cloudtasker 0.13.2 → 0.14.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f26efb724bb305aed27041f6e2edbd8ffe82d4b07db39d3e4bf602415a4b7ef
-  data.tar.gz: 117ea1a8772a4a6512b1198a9429122dad98f379b82d49a6daf926323dc31987
+  metadata.gz: ca57b71a4e3552693d0a64720f423bf7ff1168d5078018a0177c65f09ad681d8
+  data.tar.gz: f886fe29dec2c4ce12286b3e5af843a02e4ea426fbef6db0d2cfcb300418ea34
 SHA512:
-  metadata.gz: 6ce293af0e108913d4f7161ed9a714e4a76bdb7b6078982d00e17d543be1acc826566f7af15652ccec17f4ca2a7420af4651ea78e8ee028159d3e39fab2029a3
-  data.tar.gz: 66c6bf2443ac5dcd61939eb0cf22a6e0ee87258a2cb2997b8f3905471bdce99eaf0dfd560968e8ba7f61d2220b62ac42f68e25f97eba808e141c0985f64be6e2
+  metadata.gz: 8312536629168911d321d0630a126f0671eb9e7e6bdb51c86f675ac159d7294f8a1a87bf89d4b4948dae23f4e9411e5673718bc6edac8b73d10592f1a8527744
+  data.tar.gz: a6aeb550354e06413bcd21e3ce47f0b136184c236b4c908104ee1ae51412f4fbcad6cdc3ab392bf991046fe9a1747f32770ca1a0f8d3bddf35dd54813f8b646e

data/.github/workflows/lint_rubocop.yml

@@ -10,6 +10,6 @@ jobs:
       - uses: zhulik/redis-action@1.1.0
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: '3.0.1'
+          ruby-version: '3.3.0'
           bundler-cache: true
       - run: bundle exec rubocop

data/.github/workflows/test_ruby_3.x.yml

@@ -11,6 +11,7 @@ jobs:
           - '3.0'
           - '3.1'
           - '3.2'
+          - '3.3'
         appraisal:
           - 'google_cloud_tasks_1.0'
           - 'google_cloud_tasks_1.1'

data/.gitignore

@@ -14,7 +14,10 @@
 /tmp/
 
 # Ignore lock files (e.g. Gemfile.lock)
-*.lock
+/Gemfile.lock
 
 # rspec failure tracking
 .rspec_status
+
+# Dev databases
+*.sqlite3

data/.rubocop.yml

@@ -1,27 +1,28 @@
 require: rubocop-rspec
 
 AllCops:
+  NewCops: enable
+  SuggestExtensions: false
+  TargetRubyVersion: 2.7
   Exclude:
     - 'gemfiles/**/*'
     - 'vendor/**/*'
 
-# Ruby 3.0: curly braces around last argument has meaning
-# See: https://github.com/rubocop/rubocop/issues/7641
-Style/BracesAroundHashParameters:
-  Enabled: false
-
 Metrics/ClassLength:
-  Max: 200
+  Max: 300
 
 Metrics/ModuleLength:
   Max: 150
 
 Metrics/AbcSize:
-  Max: 25
+  Max: 30
   Exclude:
     - 'spec/support/*'
 
-Metrics/LineLength:
+Metrics/PerceivedComplexity:
+  Max: 20
+
+Layout/LineLength:
   Max: 120
 
 Metrics/MethodLength:
@@ -53,6 +54,13 @@ Style/Documentation:
 Metrics/ParameterLists:
   CountKeywordArgs: false
 
+Metrics/CyclomaticComplexity:
+  Max: 15
+
+Lint/EmptyBlock:
+  Exclude:
+    - 'examples/rails/config/routes.rb'
+
 RSpec/MessageSpies:
   Enabled: false
 
@@ -62,4 +70,24 @@ RSpec/MultipleExpectations:
     - 'spec/integration/**/*'
 
 RSpec/AnyInstance:
-  Enabled: false
+  Enabled: false
+
+RSpec/MultipleMemoizedHelpers:
+  Enabled: false
+
+RSpec/NoExpectationExample:
+  AllowedPatterns:
+    - ^expect_
+    - ^assert_
+
+RSpec/IndexedLet:
+  Enabled: false
+
+RSpec/StubbedMock:
+  Enabled: false
+
+RSpec/VerifiedDoubles:
+  Exclude:
+    - spec/cloudtasker/cloud_task_spec.rb
+    - spec/cloudtasker/backend/google_cloud_task_v1_spec.rb
+    - spec/cloudtasker/backend/google_cloud_task_v2_spec.rb

data/Appraisals

@@ -1,42 +1,34 @@
 # frozen_string_literal: true
 
 appraise 'google_cloud_tasks_1.0' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 1.0.0'
 end
 
 appraise 'google_cloud_tasks_1.1' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 1.1.0'
 end
 
 appraise 'google_cloud_tasks_1.2' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 1.2.0'
 end
 
 appraise 'google_cloud_tasks_1.3' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 1.3.0'
 end
 
 appraise 'google_cloud_tasks_1.4' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 1.4.0'
 end
 
 appraise 'google_cloud_tasks_1.5' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 1.5.0'
 end
 
 appraise 'google_cloud_tasks_2.0' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 2.0.0'
 end
 
 appraise 'google_cloud_tasks_2.1' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'google-cloud-tasks', '~> 2.1.0'
 end
 
@@ -65,21 +57,17 @@ if RUBY_VERSION >= '2.7'
 end
 
 appraise 'semantic_logger_3.4' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'semantic_logger', '3.4.1'
 end
 
 appraise 'semantic_logger_4.6' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'semantic_logger', '4.6.1'
 end
 
 appraise 'semantic_logger_4.7.0' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'semantic_logger', '4.7.0'
 end
 
 appraise 'semantic_logger_4.7.2' do
-  gem 'activesupport', '~> 6.1.0' # ruby 2.6 compatibility
   gem 'semantic_logger', '4.7.2'
 end

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [v0.14.rc1](https://github.com/keypup-io/cloudtasker/tree/v0.14.rc1) (2024-09-22)
+
+[Full Changelog](https://github.com/keypup-io/cloudtasker/compare/v0.13.2...v0.14.rc1)
+
+**Improvements:**
+- Authentication: To support OIDC and regular Cloudtasker authentication, we moved the Cloudtasker Authentication header from `Authorization` to `X-Cloudtasker-Authorization`. Backward compatibility is maintained for existing jobs.
+- Authentication: Use signature-based authentication instead of plain tokens. The authentication token now HMACs the content of the job. This approach prevents token from being reused.
+- Batch Jobs: Batch job progress and statistics are now calculated using counters, instead of checking every job. This is much faster.
+- Cron Validation: The cron jobs extension now fails epicly if the cron configuration is invalid, instead of failing silently.
+- GCP OIDC Authentification: It is now possible to specify an Open ID Connect (OIDC) service account to run Cloudtasker on private Cloud Run services. OIDC authentication is provided as an extra authentication layer on top of the regular Cloudtasker authentication system (see below). See the OIDC section in the [initializer documentation](https://github.com/keypup-io/cloudtasker?tab=readme-ov-file#cloudtasker-initializer).
+- Job Execution Control: Add ability to conditionally raise `Cloudtasker::RetryWorkerError` to retry jobs. This error does not get logged but the retry count will still be increased. This is a safer approach than using the `reenqueue` helper, which can lead to forever running jobs if not used properly. [Documentation](https://github.com/keypup-io/cloudtasker?tab=readme-ov-file#conditional-reenqueues-using-retry-errors).
+- Log Arguments Truncation: Add `Cloudtasker::WorkerLogger.truncate` helper to truncate large payloads. This is useful to log the top-level attributes of hash/array payloads, without logging the full depth. This case save you significant $$ in logging costs. [Documentation](https://github.com/keypup-io/cloudtasker?tab=readme-ov-file#truncating-log-arguments).
+- Storable Jobs: Add an interface to park Cloudtasker jobs that need to be conditionally run later. This is useful when you need to capture jobs (and their arguments) during a batch but only enqueue them after the batch is completed. This extension requires Redis and is provided as an optional module. [Documentation](https://github.com/keypup-io/cloudtasker/blob/master/docs/STORABLE_JOBS.md).
+- Local Server: Add ability to disable SSL verification on the local server when local HTTPS endpoints are used. See the `local_server_ssl_verify` section in the [initializer documentation](https://github.com/keypup-io/cloudtasker?tab=readme-ov-file#cloudtasker-initializer).
+
+**Fixed bugs:**
+- ActiveJob: Support `enqueue_after_transaction_commit?` to be ISO with the ActiveJob interface.
+- Batch Jobs: Do not register batch jobs that were not actually enqueued due to other factors (e.g. Job Uniqueness extension). This issue could lead to never-ending batches.
+- Duration Logging: Specify the unit (`s` for seconds) on the job duration attribute so it gets properly picked up by GCP Logging. GCP Logging was occasionally mixing up seconds and milliseconds.
+- Job Retry Count: GCP fixed their retry count header some time ago. We now use the `X-CloudTasks-TaskExecutionCount` header instead of the `X-CloudTasks-TaskRetryCount`. [See more details here](https://github.com/keypup-io/cloudtasker?tab=readme-ov-file#max-retries).
+- Rails: Use `skip_forgery_protection` instead of `skip_before_action`. The later was causing occasional issues on some setups.
+
+
+
 ## [v0.13.2](https://github.com/keypup-io/cloudtasker/tree/v0.13.2) (2023-07-02)
 
 [Full Changelog](https://github.com/keypup-io/cloudtasker/compare/v0.13.1...v0.13.2)

data/Gemfile

@@ -4,3 +4,15 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in cloudtasker.gemspec
 gemspec
+
+# Dev dependencies
+gem 'appraisal', github: 'thoughtbot/appraisal'
+gem 'bundler', '~> 2.0'
+gem 'rake', '>= 12.3.3'
+gem 'rspec', '~> 3.0'
+gem 'rspec-json_expectations', '~> 2.2'
+gem 'rubocop', '~> 1.64.1'
+gem 'rubocop-rspec', '~> 3.0.1'
+gem 'semantic_logger'
+gem 'timecop'
+gem 'webmock'

data/README.md

@@ -1,5 +1,7 @@
 ![Build Status](https://github.com/keypup-io/cloudtasker/workflows/Test/badge.svg) [![Gem Version](https://badge.fury.io/rb/cloudtasker.svg)](https://badge.fury.io/rb/cloudtasker)
 
+🚀🚀🚀 Cloudtasker 0.14 release candidate (`v0.14.rc1`) is out and it's quite big ([Changelog](https://github.com/keypup-io/cloudtasker/blob/master/CHANGELOG.md)). Any help testing this release is welcome, and feel free to open issues if you spot any regression.
+
 # Cloudtasker
 
 Background jobs for Ruby using Google Cloud Tasks.
@@ -8,7 +10,7 @@ Cloudtasker provides an easy to manage interface to Google Cloud Tasks for backg
 
 Cloudtasker is particularly suited for serverless applications only responding to HTTP requests and where running a dedicated job processing server is not an option (e.g. deploy via [Cloud Run](https://cloud.google.com/run)). All jobs enqueued in Cloud Tasks via Cloudtasker eventually get processed by your application via HTTP requests.
 
-Cloudtasker also provides optional modules for running [cron jobs](docs/CRON_JOBS.md), [batch jobs](docs/BATCH_JOBS.md) and [unique jobs](docs/UNIQUE_JOBS.md).
+Cloudtasker also provides optional modules for running [cron jobs](docs/CRON_JOBS.md), [batch jobs](docs/BATCH_JOBS.md), [unique jobs](docs/UNIQUE_JOBS.md) and [storable jobs](docs/STORABLE_JOBS.md).
 
 A local processing server is also available for development. This local server processes jobs in lieu of Cloud Tasks and allows you to work offline.
 
@@ -31,12 +33,15 @@ A local processing server is also available for development. This local server p
 8. [Logging](#logging)
     1. [Configuring a logger](#configuring-a-logger)
     2. [Logging context](#logging-context)
+    3. [Truncating log arguments](#truncating-log-arguments)
+    4. [Searching logs: Job ID vs Task ID](#searching-logs-job-id-vs-task-id)
 9. [Error Handling](#error-handling)
     1. [HTTP Error codes](#http-error-codes)
     2. [Worker callbacks](#worker-callbacks)
     3. [Global callbacks](#global-callbacks)
     4. [Max retries](#max-retries)
-    5. [Dispatch deadline](#dispatch-deadline)
+    5. [Conditional reenqueues using retry errors](#conditional-reenqueues-using-retry-errors)
+    6. [Dispatch deadline](#dispatch-deadline)
 10. [Testing](#testing)
     1. [Test helper setup](#test-helper-setup)
     2. [In-memory queues](#in-memory-queues)
@@ -137,7 +142,7 @@ Now jump to the next section to configure your app to use Google Cloud Tasks as
 
 ## Get started with Rails & ActiveJob
 **Note**: ActiveJob is supported since `0.11.0`  
-**Note**: Cloudtasker extensions (cron, batch and unique jobs) are not available when using cloudtasker via ActiveJob.
+**Note**: Cloudtasker extensions (cron, batch, unique jobs and storable) are not available when using cloudtasker via ActiveJob.
 
 Cloudtasker is pre-integrated with ActiveJob. Follow the steps below to get started.
 
@@ -328,7 +333,8 @@ Cloudtasker.configure do |config|
   # Specify the redis connection hash.
   #
   # This is ONLY required in development for the Cloudtasker local server and in
-  # all environments if you use any cloudtasker extension (unique jobs, cron jobs or batch jobs)
+  # all environments if you use any cloudtasker extension (unique jobs, cron jobs,
+  # batch jobs or storable jobs)
   #
   # See https://github.com/redis/redis-rb for examples of configuration hashes.
   #
@@ -370,6 +376,8 @@ Cloudtasker.configure do |config|
   # Supported since: v0.12.0
   #
   # Default: 600 seconds (10 minutes)
+  # Min: 15 seconds
+  # Max: 1800 seconds (30 minutes)
   #
   # config.dispatch_deadline = 600
 
@@ -402,6 +410,40 @@ Cloudtasker.configure do |config|
   # Default: no operation
   #
   # config.on_dead = ->(error, worker) { Rollbar.error(error) }
+
+  #
+  # Specify the Open ID Connect (OIDC) details to connect to a protected GCP service, such
+  # as a private Cloud Run application.
+  #
+  # The configuration supports the following details:
+  # - service_account_email: This is the "act as" user. It can be found under the security details
+  #   of the Cloud Run service.
+  # - audience: The audience is usually the publicly accessible host for the Cloud Run service
+  #   (which is the same value configured as the processor_host). If no audiences are provided
+  #   it will be set to the processor_host.
+  #
+  # Note: If the OIDC token is used for a Cloud Run service make sure to include the
+  # `iam.serviceAccounts.actAs` permission on the service account.
+  #
+  # See https://cloud.google.com/tasks/docs/creating-http-target-tasks#sa for more information on
+  # setting up service accounts for use with Cloud Tasks.
+  #
+  # Supported since: v0.14.rc1
+  #
+  # Default: nil 
+  #
+  # config.oidc = { service_account_email: 'example@gserviceaccount.com' }
+  # config.oidc = { service_account_email: 'example@gserviceaccount.com', audience: 'https://api.example.net' }
+
+  #
+  # Enable/disable the verification of SSL certificates on the local processing server when
+  # sending tasks to the processor.
+  #
+  # Set to false to disable SSL verification (OpenSSL::SSL::VERIFY_NONE).
+  #
+  # Default: true
+  #
+  # config.local_server_ssl_verify = true
 end
 ```
 
@@ -449,6 +491,8 @@ class FetchResourceWorker
     # ...do some logic...
     if some_condition
       # Stop and re-enqueue the job to be run again in 10 seconds.
+      # Also see the section on Cloudtasker::RetryWorkerError for a different
+      # approach on reenqueuing.
       return reenqueue(10)
     else
       # ...keep going...
@@ -510,6 +554,7 @@ Cloudtasker comes with three optional features:
 - Cron Jobs [[docs](docs/CRON_JOBS.md)]: Run jobs at fixed intervals.
 - Batch Jobs [[docs](docs/BATCH_JOBS.md)]: Run jobs in jobs and track completion of the overall batch.
 - Unique Jobs [[docs](docs/UNIQUE_JOBS.md)]: Ensure uniqueness of jobs based on job arguments.
+- Storable Jobs [[docs](docs/STORABLE_JOBS.md)]: Park jobs until they are ready to be enqueued.
 
 ## Working locally
 
@@ -652,6 +697,60 @@ end
 
 See the [Cloudtasker::Worker class](lib/cloudtasker/worker.rb) for more information on attributes available to be logged in your `log_context_processor` proc.
 
+### Truncating log arguments
+**Supported since**: `v0.14.rc1`  
+
+By default Cloudtasker does not log job arguments as arguments can contain sensitive data and generate voluminous logs, which may lead to noticeable costs with your log provider (e.g. GCP Logging). Also some providers (e.g. GCP Logging) will automatically truncate log entries that are too big and reduce their searchability.
+
+Job arguments can be logged for all workers by configuring the following log context processor in your Cloudtasker initializer:
+```ruby
+Cloudtasker::WorkerLogger.log_context_processor = ->(worker) { worker.to_h }
+```
+
+In order to reduce the size of logged job arguments, the following `truncate` utility is provided by Cloudtasker: 
+```ruby
+# string_limit: The maximum size for strings. Default is 64. Set to -1 to disable.
+# array_limit: The maximum length for arrays. Default is 10. Set to -1 to disable.
+# max_depth: The maximum recursive depth. Default is 3. Set to -1 to disable.
+Cloudtasker::WorkerLogger.truncate(payload, string_limit: 64, array_limit: 10, max_depth: 3)
+```
+
+You may use it the following way:
+```ruby
+Cloudtasker::WorkerLogger.log_context_processor = lambda do |worker|
+  payload = worker.to_h
+
+  # Using default options
+  payload[:job_args] = Cloudtasker::WorkerLogger.truncate(payload[:job_args])
+
+  # Using custom options
+  # payload[:job_args] = Cloudtasker::WorkerLogger.truncate(payload[:job_args], string_limit: 32, array_limit: 5, max_depth: 2)
+
+  # Return the payload to log
+  payload
+end
+```
+
+To further reduce logging cost, you may also log a reasonably complete version of job arguments at start then log a watered down version for the remaining log entries:
+```ruby
+Cloudtasker::WorkerLogger.log_context_processor = lambda do |worker|
+  payload = worker.to_h
+
+  # Adjust the log payload based on the lifecycle of the job
+  payload[:job_args] = if worker.perform_started_at
+                         # The job start has already been logged. Log the job primitive arguments without depth.
+                         # Arrays and hashes will be masked.
+                         Cloudtasker::WorkerLogger.truncate(payload[:job_args], max_depth: 0)
+                       else
+                         # This is the job start. Log a more complete version of the job args.
+                         Cloudtasker::WorkerLogger.truncate(payload[:job_args])
+                       end
+
+  # Return the payload to log
+  payload
+end
+```
+
 ### Searching logs: Job ID vs Task ID
 **Note**: `task_id` field is available in logs starting with `0.10.0`
 
@@ -735,7 +834,7 @@ By default jobs are retried 25 times - using an exponential backoff - before bei
 
 Note that the number of retries set on your Cloud Task queue should be many times higher than the number of retries configured in Cloudtasker because Cloud Task also includes failures to connect to your application. Ideally set the number of retries to `unlimited` in Cloud Tasks.
 
-**Note**: The `X-CloudTasks-TaskExecutionCount` header sent by Google Cloud Tasks and providing the number of retries outside of `HTTP 503` (instance not reachable) is currently bugged and remains at `0` all the time. Starting with `v0.10.0` Cloudtasker uses the `X-CloudTasks-TaskRetryCount` header to detect the number of retries. This header includes `HTTP 503` errors which means that if your application is down at some point, jobs will fail and these failures will be counted toward the maximum number of retries. A [bug report](https://issuetracker.google.com/issues/154532072) has been raised with GCP to address this issue. Once fixed we will revert to using `X-CloudTasks-TaskExecutionCount` to avoid counting `HTTP 503` as job failures.
+**Note**: Versions prior to `v0.14.rc1` use the `X-CloudTasks-TaskRetryCount` header for retries instead of the `X-CloudTasks-TaskExecutionCount` header to detect the number of retries, because there a previous bug on the GCP side which made the `X-CloudTasks-TaskExecutionCount` stay at zero instead of increasing on successive executions. Versions prior to `v0.14.rc1` count any failure as failure, including failures due to the backend being unavailable (`HTTP 503`). Versions `v0.14.rc1` and later only count application failure (`HTTP 4xx`) as failure for retry purpose.
 
 E.g. Set max number of retries globally via the cloudtasker initializer.
 ```ruby
@@ -791,6 +890,46 @@ class SomeErrorWorker
 end
 ```
 
+### Conditional reenqueues using retry errors
+**Supported since**: `v0.14.rc1`  
+
+If your worker is waiting for some precondition to occur and you want to re-enqueue it until the condition has been met, you can raise a `Cloudtasker::RetryWorkerError`. This special error will fail your job **without logging an error** while still increasing the number of retries.
+
+This is a safer approach than using the `reenqueue` helper, which can lead to forever running jobs if not used properly.
+
+```ruby
+# app/workers/my_worker.rb
+
+class MyWorker
+  include Cloudtasker::Worker
+
+  def perform(project_id)
+    # Abort if project does not exist
+    return unless (project = Project.find_by(id: project_id))
+
+    # Trigger a retry if the project is still in "discovering" status
+    # This error will NOT log an error. It only triggers a retry.
+    raise Cloudtasker::RetryWorkerError if project.status == 'discovering'
+
+    # The previous approach was to use `reenqueue`. This works but since it
+    # does not increase the number of retries, you may end up with forever running
+    # jobs
+    # return reenqueue(10) if project.status == 'discovering'
+
+    # Do stuff when project is not longer discovering
+    do_some_stuff
+  end
+
+  # You can then specify what should be done if we've been waiting for too long
+  def on_dead(error)
+    logger.error("Looks like the project is forever discovering. Time to give up.")
+
+    # This is of course an imaginary method
+    send_slack_notification_to_internal_support_team(worker: self.class, args: job_args)
+  end
+end
+```
+
 ### Dispatch deadline
 **Supported since**: `0.12.0`  
 
@@ -1092,7 +1231,7 @@ To size the concurrency of your queues you should therefore take the most limiti
 After checking out the repo, run `bin/setup` to install dependencies.
 
 For tests, run `rake` to run the tests. Note that Rails is not in context by default, which means Rails-specific test will not run.
-For tests including Rails-specific tests, run `bundle exec appraisal rails-7.0 rake`
+For tests including Rails-specific tests, run `bundle exec appraisal rails_7.0 rake`
 For all context-specific tests (incl. Rails), run the [appraisal tests](Appraisals) using `bundle exec appraisal rake`.
 
 You can run `bin/console` for an interactive prompt that will allow you to experiment.

data/app/controllers/cloudtasker/worker_controller.rb

@@ -4,7 +4,7 @@ module Cloudtasker
   # Handle execution of workers
   class WorkerController < ActionController::Base
     # No need for CSRF verification on API endpoints
-    skip_before_action :verify_authenticity_token
+    skip_forgery_protection
 
     # Authenticate all requests.
     before_action :authenticate!
@@ -36,13 +36,12 @@ module Cloudtasker
     private
 
     #
-    # Parse the request body and return the actual job
-    # payload.
+    # Parse the request body and return the JSON payload
     #
-    # @return [Hash] The job payload
+    # @return [String] The JSON payload
     #
-    def payload
-      @payload ||= begin
+    def json_payload
+      @json_payload ||= begin
         # Get raw body
         content = request.body.read
 
@@ -51,11 +50,22 @@ module Cloudtasker
           content = Base64.decode64(content)
         end
 
-        # Return content parsed as JSON and add job retries count
-        JSON.parse(content).merge(job_retries: job_retries, task_id: task_id)
+        # Return the content
+        content
       end
     end
 
+    #
+    # Parse the request body and return the actual job
+    # payload.
+    #
+    # @return [Hash] The job payload
+    #
+    def payload
+      # Return content parsed as JSON and add job retries count
+      @payload ||= JSON.parse(json_payload).merge(job_retries: job_retries, task_id: task_id)
+    end
+
     #
     # Extract the number of times this task failed at runtime.
     #
@@ -80,7 +90,18 @@ module Cloudtasker
     # See Cloudtasker::Authenticator#verification_token
     #
     def authenticate!
-      Authenticator.verify!(request.headers['Authorization'].to_s.split(' ').last)
+      if (signature = request.headers[Cloudtasker::Config::CT_SIGNATURE_HEADER])
+        # Verify content signature
+        Authenticator.verify_signature!(signature, json_payload)
+      else
+        # Get authorization token from custom header (since v0.14.rc1) or fallback to
+        # former authorization header (jobs enqueued by v0.13 and below)
+        bearer_token = request.headers[Cloudtasker::Config::CT_AUTHORIZATION_HEADER].to_s.split.last ||
+                       request.headers[Cloudtasker::Config::OIDC_AUTHORIZATION_HEADER].to_s.split.last
+
+        # Verify the token
+        Authenticator.verify!(bearer_token)
+      end
     end
   end
 end

data/cloudtasker.gemspec

@@ -28,6 +28,8 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
+  spec.required_ruby_version = '>= 2.7.0'
+
   spec.add_dependency 'activesupport'
   spec.add_dependency 'connection_pool'
   spec.add_dependency 'fugit'
@@ -36,14 +38,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'redis'
   spec.add_dependency 'retriable'
 
-  spec.add_development_dependency 'appraisal'
-  spec.add_development_dependency 'bundler', '~> 2.0'
-  spec.add_development_dependency 'rake', '>= 12.3.3'
-  spec.add_development_dependency 'rspec', '~> 3.0'
-  spec.add_development_dependency 'rspec-json_expectations', '~> 2.2'
-  spec.add_development_dependency 'rubocop', '0.76.0'
-  spec.add_development_dependency 'rubocop-rspec', '1.37.0'
-  spec.add_development_dependency 'semantic_logger'
-  spec.add_development_dependency 'timecop'
-  spec.add_development_dependency 'webmock'
+  spec.metadata['rubygems_mfa_required'] = 'true'
 end

data/docs/CRON_JOBS.md

@@ -65,6 +65,29 @@ if File.exist?(schedule_file) && !Rails.env.test?
 end
 ```
 
+## With Puma Cluster-mode
+Due to this issue with gRPC here: https://github.com/grpc/grpc/issues/7951.
+
+TLTR: 
+> Forking processes and using gRPC across processes is not supported behavior due to very low-level resource issues. Either delay your use of gRPC until you've forked from fresh processes (similar to Python 3's use of a zygote process), or don't expect things to work after a fork.
+
+In order to make it works, we should schedule cron jobs (which triggers gPRC calls) once puma is booted.
+
+Example:
+```ruby
+config/puma.rb
+
+workers ENV.fetch("WEB_CONCURRENCY") { 2 }
+preload_app!
+
+on_booted do
+  schedule_file = "config/cloudtasker_cron.yml"
+  if File.exist?(schedule_file) && !Rails.env.test?
+    Cloudtasker::Cron::Schedule.load_from_hash!(YAML.load_file(schedule_file))
+  end
+end
+```
+
 ## Limitations
 GCP Cloud Tasks does not allow tasks to be scheduled more than 30 days (720h) in the future. Cron schedules should therefore be limited to 30 days intervals at most.