action_ip_filter 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af3d4fbb598b8802bc90a29a75a0f6f3d38cd77757a04c8bef538fe34172ba14
-  data.tar.gz: 13e2e5ed9b621b70c27f11046149643d7237fe977766e29722f9f293c5ebe46d
+  metadata.gz: dd87d049abbc429bef20f3c4d684efd1f94a97cf9758603e6a404ecc97c487c0
+  data.tar.gz: 1460f97edeb6ddd39c71190ec07d866c3bc473818ab2ae852624a034027b1d7d
 SHA512:
-  metadata.gz: 578ca535fedf30d89e7681b286f2d68518cef4a001802d053cd49cc1a42cf9e9f85d7628230b4a28ddf7c54cc6225a158ce4f7f161d8f09c0fb55833adafb154
-  data.tar.gz: 1ba8977aa885e48794147c6c09c1d4c4bbd71f35974371cfb5ef8c75ea47efbf179480fea9f1c6259ea57ac7fdb0fc58e562969a230815bec857aa109da97551
+  metadata.gz: 7e279fadffc67defc41e2447f985780fc0332022a1bce62de27b065f9e715bbf18d173f8c87aa72780d2b8b91b743d45130608235f0b6d7c42cdfa24b699518e
+  data.tar.gz: e2918f5170516b232838a516e0ddf7c80f81cd5ef7c9359a1c07820e9ec96d1a8d91f9579824df7b535b24064596cd0da2e1d046db63146a4d3c524eeea9c0cb

data/CHANGELOG.md

@@ -1,10 +1,38 @@
 ## [Unreleased]
 
+## [0.4.0] - 2025-12-01
+
+### Breaking Changes
+
+#### Change both the behavior and the interface of `filter_ip` [#5](https://github.com/smartbank-inc/action_ip_filter/pull/5)
+
+Previously, `filter_ip` accepted a variable number of action names along with an `allowed_ips:` parameter. It now instead accepts a variable number of allowed IP addresses.
+
+When neither `only:` nor `except:` is specified, the filter is applied to all actions in the controller. To restric filtering to specific actions, `only:` or `except:` must be used—similar to how `before_action` is scoped.
+
+**Example:**
+
+Before:
+
+```ruby
+filter_ip :index, :show, allowed_ips: %w[192.0.2.0/24 198.51.100.1]
+```
+
+After:
+
+```ruby
+filter_ip "192.0.2.0/24", "198.51.100.1", only: [:index, :show]
+```
+
+## [0.3.1] - 2025-12-01
+
+- Simplify IpMatcher#match? by removing unnecessary branching [#3](https://github.com/smartbank-inc/action_ip_filter/pull/3)
+
 ## [0.3.0] - 2025-11-29
 
 ### Breaking Changes
 
-#### Change `ip_resolver` to use controller context instead of request parameter
+#### Change `ip_resolver` to use controller context instead of request parameter [#1](https://github.com/smartbank-inc/action_ip_filter/pull/1)
 
 Usage has changed. The `request` parameter in the Proc was previously required, but it is no longer needed. You can now access controller methods (`request`, `params`, etc.) directly instead of receiving `request` as an argument.
 

data/README.md

@@ -1,4 +1,4 @@
-# action_ip_filter
+# action_ip_filter [![CI](https://github.com/smartbank-inc/action_ip_filter/actions/workflows/ci.yml/badge.svg)](https://github.com/smartbank-inc/action_ip_filter/actions/workflows/ci.yml) [![Gem Version](https://img.shields.io/gem/v/action_ip_filter)](https://rubygems.org/gems/action_ip_filter)
 
 A lightweight gem that provides IP address restrictions for Rails controllers at the action level.
 
@@ -54,13 +54,13 @@ bundle install
 
 ### Basic Usage
 
-Include the concern and use `filter_ip` to protect specific actions:
+Include the concern and use `filter_ip` to protect all actions when neither `:only` nor `:except` is specified:
 
 ```ruby
 class AdminController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip :index, :show, allowed_ips: %w[192.0.2.0/24 198.51.100.1]
+  filter_ip "192.0.2.0/24", "198.51.100.1"
 
   def index
     # Only accessible from 192.0.2.0/24 or 198.51.100.1
@@ -71,27 +71,50 @@ class AdminController < ApplicationController
   end
 
   def public_action
-    # Not restricted
+    # Also restricted
   end
 end
 ```
 
-### Restrict All Actions
+#### With modifiers
+
+```ruby
+class AdminController < ApplicationController
+  include ActionIpFilter::IpFilterable
+
+  filter_ip "192.0.2.0/24", "198.51.100.1", only: [:index, :show]
+
+  def index
+    # Only accessible from 192.0.2.0/24 or 198.51.100.1
+  end
+
+  def show
+    # Also restricted
+  end
+
+  def public_action
+    # Not restricted
+  end
+end
+```
 
-Use `filter_ip_for_all` to protect all actions with optional exceptions:
+The above example is functionally equivalent to the following:
 
 ```ruby
-class WebhooksController < ApplicationController
+class AdminController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip_for_all allowed_ips: ENV["WEBHOOK_ALLOWED_IPS"].to_s.split(","),
-                    except: [:health_check]
+  filter_ip "192.0.2.0/24", "198.51.100.1", except: [:public_action]
+
+  def index
+    # Only accessible from 192.0.2.0/24 or 198.51.100.1
+  end
 
-  def stripe
-    # Restricted
+  def show
+    # Also restricted
   end
 
-  def health_check
+  def public_action
     # Not restricted
   end
 end
@@ -105,8 +128,19 @@ Pass a Proc for dynamic IP resolution:
 class SecureController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip :sensitive_action,
-    allowed_ips: -> { Rails.application.credentials.dig(:allowed_ips) || [] }
+  filter_ip -> { Rails.application.credentials.dig(:allowed_ips) || [] }
+end
+```
+
+The Proc must return a value of type `Array[String]`.
+
+You can also combine static IPs with dynamic resolution:
+
+```ruby
+class SecureController < ApplicationController
+  include ActionIpFilter::IpFilterable
+
+  filter_ip "192.0.2.0/24", -> { Rails.application.credentials.dig(:allowed_ips) || [] }
 end
 ```
 
@@ -118,8 +152,7 @@ Customize the response when access is denied. The block is executed via `instanc
 class ApiController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip :create,
-    allowed_ips: %w[192.0.2.0/24],
+  filter_ip "192.0.2.0/24",
     on_denied: -> { render json: { error: "Access denied from #{request.remote_ip}" }, status: :forbidden }
 end
 ```

data/lib/action_ip_filter/ip_filterable.rb

@@ -6,80 +6,46 @@ module ActionIpFilter
   module IpFilterable
     extend ActiveSupport::Concern
 
-    included do
-      class_attribute :action_ip_restrictions, default: {}
-    end
-
     # @rbs!
-    #   type restriction_options = { allowed_ips: Array[String] | ^() -> Array[String], on_denied: (^() -> void)? }
-    #   def action_ip_restrictions: () -> Hash[Symbol, untyped]
-    #   def action_ip_restrictions=: (Hash[Symbol, untyped]) -> void
-
-    # @rbs!
-    #   def request: () -> ActionDispatch::Request
     #   def action_name: () -> String
-    #   def instance_exec: (*untyped) { () -> void } -> void
+    #   def instance_exec: [T] (*untyped) { () -> T } -> T
     #   def before_action: (*untyped, **untyped) -> void
 
     class_methods do
-      # @rbs *actions: Symbol
-      # @rbs allowed_ips: Array[String] | ^() -> Array[String]
-      # @rbs on_denied: (^() -> void)?
-      # @rbs return: void
-      def filter_ip(*actions, allowed_ips:, on_denied: nil)
-        actions.flatten.each do |action|
-          self.action_ip_restrictions = action_ip_restrictions.merge(action.to_sym => {allowed_ips:, on_denied:})
-          before_action -> { check_ip_restriction(action) }, only: action
-        end
-      end
-
-      # @rbs allowed_ips: Array[String] | ^() -> Array[String]
-      # @rbs except: Array[Symbol]
+      # @rbs allowed_ips: String | ^() -> Array[String]
       # @rbs on_denied: (^() -> void)?
+      # @rbs only: Array[Symbol]?
+      # @rbs except: Array[Symbol]?
       # @rbs return: void
-      def filter_ip_for_all(allowed_ips:, except: [], on_denied: nil)
-        # note: hyphen is not allowed in method (i.e., action) names, so it's safe to use it as a marker
-        self.action_ip_restrictions = action_ip_restrictions.merge("all-marker": {allowed_ips:, on_denied:})
-        before_action :check_ip_restriction_for_all, except:
+      def filter_ip(*allowed_ips, on_denied: nil, only: nil, except: nil)
+        before_action -> { verify_ip_access(allowed_ips:, on_denied:) }, only:, except:
       end
     end
 
     private
 
-    # @rbs action: Symbol
+    # @rbs allowed_ips: Array[String | ^() -> Array[String]]
+    # @rbs on_denied: (^() -> void)?
     # @rbs return: void
-    def check_ip_restriction(action)
-      verify_ip_access(action_ip_restrictions[action.to_sym])
-    end
+    def verify_ip_access(allowed_ips:, on_denied:)
+      return if ActionIpFilter.test_mode?
 
-    # @rbs return: void
-    def check_ip_restriction_for_all
-      verify_ip_access(action_ip_restrictions[:"all-marker"])
-    end
-
-    # @rbs restriction: restriction_options?
-    # @rbs return: void
-    def verify_ip_access(restriction)
-      return if restriction.nil? || ActionIpFilter.test_mode?
+      client_ip = instance_exec(&ActionIpFilter.configuration.ip_resolver)
 
-      client_ip = instance_exec(&ActionIpFilter.configuration.ip_resolver) #: String?
-      allowed_ips = resolve_allowed_ips(restriction[:allowed_ips])
+      allowed = allowed_ips.any? do |allowed_ip|
+        ips = case allowed_ip
+        when Proc
+          instance_exec(&allowed_ip)
+        else
+          [allowed_ip]
+        end
 
-      unless IpMatcher.allowed?(client_ip, allowed_ips)
-        log_ip_denial(client_ip)
-        on_denied = restriction[:on_denied] || ActionIpFilter.configuration.on_denied
-        instance_exec(&on_denied)
+        IpMatcher.allowed?(client_ip, ips)
       end
-    end
 
-    # @rbs allowed_ips: Array[String] | ^() -> Array[String]
-    # @rbs return: Array[String]
-    def resolve_allowed_ips(allowed_ips)
-      case allowed_ips
-      when Proc
-        instance_exec(&allowed_ips) #: Array[String]
-      else
-        Array(allowed_ips)
+      unless allowed
+        log_ip_denial(client_ip)
+        instance_exec(&on_denied || ActionIpFilter.configuration.on_denied)
       end
     end
 

data/lib/action_ip_filter/ip_matcher.rb

@@ -33,13 +33,8 @@ module ActionIpFilter
       # @rbs allowed_ip: String
       # @rbs return: bool
       def match?(client_addr, allowed_ip)
-        if allowed_ip.include?("/")
-          range = IPAddr.new(allowed_ip)
-          range.include?(client_addr)
-        else
-          allowed_addr = IPAddr.new(allowed_ip)
-          client_addr == allowed_addr
-        end
+        allowed_addr = IPAddr.new(allowed_ip)
+        allowed_addr.include?(client_addr)
       rescue IPAddr::InvalidAddressError
         false
       end

data/lib/action_ip_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActionIpFilter
-  VERSION = "0.3.0" #: String
+  VERSION = "0.4.0" #: String
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: action_ip_filter
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - SmartBank, Inc.