balrog 1.0.0 → 1.1.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: b518904751f63b68eab38cc945dfebe1cf013124be9b16abf684fbfe24450550
4
- data.tar.gz: '0179daeb802833fdf7cb6771584f604fcba47bbdb4fe8177003ea70c1ec3aa4d'
3
+ metadata.gz: 232b0520af207a4da00798bba32874e5ef4ee33c55419793c7ec23e8312c5712
4
+ data.tar.gz: 4fc0f719261215f6b2c657f4d2a1964df096d92b67cf2b94f1585ec99a609b94
5
5
  SHA512:
6
- metadata.gz: c85e1122e208eba94aa7dd98940b38a1274a5e048922d4f15b9cf7699daabb2f7d905efcdc1f5e711192270e554229a5c324cbfcf78e6decc6ab7c40b9588708
7
- data.tar.gz: 5f0ad78e961fed3cc084af8f6a12c20fb8f5118967aa8de08491519fd33ca55fa481fa168b3df5a505279cbeed3de008e79c9a636ae7f0606f5e74ce048c2982
6
+ metadata.gz: 4521321149b2a0636694f064e43cb20e8416c8eb2f93fd90668195d82a68dfd17bca183618664049139428dec095e7a74f1754b0b66a650d71d3d78610a91806
7
+ data.tar.gz: 4d7fbda793ea374006246abae4c9f1aa62b9369972e33f94aa090a152c799a2800d0081b29ec65a1a8d9a1b2a351f11bfe7ce9a85a47ff0637b54b769a707e69
@@ -1,3 +1,7 @@
1
+ # 1.1.0
2
+ - added `Balrog::Middleware#session_expires_after`, which would force end users to login again after a certain period of time.
3
+ - added `balrog:view` generator, enabling users to modify their Balrog gate view.
4
+
1
5
  # 1.0.0
2
6
 
3
7
  - added `Balrog::RoutesMiddleware` module, which can be used to protect mounted Rack applications.
@@ -1,66 +1,79 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- balrog (1.0.0)
4
+ balrog (1.1.0)
5
5
  bcrypt (~> 3.0)
6
6
  rails (>= 5)
7
7
 
8
8
  GEM
9
9
  remote: https://rubygems.org/
10
10
  specs:
11
- actioncable (5.2.3)
12
- actionpack (= 5.2.3)
11
+ actioncable (6.0.1)
12
+ actionpack (= 6.0.1)
13
13
  nio4r (~> 2.0)
14
14
  websocket-driver (>= 0.6.1)
15
- actionmailer (5.2.3)
16
- actionpack (= 5.2.3)
17
- actionview (= 5.2.3)
18
- activejob (= 5.2.3)
15
+ actionmailbox (6.0.1)
16
+ actionpack (= 6.0.1)
17
+ activejob (= 6.0.1)
18
+ activerecord (= 6.0.1)
19
+ activestorage (= 6.0.1)
20
+ activesupport (= 6.0.1)
21
+ mail (>= 2.7.1)
22
+ actionmailer (6.0.1)
23
+ actionpack (= 6.0.1)
24
+ actionview (= 6.0.1)
25
+ activejob (= 6.0.1)
19
26
  mail (~> 2.5, >= 2.5.4)
20
27
  rails-dom-testing (~> 2.0)
21
- actionpack (5.2.3)
22
- actionview (= 5.2.3)
23
- activesupport (= 5.2.3)
28
+ actionpack (6.0.1)
29
+ actionview (= 6.0.1)
30
+ activesupport (= 6.0.1)
24
31
  rack (~> 2.0)
25
32
  rack-test (>= 0.6.3)
26
33
  rails-dom-testing (~> 2.0)
27
- rails-html-sanitizer (~> 1.0, >= 1.0.2)
28
- actionview (5.2.3)
29
- activesupport (= 5.2.3)
34
+ rails-html-sanitizer (~> 1.0, >= 1.2.0)
35
+ actiontext (6.0.1)
36
+ actionpack (= 6.0.1)
37
+ activerecord (= 6.0.1)
38
+ activestorage (= 6.0.1)
39
+ activesupport (= 6.0.1)
40
+ nokogiri (>= 1.8.5)
41
+ actionview (6.0.1)
42
+ activesupport (= 6.0.1)
30
43
  builder (~> 3.1)
31
44
  erubi (~> 1.4)
32
45
  rails-dom-testing (~> 2.0)
33
- rails-html-sanitizer (~> 1.0, >= 1.0.3)
34
- activejob (5.2.3)
35
- activesupport (= 5.2.3)
46
+ rails-html-sanitizer (~> 1.1, >= 1.2.0)
47
+ activejob (6.0.1)
48
+ activesupport (= 6.0.1)
36
49
  globalid (>= 0.3.6)
37
- activemodel (5.2.3)
38
- activesupport (= 5.2.3)
39
- activerecord (5.2.3)
40
- activemodel (= 5.2.3)
41
- activesupport (= 5.2.3)
42
- arel (>= 9.0)
43
- activestorage (5.2.3)
44
- actionpack (= 5.2.3)
45
- activerecord (= 5.2.3)
50
+ activemodel (6.0.1)
51
+ activesupport (= 6.0.1)
52
+ activerecord (6.0.1)
53
+ activemodel (= 6.0.1)
54
+ activesupport (= 6.0.1)
55
+ activestorage (6.0.1)
56
+ actionpack (= 6.0.1)
57
+ activejob (= 6.0.1)
58
+ activerecord (= 6.0.1)
46
59
  marcel (~> 0.3.1)
47
- activesupport (5.2.3)
60
+ activesupport (6.0.1)
48
61
  concurrent-ruby (~> 1.0, >= 1.0.2)
49
62
  i18n (>= 0.7, < 2)
50
63
  minitest (~> 5.1)
51
64
  tzinfo (~> 1.1)
52
- arel (9.0.0)
53
- bcrypt (3.1.12)
65
+ zeitwerk (~> 2.2)
66
+ bcrypt (3.1.13)
54
67
  builder (3.2.3)
55
68
  concurrent-ruby (1.1.5)
56
- crass (1.0.4)
69
+ crass (1.0.5)
57
70
  diff-lcs (1.3)
58
- erubi (1.8.0)
71
+ erubi (1.9.0)
59
72
  globalid (0.4.2)
60
73
  activesupport (>= 4.2.0)
61
- i18n (1.6.0)
74
+ i18n (1.7.0)
62
75
  concurrent-ruby (~> 1.0)
63
- loofah (2.2.3)
76
+ loofah (2.3.1)
64
77
  crass (~> 1.0.2)
65
78
  nokogiri (>= 1.5.9)
66
79
  mail (2.7.1)
@@ -69,54 +82,56 @@ GEM
69
82
  mimemagic (~> 0.3.2)
70
83
  method_source (0.9.2)
71
84
  mimemagic (0.3.3)
72
- mini_mime (1.0.1)
85
+ mini_mime (1.0.2)
73
86
  mini_portile2 (2.4.0)
74
- minitest (5.11.3)
75
- nio4r (2.3.1)
76
- nokogiri (1.10.3)
87
+ minitest (5.13.0)
88
+ nio4r (2.5.2)
89
+ nokogiri (1.10.5)
77
90
  mini_portile2 (~> 2.4.0)
78
91
  rack (2.0.7)
79
92
  rack-test (1.1.0)
80
93
  rack (>= 1.0, < 3)
81
- rails (5.2.3)
82
- actioncable (= 5.2.3)
83
- actionmailer (= 5.2.3)
84
- actionpack (= 5.2.3)
85
- actionview (= 5.2.3)
86
- activejob (= 5.2.3)
87
- activemodel (= 5.2.3)
88
- activerecord (= 5.2.3)
89
- activestorage (= 5.2.3)
90
- activesupport (= 5.2.3)
94
+ rails (6.0.1)
95
+ actioncable (= 6.0.1)
96
+ actionmailbox (= 6.0.1)
97
+ actionmailer (= 6.0.1)
98
+ actionpack (= 6.0.1)
99
+ actiontext (= 6.0.1)
100
+ actionview (= 6.0.1)
101
+ activejob (= 6.0.1)
102
+ activemodel (= 6.0.1)
103
+ activerecord (= 6.0.1)
104
+ activestorage (= 6.0.1)
105
+ activesupport (= 6.0.1)
91
106
  bundler (>= 1.3.0)
92
- railties (= 5.2.3)
107
+ railties (= 6.0.1)
93
108
  sprockets-rails (>= 2.0.0)
94
109
  rails-dom-testing (2.0.3)
95
110
  activesupport (>= 4.2.0)
96
111
  nokogiri (>= 1.6)
97
- rails-html-sanitizer (1.0.4)
98
- loofah (~> 2.2, >= 2.2.2)
99
- railties (5.2.3)
100
- actionpack (= 5.2.3)
101
- activesupport (= 5.2.3)
112
+ rails-html-sanitizer (1.3.0)
113
+ loofah (~> 2.3)
114
+ railties (6.0.1)
115
+ actionpack (= 6.0.1)
116
+ activesupport (= 6.0.1)
102
117
  method_source
103
118
  rake (>= 0.8.7)
104
- thor (>= 0.19.0, < 2.0)
119
+ thor (>= 0.20.3, < 2.0)
105
120
  rake (10.5.0)
106
- rspec (3.8.0)
107
- rspec-core (~> 3.8.0)
108
- rspec-expectations (~> 3.8.0)
109
- rspec-mocks (~> 3.8.0)
110
- rspec-core (3.8.0)
111
- rspec-support (~> 3.8.0)
112
- rspec-expectations (3.8.3)
121
+ rspec (3.9.0)
122
+ rspec-core (~> 3.9.0)
123
+ rspec-expectations (~> 3.9.0)
124
+ rspec-mocks (~> 3.9.0)
125
+ rspec-core (3.9.0)
126
+ rspec-support (~> 3.9.0)
127
+ rspec-expectations (3.9.0)
113
128
  diff-lcs (>= 1.2.0, < 2.0)
114
- rspec-support (~> 3.8.0)
115
- rspec-mocks (3.8.0)
129
+ rspec-support (~> 3.9.0)
130
+ rspec-mocks (3.9.0)
116
131
  diff-lcs (>= 1.2.0, < 2.0)
117
- rspec-support (~> 3.8.0)
118
- rspec-support (3.8.0)
119
- sprockets (3.7.2)
132
+ rspec-support (~> 3.9.0)
133
+ rspec-support (3.9.0)
134
+ sprockets (4.0.0)
120
135
  concurrent-ruby (~> 1.0)
121
136
  rack (> 1, < 3)
122
137
  sprockets-rails (3.2.1)
@@ -127,9 +142,10 @@ GEM
127
142
  thread_safe (0.3.6)
128
143
  tzinfo (1.2.5)
129
144
  thread_safe (~> 0.1)
130
- websocket-driver (0.7.0)
145
+ websocket-driver (0.7.1)
131
146
  websocket-extensions (>= 0.1.0)
132
- websocket-extensions (0.1.3)
147
+ websocket-extensions (0.1.4)
148
+ zeitwerk (2.2.1)
133
149
 
134
150
  PLATFORMS
135
151
  ruby
data/README.md CHANGED
@@ -30,8 +30,8 @@ Run the installer to generate an initializer:
30
30
 
31
31
  ```shell
32
32
  $ bundle exec rails generate balrog:install
33
- Enter New Password:
34
- Confirm New Password:
33
+ Enter New Password:
34
+ Confirm New Password:
35
35
  create config/initializers/balrog.rb
36
36
  $
37
37
  ```
@@ -107,6 +107,43 @@ Other usage examples:
107
107
  <%= balrog_logout_button class: 'fancy-button--with-default-text' %>
108
108
  ```
109
109
 
110
+ ## Changing session expiry length
111
+
112
+ `set_session_expiry` requires the user to login again after a period of time.
113
+ To customise this value, open `config/initializers/balrog.rb` after running `balrog:install`
114
+ and change the argument being passed to `set_session_expiry`.
115
+
116
+ The argument passed to `set_session_expiry` can be any of the
117
+ [Rails time extensions](https://api.rubyonrails.org/classes/Numeric.html).
118
+
119
+ If you don't want sessions to expire, remove `set_session_expiry`
120
+ from the initializer completely.
121
+
122
+ ```ruby
123
+ Rails.application.config.middleware.use Balrog::Middleware do
124
+ password_hash '$2a$12$BLz7XCFdG9YfwL64KlTgY.T3FY55aQk8SZEzHfpHfw15F2uN1kuSi'
125
+ set_session_expiry 30.minutes
126
+ end
127
+ ```
128
+ ## Configuring the Balrog gate view
129
+
130
+ We built Balrog to have a default view and stylesheet so that you can drop
131
+ Balrog into your project and everything should “just work”.
132
+ However, we don't want to be in your way if you needed to customise
133
+ your Balrog gate view.
134
+
135
+ If you want to customise the Balrog view, you can run the `balrog:view`
136
+ generator, which will copy the required view and layout to your application:
137
+
138
+ ```shell
139
+ $ rails generate balrog:view
140
+ ```
141
+
142
+ After running the generator, you can now add elements and classes to the
143
+ `views/balrog/gate.html.erb`, add styles to the
144
+ `assets/stylesheets/application.css` and import the application stylesheet in
145
+ `app/views/layouts/balrog.html.erb`. For an example, see the
146
+ [dummy-rails-app](https://github.com/pixielabs/balrog/tree/master/spec/dummy-rails-app) in the spec folder.
110
147
 
111
148
  ## Contributing
112
149
 
@@ -137,5 +174,3 @@ Before contributing, please read the [code of conduct](CODE_OF_CONDUCT.md).
137
174
 
138
175
  * Restricting access via `routes.rb`
139
176
  * Test coverage
140
- * Check it's OK with Ruby on Rails 6
141
- * Expire sessions
@@ -1,26 +1,6 @@
1
- <!doctype html>
2
- <html lang=en>
3
- <head>
4
- <meta charset=utf-8>
5
- <title>Login</title>
6
- <%= stylesheet_link_tag "balrog/gate" %>
7
- </head>
8
-
9
- <body>
10
-
11
- <section>
12
- <form action='/balrog/signin' method='POST'>
13
- <input autofocus type='password' name='password' placeholder='Password'>
14
- <button type='submit'>Login</button>
15
- </form>
16
- </section>
17
-
18
- <footer>
19
- <a href="https://github.com/pixielabs/balrog" target="_blank">
20
- <%= image_tag "balrog/logo.png", class: 'logo' %>
21
- </a>
22
- </footer>
23
-
24
- </body>
25
-
26
- </html>
1
+ <section>
2
+ <form action='/balrog/signin' method='POST'>
3
+ <input autofocus type='password' name='password' placeholder='Password'>
4
+ <button type='submit'>Login</button>
5
+ </form>
6
+ </section>
@@ -0,0 +1,21 @@
1
+ <!doctype html>
2
+ <html lang=en>
3
+ <head>
4
+ <meta charset=utf-8>
5
+ <title>Login</title>
6
+ <%= stylesheet_link_tag "balrog/gate" %>
7
+ </head>
8
+
9
+ <body>
10
+
11
+ <%= yield %>
12
+
13
+ <footer>
14
+ <a href="https://github.com/pixielabs/balrog" target="_blank">
15
+ <%= image_tag "balrog/logo.png", class: 'logo' %>
16
+ </a>
17
+ </footer>
18
+
19
+ </body>
20
+
21
+ </html>
@@ -1,6 +1,6 @@
1
1
  # This Railtie makes the Balrog Generators available from the command line.
2
2
  class Balrog::Generators < Rails::Railtie
3
3
  generators do
4
- require File.join(File.dirname(__FILE__), 'generators', 'install_generator')
4
+ Dir[File.join(__dir__, 'generators', '*.rb')].each { |file| require file }
5
5
  end
6
6
  end
@@ -8,6 +8,7 @@ class Balrog::InstallGenerator < Rails::Generators::Base
8
8
  contents = <<~EOF
9
9
  Rails.application.config.middleware.use Balrog::Middleware do
10
10
  password_hash '#{password_hash}'
11
+ set_session_expiry 30.minutes
11
12
  end
12
13
  EOF
13
14
  create_file "config/initializers/balrog.rb", contents
@@ -0,0 +1,25 @@
1
+ class Balrog::ViewGenerator < Rails::Generators::Base
2
+
3
+ desc "Copies the Balrog gate view and layout into your application, where you can edit and style them."
4
+ def copy_gate_view
5
+ gate_view = File.open(
6
+ File.join(__dir__, '../../../', 'app/views/balrog/gate.html.erb'),
7
+ 'r')
8
+
9
+ content = gate_view.read
10
+ gate_view.close
11
+
12
+ create_file "app/views/balrog/gate.html.erb", content
13
+ end
14
+
15
+ def copy_layout
16
+ gate_view = File.open(
17
+ File.join(__dir__, '../../../', 'app/views/layouts/balrog.html.erb'),
18
+ 'r')
19
+
20
+ content = gate_view.read
21
+ gate_view.close
22
+
23
+ create_file "app/views/layouts/balrog.html.erb", content
24
+ end
25
+ end
@@ -0,0 +1,24 @@
1
+ # Contains authentication logic to check the user has been authenticated,
2
+ # and that the session hasn't expired.
3
+ module Balrog::Guard
4
+ def authenticated?(balrog_session)
5
+ @balrog_session = balrog_session
6
+ previously_authenticated? && still_valid?
7
+ end
8
+
9
+ private
10
+
11
+ # A method to check that the user has been authenticated before.
12
+ def previously_authenticated?
13
+ return false unless @balrog_session
14
+ @balrog_session['value'] == 'authenticated'
15
+ end
16
+
17
+ # A method to check that the authentication has not expired.
18
+ def still_valid?
19
+ # If the user did not set configured the Balrog session
20
+ # to expire, the cookie is valid.
21
+ return true unless @balrog_session['expiry_date']
22
+ DateTime.current < @balrog_session['expiry_date']
23
+ end
24
+ end
@@ -1,8 +1,12 @@
1
+ require_relative 'guard'
2
+
1
3
  # Helpers methods are made available in all controllers by the code in engine.rb.
2
4
  module Balrog::Helpers
5
+ include Balrog::Guard
6
+
3
7
  def authenticate_with_balrog!
4
- unless session[:balrog] == 'authenticated'
5
- render 'balrog/gate', layout: nil
8
+ unless authenticated?(session[:balrog])
9
+ render 'balrog/gate', layout: 'balrog'
6
10
  end
7
11
  end
8
12
  end
@@ -34,6 +34,10 @@ class Balrog::Middleware
34
34
  @password_hash = BCrypt::Password.new(input)
35
35
  end
36
36
 
37
+ def set_session_expiry(time_period)
38
+ @session_length = time_period
39
+ end
40
+
37
41
  def handle_login(env)
38
42
  if env['rack.request.form_hash']
39
43
  submitted_password = env['rack.request.form_hash']['password']
@@ -56,7 +60,9 @@ class Balrog::Middleware
56
60
  end
57
61
 
58
62
  if @password_hash == submitted_password
59
- env['rack.session'][:balrog] = 'authenticated'
63
+ session_data = { value: 'authenticated' }
64
+ add_expiry_date!(session_data)
65
+ env['rack.session'][:balrog] = session_data
60
66
  end
61
67
 
62
68
  referer = env["HTTP_REFERER"] || '/'
@@ -69,5 +75,12 @@ class Balrog::Middleware
69
75
  [302, {"Location" => '/'}, [""]]
70
76
  end
71
77
 
78
+ # If the user configured the Balrog session to expire, add the
79
+ # expiry_date to the Balrog session.
80
+ def add_expiry_date!(session_data)
81
+ if @session_length
82
+ session_data[:expiry_date] = DateTime.current + @session_length
83
+ end
84
+ end
72
85
  end
73
86
 
@@ -1,3 +1,5 @@
1
+ require_relative 'guard'
2
+
1
3
  # Public: Balrog routes middleware that redirects the user to a security
2
4
  # gate unless the session includes { 'balrog' => 'authenticated' }.
3
5
  #
@@ -11,17 +13,18 @@
11
13
  # mount Sidekiq::Web => '/sidekiq'
12
14
 
13
15
  class Balrog::RoutesMiddleware
16
+ include Balrog::Guard
17
+
14
18
  def initialize(app)
15
19
  @app = app
16
20
  end
17
21
 
18
22
  def call(env)
19
- unless env['rack.session']['balrog'] == 'authenticated'
20
- html = ApplicationController.renderer.render 'balrog/gate', layout: nil
23
+ unless authenticated?(env['rack.session']['balrog'])
24
+ html = ApplicationController.renderer.render 'balrog/gate', layout: 'balrog'
21
25
  return [200, {"Content-Type" => "text/html"}, [html]]
22
26
  end
23
27
  @app.call(env)
24
- end
25
-
28
+ end
26
29
  end
27
30
 
@@ -1,3 +1,3 @@
1
1
  module Balrog
2
- VERSION = "1.0.0"
2
+ VERSION = "1.1.0"
3
3
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: balrog
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.0.0
4
+ version: 1.1.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Pixie Labs
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2019-05-14 00:00:00.000000000 Z
11
+ date: 2019-11-18 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bcrypt
@@ -102,6 +102,7 @@ files:
102
102
  - app/assets/images/balrog/logo.png
103
103
  - app/assets/stylesheets/balrog/gate.css
104
104
  - app/views/balrog/gate.html.erb
105
+ - app/views/layouts/balrog.html.erb
105
106
  - balrog.gemspec
106
107
  - bin/console
107
108
  - bin/setup
@@ -109,6 +110,8 @@ files:
109
110
  - lib/balrog/engine.rb
110
111
  - lib/balrog/generators.rb
111
112
  - lib/balrog/generators/install_generator.rb
113
+ - lib/balrog/generators/view_generator.rb
114
+ - lib/balrog/guard.rb
112
115
  - lib/balrog/helpers.rb
113
116
  - lib/balrog/middleware.rb
114
117
  - lib/balrog/password_hasher.rb