action_ip_filter 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a00718ef1f7bccb16f52d1b8a1e5f9e746e9ba15f933795be419ff3c0d303c3d
-  data.tar.gz: 5c0f2e216e5481ec40f6156dd512d6a5ea5af39de88d64e7c06504faa5966fd7
+  metadata.gz: dd87d049abbc429bef20f3c4d684efd1f94a97cf9758603e6a404ecc97c487c0
+  data.tar.gz: 1460f97edeb6ddd39c71190ec07d866c3bc473818ab2ae852624a034027b1d7d
 SHA512:
-  metadata.gz: ed618b5060effa6e112c7cfce1616f5f43467728971503779caff3230ec1b3506c18585766d41df45088e45c74e1b3756522341e5ca873b96d0f73284e15ee4b
-  data.tar.gz: 355e3c64444d092f466166c11c2d9afad5dfedab274e4a80f56e47d6d724a64b63dc21774e781496889d07e435c675d1b528bd017e9c79ef7f568fb59e9a49e0
+  metadata.gz: 7e279fadffc67defc41e2447f985780fc0332022a1bce62de27b065f9e715bbf18d173f8c87aa72780d2b8b91b743d45130608235f0b6d7c42cdfa24b699518e
+  data.tar.gz: e2918f5170516b232838a516e0ddf7c80f81cd5ef7c9359a1c07820e9ec96d1a8d91f9579824df7b535b24064596cd0da2e1d046db63146a4d3c524eeea9c0cb

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 ## [Unreleased]
 
+## [0.4.0] - 2025-12-01
+
+### Breaking Changes
+
+#### Change both the behavior and the interface of `filter_ip` [#5](https://github.com/smartbank-inc/action_ip_filter/pull/5)
+
+Previously, `filter_ip` accepted a variable number of action names along with an `allowed_ips:` parameter. It now instead accepts a variable number of allowed IP addresses.
+
+When neither `only:` nor `except:` is specified, the filter is applied to all actions in the controller. To restric filtering to specific actions, `only:` or `except:` must be used—similar to how `before_action` is scoped.
+
+**Example:**
+
+Before:
+
+```ruby
+filter_ip :index, :show, allowed_ips: %w[192.0.2.0/24 198.51.100.1]
+```
+
+After:
+
+```ruby
+filter_ip "192.0.2.0/24", "198.51.100.1", only: [:index, :show]
+```
+
 ## [0.3.1] - 2025-12-01
 
 - Simplify IpMatcher#match? by removing unnecessary branching [#3](https://github.com/smartbank-inc/action_ip_filter/pull/3)

data/README.md

@@ -54,13 +54,13 @@ bundle install
 
 ### Basic Usage
 
-Include the concern and use `filter_ip` to protect specific actions:
+Include the concern and use `filter_ip` to protect all actions when neither `:only` nor `:except` is specified:
 
 ```ruby
 class AdminController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip :index, :show, allowed_ips: %w[192.0.2.0/24 198.51.100.1]
+  filter_ip "192.0.2.0/24", "198.51.100.1"
 
   def index
     # Only accessible from 192.0.2.0/24 or 198.51.100.1
@@ -71,27 +71,50 @@ class AdminController < ApplicationController
   end
 
   def public_action
-    # Not restricted
+    # Also restricted
   end
 end
 ```
 
-### Restrict All Actions
+#### With modifiers
+
+```ruby
+class AdminController < ApplicationController
+  include ActionIpFilter::IpFilterable
+
+  filter_ip "192.0.2.0/24", "198.51.100.1", only: [:index, :show]
+
+  def index
+    # Only accessible from 192.0.2.0/24 or 198.51.100.1
+  end
+
+  def show
+    # Also restricted
+  end
+
+  def public_action
+    # Not restricted
+  end
+end
+```
 
-Use `filter_ip_for_all` to protect all actions with optional exceptions:
+The above example is functionally equivalent to the following:
 
 ```ruby
-class WebhooksController < ApplicationController
+class AdminController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip_for_all allowed_ips: ENV["WEBHOOK_ALLOWED_IPS"].to_s.split(","),
-                    except: [:health_check]
+  filter_ip "192.0.2.0/24", "198.51.100.1", except: [:public_action]
+
+  def index
+    # Only accessible from 192.0.2.0/24 or 198.51.100.1
+  end
 
-  def stripe
-    # Restricted
+  def show
+    # Also restricted
   end
 
-  def health_check
+  def public_action
     # Not restricted
   end
 end
@@ -105,8 +128,19 @@ Pass a Proc for dynamic IP resolution:
 class SecureController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip :sensitive_action,
-    allowed_ips: -> { Rails.application.credentials.dig(:allowed_ips) || [] }
+  filter_ip -> { Rails.application.credentials.dig(:allowed_ips) || [] }
+end
+```
+
+The Proc must return a value of type `Array[String]`.
+
+You can also combine static IPs with dynamic resolution:
+
+```ruby
+class SecureController < ApplicationController
+  include ActionIpFilter::IpFilterable
+
+  filter_ip "192.0.2.0/24", -> { Rails.application.credentials.dig(:allowed_ips) || [] }
 end
 ```
 
@@ -118,8 +152,7 @@ Customize the response when access is denied. The block is executed via `instanc
 class ApiController < ApplicationController
   include ActionIpFilter::IpFilterable
 
-  filter_ip :create,
-    allowed_ips: %w[192.0.2.0/24],
+  filter_ip "192.0.2.0/24",
     on_denied: -> { render json: { error: "Access denied from #{request.remote_ip}" }, status: :forbidden }
 end
 ```

data/lib/action_ip_filter/ip_filterable.rb

@@ -6,80 +6,46 @@ module ActionIpFilter
   module IpFilterable
     extend ActiveSupport::Concern
 
-    included do
-      class_attribute :action_ip_restrictions, default: {}
-    end
-
     # @rbs!
-    #   type restriction_options = { allowed_ips: Array[String] | ^() -> Array[String], on_denied: (^() -> void)? }
-    #   def action_ip_restrictions: () -> Hash[Symbol, untyped]
-    #   def action_ip_restrictions=: (Hash[Symbol, untyped]) -> void
-
-    # @rbs!
-    #   def request: () -> ActionDispatch::Request
     #   def action_name: () -> String
-    #   def instance_exec: (*untyped) { () -> void } -> void
+    #   def instance_exec: [T] (*untyped) { () -> T } -> T
     #   def before_action: (*untyped, **untyped) -> void
 
     class_methods do
-      # @rbs *actions: Symbol
-      # @rbs allowed_ips: Array[String] | ^() -> Array[String]
-      # @rbs on_denied: (^() -> void)?
-      # @rbs return: void
-      def filter_ip(*actions, allowed_ips:, on_denied: nil)
-        actions.flatten.each do |action|
-          self.action_ip_restrictions = action_ip_restrictions.merge(action.to_sym => {allowed_ips:, on_denied:})
-          before_action -> { check_ip_restriction(action) }, only: action
-        end
-      end
-
-      # @rbs allowed_ips: Array[String] | ^() -> Array[String]
-      # @rbs except: Array[Symbol]
+      # @rbs allowed_ips: String | ^() -> Array[String]
       # @rbs on_denied: (^() -> void)?
+      # @rbs only: Array[Symbol]?
+      # @rbs except: Array[Symbol]?
       # @rbs return: void
-      def filter_ip_for_all(allowed_ips:, except: [], on_denied: nil)
-        # note: hyphen is not allowed in method (i.e., action) names, so it's safe to use it as a marker
-        self.action_ip_restrictions = action_ip_restrictions.merge("all-marker": {allowed_ips:, on_denied:})
-        before_action :check_ip_restriction_for_all, except:
+      def filter_ip(*allowed_ips, on_denied: nil, only: nil, except: nil)
+        before_action -> { verify_ip_access(allowed_ips:, on_denied:) }, only:, except:
       end
     end
 
     private
 
-    # @rbs action: Symbol
+    # @rbs allowed_ips: Array[String | ^() -> Array[String]]
+    # @rbs on_denied: (^() -> void)?
     # @rbs return: void
-    def check_ip_restriction(action)
-      verify_ip_access(action_ip_restrictions[action.to_sym])
-    end
+    def verify_ip_access(allowed_ips:, on_denied:)
+      return if ActionIpFilter.test_mode?
 
-    # @rbs return: void
-    def check_ip_restriction_for_all
-      verify_ip_access(action_ip_restrictions[:"all-marker"])
-    end
-
-    # @rbs restriction: restriction_options?
-    # @rbs return: void
-    def verify_ip_access(restriction)
-      return if restriction.nil? || ActionIpFilter.test_mode?
+      client_ip = instance_exec(&ActionIpFilter.configuration.ip_resolver)
 
-      client_ip = instance_exec(&ActionIpFilter.configuration.ip_resolver) #: String?
-      allowed_ips = resolve_allowed_ips(restriction[:allowed_ips])
+      allowed = allowed_ips.any? do |allowed_ip|
+        ips = case allowed_ip
+        when Proc
+          instance_exec(&allowed_ip)
+        else
+          [allowed_ip]
+        end
 
-      unless IpMatcher.allowed?(client_ip, allowed_ips)
-        log_ip_denial(client_ip)
-        on_denied = restriction[:on_denied] || ActionIpFilter.configuration.on_denied
-        instance_exec(&on_denied)
+        IpMatcher.allowed?(client_ip, ips)
       end
-    end
 
-    # @rbs allowed_ips: Array[String] | ^() -> Array[String]
-    # @rbs return: Array[String]
-    def resolve_allowed_ips(allowed_ips)
-      case allowed_ips
-      when Proc
-        instance_exec(&allowed_ips) #: Array[String]
-      else
-        Array(allowed_ips)
+      unless allowed
+        log_ip_denial(client_ip)
+        instance_exec(&on_denied || ActionIpFilter.configuration.on_denied)
       end
     end
 

data/lib/action_ip_filter/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActionIpFilter
-  VERSION = "0.3.1" #: String
+  VERSION = "0.4.0" #: String
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: action_ip_filter
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - SmartBank, Inc.