aikido-zen 1.7.2.beta.2 → 1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aedfb64ca08c10194c0483138460f984e086ad2ac95250d3ce570b4c08b48263
-  data.tar.gz: 6332c4155469c35483394a76683169e973feea9ba417fb4c4f434f8df3231b2e
+  metadata.gz: 41f1982e134a806c513cc166247059c3f290f6bbc88ff32dcf4bdc65da9f377d
+  data.tar.gz: d97dac2f830555239836a143b815ca3c85c4993776183ce73bc5dc392fed9618
 SHA512:
-  metadata.gz: 97a1b03ca7b5b92d944793c650f11791f7a36794e5ebcc85c6c41e6a93f71c1fbab3a5e32f0beeae6254c89ea06f23535275f20cc3732f18c8db722e4b6ec482
-  data.tar.gz: 35ba0d4afe57aba7dac30c89294a875779fba9f36413c1c335d97efb62a47b5d3beaa8c5b96d31a9dda491d89b2dd0a78851a4d5ca83dd34071732c981d92b56
+  metadata.gz: 526140c45a47c29f4f36e1508bc3305bafe535e92479c877deeb92a1f74c618fa19d7c46a7d67183310fbc414f05912b93c88f2cdb109730d04c0b4b6a54b301
+  data.tar.gz: 6c43bc7461a52ded8331b6ba2188afd9d273e1b012f5912b2d9786c439e2890380003779925bd3f37fdd4422f4b34aefe13af6d29d0a6a7f3b4e351c5019dca1

data/docs/request-bypassing.md

@@ -0,0 +1,38 @@
+# Bypass Zen for a specific request
+
+To disable Zen for a specific request, call `Aikido::Zen.request_bypassed!` from a Rack middleware. This bypasses Zen's security checks and stats collection for that request.
+
+> [!NOTE]
+> Zen already has a built-in feature for bypassing specific IP addresses. This feature offers more flexibility, letting you bypass Zen for a request based on any criteria you choose.
+
+`Aikido::Zen.request_bypassed!` needs the request's context to already be set up, so your middleware must run after Zen's `ContextSetter` middleware. The following example shows how to bypass a specific request in a Rails application:
+
+```ruby
+# config/application.rb
+class RequestBypasser
+  def initialize(app)
+    @app = app
+  end
+
+  def call(env)
+    if your_custom_logic?(env)
+      Aikido::Zen.request_bypassed! # Bypasses Zen for this request
+    end
+
+    @app.call(env)
+  end
+end
+
+module YourApp
+  class Application < Rails::Application
+    # ...
+
+    initializer "your_app.insert_request_bypasser", after: "aikido.add_middleware" do |app|
+      app.middleware.insert_after Aikido::Zen::Middleware::ContextSetter, RequestBypasser
+    end
+  end
+end
+```
+
+> [!WARNING]
+> Use this feature with caution, as it can potentially expose your application to security risks if not used properly.

data/lib/aikido/zen/context.rb

@@ -24,6 +24,10 @@ module Aikido::Zen
     attr_accessor :scanning
     alias_method :scanning?, :scanning
 
+    # @return [Boolean, nil] whether the request is bypassed.
+    attr_accessor :request_bypassed
+    alias_method :request_bypassed?, :request_bypassed
+
     # @return [Boolean] whether attack protection for the currently requested
     #   endpoint was disabled on the Aikido dashboard, or if the source IP for
     #   this request is in the "Bypass List".
@@ -48,6 +52,7 @@ module Aikido::Zen
 
       @metadata = {}
       @scanning = false
+      @request_bypassed = nil
       @protection_disabled = false
       @idor_protection_enabled = false
     end

data/lib/aikido/zen/middleware/allowed_address_checker.rb

@@ -5,8 +5,9 @@ module Aikido::Zen
     # Middleware that only allows allowed IPs when allowed IPs are configured for
     # any matching route in the Aikido dashboard.
     class AllowedAddressChecker
-      def initialize(app, config: Aikido::Zen.config, settings: Aikido::Zen.runtime_settings)
+      def initialize(app, zen: Aikido::Zen, config: zen.config, settings: zen.runtime_settings)
         @app = app
+        @zen = zen
         @config = config
         @settings = settings
       end
@@ -22,7 +23,7 @@ module Aikido::Zen
       end
 
       private def allowed?(request)
-        return true if @settings.bypassed_ips.include?(request.client_ip)
+        return true if @zen.request_bypassed?
 
         matches = @settings.endpoints.matched_settings(request.route)
 

data/lib/aikido/zen/middleware/attack_protector.rb

@@ -19,7 +19,7 @@ module Aikido::Zen
       end
 
       private def protection_disabled?(request)
-        return true if @settings.bypassed_ips.include?(request.client_ip)
+        return true if @zen.request_bypassed?
 
         !@settings.endpoints.matched_settings(request.route).all?(&:protected?)
       end

data/lib/aikido/zen/middleware/attack_wave_protector.rb

@@ -4,10 +4,9 @@ module Aikido
   module Zen
     module Middleware
       class AttackWaveProtector
-        def initialize(app, zen: Aikido::Zen, settings: Aikido::Zen.runtime_settings)
+        def initialize(app, zen: Aikido::Zen)
           @app = app
           @zen = zen
-          @settings = settings
         end
 
         def call(env)
@@ -30,7 +29,7 @@ module Aikido
           request = context.request
           return nil if request.nil?
 
-          return nil if @settings.bypassed_ips.include?(request.client_ip)
+          return nil if @zen.request_bypassed?
 
           @zen.detect_attack_wave(context, status_code)
         end

data/lib/aikido/zen/middleware/ip_list_checker.rb

@@ -15,7 +15,7 @@ module Aikido::Zen
 
         client_ip = request.client_ip
 
-        return @app.call(env) if bypassed_ip?(client_ip)
+        return @app.call(env) if @zen.request_bypassed?
 
         if !@settings.allowed_ip?(client_ip)
           return @config.blocked_responder.call(request, :ip_allowed_list)
@@ -38,10 +38,6 @@ module Aikido::Zen
 
         @app.call(env)
       end
-
-      def bypassed_ip?(client_ip)
-        @settings.bypassed_ips.include?(client_ip)
-      end
     end
   end
 end

data/lib/aikido/zen/middleware/rack_throttler.rb

@@ -34,7 +34,7 @@ module Aikido::Zen
       private
 
       def should_throttle?(request)
-        return false if @settings.bypassed_ips.include?(request.client_ip)
+        return false if @zen.request_bypassed?
 
         return false if request.actor && @settings.user_excluded_from_rate_limiting?(request.actor.id)
 

data/lib/aikido/zen/middleware/request_tracker.rb

@@ -5,8 +5,9 @@ module Aikido::Zen
     # Rack middleware used to track request
     # It implements the logic under that which is considered worthy of being tracked.
     class RequestTracker
-      def initialize(app, settings: Aikido::Zen.runtime_settings)
+      def initialize(app, zen: Aikido::Zen, settings: zen.runtime_settings)
         @app = app
+        @zen = zen
         @settings = settings
       end
 
@@ -17,13 +18,12 @@ module Aikido::Zen
         if request.route && track?(
           status_code: response[0],
           route: request.route.path,
-          http_method: request.request_method,
-          ip: request.client_ip
+          http_method: request.request_method
         )
-          Aikido::Zen.track_request(request)
+          @zen.track_request(request)
 
-          if Aikido::Zen.config.collect_api_schema?
-            Aikido::Zen.track_discovered_route(request)
+          if @zen.config.collect_api_schema?
+            @zen.track_discovered_route(request)
           end
         end
 
@@ -128,8 +128,8 @@ module Aikido::Zen
       # @param status_code [Integer]
       # @param route [String]
       # @param http_method [String]
-      def track?(status_code:, route:, http_method:, ip: nil)
-        return false if @settings.bypassed_ips.include?(ip)
+      def track?(status_code:, route:, http_method:)
+        return false if @zen.request_bypassed?
 
         # In the UI we want to show only successful (2xx) or redirect (3xx) responses
         # anything else is discarded.

data/lib/aikido/zen/middleware/user_agent_checker.rb

@@ -13,7 +13,7 @@ module Aikido::Zen
       def call(env)
         request = Aikido::Zen::Middleware.request_from(env)
 
-        return @app.call(env) if bypassed?(request)
+        return @app.call(env) if @zen.request_bypassed?
 
         user_agent = request.user_agent
 
@@ -31,10 +31,6 @@ module Aikido::Zen
 
         @app.call(env)
       end
-
-      def bypassed?(request)
-        @settings.bypassed_ips.include?(request.client_ip)
-      end
     end
   end
 end

data/lib/aikido/zen/sinks/action_controller.rb

@@ -30,7 +30,7 @@ module Aikido::Zen
 
           request = context.request
 
-          return false if @settings.bypassed_ips.include?(request.client_ip)
+          return false if @zen.request_bypassed?
 
           if should_block_user?(request)
             status, headers, body = @config.blocked_responder.call(request, :user)

data/lib/aikido/zen/sinks/async_http.rb

@@ -52,9 +52,7 @@ module Aikido::Zen
 
                 settings = Aikido::Zen.runtime_settings
 
-                client_ip = context&.request&.client_ip
-
-                unless settings.bypassed_ip?(client_ip)
+                unless Aikido::Zen.request_bypassed?
                   Aikido::Zen.track_outbound(connection)
 
                   if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/curb.rb

@@ -64,9 +64,7 @@ module Aikido::Zen
 
               settings = Aikido::Zen.runtime_settings
 
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
                 if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/em_http.rb

@@ -50,9 +50,7 @@ module Aikido::Zen
 
                 settings = Aikido::Zen.runtime_settings
 
-                client_ip = context&.request&.client_ip
-
-                unless settings.bypassed_ip?(client_ip)
+                unless Aikido::Zen.request_bypassed?
                   Aikido::Zen.track_outbound(connection)
 
                   if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/excon.rb

@@ -56,9 +56,7 @@ module Aikido::Zen
 
               settings = Aikido::Zen.runtime_settings
 
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
                 if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/http.rb

@@ -70,9 +70,7 @@ module Aikido::Zen
 
               settings = Aikido::Zen.runtime_settings
 
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
                 if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/httpclient.rb

@@ -50,9 +50,7 @@ module Aikido::Zen
 
           settings = Aikido::Zen.runtime_settings
 
-          client_ip = context&.request&.client_ip
-
-          unless settings.bypassed_ip?(client_ip)
+          unless Aikido::Zen.request_bypassed?
             Aikido::Zen.track_outbound(connection)
 
             if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/httpx.rb

@@ -55,9 +55,7 @@ module Aikido::Zen
 
               settings = Aikido::Zen.runtime_settings
 
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
                 if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/net_http.rb

@@ -86,9 +86,7 @@ module Aikido::Zen
 
               settings = Aikido::Zen.runtime_settings
 
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
                 if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/patron.rb

@@ -59,9 +59,7 @@ module Aikido::Zen
 
               settings = Aikido::Zen.runtime_settings
 
-              client_ip = context&.request&.client_ip
-
-              unless settings.bypassed_ip?(client_ip)
+              unless Aikido::Zen.request_bypassed?
                 Aikido::Zen.track_outbound(connection)
 
                 if settings.block_outbound?(connection)

data/lib/aikido/zen/sinks/typhoeus.rb

@@ -26,9 +26,7 @@ module Aikido::Zen
 
         settings = Aikido::Zen.runtime_settings
 
-        client_ip = context&.request&.client_ip
-
-        unless settings.bypassed_ip?(client_ip)
+        unless Aikido::Zen.request_bypassed?
           Aikido::Zen.track_outbound(connection)
 
           if settings.block_outbound?(connection)

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.7.2.beta.2"
+    VERSION = "1.7.2"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.61"

data/lib/aikido/zen.rb

@@ -153,6 +153,23 @@ module Aikido
       Fiber.current.aikido_current_context = context
     end
 
+    # @return [Boolean] whether the current request is bypassed.
+    def self.request_bypassed?
+      context = current_context
+      return unless context
+
+      return context.request_bypassed unless context.request_bypassed.nil?
+
+      context.request_bypassed = runtime_settings.bypassed_ip?(context.request.client_ip)
+    end
+
+    # Marks the current request as bypassed.
+    #
+    # @return [void]
+    def self.request_bypassed!
+      current_context&.request_bypassed = true
+    end
+
     # Track statistics about an HTTP request the app is handling.
     #
     # @param request [Aikido::Zen::Request]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.7.2.beta.2
+  version: 1.7.2
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-14 00:00:00.000000000 Z
+date: 2026-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -93,6 +93,7 @@ files:
 - docs/invalid-sql-queries.md
 - docs/proxy.md
 - docs/rails.md
+- docs/request-bypassing.md
 - docs/troubleshooting.md
 - lib/aikido-zen.rb
 - lib/aikido/zen.rb