castle-rb 3.5.2 → 3.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 24c43b5fce4ad8c26dd2ebd12986ca7c7cd8ba8cec976dfdff4e3885c1966247
-  data.tar.gz: 4056b857b4352aed10385049f2bb6a2f55879493f7ddbec7a2a6c7b199bb5224
+  metadata.gz: 10971e0d6aaf51fd108b6a4316e938fd223146eb65bf1d1216c585816a0d8e2c
+  data.tar.gz: 52bae4bd484b9ccc79d6665f2a80c3839532442f4850c9fa4b1a0a7768fc3426
 SHA512:
-  metadata.gz: 65344ead893ec01aa9502203f23707b5bb5288a1785b535e301c2a0dd45c7a2eacbfec4f008a422448e7ee0f847354fff392a98fb05b0ef3c9f4c5ffc30ad4e0
-  data.tar.gz: f3a12fdd744d44fabb08f4ceb2c61274997168ddb5600d83e1b882abd181471c57b94518cf43feafb9bba52b4112be020fb3185216cab3e4647fb9a0cd1aa65d
+  metadata.gz: fa31103ea67d58adb41aad80a1e925173892d73c9cad31b1028bf38194044128c9d3bedfaf399050603749e0f84ae87e48edb922124c99b9cd99b063a65734dd
+  data.tar.gz: c203a28c0bb5bde14212282e3565123d41797ea3af151cc5e7405666bea63f58b98decb0807d7fb95de262e066f1f154d3448b1d9714545964842a78fefc0e75

data/README.md

@@ -67,6 +67,7 @@ Castle.configure do |config|
 
   # Whitelisted and Blacklisted headers are case insensitive and allow to use _ and - as a separator, http prefixes are removed
   # Whitelisted headers
+  # @note In case of the whitelist, we won't send the values of other headers but we will send their names
   config.whitelisted = ['X_HEADER']
   # or append to default
   config.whitelisted += ['http-x-header']

data/lib/castle/api.rb

@@ -28,11 +28,11 @@ module Castle
               headers
             )
           )
-        rescue *HANDLED_ERRORS => error
+        rescue *HANDLED_ERRORS => e
           # @note We need to initialize the error, as the original error is a cause for this
           # custom exception. If we would do it the default Ruby way, the original error
           # would get converted into a string
-          raise Castle::RequestError.new(error) # rubocop:disable Style/RaiseArgs
+          raise Castle::RequestError.new(e) # rubocop:disable Style/RaiseArgs
         end
       end
     end

data/lib/castle/client.rb

@@ -43,9 +43,9 @@ module Castle
         command = Castle::Commands::Authenticate.new(@context).build(options)
         begin
           Castle::API.request(command).merge(failover: false, failover_reason: nil)
-        rescue Castle::RequestError, Castle::InternalServerError => error
+        rescue Castle::RequestError, Castle::InternalServerError => e
           self.class.failover_response_or_raise(
-            FailoverAuthResponse.new(options[:user_id], reason: error.to_s), error
+            FailoverAuthResponse.new(options[:user_id], reason: e.to_s), e
           )
         end
       else

data/lib/castle/extractors/headers.rb

@@ -14,9 +14,14 @@ module Castle
       def call
         @request_env.keys.each_with_object({}) do |header, acc|
           name = @formatter.call(header)
-          next unless Castle.config.whitelisted.include?(name)
-          next if Castle.config.blacklisted.include?(name)
-          acc[name] = @request_env[header]
+
+          if Castle.config.whitelisted.include?(name) && !Castle.config.blacklisted.include?(name)
+            acc[name] = @request_env[header]
+          else
+            # When a header is not whitelisted or blacklisted, we're not suppose to send
+            # it's value but we should send it's name to indicate it's presence
+            acc[name] = true
+          end
         end
       end
     end

data/lib/castle/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Castle
-  VERSION = '3.5.2'
+  VERSION = '3.6.0'
 end

data/spec/lib/castle/client_spec.rb

@@ -20,14 +20,24 @@ describe Castle::Client do
   end
   let(:client_with_no_timestamp) { described_class.new(request_to_context) }
 
-  let(:headers) { { 'X-Forwarded-For' => ip.to_s, 'User-Agent' => ua } }
+  let(:headers) do
+    {
+      'Rack.version': true, 'Rack.input': true, 'Rack.errors': true,
+      'Rack.multithread': true, 'Rack.multiprocess': true, 'Rack.run-Once': true,
+      'Request-Method': true, 'Server-Name': true, 'Server-Port': true,
+      'Query-String': true, 'Path-Info': true, 'Rack.url-Scheme': true,
+      'Https': true, 'Script-Name': true, 'Content-Length': true,
+      'User-Agent': ua, 'X-Forwarded-For': ip.to_s, 'Rack.request.cookie-Hash': true,
+      'Rack.request.cookie-String': true, 'Cookie': true
+    }
+  end
   let(:context) do
     {
       client_id: 'abcd',
       active: true,
       origin: 'web',
       user_agent: ua,
-      headers: { 'X-Forwarded-For': ip.to_s, 'User-Agent': ua },
+      headers: headers,
       ip: ip,
       library: { name: 'castle-rb', version: '2.2.0' }
     }

data/spec/lib/castle/context/default_spec.rb

@@ -25,7 +25,14 @@ describe Castle::Context::Default do
   it { expect(default_context[:origin]).to be_eql('web') }
   it {
     expect(default_context[:headers]).to be_eql(
-      'X-Forwarded-For' => '1.2.3.4', 'Accept-Language' => 'en', 'User-Agent' => 'test'
+      'Rack.version' => true, 'Rack.input' => true, 'Rack.errors' => true,
+      'Rack.multithread' => true, 'Rack.multiprocess' => true, 'Rack.run-Once' => true,
+      'Request-Method' => true, 'Server-Name' => true, 'Server-Port' => true,
+      'Query-String' => true, 'Path-Info' => true, 'Rack.url-Scheme' => true,
+      'Https' => true, 'Script-Name' => true, 'Content-Length' => true,
+      'X-Forwarded-For' => '1.2.3.4', 'Accept-Language' => 'en', 'User-Agent' => 'test',
+      'Rack.request.cookie-Hash' => true, 'Rack.request.cookie-String' => true,
+      'Cookie' => true
     )
   }
   it { expect(default_context[:ip]).to be_eql(ip) }

data/spec/lib/castle/extractors/headers_spec.rb

@@ -19,7 +19,13 @@ describe Castle::Extractors::Headers do
     end
     it do
       expect(extractor.call).to eql(
-        'X-Forwarded-For' => '1.2.3.4', 'Test' => '1'
+        'Test' => '1', 'Ok' => true, 'Rack.version' => true,
+        'Rack.input' => true, 'Rack.errors' => true, 'Rack.multithread' => true,
+        'Rack.multiprocess' => true, 'Rack.run-Once' => true, 'Request-Method' => true,
+        'Server-Name' => true, 'Server-Port' => true, 'Query-String' => true,
+        'Path-Info' => true, 'Rack.url-Scheme' => true, 'Https' => true,
+        'Script-Name' => true, 'Content-Length' => true, 'X-Forwarded-For' => '1.2.3.4',
+        'Cookie' => true
       )
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: castle-rb
 version: !ruby/object:Gem::Version
-  version: 3.5.2
+  version: 3.6.0
 platform: ruby
 authors:
 - Johan Brissmyr
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-09 00:00:00.000000000 Z
+date: 2020-01-07 00:00:00.000000000 Z
 dependencies: []
 description: Castle protects your users from account compromise
 email: johan@castle.io
@@ -95,15 +95,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.2.6
+      version: '2.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: Castle