aikido-zen 1.7.0 → 1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 651c1ff033d7689d75fa83bc27e64249463e74ad5ecac534df46e2cae96fcda2
-  data.tar.gz: 8232034fd237b6b4be9cde3cbea8d35c9a796d05b6f72bb90ff4cfc63888d037
+  metadata.gz: ddee51760626c0c9d7af69137f88286d0b49ac9d5aab02d17bebbff71136bb0f
+  data.tar.gz: 7b5ea9701c89111b1423c99750495b7a4d85b725e78008d93b110e4a2be9007c
 SHA512:
-  metadata.gz: bf4940ca74224b195ddbe9447b5d14d61b6f677c152f484a5ed71b6fe100482e5bd71d917f57807b632b24e93e4b9f6d9dbb53f6cc5cdc280dcf3e3315fdbcfd
-  data.tar.gz: f7746da3d5a9bb8e4c54be18c689fc3338ba7598fe59a683921ff47a8455b6800572016a4ad1103bc42aa0f01e09f34d9e38aecf957474c8dbd18847632ac937
+  metadata.gz: edada0391a4cc9f6982dddedd67e6972a13ddb60fad9c723cd1c369e36c3ba5699637dbfacce686c1472e6009e9927f69dcb16945ae7c41c65745e110cff614d
+  data.tar.gz: aa43771cf0fb387c55d35fc1f26b3e765ce0c36ed29764ad677fca7d4f69459310a3115088f73a2df65e35d2bc145dc6a6e2294d20ec4aed35cc81fce96de80a

data/docs/config.md

@@ -77,7 +77,9 @@ Aikido::Zen.rate_limited_responder = ->(request) {
 }
 ```
 
-By default, Zen emits a `text/plain` 429 response that says "Too many requests".
+By default, Zen emits a `text/plain` 429 response that says "Too many requests"
+and includes a `Retry-After` header with the number of seconds until the rate
+limit window resets.
 
 ### Providing details about the rate limiting
 

data/lib/aikido/zen/config.rb

@@ -409,7 +409,13 @@ module Aikido::Zen
 
     # @!visibility private
     DEFAULT_RATE_LIMITED_RESPONDER = ->(request) do
-      [429, {"Content-Type" => "text/plain"}, ["Too many requests."]]
+      rate_limit = request.env["aikido.rate_limiting"]
+      headers = {
+        "Content-Type" => "text/plain",
+        "Retry-After" => rate_limit.time_remaining.to_s
+      }
+
+      [429, headers, ["Too many requests."]]
     end
 
     # @!visibility private

data/lib/aikido/zen/rails_engine.rb

@@ -4,6 +4,31 @@ require "action_dispatch"
 
 module Aikido::Zen
   class RailsEngine < ::Rails::Engine
+    # ActionController::Live runs the whole action in a new Thread so that
+    # the original thread can be freed to handle the next request once the
+    # response headers are committed.
+    #
+    # Zen stores the current context on the current Fiber, and propagates
+    # this context to new Fibers created with Fiber.new. The root Fiber of
+    # a new Thread is not created with Fiber.new so the current context is
+    # not propagated automatically.
+    #
+    # Propagate the current context to the root Fiber of the new Thread
+    # created by ActionController::Live to run the action.
+    module LiveThreadContextSetter
+      private
+
+      def new_controller_thread(&blk)
+        context = Aikido::Zen.current_context
+
+        super do
+          Fiber.current.aikido_current_context = context
+
+          blk.call
+        end
+      end
+    end
+
     config.before_configuration do
       # Access library configuration at `Rails.application.config.zen`.
       config.zen = Aikido::Zen.config
@@ -39,6 +64,8 @@ module Aikido::Zen
       end
 
       ActiveSupport.on_load(:action_controller) do
+        ::ActionController::Live.prepend(Aikido::Zen::RailsEngine::LiveThreadContextSetter)
+
         before_action do
           Aikido::Zen.enable_idor_protection if Aikido::Zen.config.idor_protection_enabled?
         end
@@ -50,7 +77,7 @@ module Aikido::Zen
         # This way, we overwrite the Request object as early as we can in the
         # request handling, so that by the time we start evaluating inputs, we
         # have assigned the request correctly.
-        before_action { Aikido::Zen.current_context.update_request(request) }
+        before_action { Aikido::Zen.current_context&.update_request(request) }
       end
     end
 

data/lib/aikido/zen/sinks/action_controller.rb

@@ -26,6 +26,8 @@ module Aikido::Zen
           return false unless controller.respond_to?(:request)
 
           context = controller.request.env[Aikido::Zen::ENV_KEY]
+          return false if context.nil?
+
           request = context.request
 
           return false if @settings.bypassed_ips.include?(request.client_ip)

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.7.0"
+    VERSION = "1.7.1"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.7.1
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-04 00:00:00.000000000 Z
+date: 2026-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby