cloudflare_access_gate 0.2.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b6ca1922f843d5b954725992cecf9898d6b073f62a8c2f51c189c9c4082aea07
+  data.tar.gz: 81850fd90a1bcf4484e0666ed7ef82497f00507554ff61572e52cca93093f45f
+SHA512:
+  metadata.gz: 71baf0701840236e6dbaa3a49a18f850426d13eb2da81479963bb620892e82be2dcafb86aedf7e432a8aeac1547702b68c512a05f233d98ed47940273773d543
+  data.tar.gz: 0ff41256842e598670d5e6d051abebdddbfffe2935a7be7f5ca7baf8fdf6d00472b39650e24de87123467a9e19cf7fa7cd4167b8cebf27c178cd0ca6633a9e73

data/CHANGELOG.md

@@ -0,0 +1,155 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.1] - 2026-08-09
+
+First release published to RubyGems. The library is unchanged from 0.2.0 — that
+version was tagged in the repository but never pushed to rubygems.org, so 0.2.1
+is the first version installable with `gem install cloudflare_access_gate`.
+
+### Added
+- A `Release` workflow that builds the gem and publishes it to RubyGems via
+  [trusted publishing](https://guides.rubygems.org/trusted-publishing/) whenever
+  a `v*` tag is pushed, so a release needs no long-lived API key on anyone's
+  machine. It refuses to publish when the tag and `VERSION` disagree, since a
+  yanked version number can never be re-pushed.
+
+## [0.2.0] - 2026-08-05
+
+Public-release preparation on top of 0.1.1. Everything 0.1.1 added is kept: the
+`ensure`-logged audit record, `.protect` idempotency, the plain-Ruby blank
+check, and the fail-closed flag specs.
+
+### Security
+
+- **Verify the `iss` claim.** Tokens are now checked against
+  `https://<team>.cloudflareaccess.com`, so a valid Access JWT minted by a
+  *different* Access team is rejected instead of accepted.
+- **Deny when the team domain is unset**, as an explicit fail-closed check
+  rather than a side effect of the JWKS fetch failing.
+- **Require `exp`, `iss`, and `aud` to be present.** The `jwt` gem's `verify_*`
+  options only check a claim when it exists, so a correctly signed token with the
+  right issuer and audience but *no* `exp` was accepted indefinitely. Now passed
+  as `required_claims`.
+- **Reject an unusable JWKS.** A `{"keys": []}` response — or one whose entries
+  carry no key type, e.g. `{"keys":[{}]}` — is treated as a failed fetch. The
+  latter previously cached as good, evicting the last known-good key set and then
+  failing every signature check for a full TTL instead of falling back to it.
+- **Synchronize the JwksCache construction.** `JwksCache` guards its own fetches,
+  but `Gate` memoized it with an unsynchronized `||=`, so concurrent cold-start
+  requests could each build a separate cache and run a separate 6-second fetch —
+  defeating the backoff this release added.
+
+### Fixed
+
+- **Rack 3 SPEC compliance.** The 403 response used a `Content-Type` header,
+  which Rack 3 rejects outright (`Rack::Lint::LintError: uppercase character in
+  header name`). Header names are now lowercase, valid on both Rack 2 and Rack 3.
+  The response also carries an explicit `content-length`, and its headers hash is
+  a fresh mutable hash per response, so downstream middleware can add to it.
+  `spec/rack_compliance_spec.rb` runs every response through `Rack::Lint`, and CI
+  exercises Rack 2.2 and 3.x across the whole Ruby matrix.
+
+### Added
+
+- Clock-drift leeway of 60s for `exp`/`nbf` (configurable via `leeway:`),
+  matching the tolerance Cloudflare itself applies. Fixes spurious 403s from
+  minor clock skew. (`iat` is deliberately not covered: ruby-jwt leaves
+  `verify_iat` off and its `iat` check does not consume this leeway.)
+- `CloudflareAccessGate::JwksCache`, extracted from `Gate`, with two new
+  availability behaviors:
+  - a 30-second backoff after a failed fetch, so a JWKS outage no longer queues
+    every request behind its own (up to 6s) HTTP timeout while holding the cache
+    mutex;
+  - a staleness grace window (`jwks_stale_grace:`, default 300s) during which a
+    previously-good key set is reused if a refresh fails. Set to `0` for strict
+    behavior.
+- `CloudflareAccessGate::StructuredLogger` and `CloudflareAccessGate.logger`, so
+  any logger works: SemanticLogger gets native structured payloads and named
+  tags, and everything else gets the payload appended as `key=value` pairs.
+- `logger:` option on both middlewares; `message:` and `tag_key:` on
+  `AuditLogger`; `team_domain:`/`leeway:`/`jwks_stale_grace:` on `Gate`.
+- `.protect` forwards extra keyword arguments to `Gate`.
+- `spec/no_rails_spec.rb`, which runs the middlewares in a subprocess where
+  requiring Rails, ActiveSupport, or SemanticLogger raises — the 0.1.1 blank-check
+  fix is now guarded against regression rather than asserted in prose.
+- `SECURITY.md` with a private vulnerability reporting path, and
+  `CONTRIBUTING.md`.
+- CI pins `ruby/setup-ruby` to a commit SHA rather than the mutable `v1` tag,
+  clearing the CodeQL unpinned-third-party-action finding.
+
+### Changed (breaking)
+
+- **Gem renamed** from `cloudflare-access-gate` to `cloudflare_access_gate`, so
+  `require:` no longer has to be spelled out in a `Gemfile`. The library name and
+  `CloudflareAccessGate` namespace are unchanged.
+- **`semantic_logger` is no longer a runtime dependency** — it is used when the
+  host app has it loaded and ignored otherwise, which supersedes 0.1.1's
+  `>= 4, < 6` runtime bound (that bound now applies to the development
+  dependency). `jwt` is the only runtime dependency.
+- **`required_ruby_version` lowered back to `>= 3.1`** from 0.1.1's `>= 3.4`. A
+  public gem shouldn't demand the newest Ruby, and CI now proves 3.1 works by
+  testing the full 3.1-3.4 range instead of 3.4 alone.
+- Removed the `allowed_push_host` gemspec pin to a private registry.
+- Internal application names, ticket IDs, and the Access team slug are out of the
+  README, CHANGELOG, gemspec, and specs ahead of the repository going public.
+
+## [0.1.1] - 2026-07-24
+
+### Fixed
+- `Gate` no longer depends on ActiveSupport: the `.blank?` calls on the token,
+  audience, and team domain are replaced with a plain-Ruby check, so the
+  advertised "standalone / plain Rack, no Rails dependency" claim actually holds
+  for a non-Rails consumer (previously raised `NoMethodError`).
+- `AuditLogger` now emits the access line in an `ensure` block, so a request
+  that raises (e.g. Redis down mid-POST) is still audited (status best-effort
+  `nil`) before the error propagates — previously the record vanished exactly
+  when it mattered.
+- `.protect` is now idempotent: repeated calls for the same app (including
+  a development route-reload) no longer re-append the class-level middleware
+  stack. Returns the app.
+
+### Changed
+- `semantic_logger` dependency is bounded (`>= 4, < 6`) so a future major can't
+  break consumers whose lockfile has resolved past the pinned revision.
+- `required_ruby_version` raised to `>= 3.4` to match what CI actually tests
+  (the RuboCop `TargetRubyVersion` and CI matrix are aligned at 3.4).
+
+### Added
+- Specs for the fail-closed flag semantics (non-`'false'` and unset both stay
+  enabled), the team-domain-blank fail-closed path, the 403 response body /
+  `Content-Type`, `.protect` idempotency + return value, and `ensure`-logging on
+  a raising inner app.
+
+### Docs
+- Corrected the provenance: one consumer held the vendored copy; the other two
+  migrated from HTTP Basic Auth / a Devise session.
+- README: `github:` install shorthand, a per-app `session_key` example,
+  `CLOUDFLARE_ACCESS_SIDEKIQ_AUD` in the ENV table, a
+  local-dev (`ENABLE_CLOUDFLARE_GATE=false`) note, a `session_key` rationale, a
+  Releasing section, and both wiring placements (initializer or inline routes).
+
+## [0.1.0] - 2026-07-24
+
+### Added
+- Initial extraction of the Cloudflare Access Sidekiq gate middleware
+  consolidated from three internal Rails applications.
+- `CloudflareAccessGate::Gate` — Rack middleware that validates the
+  `Cf-Access-Jwt-Assertion` header against the Cloudflare Access team JWKS and a
+  configured audience. Fails closed: gate + JWT validation stay on unless a flag
+  is explicitly set to `'false'`, and a blank audience or unavailable JWKS
+  yields a 403. Hardened with JWKS HTTP timeouts, TLS peer verification, a
+  mutex-guarded JWKS cache, and denial logging (path + user).
+- `CloudflareAccessGate::AuditLogger` — Rack middleware that logs
+  method/path/user/status for every dashboard request via SemanticLogger.
+- `CloudflareAccessGate.protect(app, audience:, session_key:)` — installer
+  helper that wires Gate, AuditLogger, `ActionDispatch::Cookies`, and
+  `ActionDispatch::Session::CookieStore` onto a Rack app in the canonical order.
+
+### Notes
+- The `BLOCKED_METHODS` HTTP-method blocklist present in earlier copies was
+  intentionally dropped and is not carried by this gem.

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Homebot, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,280 @@
+# cloudflare_access_gate
+
+Rack middleware that gates a Sidekiq (or any Rack) dashboard behind
+[Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/policies/access/),
+plus an audit logger for every request that gets through.
+
+It **fails closed** and has exactly one runtime dependency
+([`jwt`](https://github.com/jwt/ruby-jwt)) — no Rails, no ActiveSupport, and no
+logging library required. It works on **Rack 2 and Rack 3**, and it doesn't even
+require `rack` itself: it calls no Rack APIs, only the SPEC's `call(env)`
+contract.
+
+It ships two plain-Rack middlewares and one Rails installer helper:
+
+- `CloudflareAccessGate::Gate` — validates the `Cf-Access-Jwt-Assertion` header
+  (injected by the Cloudflare Access application in front of your host) against
+  your Access team's JWKS, issuer, and audience. **Fails closed.**
+- `CloudflareAccessGate::AuditLogger` — logs `method` / `path` / `user` /
+  `status` for GET, POST, PUT, PATCH, and DELETE dashboard requests, in an
+  `ensure` so the record is emitted even if the request raises.
+- `CloudflareAccessGate.protect(app, audience:, session_key:)` — wires both
+  middlewares plus the ActionDispatch cookie/session store onto a Rack app in
+  the canonical order (Rails hosts only). Idempotent.
+
+## Installation
+
+```ruby
+gem 'cloudflare_access_gate'
+```
+
+Or straight from git, pinned to a tag:
+
+```ruby
+gem 'cloudflare_access_gate', github: 'homebotapp/cloudflare_access_gate',
+    tag: 'v0.2.1'
+```
+
+## Usage
+
+### Rails + Sidekiq
+
+Mount `Sidekiq::Web` **outside** your authenticated routes and register the gate
+on it. Two placements are both valid — pick whichever your app already uses.
+
+**A. Initializer** (e.g. `config/initializers/sidekiq_web.rb`), wired in an
+`after_initialize` hook so the autoloader/eager-load have finished:
+
+```ruby
+require 'sidekiq/web'
+
+Rails.application.config.after_initialize do
+  CloudflareAccessGate.protect(
+    Sidekiq::Web,
+    audience: ENV.fetch('CLOUDFLARE_ACCESS_SIDEKIQ_AUD', nil),
+    session_key: '_myapp_sidekiq_session'
+  )
+end
+```
+
+**B. Inline in `config/routes.rb`**, immediately before you `mount Sidekiq::Web`:
+
+```ruby
+CloudflareAccessGate.protect(
+  Sidekiq::Web,
+  audience: ENV.fetch('CLOUDFLARE_ACCESS_SIDEKIQ_AUD', nil),
+  session_key: '_myapp_sidekiq_session'
+)
+mount Sidekiq::Web => '/sidekiq'
+```
+
+`.protect` installs, in order:
+
+1. `CloudflareAccessGate::Gate` (with the given `audience`)
+2. `CloudflareAccessGate::AuditLogger`
+3. `ActionDispatch::Cookies`
+4. `ActionDispatch::Session::CookieStore` (keyed by `session_key`)
+
+It is **idempotent** per app: `Sidekiq::Web`'s middleware stack is class-level,
+so calling `.protect` twice — or on a development route-reload — would otherwise
+re-append the whole stack. Repeated calls for the same app are a no-op, and the
+app is returned either way.
+
+Extra keyword arguments are forwarded to `Gate`, so
+`CloudflareAccessGate.protect(app, audience: …, session_key: …, jwks_stale_grace: 0)`
+works.
+
+`ActionDispatch` must already be loaded, so `.protect` is for Rails hosts.
+
+### `session_key`
+
+Pass a **unique** `session_key` per app so the Sidekiq dashboard's session
+cookie doesn't collide with another app's cookie when several dashboards share a
+parent domain.
+
+The cookie/session pair isn't for the gate — the gate is stateless, since
+Cloudflare Access appends `Cf-Access-Jwt-Assertion` to every proxied request.
+It's for Sidekiq's own CSRF protection, which hard-fails any non-safe request
+without a `rack.session`. An `api_only` Rails app has no Cookies/Session
+middleware of its own, so without this pair every dashboard POST (retry, kill,
+queue pause/delete) would raise.
+
+### Any other Rack app
+
+`Gate` and `AuditLogger` are plain Rack — install them directly:
+
+```ruby
+use CloudflareAccessGate::Gate, audience: ENV['CLOUDFLARE_ACCESS_AUD']
+use CloudflareAccessGate::AuditLogger
+```
+
+## Configuration
+
+### ENV contract
+
+| Variable | Default | Effect |
+| --- | --- | --- |
+| `ENABLE_CLOUDFLARE_GATE` | `true` | Set to exactly `'false'` to disable the gate entirely. Any other value — including `'0'` — or unset keeps it **on**. |
+| `ENABLE_CLOUDFLARE_JWT_VALIDATION` | `true` | Set to exactly `'false'` to skip signature/issuer/audience/expiry validation (header-presence check only). Any other value keeps validation **on**. |
+| `CLOUDFLARE_ACCESS_TEAM_DOMAIN` | _(unset)_ | Your Access team slug, used to derive the issuer `https://<team>.cloudflareaccess.com` and fetch its `/cdn-cgi/access/certs`. If blank while validation is on, requests are denied. |
+| `CLOUDFLARE_ACCESS_SIDEKIQ_AUD` | _(unset)_ | Conventional name for the Access application AUD tag. **Not read by the gem** — your app reads it and passes it as `audience:`. |
+
+### Gate options
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `audience:` | _(none)_ | The Access application AUD tag. A blank audience denies every request rather than skipping audience verification. |
+| `team_domain:` | `ENV['CLOUDFLARE_ACCESS_TEAM_DOMAIN']` | Access team slug. |
+| `leeway:` | `60` | Clock-drift allowance in seconds for `exp`/`nbf`, matching the 60s Cloudflare itself allows. |
+| `jwks_stale_grace:` | `300` | How long a previously-good JWKS may still be used when a refresh fails. `0` denies as soon as the cache expires. |
+| `logger:` | _(global)_ | Per-instance logger override. |
+
+### AuditLogger options
+
+| Option | Default | Meaning |
+| --- | --- | --- |
+| `message:` | `'Sidekiq dashboard access'` | Log message for each audited request. |
+| `tag_key:` | `:sidekiq_user` | SemanticLogger named-tag key for the authenticated user. |
+| `logger:` | _(global)_ | Per-instance logger override. |
+
+### Logging
+
+Both middlewares log through `CloudflareAccessGate::StructuredLogger`, which
+takes any logger you give it:
+
+```ruby
+CloudflareAccessGate.logger = Rails.logger
+```
+
+If you don't set one, [SemanticLogger](https://github.com/reidmorrison/semantic_logger)
+is used when your app already has it loaded (giving per-class named loggers,
+structured payloads, and a `sidekiq_user` named tag around each request), and a
+stdlib `Logger.new($stdout)` otherwise. For non-SemanticLogger loggers the
+structured payload is appended to the message as `key=value` pairs rather than
+dropped, and tagging is skipped.
+
+### Local development
+
+There is no Cloudflare Access in front of your local dashboard, so no
+`Cf-Access-Jwt-Assertion` header is present and the fail-closed gate returns
+**403** for every `/sidekiq` request. To use the dashboard locally, set:
+
+```sh
+ENABLE_CLOUDFLARE_GATE=false
+```
+
+(Only the literal string `false` disables it.)
+
+## Security behavior
+
+### Fail-closed
+
+- Missing/blank `Cf-Access-Jwt-Assertion` header → **403**.
+- JWT validation on + blank audience → **403** (never verifies "no audience").
+- JWT validation on + blank team domain → **403** (no issuer to verify against).
+- JWKS endpoint unavailable, non-JSON, or containing no usable keys → **403**.
+- Invalid signature, wrong issuer, wrong audience, expired token, or algorithm
+  confusion (e.g. HS256 with the public key) → **403**.
+- A token **missing** `exp`, `iss`, or `aud` → **403**. The `jwt` gem's
+  `verify_*` options only check a claim that is present, so these are required
+  explicitly; otherwise a correctly signed token with no `exp` would never
+  expire.
+- Flags are strict: only the literal string `'false'` disables the gate / JWT
+  validation. Any other value — including `'0'` or an unset var — leaves them on.
+
+### Hardening
+
+- JWKS fetches use short open/read timeouts and `OpenSSL::SSL::VERIFY_PEER`.
+- The JWKS cache is mutex-guarded and refreshed after a 10-minute TTL.
+- A failed JWKS fetch starts a 30-second backoff, so a JWKS outage can't queue
+  every request behind its own HTTP timeout.
+- Denials are logged with the request path and the Cloudflare-authenticated user.
+
+### The staleness trade-off
+
+If a JWKS refresh fails, the last known-good key set is reused for up to
+`jwks_stale_grace` seconds (default 300) past the cache TTL. Access signing keys
+rotate on the order of weeks, so a few minutes of staleness is a much smaller
+risk than locking every operator out of the dashboard during a transient
+failure. If you would rather deny than serve stale keys, set
+`jwks_stale_grace: 0`.
+
+### What this middleware does *not* do
+
+It verifies that a request carries a valid Access JWT for **your** application.
+It does not implement per-user authorization — which identities may reach the
+app is decided by your Cloudflare Access policy, not by this gem. It is also not
+a substitute for keeping the origin unreachable except through Cloudflare; an
+attacker who can reach your origin directly bypasses Access entirely, so pair
+this with origin locking (Tunnel, mTLS, or IP allowlisting).
+
+To report a vulnerability, see [SECURITY.md](SECURITY.md).
+
+## Rack compatibility
+
+Supported on **Rack 2.x and Rack 3.x**, and on plain Rack-compatible servers with
+no `rack` gem loaded at all — the middlewares implement `call(env)` and use
+nothing from Rack's API.
+
+Responses use **lowercase header names** (`content-type`, not `Content-Type`).
+Rack 3 requires this — an uppercase header name is a `Rack::Lint::LintError`
+there — and Rack 2 accepts it, since HTTP header names are case-insensitive. The
+403 also carries an explicit `content-length`, and its headers hash is a fresh
+mutable hash per response so downstream middleware can add to it.
+
+`spec/rack_compliance_spec.rb` runs every response this gem produces through
+`Rack::Lint`, the SPEC in executable form. CI runs it against both major Rack
+versions across Ruby 3.1–3.4.
+
+## Development
+
+```sh
+bundle install
+bundle exec rspec      # test suite
+bundle exec rubocop    # lint
+bundle exec rake       # both (default task)
+```
+
+To test against a specific Rack major version, as CI does:
+
+```sh
+RACK_VERSION=2.2 bundle install && RACK_VERSION=2.2 bundle exec rspec
+RACK_VERSION=3   bundle install && RACK_VERSION=3   bundle exec rspec
+```
+
+`spec/no_rails_spec.rb` runs the middlewares in a subprocess where requiring
+Rails, ActiveSupport, or SemanticLogger raises, which is what keeps the
+"no Rails dependency" claim honest. CI runs rspec on Ruby 3.1–3.4 against Rack
+2.2 and 3.x, plus rubocop.
+
+Contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Releasing
+
+`.github/workflows/release.yml` publishes to RubyGems over
+[trusted publishing](https://guides.rubygems.org/trusted-publishing/), so no API
+key is stored in the repository or on a maintainer's machine.
+
+1. Open a PR bumping `CloudflareAccessGate::VERSION` in
+   `lib/cloudflare_access_gate/version.rb`, updating the version assertion in
+   `spec/cloudflare_access_gate_spec.rb`, and adding a `CHANGELOG.md` entry.
+   `main` is protected, so this can't be pushed directly.
+2. Merge it once CI is green.
+3. Create and push an annotated tag on the merge commit:
+   `git tag -a vX.Y.Z -m "…" && git push origin vX.Y.Z`.
+4. The Release workflow verifies the tag matches `VERSION`, builds the gem,
+   pushes it to RubyGems, and creates the GitHub Release. A mismatch fails the
+   job before anything is published — a yanked version number can never be
+   reused.
+5. For consumers pinned by git ref rather than the published gem, update the
+   `tag:` in their `Gemfile` and re-resolve:
+   `bundle update cloudflare_access_gate`.
+
+Don't run `rake release` yourself: it pushes the release commit and tag straight
+to `main`, which branch protection rejects. The workflow does invoke it, but
+because the tag already exists when it runs, Bundler skips its source-control
+push and goes straight to publishing.
+
+## License
+
+[MIT](LICENSE.txt) © Homebot, Inc.

data/SECURITY.md

@@ -0,0 +1,43 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are released for the latest minor version. Until 1.0, that means
+the most recent `0.x` release.
+
+## Reporting a vulnerability
+
+**Please do not open a public GitHub issue for a security vulnerability.**
+
+Report it privately through either channel:
+
+- GitHub's [private vulnerability reporting](https://github.com/homebotapp/cloudflare_access_gate/security/advisories/new)
+  (Security → Report a vulnerability), or
+- email **engineering@homebot.ai** with `cloudflare_access_gate` in the subject.
+
+Please include the affected version, a description of the impact, and enough
+detail to reproduce — a failing spec or a minimal Rack app is ideal.
+
+We aim to acknowledge a report within 3 business days and to ship a fix or share
+a mitigation timeline within 30 days. We'll credit you in the advisory and
+CHANGELOG unless you'd rather stay anonymous.
+
+## Scope
+
+In scope — anything that lets a request reach the protected app without a valid
+Cloudflare Access JWT for the configured audience, for example:
+
+- accepting a token with a wrong or absent signature, issuer, audience, or expiry
+- a configuration or failure mode that opens the gate instead of closing it
+- cache poisoning of the JWKS, or accepting keys from another Access team
+
+Out of scope:
+
+- Cloudflare Access policy misconfiguration (which identities are allowed is
+  decided in your Access policy, not by this gem)
+- an origin reachable without going through Cloudflare — see "What this
+  middleware does *not* do" in the README
+- setting `ENABLE_CLOUDFLARE_GATE=false` or `ENABLE_CLOUDFLARE_JWT_VALIDATION=false`,
+  which are documented, deliberate off switches
+- vulnerabilities in the `jwt` gem itself (report those to
+  [ruby-jwt](https://github.com/jwt/ruby-jwt/security))

data/lib/cloudflare_access_gate/audit_logger.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module CloudflareAccessGate
+  # Rack middleware that audit-logs every request to the gated dashboard,
+  # recording the HTTP method, path, Cloudflare-authenticated user email, and
+  # response status. Install it behind Gate so only authorized requests are
+  # logged.
+  #
+  # Like Gate, this is plain Rack: no Rails, ActiveSupport, or logging library is
+  # required at runtime.
+  class AuditLogger
+    LOGGED_METHODS = %w[GET POST PUT PATCH DELETE].freeze
+
+    DEFAULT_MESSAGE = 'Sidekiq dashboard access'
+    DEFAULT_TAG_KEY = :sidekiq_user
+
+    # Options:
+    #   logger:   per-instance logger override
+    #   message:  log message for each audited request
+    #   tag_key:  SemanticLogger named-tag key for the authenticated user
+    def initialize(app, options = {})
+      @app = app
+      @logger = options[:logger] && StructuredLogger.wrap(options[:logger])
+      @message = options.fetch(:message, DEFAULT_MESSAGE)
+      @tag_key = options.fetch(:tag_key, DEFAULT_TAG_KEY)
+    end
+
+    def call(env)
+      request_method = env['REQUEST_METHOD']
+
+      return @app.call(env) unless LOGGED_METHODS.include?(request_method)
+
+      email = env['HTTP_CF_ACCESS_AUTHENTICATED_USER_EMAIL'] || 'unknown'
+      status = nil
+
+      # Logged in an `ensure` so a raising request is still audited.
+      logger.tagged(@tag_key => email) do
+        response = @app.call(env)
+        status = response.first
+        response
+      ensure
+        logger.info(
+          @message,
+          method: request_method,
+          path: env['PATH_INFO'],
+          user: email,
+          status: status
+        )
+      end
+    end
+
+    private
+
+    def logger
+      @logger ||= CloudflareAccessGate.logger_for('CloudflareAccessGate::AuditLogger')
+    end
+  end
+end

data/lib/cloudflare_access_gate/gate.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require 'jwt'
+
+module CloudflareAccessGate
+  # Rack middleware that gates a dashboard (typically Sidekiq::Web) behind
+  # Cloudflare Access. It reads the `Cf-Access-Jwt-Assertion` header injected by
+  # the Cloudflare Access application in front of the host and, when JWT
+  # validation is enabled, verifies the token's signature (against the team's
+  # JWKS), issuer, audience, and expiry before letting the request through.
+  #
+  # Everything is fail-closed: the gate stays on and rejects requests unless a
+  # flag is explicitly set to the string 'false', and a missing audience, missing
+  # team domain, or unavailable JWKS results in a 403 rather than an open door.
+  #
+  # ENV contract:
+  #   ENABLE_CLOUDFLARE_GATE            - 'false' disables the gate entirely
+  #   ENABLE_CLOUDFLARE_JWT_VALIDATION  - 'false' skips signature/iss/aud checks
+  #   CLOUDFLARE_ACCESS_TEAM_DOMAIN     - your Cloudflare Access team slug
+  # The audience is passed as a constructor option, not read from ENV.
+  #
+  # This class is plain Rack: no Rails, ActiveSupport, or logging library is
+  # required at runtime.
+  class Gate
+    # Clock drift allowance for exp/nbf, matching the 60s Cloudflare itself
+    # allows when validating tokens. (`iat` is not verified: ruby-jwt leaves
+    # verify_iat off by default and its iat check ignores this leeway.)
+    DEFAULT_LEEWAY = 60 # seconds
+
+    # `verify_*` options only check a claim when it is present, so a correctly
+    # signed token that simply omits `exp` would otherwise never expire.
+    REQUIRED_CLAIMS = %w[exp iss aud].freeze
+
+    FORBIDDEN_BODY = 'Forbidden'
+
+    # Header names are lowercase because the Rack 3 SPEC requires it ("uppercase
+    # character in header name" is a Rack::Lint error there). Rack 2 accepts
+    # lowercase too — HTTP header names are case-insensitive — so one spelling
+    # is correct on both. `content-length` is set explicitly so the response is
+    # complete for servers that don't add it.
+    FORBIDDEN_HEADERS = {
+      'content-type' => 'text/plain',
+      'content-length' => FORBIDDEN_BODY.bytesize.to_s
+    }.freeze
+
+    attr_reader :audience, :team_domain
+
+    # Options:
+    #   audience:         (required in practice) the Access application AUD tag
+    #   team_domain:      Access team slug; defaults to ENV
+    #   leeway:           clock drift allowance in seconds
+    #   jwks_stale_grace: seconds a stale JWKS may be reused on refresh failure
+    #   logger:           per-instance logger override
+    #   clock:            callable returning monotonic seconds (for tests)
+    def initialize(app, options = {})
+      @app = app
+      @audience = options[:audience]
+      @team_domain = options.fetch(:team_domain) { ENV.fetch('CLOUDFLARE_ACCESS_TEAM_DOMAIN', nil) }
+      @leeway = options.fetch(:leeway, DEFAULT_LEEWAY)
+      @logger = options[:logger] && StructuredLogger.wrap(options[:logger])
+      @jwks_cache_mutex = Mutex.new
+      @jwks_options = {
+        stale_grace: options.fetch(:jwks_stale_grace, JwksCache::DEFAULT_STALE_GRACE),
+        clock: options.fetch(:clock, JwksCache::MONOTONIC_CLOCK)
+      }
+    end
+
+    def call(env)
+      return @app.call(env) unless self.class.enabled?
+
+      token = env['HTTP_CF_ACCESS_JWT_ASSERTION']
+      return forbidden('Missing access token', env) if blank?(token)
+
+      return forbidden('Invalid access token', env) unless token_acceptable?(token)
+
+      @app.call(env)
+    end
+
+    # Fail closed: the gate stays ON unless explicitly disabled with 'false'.
+    def self.enabled?
+      ENV.fetch('ENABLE_CLOUDFLARE_GATE', 'true') != 'false'
+    end
+
+    # Fail closed: JWT validation stays ON unless explicitly disabled with 'false'.
+    def self.jwt_validation_enabled?
+      ENV.fetch('ENABLE_CLOUDFLARE_JWT_VALIDATION', 'true') != 'false'
+    end
+
+    private
+
+    # When JWT validation is switched off, the presence of the header (already
+    # checked by the caller) is all that is required.
+    def token_acceptable?(token)
+      return true unless self.class.jwt_validation_enabled?
+
+      !verify_token(token).nil?
+    end
+
+    # Returns the decoded payload, or nil if the token must be rejected.
+    def verify_token(token)
+      return nil unless verifiable?
+
+      jwks = jwks_cache.fetch
+      return nil unless jwks
+
+      decode(token, jwks)
+    rescue JWT::DecodeError => e
+      logger.warn('Cloudflare Access JWT verification failed', error: e.message, error_class: e.class.name)
+      nil
+    end
+
+    def decode(token, jwks)
+      JWT.decode(
+        token,
+        nil,
+        true,
+        algorithms: ['RS256'],
+        jwks: jwks,
+        aud: audience,
+        verify_aud: true,
+        iss: issuer,
+        verify_iss: true,
+        verify_expiration: true,
+        required_claims: REQUIRED_CLAIMS,
+        leeway: @leeway
+      ).first
+    end
+
+    # Both of these must be configured for verification to mean anything, so a
+    # blank value denies rather than silently skipping a check.
+    def verifiable?
+      # A nil/blank audience makes the jwt gem skip aud verification, which would
+      # let any valid Cloudflare Access JWT (from any app) through.
+      if blank?(audience)
+        logger.error('Cloudflare Access JWT not verified: audience not configured')
+        return false
+      end
+
+      # The issuer and the JWKS URL are both derived from the team domain.
+      if blank?(team_domain)
+        logger.error('Cloudflare Access JWT not verified: CLOUDFLARE_ACCESS_TEAM_DOMAIN unset')
+        return false
+      end
+
+      true
+    end
+
+    def issuer
+      "https://#{team_domain}.cloudflareaccess.com"
+    end
+
+    # Synchronized: JwksCache guards its own fetches, but an unsynchronized
+    # `||=` here lets concurrent cold-start requests each build their own cache
+    # and each run a separate fetch, which is what the backoff exists to prevent.
+    def jwks_cache
+      @jwks_cache_mutex.synchronize do
+        @jwks_cache ||= JwksCache.new(
+          certs_url: "#{issuer}/cdn-cgi/access/certs",
+          logger: logger,
+          **@jwks_options
+        )
+      end
+    end
+
+    def forbidden(message, env)
+      logger.warn('Cloudflare Access gate denied request',
+                  reason: message,
+                  path: env['PATH_INFO'],
+                  user: env['HTTP_CF_ACCESS_AUTHENTICATED_USER_EMAIL'])
+      [403, FORBIDDEN_HEADERS.dup, [FORBIDDEN_BODY]]
+    end
+
+    # Stands in for ActiveSupport's `Object#blank?` so the middleware works in a
+    # plain Rack app with no Rails loaded.
+    def blank?(value)
+      value.nil? || value.to_s.strip.empty?
+    end
+
+    def logger
+      @logger ||= CloudflareAccessGate.logger_for('CloudflareAccessGate::Gate')
+    end
+  end
+end

data/lib/cloudflare_access_gate/jwks_cache.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'net/http'
+require 'openssl'
+
+module CloudflareAccessGate
+  # Fetches and caches the Cloudflare Access team's JWKS (public signing keys).
+  #
+  # `#fetch` returns a usable key set or nil; nil means the caller must deny the
+  # request. Three behaviors matter for a gate that has to stay both closed and
+  # available:
+  #
+  # * **TTL** — a good key set is served from memory for CACHE_TTL seconds.
+  # * **Error backoff** — fetches happen under a mutex, so without a cooldown
+  #   every request during a JWKS outage would queue behind its own (up to 6s)
+  #   HTTP timeout, hanging the dashboard. After a failure, Cloudflare isn't
+  #   contacted again for ERROR_BACKOFF seconds.
+  # * **Staleness grace** — if a refresh fails, the last known-good key set is
+  #   reused for up to `stale_grace` seconds past the TTL. Access signing keys
+  #   rotate on the order of weeks, so a few minutes of staleness is a far
+  #   smaller risk than locking every operator out during a transient failure.
+  #   Pass `stale_grace: 0` for strict behavior.
+  class JwksCache
+    CACHE_TTL = 600 # seconds a successfully fetched JWKS is served as fresh
+    ERROR_BACKOFF = 30 # seconds to wait after a failed fetch before retrying
+    DEFAULT_STALE_GRACE = 300 # seconds a stale JWKS may be reused past the TTL
+    HTTP_OPEN_TIMEOUT = 3 # seconds
+    HTTP_READ_TIMEOUT = 3 # seconds
+
+    MONOTONIC_CLOCK = -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
+
+    def initialize(certs_url:, logger:, stale_grace: DEFAULT_STALE_GRACE, clock: MONOTONIC_CLOCK)
+      @certs_url = certs_url
+      @logger = logger
+      @stale_grace = stale_grace
+      @clock = clock
+
+      @jwks = nil
+      @fetched_at = nil
+      @failed_at = nil
+      @mutex = Mutex.new
+    end
+
+    # Returns the JWKS to verify against, or nil if none can be obtained.
+    def fetch
+      @mutex.synchronize do
+        return @jwks if fresh?
+        return stale if backing_off?
+
+        jwks = request
+        return remember(jwks) if jwks
+
+        @failed_at = now
+        stale
+      end
+    end
+
+    private
+
+    attr_reader :logger
+
+    def remember(jwks)
+      @jwks = jwks
+      @fetched_at = now
+      @failed_at = nil
+      @jwks
+    end
+
+    def fresh?
+      !@jwks.nil? && !@fetched_at.nil? && (now - @fetched_at) < CACHE_TTL
+    end
+
+    # True while the JWKS endpoint is in its post-failure cooldown.
+    def backing_off?
+      !@failed_at.nil? && (now - @failed_at) < ERROR_BACKOFF
+    end
+
+    # The last known-good JWKS, if it is still inside the staleness grace window.
+    def stale
+      return nil if @jwks.nil? || @fetched_at.nil?
+
+      age = now - @fetched_at
+      if age > (CACHE_TTL + @stale_grace)
+        logger.error('Cloudflare JWKS stale beyond grace period; denying requests', age_seconds: age.round)
+        return nil
+      end
+
+      logger.warn('Serving stale Cloudflare JWKS after refresh failure', age_seconds: age.round)
+      @jwks
+    end
+
+    # Returns the parsed JWKS on success, nil on any failure.
+    def request
+      uri = URI(@certs_url)
+      response = http_get(uri)
+
+      unless response.is_a?(Net::HTTPSuccess)
+        logger.error('Cloudflare JWKS fetch failed', http_status: response&.code)
+        return nil
+      end
+
+      parse(response.body)
+    rescue StandardError => e
+      logger.error('Failed to fetch Cloudflare JWKS', error: e.message, error_class: e.class.name)
+      nil
+    end
+
+    def http_get(uri)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = true
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      http.open_timeout = HTTP_OPEN_TIMEOUT
+      http.read_timeout = HTTP_READ_TIMEOUT
+      http.get(uri.request_uri)
+    end
+
+    def parse(body)
+      jwks = JSON.parse(body)
+      keys = jwks.is_a?(Hash) ? jwks['keys'] : nil
+
+      # A key set that is empty — or whose entries carry no key type — would be
+      # cached as good, discarding the last known-good set and then failing every
+      # signature check for a full TTL. Treat it as a failed fetch instead, so the
+      # staleness grace window can do its job.
+      unless keys.is_a?(Array) && keys.any? { |key| usable_key?(key) }
+        logger.error('Cloudflare JWKS response contained no usable keys')
+        return nil
+      end
+
+      jwks
+    rescue JSON::ParserError => e
+      logger.error('Cloudflare JWKS response was not valid JSON', error: e.message)
+      nil
+    end
+
+    # Minimum bar for a JWKS entry the jwt gem could actually verify against.
+    def usable_key?(key)
+      key.is_a?(Hash) && !key['kty'].to_s.strip.empty?
+    end
+
+    def now
+      @clock.call
+    end
+  end
+end

data/lib/cloudflare_access_gate/structured_logger.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require 'logger'
+
+module CloudflareAccessGate
+  # Thin adapter that lets this gem emit structured key/value log payloads
+  # without depending on any particular logging library.
+  #
+  # SemanticLogger accepts a payload natively (`logger.warn('msg', key: 'v')`);
+  # the stdlib `Logger`, `Rails.logger`, lograge, and friends do not. This
+  # wrapper detects a SemanticLogger target and passes the payload through,
+  # and otherwise appends a `key=value` suffix to the message so no log data is
+  # lost.
+  #
+  # Wrap any logger-ish object: it only needs to respond to the standard
+  # `debug`/`info`/`warn`/`error` severity methods.
+  class StructuredLogger
+    LEVELS = %i[debug info warn error].freeze
+
+    attr_reader :target
+
+    # Wraps `logger` unless it is already wrapped.
+    def self.wrap(logger)
+      logger.is_a?(self) ? logger : new(logger)
+    end
+
+    def initialize(target)
+      @target = target
+    end
+
+    LEVELS.each do |level|
+      define_method(level) do |message, **payload|
+        emit(level, message, payload)
+      end
+    end
+
+    # Attaches `tags` to every log line emitted inside the block.
+    #
+    # Only SemanticLogger supports this; for every other logger the block is
+    # simply yielded (the same key/values are still emitted in the payload of
+    # the log line itself, so nothing is silently dropped).
+    def tagged(**tags, &block)
+      return block.call if tags.empty? || !structured?
+
+      target.tagged(**tags, &block)
+    end
+
+    private
+
+    def emit(level, message, payload)
+      if structured?
+        target.public_send(level, message, payload)
+      else
+        target.public_send(level, merged_message(message, payload))
+      end
+    end
+
+    def structured?
+      defined?(::SemanticLogger::Base) && target.is_a?(::SemanticLogger::Base)
+    end
+
+    def merged_message(message, payload)
+      return message if payload.empty?
+
+      "#{message} (#{payload.map { |key, value| "#{key}=#{value.inspect}" }.join(' ')})"
+    end
+  end
+end

data/lib/cloudflare_access_gate/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module CloudflareAccessGate
+  VERSION = '0.2.1'
+end

data/lib/cloudflare_access_gate.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'cloudflare_access_gate/version'
+require 'cloudflare_access_gate/structured_logger'
+require 'cloudflare_access_gate/jwks_cache'
+require 'cloudflare_access_gate/gate'
+require 'cloudflare_access_gate/audit_logger'
+
+# Rack middleware that gates a dashboard (typically Sidekiq::Web) behind
+# Cloudflare Access, plus an audit logger for the requests that get through.
+# See the README for the ENV contract and security notes.
+module CloudflareAccessGate
+  @installed = {}
+  @install_mutex = Mutex.new
+
+  class << self
+    # Logger used by both middlewares. Assign anything that responds to
+    # `debug`/`info`/`warn`/`error` — SemanticLogger, a stdlib `Logger`,
+    # `Rails.logger`, and so on:
+    #
+    #   CloudflareAccessGate.logger = Rails.logger
+    #
+    # When left unset (`nil`), SemanticLogger is used if the host app has it
+    # loaded (giving per-class named loggers and tagged output), and a stdlib
+    # `Logger.new($stdout)` otherwise.
+    attr_accessor :logger
+
+    # Returns the logger to use for `name`, wrapped so structured payloads work
+    # regardless of the underlying logging library.
+    def logger_for(name)
+      StructuredLogger.wrap(@logger || default_logger(name))
+    end
+
+    private
+
+    def default_logger(name)
+      return ::SemanticLogger[name] if defined?(::SemanticLogger)
+
+      stdout_logger
+    end
+
+    def stdout_logger
+      @stdout_logger ||= ::Logger.new($stdout)
+    end
+  end
+
+  # Wire the full Cloudflare Access protection stack onto a Rack app in the
+  # canonical order. Typically called on Sidekiq::Web from an initializer:
+  #
+  #   CloudflareAccessGate.protect(
+  #     Sidekiq::Web,
+  #     audience: ENV['CLOUDFLARE_ACCESS_SIDEKIQ_AUD'],
+  #     session_key: '_myapp_sidekiq_session'
+  #   )
+  #
+  # This installs, in order:
+  #   1. Gate            - rejects requests without a valid Cf-Access JWT
+  #   2. AuditLogger     - logs who accessed the dashboard
+  #   3. ActionDispatch::Cookies
+  #   4. ActionDispatch::Session::CookieStore(key: session_key)
+  #
+  # ActionDispatch (from Rails/actionpack) must be loaded before this is
+  # called, so `.protect` is for Rails hosts only. Gate and AuditLogger
+  # themselves are plain Rack and carry no Rails dependency — outside Rails,
+  # install them directly with `app.use`.
+  #
+  # Extra keyword arguments are forwarded to Gate (e.g. `team_domain:`,
+  # `jwks_stale_grace:`).
+  #
+  # Idempotent: the middleware stack is class-level, so re-calling would
+  # otherwise re-append it. Returns the app.
+  def self.protect(app, audience:, session_key:, **gate_options)
+    @install_mutex.synchronize do
+      return app if @installed[app]
+
+      app.use Gate, **gate_options, audience: audience
+      app.use AuditLogger
+      app.use ActionDispatch::Cookies
+      app.use ActionDispatch::Session::CookieStore, key: session_key
+
+      @installed[app] = true
+    end
+
+    app
+  end
+end

metadata

@@ -0,0 +1,190 @@
+--- !ruby/object:Gem::Specification
+name: cloudflare_access_gate
+version: !ruby/object:Gem::Version
+  version: 0.2.1
+platform: ruby
+authors:
+- Homebot Infrastructure
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: semantic_logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
+- !ruby/object:Gem::Dependency
+  name: timecop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: |
+  Rack middleware that gates a Sidekiq (or any Rack) dashboard behind
+  Cloudflare Access: it validates the Cf-Access-Jwt-Assertion JWT against your
+  team's JWKS, issuer, and audience (fail-closed) and audit-logs every request
+  that gets through. No Rails or logging-library dependency at runtime.
+email:
+- engineering@homebot.ai
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- SECURITY.md
+- lib/cloudflare_access_gate.rb
+- lib/cloudflare_access_gate/audit_logger.rb
+- lib/cloudflare_access_gate/gate.rb
+- lib/cloudflare_access_gate/jwks_cache.rb
+- lib/cloudflare_access_gate/structured_logger.rb
+- lib/cloudflare_access_gate/version.rb
+homepage: https://github.com/homebotapp/cloudflare_access_gate
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/homebotapp/cloudflare_access_gate
+  changelog_uri: https://github.com/homebotapp/cloudflare_access_gate/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/homebotapp/cloudflare_access_gate/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Cloudflare Access JWT gate + audit logger Rack middleware.
+test_files: []