Preserve component authorization

Author: cardmagic

README.md

@@ -247,9 +247,9 @@ Turbo Frame requests the component with normal cookies. Only scalar targets
 that the server rendered into this `solid_object` scope are signed into its
 stream token and receive value payloads; component-only dependencies do not
 send their values to the browser. The endpoint renders the latest committed
-snapshot, returns `private, no-store`, and reauthorizes every declared
-dependency. Two viewers can therefore receive different HTML for the same
-actor without sharing either projection.
+snapshot, returns `private, no-store`, and reauthorizes the component name plus
+every declared dependency. Two viewers can therefore receive different HTML
+for the same actor without sharing either projection.
 
 Reconnect compares the component's signed initial revision with the latest
 actor incarnation and state revision, then refreshes stale components. Cable

docs/architecture.md

@@ -507,10 +507,11 @@ Turbo Frame whose source is the signed engine endpoint.
 
 The browser then makes an ordinary cookie-bearing HTTP request. The engine
 controller derives a request-specific context through
-`component_authorization_context`, calls `authorize_query` for every declared
-dependency, renders the host partial from a new committed snapshot, and returns
-`private, no-store` HTML. Subscribers to the same actor can therefore receive
-different HTML without sharing it through Cable or the database.
+`component_authorization_context`, calls `authorize_query` for the component
+name and every declared dependency, renders the host partial from a new
+committed snapshot, and returns `private, no-store` HTML. Subscribers to the
+same actor can therefore receive different HTML without sharing it through
+Cable or the database.
 
 Each channel subscription transmits current scalar replacements and compares
 each component's signed initial revision against the latest committed

docs/authorization.md

@@ -30,7 +30,8 @@ three boundaries:
 2. `ActorChannel` passes its authenticated `ActionCable::Connection` to
    `authorize_subscription`.
 3. `ComponentsController` resolves a fresh context for the cookie-bearing HTTP
-   request and calls `authorize_query` for every component dependency.
+   request and calls `authorize_query` for the component name and every
+   dependency.
 
 Configure the refresh resolver when the query policy expects a user or service
 principal rather than the engine controller:

docs/correctness.md

@@ -129,7 +129,7 @@ explicit dependencies, initial instance ID and revision, and same-origin
 refresh path. The signature detects modification but grants no access. Initial
 rendering invokes query authorization, Cable separately invokes subscription
 authorization, and the cookie-bearing refresh request invokes query
-authorization again for every dependency.
+authorization again for the component name and every dependency.
 
 The actor stream token separately signs the scalar observable targets rendered
 into its scope. A component dependency that has no scalar target carries only

docs/realtime.md

@@ -61,8 +61,9 @@ approval.
 Initial scalar and component reads call `authorize_query` with the context
 passed to `solid_object`. The refresh controller resolves a new request context
 through `component_authorization_context`, then calls `authorize_query` again
-for every declared dependency. The default resolver supplies the engine
-controller; applications commonly resolve it to `Current.user`:
+for the component name and every declared dependency. The default resolver
+supplies the engine controller; applications commonly resolve it to
+`Current.user`:
 
 ```ruby
 configuration.component_authorization_context = ->(controller:) { Current.user }

lib/generators/solid_objects/templates/solid_objects.rb

@@ -49,14 +49,8 @@
   configuration.authorize_subscription = ->(**) { false }
   configuration.authorize_administration = ->(**) { false }
 
-  # Reactive component refreshes run in the engine controller after a Cable
-  # invalidation. Resolve that controller to the same authenticated principal
-  # used by the initial view render. The query policy runs again for every
-  # declared component dependency:
-  #
-  # configuration.component_authorization_context = lambda do |controller:|
-  #   Current.user
-  # end
+  # Configure component_authorization_context to return the authenticated
+  # principal used for reactive component refreshes.
 
   # On hosts where shell access is already an authenticated administrative
   # boundary, this enables only gem commands that pass the CLI context:

lib/solid_objects/component_renderer.rb

@@ -25,7 +25,9 @@ def initialize(
 
     # @rbs () -> untyped
     def call
-      dependencies.each { |dependency| authorize_read!(dependency) }
+      [ component_name, *dependencies ].uniq.each do |authorization_name|
+        authorize_read!(authorization_name)
+      end
       actor = ComponentView.new(
         snapshot:,
         dependencies:,

test/integration/actor_helper_test.rb

@@ -52,6 +52,9 @@ def close
             <p>Open</p>
           <% end %>
         ERB
+        "actors/actor_helper_test/cart_actor/_summary.html.erb" => <<~ERB,
+          <p><%= actor.items.length %> items</p>
+        ERB
         "actors/actor_helper_test/cart_actor/_leaky.html.erb" => <<~ERB
           <p><%= actor.status %></p>
         ERB
@@ -177,6 +180,26 @@ def close
     end
   end
 
+  test "authorizes a reactive component name before its dependencies" do
+    authorization_calls = []
+    SolidObjects.configuration.authorize_query = lambda do |**arguments|
+      authorization_calls << arguments
+      arguments.fetch(:message_name) == "items"
+    end
+
+    assert_raises(SolidObjects::Unauthorized) do
+      solid_object(
+        CartActor.ref("alice"),
+        authorization_context: "alice"
+      ) do |actor|
+        actor.component(:summary, observes: :items)
+      end
+    end
+
+    assert_equal [ "summary" ],
+      authorization_calls.map { |arguments| arguments.fetch(:message_name) }
+  end
+
   test "rejects observable reads omitted from component dependencies" do
     error = assert_raises(SolidObjects::UnknownComponentDependency) do
       solid_object(CartActor.ref("alice")) do |actor|

test/integration/components_controller_test.rb

@@ -139,6 +139,26 @@ def update_room(messages:, status:)
     assert_empty @response.body
   end
 
+  test "reauthorizes the component name before refresh dependencies" do
+    reference = RoomActor.ref("general")
+    token = component_token(
+      reference,
+      component_name: "messages",
+      dependencies: %w[recent_messages]
+    )
+    authorization_calls = []
+    SolidObjects.configuration.authorize_query = lambda do |**arguments|
+      authorization_calls << arguments
+      arguments.fetch(:message_name) == "recent_messages"
+    end
+
+    render_component(token, viewer: "alice")
+
+    assert_response :forbidden
+    assert_equal [ "messages" ],
+      authorization_calls.map { |arguments| arguments.fetch(:message_name) }
+  end
+
   test "renders personalized HTML independently for each authorized request" do
     reference = RoomActor.ref("general")
     token = component_token(

test/integration/install_generator_test.rb

@@ -22,6 +22,7 @@ class InstallGeneratorTest < ActiveSupport::TestCase
       assert_includes initializer, "instance_retention_by_actor_type"
       assert_includes initializer, "authorization_context[:source] == \"cli\""
       assert_includes initializer, "component_authorization_context"
+      refute_includes initializer, "component_authorization_context = lambda"
       assert_equal 5, initializer.scan("= ->(**) { false }").length
     end
   end