api_keys 0.3.0 → 0.4.0

data/lib/api_keys/form_builder_extensions.rb

@@ -110,7 +110,8 @@ module ApiKeys
     #   - :masked [String] The masked token (e.g., "sk_live_••••abc")
     #   - :full [String, nil] The full token (only for viewable public keys)
     #   - :viewable [Boolean] Whether the full token can be displayed
-    #   - :type [Symbol] The key type (:publishable, :secret, or nil)
+    #   - :type [Symbol, String, nil] A known built-in type is a Symbol; custom
+    #     untrusted values remain Strings so they are never interned as Symbols.
     #   - :environment [String, nil] The environment (e.g., "live", "test")
     #
     # @example
@@ -127,13 +128,22 @@ module ApiKeys
         masked: object.masked_token,
         full: object.viewable_token,
         viewable: object.respond_to?(:public_key_type?) && object.public_key_type?,
-        type: object.key_type&.to_sym,
+        type: safe_key_type(object.key_type),
         environment: object.environment
       }
     end
 
     private
 
+    def safe_key_type(value)
+      case value.to_s
+      when "publishable" then :publishable
+      when "secret" then :secret
+      when "" then nil
+      else value.to_s
+      end
+    end
+
     def resolve_checked_scopes(scopes, checked)
       case checked
       when :all

data/lib/api_keys/helpers/expiration_options.rb

@@ -24,7 +24,7 @@ module ApiKeys
         { label: "60 days", value: "60_days", days: 60 },
         { label: "90 days", value: "90_days", days: 90 },
         { label: "1 year", value: "365_days", days: 365 }
-      ].freeze
+      ].map(&:freeze).freeze
 
       class << self
         # Returns options suitable for a Rails select helper.
@@ -65,9 +65,13 @@ module ApiKeys
         #   ExpirationOptions.parse("30_days")  # => 30.days.from_now
         #   ExpirationOptions.parse("no_expiration")  # => nil
         #   ExpirationOptions.parse(nil)  # => nil
-        #   ExpirationOptions.parse("invalid")  # => nil
+        #   ExpirationOptions.parse("invalid")  # => raises ArgumentError
         #
         def parse(preset)
+          return nil if preset.nil? || preset == ""
+          unless preset.is_a?(String) && preset.valid_encoding? && preset.bytesize <= 32
+            raise ArgumentError, "Invalid API key expiration preset"
+          end
           return nil if preset.blank? || preset == "no_expiration"
 
           # Try to extract days from the preset string (e.g., "30_days" => 30)
@@ -81,7 +85,7 @@ module ApiKeys
           known = DEFAULT_PRESETS.find { |p| p[:value] == preset }
           return known[:days].days.from_now if known && known[:days]
 
-          nil
+          raise ArgumentError, "Invalid API key expiration preset"
         end
 
         # Returns the default preset value (useful for form defaults)
@@ -102,6 +106,10 @@ module ApiKeys
         end
 
         def build_custom_presets(days_list, include_no_expiration)
+          unless days_list.is_a?(Array) && days_list.all? { |days| days.is_a?(Integer) && days.between?(1, 3650) }
+            raise ArgumentError, "Expiration presets must be an array of integers between 1 and 3650"
+          end
+
           options = []
 
           if include_no_expiration

data/lib/api_keys/helpers/token_session.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/numeric/time"
+require "active_support/message_encryptor"
+require "json"
+
 module ApiKeys
   module Helpers
     # Helper for managing API key tokens in the session.
@@ -8,8 +12,8 @@ module ApiKeys
     # the plaintext token is not stored in the database. This helper provides
     # a clean interface for the "show token once" pattern:
     #
-    # 1. After creating a key, store the token in the session
-    # 2. On the success page, retrieve (and clear) the token
+    # 1. After creating a key, store an encrypted, short-lived handoff in the session
+    # 2. On the success page, decrypt, retrieve, and clear the token
     # 3. If the user refreshes, the token is gone
     #
     # @example In your controller
@@ -29,9 +33,28 @@ module ApiKeys
     class TokenSession
       # Default session key for storing the token
       DEFAULT_SESSION_KEY = :api_keys_new_token
+      MAX_TOKEN_BYTESIZE = 512
+      MAX_CIPHERTEXT_BYTESIZE = 4096
+      MAX_KEY_ID_BYTESIZE = 128
+      HANDOFF_VERSION = 2
+      HANDOFF_TTL = 10.minutes
+      ENCRYPTION_CIPHER = "aes-256-gcm"
+      ENCRYPTION_SALT = "api_keys/token_session/v2"
+      ENCRYPTION_PURPOSE = "api_keys.token_session"
+      JSON_SERIALIZER = Module.new do
+        module_function
+
+        def dump(value)
+          JSON.generate(value)
+        end
+
+        def load(value)
+          JSON.parse(value)
+        end
+      end
 
       class << self
-        # Store an API key's token in the session for later retrieval.
+        # Store an encrypted API key-token handoff in the session for later retrieval.
         #
         # @param session [ActionDispatch::Request::Session] The Rails session
         # @param api_key [ApiKeys::ApiKey] The newly created API key
@@ -39,7 +62,21 @@ module ApiKeys
         # @return [String] The token that was stored
         def store(session, api_key, key: DEFAULT_SESSION_KEY)
           token = api_key.respond_to?(:token) ? api_key.token : api_key.to_s
-          session[key] = token
+          unless valid_token_payload?(token)
+            raise ArgumentError, "Cannot store an invalid API key token in the session"
+          end
+
+          api_key_id = normalize_api_key_id(api_key.id) if api_key.respond_to?(:id)
+          encrypted_payload = token_encryptor.encrypt_and_sign(
+            { "token" => token, "api_key_id" => api_key_id },
+            expires_in: HANDOFF_TTL,
+            purpose: ENCRYPTION_PURPOSE
+          )
+          session[key] = {
+            "version" => HANDOFF_VERSION,
+            "ciphertext" => encrypted_payload,
+            "api_key_id" => api_key_id
+          }
           token
         end
 
@@ -49,8 +86,22 @@ module ApiKeys
         # @param session [ActionDispatch::Request::Session] The Rails session
         # @param key [Symbol] Optional custom session key (default: :api_keys_new_token)
         # @return [String, nil] The token, or nil if not present
-        def retrieve_once(session, key: DEFAULT_SESSION_KEY)
-          session.delete(key)
+        def retrieve_once(session, key: DEFAULT_SESSION_KEY, api_key: nil, api_key_id: nil)
+          payload = session.delete(key)
+          expected_id = normalize_api_key_id(api_key_id || (api_key.id if api_key.respond_to?(:id)))
+
+          # Plain string payloads from older versions remain readable only when
+          # the caller does not request ID binding.
+          return payload if expected_id.nil? && valid_token_payload?(payload)
+          decoded_payload = decode_payload(payload)
+          return nil unless decoded_payload
+
+          token = decoded_payload["token"] || decoded_payload[:token]
+          stored_id = decoded_payload["api_key_id"] || decoded_payload[:api_key_id]
+          return nil if expected_id && stored_id.to_s != expected_id.to_s
+          return nil unless valid_token_payload?(token)
+
+          token
         end
 
         # Check if a token is available in the session without removing it.
@@ -59,8 +110,92 @@ module ApiKeys
         # @param session [ActionDispatch::Request::Session] The Rails session
         # @param key [Symbol] Optional custom session key (default: :api_keys_new_token)
         # @return [Boolean] true if a token is stored
-        def available?(session, key: DEFAULT_SESSION_KEY)
-          session[key].present?
+        def available?(session, key: DEFAULT_SESSION_KEY, api_key: nil, api_key_id: nil)
+          payload = session[key]
+          expected_id = normalize_api_key_id(api_key_id || (api_key.id if api_key.respond_to?(:id)))
+
+          return valid_token_payload?(payload) if payload.is_a?(String) && expected_id.nil?
+          decoded_payload = decode_payload(payload)
+          return false unless decoded_payload
+
+          token = decoded_payload["token"] || decoded_payload[:token]
+          stored_id = decoded_payload["api_key_id"] || decoded_payload[:api_key_id]
+          return false if expected_id && stored_id.to_s != expected_id.to_s
+
+          valid_token_payload?(token)
+        end
+
+        private
+
+        def decode_payload(payload)
+          return nil unless payload.is_a?(Hash)
+
+          version_present = payload.key?("version") || payload.key?(:version)
+          return legacy_payload(payload) unless version_present
+
+          version = payload["version"] || payload[:version]
+          return nil unless version == HANDOFF_VERSION
+
+          ciphertext = payload["ciphertext"] || payload[:ciphertext]
+          outer_id = normalize_api_key_id(payload["api_key_id"] || payload[:api_key_id])
+          return nil unless ciphertext.is_a?(String) && ciphertext.bytesize <= MAX_CIPHERTEXT_BYTESIZE
+
+          decoded = token_encryptor.decrypt_and_verify(ciphertext, purpose: ENCRYPTION_PURPOSE)
+          return nil unless decoded.is_a?(Hash)
+
+          inner_id = normalize_api_key_id(decoded["api_key_id"] || decoded[:api_key_id])
+          return nil unless outer_id == inner_id
+
+          decoded
+        rescue ActiveSupport::MessageEncryptor::InvalidMessage, ArgumentError
+          nil
+        end
+
+        def legacy_payload(payload)
+          token = payload["token"] || payload[:token]
+          stored_id = normalize_api_key_id(payload["api_key_id"] || payload[:api_key_id])
+          return nil unless valid_token_payload?(token)
+
+          { "token" => token, "api_key_id" => stored_id }
+        rescue ArgumentError
+          nil
+        end
+
+        def normalize_api_key_id(value)
+          return nil if value.nil?
+
+          normalized = value.to_s
+          valid = normalized.present? && normalized.valid_encoding? &&
+            normalized.bytesize <= MAX_KEY_ID_BYTESIZE &&
+            normalized.each_codepoint.none? { |codepoint| codepoint <= 0x20 || codepoint == 0x7f }
+          raise ArgumentError, "API key ID is invalid" unless valid
+
+          normalized
+        rescue ArgumentError
+          raise ArgumentError, "API key ID is invalid"
+        end
+
+        def token_encryptor
+          application = Rails.application if defined?(Rails) && Rails.respond_to?(:application)
+          unless application&.respond_to?(:key_generator)
+            raise ArgumentError, "Rails.application.key_generator is required for secure token handoff"
+          end
+
+          key_length = ActiveSupport::MessageEncryptor.key_len(ENCRYPTION_CIPHER)
+          encryption_key = application.key_generator.generate_key(ENCRYPTION_SALT, key_length)
+          ActiveSupport::MessageEncryptor.new(
+            encryption_key,
+            cipher: ENCRYPTION_CIPHER,
+            serializer: JSON_SERIALIZER
+          )
+        end
+
+        def valid_token_payload?(token)
+          token.is_a?(String) && token.present? && token.valid_encoding? &&
+            token.bytesize <= MAX_TOKEN_BYTESIZE &&
+            token.each_codepoint.none? { |codepoint| codepoint <= 0x20 || codepoint == 0x7f }
+        rescue ArgumentError
+          false
         end
       end
     end

data/lib/api_keys/helpers/view_helpers.rb

@@ -185,7 +185,11 @@ module ApiKeys
       #   # => { type: :publishable, label: "Publishable", color: :green }
       #
       def api_key_type_info(api_key)
-        type = api_key.key_type.presence&.to_sym || :secret
+        type = case api_key.key_type.to_s
+               when "", "secret" then :secret
+               when "publishable" then :publishable
+               else api_key.key_type.to_s
+               end
         {
           type: type,
           label: api_key_type_label(api_key),

data/lib/api_keys/jobs/callbacks_job.rb

@@ -10,8 +10,8 @@ module ApiKeys
     class CallbacksJob < ActiveJob::Base
       include ApiKeys::Logging
 
-      # Use the queue name specified in the configuration (evaluated at load time)
-      queue_as ApiKeys.configuration.callbacks_job_queue
+      # Resolve the configured queue for each job so initializer changes apply.
+      queue_as { ApiKeys.configuration.callbacks_job_queue }
 
       # Executes the appropriate callback based on the type.
       #
@@ -28,10 +28,8 @@ module ApiKeys
         else
           log_warn "[ApiKeys::Jobs::CallbacksJob] Unknown callback type: #{callback_type}"
         end
-      rescue StandardError => e
-        log_error "[ApiKeys::Jobs::CallbacksJob] Error executing callback #{callback_type} with context #{context.inspect}: #{e.class}: #{e.message}
-#{e.backtrace.join("
-")}"
+      rescue StandardError => error
+        log_error "[ApiKeys::Jobs::CallbacksJob] Error executing callback #{callback_type} (#{error.class})."
         # Avoid retrying callback errors by default, as the original request succeeded.
         # Depending on callback importance, users might configure retries separately.
       end
@@ -51,17 +49,12 @@ module ApiKeys
         arity = callback_proc.arity
         log_debug "[ApiKeys::Jobs::CallbacksJob] Executing callback with arity #{arity}"
 
-        begin
-          if arity == 1 || arity < 0 # Handle procs accepting one arg or variable args (*args)
-            callback_proc.call(context)
-          elsif arity == 0 # Handle procs accepting no args
-            callback_proc.call
-          else
-            log_warn "[ApiKeys::Jobs::CallbacksJob] Callback has unexpected arity (#{arity}). Expected 0 or 1 argument (context hash). Skipping execution."
-          end
-        rescue StandardError => e
-          # Log the specific error from the user's callback code
-          raise # Re-raise to be caught by the main perform rescue block for logging
+        if arity == 1 || arity < 0 # Handle procs accepting one arg or variable args (*args)
+          callback_proc.call(context)
+        elsif arity == 0 # Handle procs accepting no args
+          callback_proc.call
+        else
+          log_warn "[ApiKeys::Jobs::CallbacksJob] Callback has unexpected arity (#{arity}). Expected 0 or 1 argument (context hash). Skipping execution."
         end
       end
     end

data/lib/api_keys/jobs/update_stats_job.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "active_job"
+require "active_support/core_ext/numeric/time"
 require_relative "../models/api_key"
 require_relative "../logging"
 
@@ -11,8 +12,10 @@ module ApiKeys
     class UpdateStatsJob < ActiveJob::Base
       include ApiKeys::Logging # Include logging helpers
 
-      # Use the queue name specified in the configuration (evaluated at load time)
-      queue_as ApiKeys.configuration.stats_job_queue
+      MAX_FUTURE_CLOCK_SKEW = 5.minutes
+
+      # Resolve the configured queue for each job so initializer changes apply.
+      queue_as { ApiKeys.configuration.stats_job_queue }
 
       # Perform the database updates for the given ApiKey.
       #
@@ -26,11 +29,25 @@ module ApiKeys
           return
         end
 
-        log_debug "[ApiKeys::Jobs::UpdateStatsJob] Updating stats for ApiKey ID: #{api_key_id} at #{timestamp}"
+        unless timestamp.respond_to?(:to_time)
+          log_warn "[ApiKeys::Jobs::UpdateStatsJob] Invalid timestamp for ApiKey ID: #{api_key_id}. Skipping stats update."
+          return
+        end
+        timestamp = timestamp.to_time
+
+        if timestamp > Time.current + MAX_FUTURE_CLOCK_SKEW
+          log_warn "[ApiKeys::Jobs::UpdateStatsJob] Rejected a timestamp too far in the future."
+          return
+        end
+
+        log_debug "[ApiKeys::Jobs::UpdateStatsJob] Updating stats for ApiKey ID: #{api_key_id}"
 
-        # Use provided timestamp for consistency
-        # Use update_column to skip validations/callbacks for performance
-        api_key.update_column(:last_used_at, timestamp)
+        # Jobs may execute out of order. Update only when this event is newer so
+        # last_used_at can never regress to an earlier request timestamp.
+        ApiKey
+          .where(id: api_key.id)
+          .where("last_used_at IS NULL OR last_used_at < ?", timestamp)
+          .update_all(last_used_at: timestamp)
 
         # Conditionally increment requests_count if configured
         if ApiKeys.configuration.track_requests_count
@@ -41,16 +58,14 @@ module ApiKeys
 
         log_debug "[ApiKeys::Jobs::UpdateStatsJob] Finished updating stats for ApiKey ID: #{api_key_id}"
 
-      rescue ActiveRecord::ActiveRecordError => e
+      rescue ActiveRecord::ActiveRecordError => error
         # Log error but don't automatically retry unless configured to do so.
         # Frequent stats updates might tolerate occasional failures better than endless retries.
-        log_error "[ApiKeys::Jobs::UpdateStatsJob] Failed to update stats for ApiKey ID: #{api_key_id}. Error: #{e.message}"
+        log_error "[ApiKeys::Jobs::UpdateStatsJob] Failed to update stats for ApiKey ID: #{api_key_id} (#{error.class})."
         # Depending on ActiveJob adapter, specific retry logic might be needed here
         # or configured globally. For now, just log.
-      rescue StandardError => e
-        log_error "[ApiKeys::Jobs::UpdateStatsJob] Unexpected error processing ApiKey ID: #{api_key_id}. Error: #{e.class}: #{e.message}
-#{e.backtrace.join("
-")}"
+      rescue StandardError => error
+        log_error "[ApiKeys::Jobs::UpdateStatsJob] Unexpected error processing ApiKey ID: #{api_key_id} (#{error.class})."
         # Consider re-raising or using a dead-letter queue strategy depending on job system
       end
     end