apigatewayv2_rack 0.1.3 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9c5a5dcc23b7a6e524d7a8c847befb580b8771839ae013c977991e35db824ef
-  data.tar.gz: e33794f5ffae56ad06cb14f12fcac3b3a41ad5e33f6119a9c262756801d9f3b6
+  metadata.gz: 04c7d7c16ea85d001867d8a248974da31c37a028af40e42ef106ee14ef70a58d
+  data.tar.gz: 8685f08020c4afdf89b62561401234df587ffcb0d2cf626288b615f196139541
 SHA512:
-  metadata.gz: 6a27469fcbc9c1bc754aca949ed94fce1ec83f4e1cd5909fa70bee771267dd480ef12f78d69508205913f88c23bc4082a149279975ec6e5ed8897c0d5e777fbd
-  data.tar.gz: 88ff099fa17b319cf2f1cedd08091eeeff14874a7c9fa9eac37430e4ed98b2e51b7e2f1b2bf6146cb215730c637cbc639016ecd1b64e6759e96c26892c541491
+  metadata.gz: e7ad2b28601feed547b70d35a28dbe595e3f233825fa616ac022eb8bee29194914dfd566d39e387835b855acadb2f9f599a9d8ea206dc29f1abc189d7fe65efc
+  data.tar.gz: 73eab07aa3d0c1360e57d41e173458a957c5fae92c41a803be4c259a3d2891af4558363fde38198a39fa500805f4df478c9f8a44aabfc51509de8fb4e0b2cb83

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 ## [Unreleased]
 
+## [0.2.0] - 2023-03-24
+
+- `Apigatewayv2Rack.handle_request` now takes a block and pass rack env and `Apigatewayv2Rack::Request` object to allow final modification before passing env to a Rack app.
+- `Apigatewayv2Rack.generate_handler` and `handler_from_rack_config_file` propagates given block to `handle_request` for the enhancement above.
+- Introduce `Apigatewayv2Rack::Middlewares::CloudfrontXff` and `Apigatewayv2Rack::Middlewares::CloudfrontVerify` as a helper middleware.
+
 ## [0.1.3] - 2023-03-22
 
 - Fixed Errno::EACCES from StringIO when a streaming body (body does not respond to `#each`) is returned

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    apigatewayv2_rack (0.1.3)
+    apigatewayv2_rack (0.2.0)
       rack
 
 GEM
@@ -33,4 +33,4 @@ DEPENDENCIES
   rspec (~> 3.0)
 
 BUNDLED WITH
-   2.3.16
+   2.3.21

data/README.md

@@ -43,6 +43,13 @@ p resp.as_json
 
 See [./Dockerfile.integration](./Dockerfile.integration) and [./integration](./integration).
 
+### Middlewares
+
+This gem includes several utility middlewares:
+
+- [CloudfrontVerify](./lib/apigatewayv2_rack/middlewares/cloudfront_verify.rb): Verify `x-origin-header` value to protect unwanted direct access.
+- [CloudfrontXff](./lib/apigatewayv2_rack/middlewares/cloudfront_xff.rb): Respect `cloudfront-viewer-address` as `x-forwarded-for` value.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/apigatewayv2_rack/middlewares/cloudfront_verify.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+require 'rack/utils'
+
+module Apigatewayv2Rack
+  module Middlewares
+    # Compare X-Origin-Verify header matches the expected value and otherwise returns 403.
+    # This is useful to use with CloudFront's origin custom request header to protect from direct access to function.
+    #
+    # See also: https://www.wellarchitectedlabs.com/security/300_labs/300_multilayered_api_security_with_cognito_and_waf/3_prevent_requests_from_accessing_api_directly/
+    class CloudfrontVerify
+      # +value+ is an expected string value of x-origin-verify.
+      def initialize(app, value)
+        @app = app
+        @value = value
+      end
+
+      def env_name
+        'HTTP_X_ORIGIN_VERIFY'
+      end
+
+      def call(env)
+        given = env[env_name]
+
+        unless given && Rack::Utils.secure_compare(given, @value)
+          env['rack.logger']&.warn("#{self.class.name} protected unwanted access from #{env['REMOTE_ADDR'].inspect}")
+          return [401, {'Content-Type' => 'text/plain'}, ['Unauthorized']]
+        end
+
+        @app.call(env)
+      end
+    end
+  end
+end

data/lib/apigatewayv2_rack/middlewares/cloudfront_xff.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Apigatewayv2Rack
+  module Middlewares
+    # Apigatewayv2Rack::Middlewares::CloudfrontXff transforms cloudfront-viewer-address to x-forwarded-for value.
+    # It is recommended to use with Apigatewayv2Rack::Middlewares::CloudfrontVerify.
+    class CloudfrontXff
+      # When +replace_remote_addr_with+ is set, REMOTE_ADDR will be replaced with given value; this
+      # allows Rack::Request#ip to respect xff on its default ip_filter. Default to 127.0.0.1.
+      def initialize(app, replace_remote_addr_with: '127.0.0.1')
+        @app = app
+        @replace_remote_addr_with = replace_remote_addr_with
+      end
+
+      V6_REGEXP = /^([a-f0-9:]+):(\d+)$/
+
+      def call(env)
+        viewer = env['HTTP_CLOUDFRONT_VIEWER_ADDRESS']
+        if viewer
+          addr,port = if viewer.include?('.')
+            viewer.split(?:, 2)
+          else
+            viewer.downcase.match(V6_REGEXP)&.to_a[1,2]
+          end
+
+          if addr && port
+            env['HTTP_X_APIGATEWAYV2RACK_ORIG_X_FORWARDED_FOR'] = env['HTTP_X_FORWARDED_FOR'] if env['HTTP_X_FORWARDED_FOR']
+            env['HTTP_X_APIGATEWAYV2RACK_ORIG_X_FORWARDED_PORT'] = env['HTTP_X_FORWARDED_PORT'] if env['HTTP_X_FORWARDED_PORT']
+            env['HTTP_X_FORWARDED_FOR'] = addr
+            env['HTTP_X_FORWARDED_PORT'] = port
+
+            if @replace_remote_addr_with
+              env['HTTP_X_APIGATEWAYV2RACK_ORIG_REMOTE_ADDR'] = env['REMOTE_ADDR'] if env['REMOTE_ADDR']
+              env['REMOTE_ADDR'] = @replace_remote_addr_with
+            end
+          end
+        end
+
+        @app.call(env)
+      end
+    end
+  end
+end

data/lib/apigatewayv2_rack/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Apigatewayv2Rack
-  VERSION = "0.1.3"
+  VERSION = "0.2.0"
 end

data/lib/apigatewayv2_rack.rb

@@ -5,30 +5,41 @@ require_relative "apigatewayv2_rack/error"
 require_relative "apigatewayv2_rack/request"
 require_relative "apigatewayv2_rack/response"
 
+require_relative "apigatewayv2_rack/middlewares/cloudfront_xff"
+require_relative "apigatewayv2_rack/middlewares/cloudfront_verify"
+
 module Apigatewayv2Rack
   # Takes Rack +app+, Lambda +event+ and +context+ of API Gateway V2 event and
   # returns a HTTP response from +app+ as API Gateway V2 Lambda event format.
-  def self.handle_request(app:, event:, context:, request_options: {})
+  #
+  # When block is given, converted Rack env will be passed to make some final
+  # modification before passing it to an +app+.
+  def self.handle_request(app:, event:, context:, request_options: {}, &block)
     req = Request.new(event, context, **request_options)
-    status, headers, body = app.call(req.to_h)
+    env = req.to_h
+    block&.call(env, req)
+    status, headers, body = app.call(env)
     Response.new(status: status, headers: headers, body: body, elb: req.elb?, multivalued: req.multivalued?).as_json
   end
 
   module Handler
-    attr_reader :app 
-    def handle(event:, context:)
-      Apigatewayv2Rack.handle_request(event: event, context: context, app: @app)
+    attr_reader :app
+    attr_reader :block
+    def handle(event:, context:, &givenblock)
+      b = givenblock || @block
+      Apigatewayv2Rack.handle_request(event: event, context: context, app: @app, &b)
     end
   end
 
-  def self.generate_handler(app)
+  def self.generate_handler(app, &block)
     m = Module.new
     m.extend(Handler)
     m.instance_variable_set(:@app, app)
+    m.instance_variable_set(:@block, block)
     m
   end
 
-  def self.handler_from_rack_config_file(path = './config.ru')
+  def self.handler_from_rack_config_file(path = './config.ru', &block)
     require 'rack'
     require 'rack/builder'
     app = if Rack.release[0] == '2'
@@ -36,6 +47,6 @@ module Apigatewayv2Rack
     else
       Rack::Builder.load_file(path)
     end
-    generate_handler(app)
+    generate_handler(app, &block)
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: apigatewayv2_rack
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.2.0
 platform: ruby
 authors:
 - Sorah Fukumori
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-03-21 00:00:00.000000000 Z
+date: 2023-03-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -50,6 +50,8 @@ files:
 - integration/template.jsonnet
 - lib/apigatewayv2_rack.rb
 - lib/apigatewayv2_rack/error.rb
+- lib/apigatewayv2_rack/middlewares/cloudfront_verify.rb
+- lib/apigatewayv2_rack/middlewares/cloudfront_xff.rb
 - lib/apigatewayv2_rack/request.rb
 - lib/apigatewayv2_rack/response.rb
 - lib/apigatewayv2_rack/version.rb
@@ -76,7 +78,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.0.dev
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: handle AWS Lambda API Gateway V2 or ALB (ELBv2) lambda request event with