_session_token toggle is off, so the SDK falls through to public-only ACL semantics.

Returns:

  • (Symbol) —

    one of :session, :master, :public. :session means the caller passed a valid session_token:; :master means the caller passed master: true; :public means neither was supplied and the path's require_session_token toggle is off, so the SDK falls through to public-only ACL semantics.



77
78
79
80
81
82
 
# File 'lib/parse/acl_scope.rb', line 77

Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, :client, keyword_init: true) do
  def master?; mode == :master; end
  def session?; mode == :session; end
  def public?; mode == :public; end
  def strict_role?; strict_role == true; end
end

#permission_strings ⇒ Array<String>?

Returns the _rperm allow-set ready to hand to Parse::ACL.read_predicate. nil for :master — no injection runs on the master path.

Returns:



77
78
79
80
81
82
 
# File 'lib/parse/acl_scope.rb', line 77

Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, :client, keyword_init: true) do
  def master?; mode == :master; end
  def session?; mode == :session; end
  def public?; mode == :public; end
  def strict_role?; strict_role == true; end
end

#session ⇒ Parse::Authorization::Resolved?

Returns the underlying resolved-session struct (carries role-name set), nil for :master.

Returns:



77
78
79
80
81
82
 
# File 'lib/parse/acl_scope.rb', line 77

Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, :client, keyword_init: true) do
  def master?; mode == :master; end
  def session?; mode == :session; end
  def public?; mode == :public; end
  def strict_role?; strict_role == true; end
end

#strict_role ⇒ Boolean

Returns when true, downstream predicate construction (see Parse::ACLScope.match_stage_for and Parse::ACLScope.rewrite_pipeline) suppresses the implicit "*" (public) grant. Only meaningful for role-scoped resolutions where the caller wants to see ONLY rows whose _rperm explicitly includes one of the resolved role names, not every public-readable row in the collection. Defaults to false for backwards compatibility. Note: even with strict_role: true, rows with NO _rperm field still pass (Parse-Server treats absent _rperm as public-default); the knob only suppresses the "*" subscription in the $in set.

Returns:

  • (Boolean) —

    when true, downstream predicate construction (see Parse::ACLScope.match_stage_for and Parse::ACLScope.rewrite_pipeline) suppresses the implicit "*" (public) grant. Only meaningful for role-scoped resolutions where the caller wants to see ONLY rows whose _rperm explicitly includes one of the resolved role names, not every public-readable row in the collection. Defaults to false for backwards compatibility. Note: even with strict_role: true, rows with NO _rperm field still pass (Parse-Server treats absent _rperm as public-default); the knob only suppresses the "*" subscription in the $in set.



77
78
79
80
81
82
 
# File 'lib/parse/acl_scope.rb', line 77

Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, :client, keyword_init: true) do
  def master?; mode == :master; end
  def session?; mode == :session; end
  def public?; mode == :public; end
  def strict_role?; strict_role == true; end
end

#user_id ⇒ String?

Returns the resolved user_id, or nil for :master and :public.

Returns:

  • (String, nil) —

    the resolved user_id, or nil for :master and :public.



77
78
79
80
81
82
 
# File 'lib/parse/acl_scope.rb', line 77

Resolution = Struct.new(:mode, :permission_strings, :user_id, :session, :strict_role, :client, keyword_init: true) do
  def master?; mode == :master; end
  def session?; mode == :session; end
  def public?; mode == :public; end
  def strict_role?; strict_role == true; end
end

Instance Method Details

#master? ⇒ Boolean

Returns:

  • (Boolean) 


78
 
# File 'lib/parse/acl_scope.rb', line 78

def master?; mode == :master; end

#public? ⇒ Boolean

Returns:

  • (Boolean) 


80
 
# File 'lib/parse/acl_scope.rb', line 80

def public?; mode == :public; end

#session? ⇒ Boolean

Returns:

  • (Boolean) 


79
 
# File 'lib/parse/acl_scope.rb', line 79

def session?; mode == :session; end

#strict_role? ⇒ Boolean

Returns:

  • (Boolean) 


81
 
# File 'lib/parse/acl_scope.rb', line 81

def strict_role?; strict_role == true; end