aris 1.4.2 → 1.5.0

data/lib/aris/plugins/csrf.rb

@@ -1,48 +1,89 @@
+# lib/aris/plugins/csrf.rb
+#
+# Session-backed CSRF protection (synchronizer token pattern).
+#
+# Requires the Session plugin earlier in the same `use:` list:
+#
+#   use: [:session, :csrf]
+#
+# The generator makes sure the session holds a token and exposes it as
+# `request.csrf_token`. The protection step rejects POST/PUT/PATCH/DELETE
+# requests whose token (form field `_csrf`, or header `X-CSRF-Token`) does
+# not match the one in the session.
+#
+# In a form:   input type: "hidden", name: "_csrf", value: request.csrf_token
+# With fetch:  headers: { 'X-CSRF-Token': token }
 require 'securerandom'
+require 'rack/utils'
+
 module Aris
   module Plugins
     module CsrfUtility
       extend self
+
+      SESSION_KEY = :_csrf_token
+      FIELD_NAME = '_csrf'
+      HEADER_NAME = 'HTTP_X_CSRF_TOKEN'
+
       def generate_token
         SecureRandom.urlsafe_base64(32)
       end
+
       def validate_token(expected, provided)
-        expected && provided && expected == provided
+        return false if expected.nil? || provided.nil?
+        expected = expected.to_s
+        provided = provided.to_s
+        return false if expected.empty? || provided.empty?
+        ::Rack::Utils.secure_compare(expected, provided)
+      end
+
+      # The token the client sent, wherever it put it.
+      def provided_token(request)
+        header = request.respond_to?(:env) && request.env.respond_to?(:[]) ? request.env[HEADER_NAME] : nil
+        header ||= request.headers[HEADER_NAME] if request.respond_to?(:headers) && request.headers.respond_to?(:[])
+        return header if header && !header.to_s.empty?
+
+        %i[form_params multipart_params params].each do |reader|
+          next unless request.respond_to?(reader)
+          value = request.public_send(reader)
+          token = value[FIELD_NAME] if value.respond_to?(:[])
+          return token if token && !token.to_s.empty?
+        end
+        nil
       end
     end
-    
-    CSRF_THREAD_KEY = :aris_csrf_token
+
     FORM_METHODS = %w[POST PUT PATCH DELETE].freeze
-        
+
     class CsrfTokenGenerator
       def self.call(request, response)
-        if request.method == 'GET' || request.method == 'HEAD'
-          token = CsrfUtility.generate_token
-          Thread.current[CSRF_THREAD_KEY] = token
+        unless request.respond_to?(:session)
+          raise ArgumentError, "CSRF protection needs the Session plugin before it: use: [:session, :csrf]"
         end
+        request.session[CsrfUtility::SESSION_KEY] ||= CsrfUtility.generate_token
+        token = request.session[CsrfUtility::SESSION_KEY]
+        request.define_singleton_method(:csrf_token) { token }
         nil # Continue pipeline
       end
     end
-    
+
     class CsrfProtection
       def self.call(request, response)
-        return nil unless FORM_METHODS.include?(request.method)
-        expected = Thread.current[CSRF_THREAD_KEY]
-        provided = request.headers['HTTP_X_CSRF_TOKEN']
-        unless CsrfUtility.validate_token(expected, provided)
-          response.status = 403
-          response.headers['content-type'] = 'text/plain'
-          response.body = ['CSRF token validation failed']
-          return response
-        end
-        
-        nil
+        return nil unless FORM_METHODS.include?(request.method.to_s.upcase)
+        expected = request.respond_to?(:session) ? request.session[CsrfUtility::SESSION_KEY] : nil
+        provided = CsrfUtility.provided_token(request)
+        return nil if CsrfUtility.validate_token(expected, provided)
+
+        response.status = 403
+        response.headers['content-type'] = 'text/plain'
+        response.body = ['CSRF token validation failed']
+        response
       end
     end
-
   end
 end
-Aris.register_plugin(:csrf, 
+
+Aris.register_plugin(:csrf,
   generator: Aris::Plugins::CsrfTokenGenerator,
   protection: Aris::Plugins::CsrfProtection
-)
+)

data/lib/aris/plugins/flash.rb

@@ -121,4 +121,6 @@ end
       end
     end
   end
-end
+end
+# Self-register so `use: [:flash]` works without an explicit register_plugin call.
+Aris.register_plugin(:flash, plugin_class: Aris::Plugins::Flash)

data/lib/aris/plugins/form_parser.rb

@@ -3,43 +3,64 @@ require 'rack/utils'
 
 module Aris
   module Plugins
+    # Parses application/x-www-form-urlencoded bodies.
+    #
+    #   use: [:form_parser]
+    #
+    # Handlers read fields from `request.form_params` (form fields only) or
+    # `request.params` (query string merged with form fields).
     class FormParser
       attr_reader :config
-      
+
       PARSEABLE_METHODS = %w[POST PUT PATCH].freeze
-      
+      CONTENT_TYPE = 'application/x-www-form-urlencoded'.freeze
+
       def initialize(**config)
         @config = config
       end
-      
-def self.call(request, response)
-  return nil unless PARSEABLE_METHODS.include?(request.method)
-  
-  content_type = request.env['CONTENT_TYPE']
-  return nil unless content_type&.include?('application/x-www-form-urlencoded')
-  
-  raw_body = request.body
-  return nil if raw_body.nil? || raw_body.empty?
-  
-  begin
-    data = ::Rack::Utils.parse_nested_query(raw_body)
-    request.instance_variable_set(:@parsed_form_data, data)
-    
-    # Add clean accessor method
-    request.define_singleton_method(:form_params) do
-      @parsed_form_data || {}
-    end
-    
-  rescue => e
-    response.status = 400
-    response.headers['content-type'] = 'text/plain'
-    response.body = ['Invalid form data']
-    return response
-  end
-  
-  nil
-end
-      
+
+      def self.call(request, response)
+        return nil unless PARSEABLE_METHODS.include?(request.method.to_s.upcase)
+        return nil unless form_request?(request)
+
+        raw_body = request.body
+        return nil if raw_body.nil? || raw_body.empty?
+
+        begin
+          data = ::Rack::Utils.parse_nested_query(raw_body)
+        rescue StandardError
+          response.status = 400
+          response.headers['content-type'] = 'text/plain'
+          response.body = ['Invalid form data']
+          return response
+        end
+
+        request.instance_variable_set(:@parsed_form_data, data)
+        request.define_singleton_method(:form_params) { @parsed_form_data || {} }
+
+        # Merge into params so `request.params['field']` works for forms too.
+        if request.respond_to?(:params)
+          merged = request.params.merge(data)
+          request.instance_variable_set(:@params, merged)
+        end
+
+        nil
+      end
+
+      # Works with both adapters: Rack keeps CONTENT_TYPE in env, the Mock
+      # adapter keeps it in headers.
+      def self.form_request?(request)
+        content_type = nil
+        content_type = request.env['CONTENT_TYPE'] if request.respond_to?(:env) && request.env.respond_to?(:[])
+        content_type ||= request.headers['CONTENT_TYPE'] if request.respond_to?(:headers) && request.headers.respond_to?(:[])
+        content_type.to_s.include?(CONTENT_TYPE)
+      end
+
+      # Instances (from .build) behave exactly like the class.
+      def call(request, response)
+        self.class.call(request, response)
+      end
+
       def self.build(**config)
         new(**config)
       end

data/lib/aris/plugins/multipart.rb

@@ -16,10 +16,23 @@ module Aris
         @allowed_extensions = config[:allowed_extensions]  # nil = all allowed
       end
       
+      # Works as a class (`use: [:multipart]`, defaults) or an instance
+      # (`use: [Multipart.build(max_file_size: ..., allowed_extensions: [...])]`).
+      def self.call(request, response)
+        (@default_instance ||= new).call(request, response)
+      end
+
+      def self.content_type_of(request)
+        content_type = nil
+        content_type = request.env['CONTENT_TYPE'] if request.respond_to?(:env) && request.env.respond_to?(:[])
+        content_type ||= request.headers['CONTENT_TYPE'] if request.respond_to?(:headers) && request.headers.respond_to?(:[])
+        content_type
+      end
+
       def call(request, response)
-        return nil unless PARSEABLE_METHODS.include?(request.method)
+        return nil unless PARSEABLE_METHODS.include?(request.method.to_s.upcase)
         
-        content_type = request.env['CONTENT_TYPE']
+        content_type = self.class.content_type_of(request)
         return nil unless content_type&.include?('multipart/form-data')
         
         # Extract boundary from content type
@@ -69,6 +82,13 @@ module Aris
           
           # Attach parsed data to request
           request.instance_variable_set(:@multipart_data, parts)
+          fields = parts.each_with_object({}) { |p, h| h[p[:name]] = p[:data] if p[:type] == :field }
+          request.define_singleton_method(:multipart_data) { @multipart_data || [] }
+          request.define_singleton_method(:multipart_params) { fields }
+          request.define_singleton_method(:multipart_files) { (@multipart_data || []).select { |p| p[:type] == :file } }
+          if request.respond_to?(:params)
+            request.instance_variable_set(:@params, request.params.merge(fields))
+          end
           
         rescue => e
           response.status = 400

data/lib/aris/plugins/request_logger.rb

@@ -38,6 +38,13 @@ module Aris
       def self.build(**config)
         new(**config)
       end
+
+      # `use: [:request_logger]` (the bare symbol) runs an instance with default options.
+      def self.call(request, response)
+        (@default_instance ||= new).call(request, response)
+      end
     end
   end
-end
+end
+# Self-register so `use: [:request_logger]` works without an explicit register_plugin call.
+Aris.register_plugin(:request_logger, plugin_class: Aris::Plugins::RequestLogger)

data/lib/aris/plugins/security_headers.rb

@@ -30,6 +30,11 @@ module Aris
       def self.build(**config)
         new(**config)
       end
+
+      # `use: [:security_headers]` (the bare symbol) runs an instance with default options.
+      def self.call(request, response)
+        (@default_instance ||= new).call(request, response)
+      end
       
       private
       
@@ -96,4 +101,6 @@ def build_headers(config)
 end
     end
   end
-end
+end
+# Self-register so `use: [:security_headers]` works without an explicit register_plugin call.
+Aris.register_plugin(:security_headers, plugin_class: Aris::Plugins::SecurityHeaders)

data/lib/aris/plugins/session.rb

@@ -1,168 +1,219 @@
 # lib/aris/plugins/session.rb
+#
+# Cookie sessions that can carry authentication.
+#
+# The cookie holds an AES-256-GCM encrypted, authenticated blob keyed from
+# Aris::Config.secret_key_base. A client cannot read the session contents
+# and cannot forge or modify them: any tampering, wrong key, or expired
+# session simply loads as an empty session.
+#
+#   Aris.configure { |c| c.secret_key_base = ENV.fetch('SECRET_KEY_BASE') }
+#
+#   Aris.routes({
+#     "example.com": {
+#       use: [:session],
+#       "/login":   { post: { to: ->(req, res, prm) { req.session[:user_id] = 1; res.redirect('/') } } },
+#       "/logout":  { post: { to: ->(req, res, prm) { req.session.destroy; res.redirect('/') } } },
+#     }
+#   })
+#
+# Options (Session.default_config, or Session.build(**opts) for a per-scope
+# instance): key, expire_after (seconds), secret, secure, same_site, path.
 require 'json'
 require 'base64'
 require 'openssl'
+require 'securerandom'
 
 module Aris
   module Plugins
     class Session
+      CIPHER = 'aes-256-gcm'
+      IV_BYTES = 12
+      TAG_BYTES = 16
+      MIN_SECRET_BYTES = 32
+
       @default_config = {
         enabled: true,
         store: :cookie,
         key: '_aris_session',
         expire_after: 14 * 24 * 3600, # 2 weeks in seconds
-        secret: nil
+        secret: nil,
+        secure: nil,       # nil = Config.cookie_options[:secure], or true in production
+        same_site: :lax,
+        path: '/'
       }
-      
+
       class << self
         attr_accessor :default_config
-        
+
+        # Plugin protocol (class used directly: `use: [:session]`)
         def call(request, response)
-          load_session(request)
+          load_session(request, effective_config)
           nil
         end
-        
+
         def call_response(request, response)
           return unless request.respond_to?(:session)
-          
-          store_session(request, response)
+          store_session(request, response, effective_config)
         end
-        
+
+        # `use: [Aris::Plugins::Session.build(key: '_myapp', expire_after: 3600)]`
         def build(**config)
-          config = default_config.merge(config)
-          config[:secret] ||= Aris::Config.secret_key_base
-          new(config)
-        end
-        
-        private
-        
-        def load_session(request)
-          session_data = load_from_store(request)
-          
-          request.define_singleton_method(:session) do
-            @session ||= SessionData.new(session_data)
-          end
+          new(default_config.merge(config))
         end
-        
-        def store_session(request, response)
-          return unless request.session.changed? || request.session.destroyed?
-          
-          if request.session.destroyed?
-            clear_from_store(request, response)
-          else
-            save_to_store(request, response, request.session.to_hash)
-          end
+
+        def effective_config
+          default_config
+        end
+
+        # --- implementation shared by the class and instances ---------------
+
+        def load_session(request, config)
+          data = load_from_cookie(request, config)
+          request.define_singleton_method(:session) { @session ||= SessionData.new(data) }
         end
-        
-        def load_from_store(request)
-          case default_config[:store]
-          when :cookie
-            load_from_cookie(request)
+
+        def store_session(request, response, config)
+          session = request.session
+          return unless session.changed? || session.destroyed?
+          if session.destroyed? || session.to_hash.empty?
+            response.delete_cookie(config[:key], path: config[:path])
           else
-            {} # Default empty session
+            response.set_cookie(config[:key], encrypt(session.to_hash, config), cookie_options(config))
           end
         end
-        
-        def save_to_store(request, response, data)
-          case default_config[:store]
-          when :cookie
-            save_to_cookie(request, response, data)
-          end
+
+        def load_from_cookie(request, config)
+          return {} unless request.respond_to?(:cookies)
+          raw = request.cookies[config[:key]]
+          return {} if raw.nil? || raw.empty?
+          decrypt(raw, config) || {}
         end
-        
-        def clear_from_store(request, response)
-          case default_config[:store]
-          when :cookie
-            clear_cookie(response)
-          end
+
+        def cookie_options(config)
+          secure = config[:secure]
+          secure = (Aris::Config.cookie_options || {})[:secure] if secure.nil?
+          secure = (ENV['RACK_ENV'] == 'production') if secure.nil?
+          {
+            httponly: true,
+            secure: secure ? true : false,
+            same_site: config[:same_site],
+            path: config[:path],
+            max_age: config[:expire_after]
+          }
         end
-        
-        def load_from_cookie(request)
-          return {} unless request.respond_to?(:cookies)
-          
-          cookie_value = request.cookies[default_config[:key]]
-          return {} unless cookie_value
-          
-          begin
-            # For encrypted sessions
-            decrypt_session(cookie_value)
-          rescue
-            {} # Invalid session, start fresh
+
+        def secret_for(config)
+          secret = config[:secret] || Aris::Config.secret_key_base
+          if secret.nil? || secret.to_s.bytesize < MIN_SECRET_BYTES
+            raise ArgumentError,
+              "Aris sessions need Aris::Config.secret_key_base (or session secret:) of at least #{MIN_SECRET_BYTES} bytes"
           end
+          secret.to_s
         end
-        
-        def save_to_cookie(request, response, data)
-          return if data.empty?
-          
-          encrypted_data = encrypt_session(data)
-          response.set_cookie(default_config[:key], encrypted_data, {
-            httponly: true,
-            secure: (ENV['RACK_ENV'] == 'production'),
-            path: '/',
-            max_age: default_config[:expire_after]
-          })
-        end
-        
-        def clear_cookie(response)
-          response.delete_cookie(default_config[:key])
-        end
-        
-        def encrypt_session(data)
-          # Simple encryption for demo - use proper encryption in production
-          json_data = data.to_json
-          Base64.urlsafe_encode64(json_data)
-        end
-        
-        def decrypt_session(encrypted_data)
-          json_data = Base64.urlsafe_decode64(encrypted_data)
-          JSON.parse(json_data, symbolize_names: true)
+
+        def derived_key(config)
+          OpenSSL::HMAC.digest('SHA256', secret_for(config), 'aris.session.v1')
+        end
+
+        def encrypt(data, config)
+          payload = data.merge('_exp' => Time.now.to_i + config[:expire_after].to_i)
+          cipher = OpenSSL::Cipher.new(CIPHER).encrypt
+          cipher.key = derived_key(config)
+          iv = cipher.random_iv
+          cipher.auth_data = ''
+          ciphertext = cipher.update(JSON.generate(payload)) + cipher.final
+          Base64.urlsafe_encode64(iv + cipher.auth_tag + ciphertext, padding: false)
+        end
+
+        def decrypt(raw, config)
+          blob = Base64.urlsafe_decode64(raw)
+          return nil if blob.bytesize <= IV_BYTES + TAG_BYTES
+          iv = blob.byteslice(0, IV_BYTES)
+          tag = blob.byteslice(IV_BYTES, TAG_BYTES)
+          ciphertext = blob.byteslice(IV_BYTES + TAG_BYTES, blob.bytesize)
+          cipher = OpenSSL::Cipher.new(CIPHER).decrypt
+          cipher.key = derived_key(config)
+          cipher.iv = iv
+          cipher.auth_tag = tag
+          cipher.auth_data = ''
+          json = cipher.update(ciphertext) + cipher.final
+          payload = JSON.parse(json, symbolize_names: true)
+          return nil unless payload.is_a?(Hash)
+          exp = payload.delete(:_exp)
+          return nil if exp && Time.now.to_i > exp.to_i
+          payload
+        rescue ArgumentError, OpenSSL::Cipher::CipherError, JSON::ParserError, TypeError
+          nil # bad base64, tampered, wrong key, or garbage: start a fresh session
         end
       end
-      
+
       def initialize(config)
         @config = config
       end
-      
+
+      attr_reader :config
+
+      # Plugin protocol (instance from Session.build)
+      def call(request, response)
+        self.class.load_session(request, @config)
+        nil
+      end
+
+      def call_response(request, response)
+        return unless request.respond_to?(:session)
+        self.class.store_session(request, response, @config)
+      end
+
       # Session data container
       class SessionData
         def initialize(initial_data = {})
-          @data = initial_data || {}
+          @data = (initial_data || {}).transform_keys { |k| k.to_sym }
           @changed = false
           @destroyed = false
         end
-        
+
         def [](key)
           @data[key.to_sym]
         end
-        
+
         def []=(key, value)
           @data[key.to_sym] = value
           @changed = true
         end
-        
+
+        def fetch(key, *default, &block)
+          @data.fetch(key.to_sym, *default, &block)
+        end
+
+        def key?(key)
+          @data.key?(key.to_sym)
+        end
+
         def delete(key)
-          @data.delete(key.to_sym)
           @changed = true
+          @data.delete(key.to_sym)
         end
-        
+
         def clear
           @data.clear
           @changed = true
         end
-        
+
         def destroy
           clear
           @destroyed = true
         end
-        
+
         def to_hash
           @data.dup
         end
-        
+        alias to_h to_hash
+
         def changed?
           @changed
         end
-        
+
         def destroyed?
           @destroyed
         end
@@ -172,4 +223,4 @@ module Aris
 end
 
 # Register the plugin
-Aris.register_plugin(:session, plugin_class: Aris::Plugins::Session)
+Aris.register_plugin(:session, plugin_class: Aris::Plugins::Session)

data/lib/aris/response_helpers.rb

@@ -1,5 +1,6 @@
 # lib/aris/response_helpers.rb
 require 'json'
+require 'time'
 
 module Aris
   module ResponseHelpers
@@ -73,6 +74,37 @@ module Aris
       redirect(path, status: status)
     end
     
+    # --- Cookies -----------------------------------------------------------
+    # Available on every response (Rack and Mock). Emits Rack 3 compliant
+    # headers: the key is lowercase `set-cookie`, and several cookies become
+    # an Array of values instead of a comma-joined string (which browsers
+    # cannot parse).
+    #
+    #   res.set_cookie('theme', 'dark', max_age: 3600)
+    #   res.set_cookie('sid', token, httponly: true, secure: true, same_site: :lax)
+    #   res.delete_cookie('sid')
+    #
+    # Defaults come from Aris::Config.cookie_options.
+    def set_cookie(name, value, options = {})
+      merged = (Aris::Config.cookie_options || {}).merge(options)
+      parts = ["#{name}=#{value}"]
+      parts << "Domain=#{merged[:domain]}" if merged[:domain]
+      parts << "Path=#{merged[:path]}" if merged[:path]
+      parts << "Max-Age=#{merged[:max_age]}" if merged.key?(:max_age) && !merged[:max_age].nil?
+      parts << "Expires=#{merged[:expires].httpdate}" if merged[:expires].respond_to?(:httpdate)
+      parts << "HttpOnly" if merged[:httponly]
+      parts << "Secure" if merged[:secure]
+      if merged[:same_site]
+        parts << "SameSite=#{merged[:same_site].to_s.capitalize}"
+      end
+      add_set_cookie_header(parts.join('; '))
+      self
+    end
+
+    def delete_cookie(name, options = {})
+      set_cookie(name, '', options.merge(max_age: 0, expires: Time.at(0).utc))
+    end
+
     # No content response
     def no_content
       self.status = 204
@@ -115,6 +147,15 @@ module Aris
     end
     
     private
+
+    def add_set_cookie_header(cookie_string)
+      existing = headers['set-cookie']
+      headers['set-cookie'] = case existing
+                              when nil then cookie_string
+                              when Array then existing + [cookie_string]
+                              else [existing, cookie_string]
+                              end
+    end
     
     def detect_content_type(file_path)
       # Handle Tempfile paths that may have random extensions