action_ip_filter 0.1.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eaf87646a87d44c3eb43e5d9c7f08151068ae3428405b46c034ae933adfad7ca
-  data.tar.gz: b1d4c318d9fdba5163bac3b7ebeb8f9969718b37b526515a5861a5f509fabce1
+  metadata.gz: af3d4fbb598b8802bc90a29a75a0f6f3d38cd77757a04c8bef538fe34172ba14
+  data.tar.gz: 13e2e5ed9b621b70c27f11046149643d7237fe977766e29722f9f293c5ebe46d
 SHA512:
-  metadata.gz: b666b53a5c8bd924a8489bb3b540bfe75add34d6d3e938fa5be54d0dace72d35723d6f08789b0c45944fbd1e9d3998c439963ae1b9f3c2d9e860f3e03e391669
-  data.tar.gz: 5f3dbd4b22bad8e02f595e47417be2564efac1386bf819077301a6020626994227725cd4f5c05b7a738b3085d3092f2c1debae349b73edaca7070a7f94dfa95d
+  metadata.gz: 578ca535fedf30d89e7681b286f2d68518cef4a001802d053cd49cc1a42cf9e9f85d7628230b4a28ddf7c54cc6225a158ce4f7f161d8f09c0fb55833adafb154
+  data.tar.gz: 1ba8977aa885e48794147c6c09c1d4c4bbd71f35974371cfb5ef8c75ea47efbf179480fea9f1c6259ea57ac7fdb0fc58e562969a230815bec857aa109da97551

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 ## [Unreleased]
 
+## [0.3.0] - 2025-11-29
+
+### Breaking Changes
+
+#### Change `ip_resolver` to use controller context instead of request parameter
+
+Usage has changed. The `request` parameter in the Proc was previously required, but it is no longer needed. You can now access controller methods (`request`, `params`, etc.) directly instead of receiving `request` as an argument.
+
+Before:
+
+```
+config.ip_resolver = ->(request) {
+  request.headers["X-Forwarded-For"]&.split(",")&.first&.strip || request.remote_ip
+}
+```
+
+After:
+
+```
+config.ip_resolver = -> {
+  request.headers["X-Forwarded-For"]&.split(",")&.first&.strip || request.remote_ip
+}
+```
+
+## [0.2.0] - 2025-11-28
+
+### Breaking Changes
+
+- Change the interface: `s/restrict_ip/filter_ip/g`
+
 ## [0.1.1] - 2025-11-28
 
 ### Maintenance

data/README.md

@@ -18,6 +18,24 @@ Unlike Rack middleware solutions (e.g., `rack-attack`), action_ip_filter operate
 - Minimal overhead (no processing for unrestricted endpoints)
 - Simple, declarative configuration per controller
 
+### Why not Rails native `rate_limit`?
+
+Rails 8.0 introduced `rate_limit`, which could be adapted for IP filtering:
+
+```ruby
+# a slightly tricky approach involving rate_limit
+rate_limit to: 0, within: 0.second, only: :create, unless: -> {
+  allowed_ips.include?(request.remote_ip)
+}
+```
+
+However, this approach has drawbacks:
+- Semantic mismatch: `rate_limit` is designed for rate limiting, not access control
+- Requires cache store: `rate_limit` needs a cache backend for counting, unnecessary for simple IP allowlists
+- Inverted logic: You're "rate limiting everyone except allowed IPs" rather than "allowing specific IPs"
+
+action_ip_filter provides a purpose-built, declarative API for IP-based access control.
+
 ## Installation
 
 Add to your Gemfile:
@@ -36,13 +54,13 @@ bundle install
 
 ### Basic Usage
 
-Include the concern and use `restrict_ip` to protect specific actions:
+Include the concern and use `filter_ip` to protect specific actions:
 
 ```ruby
 class AdminController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  restrict_ip :index, :show, allowed_ips: %w[192.0.2.0/24 198.51.100.1]
+  filter_ip :index, :show, allowed_ips: %w[192.0.2.0/24 198.51.100.1]
 
   def index
     # Only accessible from 192.0.2.0/24 or 198.51.100.1
@@ -60,14 +78,14 @@ end
 
 ### Restrict All Actions
 
-Use `restrict_ip_for_all` to protect all actions with optional exceptions:
+Use `filter_ip_for_all` to protect all actions with optional exceptions:
 
 ```ruby
 class WebhooksController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  restrict_ip_for_all allowed_ips: ENV["WEBHOOK_ALLOWED_IPS"].to_s.split(","),
-                      except: [:health_check]
+  filter_ip_for_all allowed_ips: ENV["WEBHOOK_ALLOWED_IPS"].to_s.split(","),
+                    except: [:health_check]
 
   def stripe
     # Restricted
@@ -87,7 +105,7 @@ Pass a Proc for dynamic IP resolution:
 class SecureController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  restrict_ip :sensitive_action,
+  filter_ip :sensitive_action,
     allowed_ips: -> { Rails.application.credentials.dig(:allowed_ips) || [] }
 end
 ```
@@ -100,7 +118,7 @@ Customize the response when access is denied. The block is executed via `instanc
 class ApiController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  restrict_ip :create,
+  filter_ip :create,
     allowed_ips: %w[192.0.2.0/24],
     on_denied: -> { render json: { error: "Access denied from #{request.remote_ip}" }, status: :forbidden }
 end
@@ -114,7 +132,7 @@ Configure global settings in an initializer:
 # config/initializers/action_ip_filter.rb
 ActionIpFilter.configure do |config|
   # Custom IP resolver (default: request.remote_ip)
-  config.ip_resolver = ->(request) {
+  config.ip_resolver = -> {
     request.headers["X-Forwarded-For"]&.split(",")&.first&.strip || request.remote_ip
   }
 
@@ -133,7 +151,7 @@ end
 
 | Option | Default                             | Description                                        |
 |--------|-------------------------------------|----------------------------------------------------|
-| `ip_resolver` | `->(request) { request.remote_ip }` | Proc that extracts client IP from request |
+| `ip_resolver` | `-> { request.remote_ip }` | Proc that extracts client IP from request |
 | `on_denied` | `-> { head :forbidden }`            | Handler called when access is denied (returns 403) |
 | `logger` | `Rails.logger`                      | Logger instance for denied request logging |
 | `log_denials` | `true`                              | Whether to log denied requests as warn level |

data/lib/action_ip_filter/configuration.rb

@@ -2,19 +2,19 @@
 
 module ActionIpFilter
   class Configuration
-    # @rbs @ip_resolver: ^(ActionDispatch::Request) -> String?
+    # @rbs @ip_resolver: ^() -> String?
     # @rbs @on_denied: ^() -> void
     # @rbs @logger: Logger?
     # @rbs @log_denials: bool
 
-    attr_accessor :ip_resolver #: ^(ActionDispatch::Request) -> String?
+    attr_accessor :ip_resolver #: ^() -> String?
     attr_accessor :on_denied #: ^() -> void
     attr_accessor :logger #: Logger?
     attr_accessor :log_denials #: bool
 
     # @rbs return: void
     def initialize
-      @ip_resolver = ->(request) { request.remote_ip }
+      @ip_resolver = -> { request.remote_ip } # steep:ignore NoMethod
       @on_denied = -> { head :forbidden } # steep:ignore NoMethod
       @logger = nil
       @log_denials = true

data/lib/action_ip_filter/ip_filterable.rb

@@ -26,7 +26,7 @@ module ActionIpFilter
       # @rbs allowed_ips: Array[String] | ^() -> Array[String]
       # @rbs on_denied: (^() -> void)?
       # @rbs return: void
-      def restrict_ip(*actions, allowed_ips:, on_denied: nil)
+      def filter_ip(*actions, allowed_ips:, on_denied: nil)
         actions.flatten.each do |action|
           self.action_ip_restrictions = action_ip_restrictions.merge(action.to_sym => {allowed_ips:, on_denied:})
           before_action -> { check_ip_restriction(action) }, only: action
@@ -37,7 +37,7 @@ module ActionIpFilter
       # @rbs except: Array[Symbol]
       # @rbs on_denied: (^() -> void)?
       # @rbs return: void
-      def restrict_ip_for_all(allowed_ips:, except: [], on_denied: nil)
+      def filter_ip_for_all(allowed_ips:, except: [], on_denied: nil)
         # note: hyphen is not allowed in method (i.e., action) names, so it's safe to use it as a marker
         self.action_ip_restrictions = action_ip_restrictions.merge("all-marker": {allowed_ips:, on_denied:})
         before_action :check_ip_restriction_for_all, except:
@@ -62,7 +62,7 @@ module ActionIpFilter
     def verify_ip_access(restriction)
       return if restriction.nil? || ActionIpFilter.test_mode?
 
-      client_ip = ActionIpFilter.configuration.ip_resolver.call(request)
+      client_ip = instance_exec(&ActionIpFilter.configuration.ip_resolver) #: String?
       allowed_ips = resolve_allowed_ips(restriction[:allowed_ips])
 
       unless IpMatcher.allowed?(client_ip, allowed_ips)

data/lib/action_ip_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActionIpFilter
-  VERSION = "0.1.1" #: String
+  VERSION = "0.3.0" #: String
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: action_ip_filter
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.3.0
 platform: ruby
 authors:
 - SmartBank, Inc.