action_ip_filter 0.2.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d061bab952784ba92d038b0a28d34418e9c360d6d6abd543621535170a9a21c
-  data.tar.gz: 8a57d44aa950fb7c9bc0dad8a3493add8c626df62cecea9d0a8536d5ae7bc6d6
+  metadata.gz: a00718ef1f7bccb16f52d1b8a1e5f9e746e9ba15f933795be419ff3c0d303c3d
+  data.tar.gz: 5c0f2e216e5481ec40f6156dd512d6a5ea5af39de88d64e7c06504faa5966fd7
 SHA512:
-  metadata.gz: 7f868950a961ac26cfebace46005f363f4cace350a63d0c58996b20966312a245794b8fe571b0abec32c216baae81e41fad39ea0eb393997348043e650263c3e
-  data.tar.gz: 746dc0312e87366a4d6d4e36e0bd31648255d646fb6f7d103f6e00bb4d68d1863ef4c2154737db74f3655934da81a73737b2b6a920d3338a0e8c9b69faf09afd
+  metadata.gz: ed618b5060effa6e112c7cfce1616f5f43467728971503779caff3230ec1b3506c18585766d41df45088e45c74e1b3756522341e5ca873b96d0f73284e15ee4b
+  data.tar.gz: 355e3c64444d092f466166c11c2d9afad5dfedab274e4a80f56e47d6d724a64b63dc21774e781496889d07e435c675d1b528bd017e9c79ef7f568fb59e9a49e0

data/CHANGELOG.md

@@ -1,5 +1,33 @@
 ## [Unreleased]
 
+## [0.3.1] - 2025-12-01
+
+- Simplify IpMatcher#match? by removing unnecessary branching [#3](https://github.com/smartbank-inc/action_ip_filter/pull/3)
+
+## [0.3.0] - 2025-11-29
+
+### Breaking Changes
+
+#### Change `ip_resolver` to use controller context instead of request parameter [#1](https://github.com/smartbank-inc/action_ip_filter/pull/1)
+
+Usage has changed. The `request` parameter in the Proc was previously required, but it is no longer needed. You can now access controller methods (`request`, `params`, etc.) directly instead of receiving `request` as an argument.
+
+Before:
+
+```
+config.ip_resolver = ->(request) {
+  request.headers["X-Forwarded-For"]&.split(",")&.first&.strip || request.remote_ip
+}
+```
+
+After:
+
+```
+config.ip_resolver = -> {
+  request.headers["X-Forwarded-For"]&.split(",")&.first&.strip || request.remote_ip
+}
+```
+
 ## [0.2.0] - 2025-11-28
 
 ### Breaking Changes

data/README.md

@@ -1,4 +1,4 @@
-# action_ip_filter
+# action_ip_filter [![CI](https://github.com/smartbank-inc/action_ip_filter/actions/workflows/ci.yml/badge.svg)](https://github.com/smartbank-inc/action_ip_filter/actions/workflows/ci.yml) [![Gem Version](https://img.shields.io/gem/v/action_ip_filter)](https://rubygems.org/gems/action_ip_filter)
 
 A lightweight gem that provides IP address restrictions for Rails controllers at the action level.
 
@@ -18,6 +18,24 @@ Unlike Rack middleware solutions (e.g., `rack-attack`), action_ip_filter operate
 - Minimal overhead (no processing for unrestricted endpoints)
 - Simple, declarative configuration per controller
 
+### Why not Rails native `rate_limit`?
+
+Rails 8.0 introduced `rate_limit`, which could be adapted for IP filtering:
+
+```ruby
+# a slightly tricky approach involving rate_limit
+rate_limit to: 0, within: 0.second, only: :create, unless: -> {
+  allowed_ips.include?(request.remote_ip)
+}
+```
+
+However, this approach has drawbacks:
+- Semantic mismatch: `rate_limit` is designed for rate limiting, not access control
+- Requires cache store: `rate_limit` needs a cache backend for counting, unnecessary for simple IP allowlists
+- Inverted logic: You're "rate limiting everyone except allowed IPs" rather than "allowing specific IPs"
+
+action_ip_filter provides a purpose-built, declarative API for IP-based access control.
+
 ## Installation
 
 Add to your Gemfile:
@@ -114,7 +132,7 @@ Configure global settings in an initializer:
 # config/initializers/action_ip_filter.rb
 ActionIpFilter.configure do |config|
   # Custom IP resolver (default: request.remote_ip)
-  config.ip_resolver = ->(request) {
+  config.ip_resolver = -> {
     request.headers["X-Forwarded-For"]&.split(",")&.first&.strip || request.remote_ip
   }
 
@@ -133,7 +151,7 @@ end
 
 | Option | Default                             | Description                                        |
 |--------|-------------------------------------|----------------------------------------------------|
-| `ip_resolver` | `->(request) { request.remote_ip }` | Proc that extracts client IP from request |
+| `ip_resolver` | `-> { request.remote_ip }` | Proc that extracts client IP from request |
 | `on_denied` | `-> { head :forbidden }`            | Handler called when access is denied (returns 403) |
 | `logger` | `Rails.logger`                      | Logger instance for denied request logging |
 | `log_denials` | `true`                              | Whether to log denied requests as warn level |

data/lib/action_ip_filter/configuration.rb

@@ -2,19 +2,19 @@
 
 module ActionIpFilter
   class Configuration
-    # @rbs @ip_resolver: ^(ActionDispatch::Request) -> String?
+    # @rbs @ip_resolver: ^() -> String?
     # @rbs @on_denied: ^() -> void
     # @rbs @logger: Logger?
     # @rbs @log_denials: bool
 
-    attr_accessor :ip_resolver #: ^(ActionDispatch::Request) -> String?
+    attr_accessor :ip_resolver #: ^() -> String?
     attr_accessor :on_denied #: ^() -> void
     attr_accessor :logger #: Logger?
     attr_accessor :log_denials #: bool
 
     # @rbs return: void
     def initialize
-      @ip_resolver = ->(request) { request.remote_ip }
+      @ip_resolver = -> { request.remote_ip } # steep:ignore NoMethod
       @on_denied = -> { head :forbidden } # steep:ignore NoMethod
       @logger = nil
       @log_denials = true

data/lib/action_ip_filter/ip_filterable.rb

@@ -62,7 +62,7 @@ module ActionIpFilter
     def verify_ip_access(restriction)
       return if restriction.nil? || ActionIpFilter.test_mode?
 
-      client_ip = ActionIpFilter.configuration.ip_resolver.call(request)
+      client_ip = instance_exec(&ActionIpFilter.configuration.ip_resolver) #: String?
       allowed_ips = resolve_allowed_ips(restriction[:allowed_ips])
 
       unless IpMatcher.allowed?(client_ip, allowed_ips)

data/lib/action_ip_filter/ip_matcher.rb

@@ -33,13 +33,8 @@ module ActionIpFilter
       # @rbs allowed_ip: String
       # @rbs return: bool
       def match?(client_addr, allowed_ip)
-        if allowed_ip.include?("/")
-          range = IPAddr.new(allowed_ip)
-          range.include?(client_addr)
-        else
-          allowed_addr = IPAddr.new(allowed_ip)
-          client_addr == allowed_addr
-        end
+        allowed_addr = IPAddr.new(allowed_ip)
+        allowed_addr.include?(client_addr)
       rescue IPAddr::InvalidAddressError
         false
       end

data/lib/action_ip_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActionIpFilter
-  VERSION = "0.2.0" #: String
+  VERSION = "0.3.1" #: String
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: action_ip_filter
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.1
 platform: ruby
 authors:
 - SmartBank, Inc.