binxtils 0.5.2 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8af9c778119b7f329d28122fcdaf2957914abe72ee7b43fde8a5b5e25a0e6294
-  data.tar.gz: 9573e86af8de64e62d98cb64c47c59040897fe3202d2b1167b740404301d270f
+  metadata.gz: 5d72b64353d985a2d1473b717fe1adff0e04c89af0d62ef6b5a1a1af9d274509
+  data.tar.gz: dc3707cc25fd903d65bddca88af6eeea7ea1e05abad11ae17f9f53b2afacc880
 SHA512:
-  metadata.gz: 3439600aa1a4add439671f2dcee1434f4627d9968645b05634f734d643d007fbec2a5eb40b93192b457edc0a14bcbab3b4ed4e64a05d5f560a0f1df924fe2fe0
-  data.tar.gz: 6e77b0e688d8c58b5d9bdc20d636ad743f95bd4b7218c49b97ad86c8011010aa8d116414ecd1206f6e2d6ecb855c7587bbbca46938485c820a004aba0edcd7e9
+  metadata.gz: 965dbfb38c5dc90180f92ebd1ca5a1403d39cc4688183c42ee474d859efc396387453eec0647ec04a67b57df64a10b05bf29b99294a5d72c2f6f4e80b35f1a9f
+  data.tar.gz: b3a516d70a73ae33f9d4486f23c292f6f644c4a341e591c07d83d67737813e1cda77b6f3649a268887bd6902e611cbabe83f0ae76c291ab339f825c790e365d4

data/README.md

@@ -9,6 +9,7 @@ gem "binxtils"
 ## Modules
 
 - **Binxtils::InputNormalizer** - Sanitize and normalize user input strings
+- **Binxtils::Secure** - Constant-time comparison of a value against an expected secret
 - **Binxtils::TimeParser** - Parse fuzzy time/date strings into `Time` objects
 - **Binxtils::TimeZoneParser** - Parse and resolve time zone strings
 
@@ -20,6 +21,7 @@ These modules use [Functionable](https://github.com/sethherr/functionable) and a
 Binxtils::TimeParser.parse("next thursday")
 Binxtils::InputNormalizer.string("  Some Input  ")
 Binxtils::TimeZoneParser.parse("Eastern Time")
+Binxtils::Secure.compare?(params[:token], ENV["WEBHOOK_TOKEN"])
 ```
 
 ### Rails concerns
@@ -59,9 +61,18 @@ end
 
 ## npm package
 
-This repo also publishes `@bikeindex/time-localizer`, an npm package for localizing time elements in the browser. Luxon is bundled into the published package, so consumers don't need to install it separately.
+This repo also publishes `@bikeindex/time-localizer`, an npm package for localizing time elements in the browser. It ships two builds of the same source:
 
-To publish a new version: update the version in `package.json`, then run `npm publish` from the repo root (requires npm login with access to the `@bikeindex` scope). The `prepublishOnly` script automatically builds `dist/index.js` before publishing.
+| Build | Luxon | Use when |
+| --- | --- | --- |
+| `dist/index.js` (default) | external — install it yourself | You have a bundler. Luxon stays deduped with your own copy, so `Settings.defaultLocale`, `Settings.now` etc. apply to both. |
+| `dist/index.bundle.js` | bundled in | You have no bundler (e.g. importmap-rails). One request, nothing to resolve. |
+
+Import the default as `@bikeindex/time-localizer` and the standalone as `@bikeindex/time-localizer/bundle`, or reference either file path directly over a CDN.
+
+Don't use the bundled build alongside your own Luxon: you'd ship two copies, and because Luxon's `Settings` are module-scoped, your global config would silently apply to only one of them.
+
+To publish a new version: update the version in `package.json`, then run `npm publish` from the repo root (requires npm login with access to the `@bikeindex` scope). The `prepublishOnly` script builds both artifacts before publishing.
 
 ## Releasing
 

data/lib/binxtils/secure.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Binxtils
+  module Secure
+    extend Functionable
+
+    def compare?(value, expected)
+      expected.present? && ActiveSupport::SecurityUtils.secure_compare(value.to_s, expected.to_s)
+    end
+  end
+end

data/lib/binxtils/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Binxtils
-  VERSION = "0.5.2"
+  VERSION = "0.6.0"
 end

data/lib/binxtils.rb

@@ -4,10 +4,12 @@ require "functionable"
 require "active_support"
 require "active_support/core_ext"
 require "active_record"
+require "active_support/security_utils"
 require "loofah"
 require "rails-html-sanitizer"
 
 require_relative "binxtils/input_normalizer"
+require_relative "binxtils/secure"
 require_relative "binxtils/time_zone_parser"
 require_relative "binxtils/time_parser"
 require "binxtils/set_period"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: binxtils
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.6.0
 platform: ruby
 authors:
 - Bike Index
@@ -81,6 +81,7 @@ files:
 - lib/binxtils.rb
 - lib/binxtils/engine.rb
 - lib/binxtils/input_normalizer.rb
+- lib/binxtils/secure.rb
 - lib/binxtils/time_parser.rb
 - lib/binxtils/time_zone_parser.rb
 - lib/binxtils/version.rb