apigatewayv2_rack 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0670d1d3244283b6842ca14f5c85492687f4b1cb99ce40addcdc43c1e7470a4e
-  data.tar.gz: 941caa3f4df1d593e3d6bf1c0b249ad2318976940606c5fc9878d4ca9134b439
+  metadata.gz: 04c7d7c16ea85d001867d8a248974da31c37a028af40e42ef106ee14ef70a58d
+  data.tar.gz: 8685f08020c4afdf89b62561401234df587ffcb0d2cf626288b615f196139541
 SHA512:
-  metadata.gz: a50fde7a105b2f4c4a5bb3882866b1278ac9ede7fcbe43b1275f0c98702cf6edcb0a8495544f100a511fedaea4803970107445273f247301a26b3824c2edea7f
-  data.tar.gz: 1c0b407ece9a1952bf2d986c573b2aeef087d38e59ab0ce0263386c58533c16c7b213ee7c08c947f3e1b673bc6720068a229304610e223001945c39f4a97fe59
+  metadata.gz: e7ad2b28601feed547b70d35a28dbe595e3f233825fa616ac022eb8bee29194914dfd566d39e387835b855acadb2f9f599a9d8ea206dc29f1abc189d7fe65efc
+  data.tar.gz: 73eab07aa3d0c1360e57d41e173458a957c5fae92c41a803be4c259a3d2891af4558363fde38198a39fa500805f4df478c9f8a44aabfc51509de8fb4e0b2cb83

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 ## [Unreleased]
 
+## [0.2.0] - 2023-03-24
+
+- `Apigatewayv2Rack.handle_request` now takes a block and pass rack env and `Apigatewayv2Rack::Request` object to allow final modification before passing env to a Rack app.
+- `Apigatewayv2Rack.generate_handler` and `handler_from_rack_config_file` propagates given block to `handle_request` for the enhancement above.
+- Introduce `Apigatewayv2Rack::Middlewares::CloudfrontXff` and `Apigatewayv2Rack::Middlewares::CloudfrontVerify` as a helper middleware.
+
+## [0.1.3] - 2023-03-22
+
+- Fixed Errno::EACCES from StringIO when a streaming body (body does not respond to `#each`) is returned
+- Raise error when a response body is nil
+
 ## [0.1.2] - 2023-03-22
 
 - Fixed Apigatewayv2Rack.handler_from_rack_config_file didn't work well with Rack 3.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    apigatewayv2_rack (0.1.2)
+    apigatewayv2_rack (0.2.0)
       rack
 
 GEM
@@ -33,4 +33,4 @@ DEPENDENCIES
   rspec (~> 3.0)
 
 BUNDLED WITH
-   2.3.16
+   2.3.21

data/README.md

@@ -43,6 +43,13 @@ p resp.as_json
 
 See [./Dockerfile.integration](./Dockerfile.integration) and [./integration](./integration).
 
+### Middlewares
+
+This gem includes several utility middlewares:
+
+- [CloudfrontVerify](./lib/apigatewayv2_rack/middlewares/cloudfront_verify.rb): Verify `x-origin-header` value to protect unwanted direct access.
+- [CloudfrontXff](./lib/apigatewayv2_rack/middlewares/cloudfront_xff.rb): Respect `cloudfront-viewer-address` as `x-forwarded-for` value.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/apigatewayv2_rack/middlewares/cloudfront_verify.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+require 'rack/utils'
+
+module Apigatewayv2Rack
+  module Middlewares
+    # Compare X-Origin-Verify header matches the expected value and otherwise returns 403.
+    # This is useful to use with CloudFront's origin custom request header to protect from direct access to function.
+    #
+    # See also: https://www.wellarchitectedlabs.com/security/300_labs/300_multilayered_api_security_with_cognito_and_waf/3_prevent_requests_from_accessing_api_directly/
+    class CloudfrontVerify
+      # +value+ is an expected string value of x-origin-verify.
+      def initialize(app, value)
+        @app = app
+        @value = value
+      end
+
+      def env_name
+        'HTTP_X_ORIGIN_VERIFY'
+      end
+
+      def call(env)
+        given = env[env_name]
+
+        unless given && Rack::Utils.secure_compare(given, @value)
+          env['rack.logger']&.warn("#{self.class.name} protected unwanted access from #{env['REMOTE_ADDR'].inspect}")
+          return [401, {'Content-Type' => 'text/plain'}, ['Unauthorized']]
+        end
+
+        @app.call(env)
+      end
+    end
+  end
+end

data/lib/apigatewayv2_rack/middlewares/cloudfront_xff.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Apigatewayv2Rack
+  module Middlewares
+    # Apigatewayv2Rack::Middlewares::CloudfrontXff transforms cloudfront-viewer-address to x-forwarded-for value.
+    # It is recommended to use with Apigatewayv2Rack::Middlewares::CloudfrontVerify.
+    class CloudfrontXff
+      # When +replace_remote_addr_with+ is set, REMOTE_ADDR will be replaced with given value; this
+      # allows Rack::Request#ip to respect xff on its default ip_filter. Default to 127.0.0.1.
+      def initialize(app, replace_remote_addr_with: '127.0.0.1')
+        @app = app
+        @replace_remote_addr_with = replace_remote_addr_with
+      end
+
+      V6_REGEXP = /^([a-f0-9:]+):(\d+)$/
+
+      def call(env)
+        viewer = env['HTTP_CLOUDFRONT_VIEWER_ADDRESS']
+        if viewer
+          addr,port = if viewer.include?('.')
+            viewer.split(?:, 2)
+          else
+            viewer.downcase.match(V6_REGEXP)&.to_a[1,2]
+          end
+
+          if addr && port
+            env['HTTP_X_APIGATEWAYV2RACK_ORIG_X_FORWARDED_FOR'] = env['HTTP_X_FORWARDED_FOR'] if env['HTTP_X_FORWARDED_FOR']
+            env['HTTP_X_APIGATEWAYV2RACK_ORIG_X_FORWARDED_PORT'] = env['HTTP_X_FORWARDED_PORT'] if env['HTTP_X_FORWARDED_PORT']
+            env['HTTP_X_FORWARDED_FOR'] = addr
+            env['HTTP_X_FORWARDED_PORT'] = port
+
+            if @replace_remote_addr_with
+              env['HTTP_X_APIGATEWAYV2RACK_ORIG_REMOTE_ADDR'] = env['REMOTE_ADDR'] if env['REMOTE_ADDR']
+              env['REMOTE_ADDR'] = @replace_remote_addr_with
+            end
+          end
+        end
+
+        @app.call(env)
+      end
+    end
+  end
+end

data/lib/apigatewayv2_rack/response.rb

@@ -33,6 +33,8 @@ module Apigatewayv2Rack
 
     private def consume_body
       case
+      when body.nil?
+        raise TypeError, "Rack app returned nil body"
       # FIXME: Rack::CommonLogger uses Rack::BodyProxy, which performs logging when body is closed, is not compatible with #to_ary on Rack 3 specification
       # when body.respond_to?(:to_ary)
       #   body.to_ary.join
@@ -42,7 +44,7 @@ module Apigatewayv2Rack
         body.close if body.respond_to?(:close)
         buf
       else
-        stream = StringIO.new('', 'w')
+        stream = StringIO.new(String.new, 'w')
         body.call(stream)
         stream.string
       end

data/lib/apigatewayv2_rack/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Apigatewayv2Rack
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

data/lib/apigatewayv2_rack.rb

@@ -5,30 +5,41 @@ require_relative "apigatewayv2_rack/error"
 require_relative "apigatewayv2_rack/request"
 require_relative "apigatewayv2_rack/response"
 
+require_relative "apigatewayv2_rack/middlewares/cloudfront_xff"
+require_relative "apigatewayv2_rack/middlewares/cloudfront_verify"
+
 module Apigatewayv2Rack
   # Takes Rack +app+, Lambda +event+ and +context+ of API Gateway V2 event and
   # returns a HTTP response from +app+ as API Gateway V2 Lambda event format.
-  def self.handle_request(app:, event:, context:, request_options: {})
+  #
+  # When block is given, converted Rack env will be passed to make some final
+  # modification before passing it to an +app+.
+  def self.handle_request(app:, event:, context:, request_options: {}, &block)
     req = Request.new(event, context, **request_options)
-    status, headers, body = app.call(req.to_h)
+    env = req.to_h
+    block&.call(env, req)
+    status, headers, body = app.call(env)
     Response.new(status: status, headers: headers, body: body, elb: req.elb?, multivalued: req.multivalued?).as_json
   end
 
   module Handler
-    attr_reader :app 
-    def handle(event:, context:)
-      Apigatewayv2Rack.handle_request(event: event, context: context, app: @app)
+    attr_reader :app
+    attr_reader :block
+    def handle(event:, context:, &givenblock)
+      b = givenblock || @block
+      Apigatewayv2Rack.handle_request(event: event, context: context, app: @app, &b)
     end
   end
 
-  def self.generate_handler(app)
+  def self.generate_handler(app, &block)
     m = Module.new
     m.extend(Handler)
     m.instance_variable_set(:@app, app)
+    m.instance_variable_set(:@block, block)
     m
   end
 
-  def self.handler_from_rack_config_file(path = './config.ru')
+  def self.handler_from_rack_config_file(path = './config.ru', &block)
     require 'rack'
     require 'rack/builder'
     app = if Rack.release[0] == '2'
@@ -36,6 +47,6 @@ module Apigatewayv2Rack
     else
       Rack::Builder.load_file(path)
     end
-    generate_handler(app)
+    generate_handler(app, &block)
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: apigatewayv2_rack
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Sorah Fukumori
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-03-21 00:00:00.000000000 Z
+date: 2023-03-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -50,6 +50,8 @@ files:
 - integration/template.jsonnet
 - lib/apigatewayv2_rack.rb
 - lib/apigatewayv2_rack/error.rb
+- lib/apigatewayv2_rack/middlewares/cloudfront_verify.rb
+- lib/apigatewayv2_rack/middlewares/cloudfront_xff.rb
 - lib/apigatewayv2_rack/request.rb
 - lib/apigatewayv2_rack/response.rb
 - lib/apigatewayv2_rack/version.rb
@@ -76,7 +78,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.0.dev
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: handle AWS Lambda API Gateway V2 or ALB (ELBv2) lambda request event with