conjur-rack 3.1.0 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 0ee85c177c59da73e229825170b3b8c34230e4e1
-  data.tar.gz: 7758e75373c0ccdfcb61539a33325795d5394600
+SHA256:
+  metadata.gz: e7a94d29090dcdb5515723b50f1f0217be932a96574e9d46c9f7e84abd3a3cb3
+  data.tar.gz: 3a011098248a61fa80a92e3085f07f71e18b8748867e3c44cc6c174dc922e69f
 SHA512:
-  metadata.gz: ccec8cadd0827fbf5b298f57fa78aa32a7792a58d985c0ff54ee05b80c256e55c0a9c868a1432be4908d7314c9becefdcf812ed95aad28ec756e989ad250def2
-  data.tar.gz: 36e507e1714480f2c5e4f5ff9d3af63cca883f855fc2259e272c3ce45420dadc36e0cd64cbe926f6396d0d3793968f802df147950ac0db86c7b69bba3abd0b8d
+  metadata.gz: a11e49c31d758257c79b508dc3f30c500310962e2420d4c31adf7b83a706f44618ea11350a53e5fdda8dc0a1173082cbf84dea8616493e3733730e42c31714cc
+  data.tar.gz: ce37831b5f5eb108a1637db47bfd73b823eec4bde8e55a3ceafcedccd98dba7f53a8007578931fec18021fd36e174fffd991cc8caf0327622fcdfe3638ba44a5

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+# unreleased version
+
+# v4.0.0
+
+* Bump `rack` to v2, `bundler` to v1.16 in gemspec
+* Add Jenkinsfile to project
+* Ignore headers such as Conjur-Privilege or Conjur-Audit if they're not
+supported by the API (instead of erroring out).
+
 # v3.1.0
 
 * Support for JWT Slosilo tokens.

data/Jenkinsfile

@@ -0,0 +1,63 @@
+pipeline {
+  agent { label 'executor-v2' }
+
+  options {
+    timestamps()
+    buildDiscarder(logRotator(daysToKeepStr: '30'))
+  }
+
+  stages {
+    stage('Run tests') {
+      steps {
+        sh './test.sh'
+
+        junit 'spec/reports/*.xml'
+      }
+    }
+
+    // Only publish to RubyGems if the HEAD is
+    // tagged with the same version as in version.rb
+    stage('Publish to RubyGems') {
+      agent { label 'releaser-v2' }
+
+      when {
+        expression { currentBuild.resultIsBetterOrEqualTo('SUCCESS') }
+        branch "master"
+        expression {
+          def exitCode = sh returnStatus: true, script: ''' set +x
+            echo "Determining if publishing is requested..."
+            
+            VERSION=`cat lib/conjur/rack/version.rb | grep VERSION | sed 's/.* "//;s/"//'`
+            echo Declared version: $VERSION
+            
+            # Jenkins git plugin is broken and always fetches with `--no-tags`
+            # (or `--tags`, neither of which is what you want), so tags end up
+            # not being fetched. Try to fix that.
+            # (Unfortunately this fetches all remote heads, so we may have to find          
+            # another solution for bigger repos.)
+            git fetch -q
+            
+            # note when tag not found git rev-parse will just print its name
+            TAG=`git rev-list -n 1 "v$VERSION" 2>/dev/null || :`
+            echo Tag v$VERSION: $TAG
+            
+            HEAD=`git rev-parse HEAD`
+            echo HEAD: $HEAD
+            
+            test "$HEAD" = "$TAG"
+          '''
+          return exitCode == 0
+        }
+      }
+      steps {
+        sh './publish.sh'
+      }
+    }
+  }
+
+  post {
+    always {
+      cleanupAndNotify(currentBuild.currentResult)
+    }
+  }
+}

data/conjur-rack.gemspec

@@ -20,9 +20,9 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "slosilo", "~> 2.1"
   spec.add_dependency "conjur-api", "< 6"
-  spec.add_dependency "rack", '~> 1'
+  spec.add_dependency "rack", '~> 2'
 
-  spec.add_development_dependency "bundler", "~> 1.3"
+  spec.add_development_dependency "bundler", "~> 1.16"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rspec"
   spec.add_development_dependency 'ci_reporter_rspec'

data/lib/conjur/rack/user.rb

@@ -37,7 +37,9 @@ module Conjur
       # actually have that privilege according to the Conjur server.
       def validated_global_privilege
         unless @validated_global_privilege
-          @privilege = nil if @privilege && !api.global_privilege_permitted?(@privilege)
+          @privilege = nil unless @privilege &&
+                  api.respond_to?(:global_privilege_permitted?) &&
+                  api.global_privilege_permitted?(@privilege)
           @validated_global_privilege = true
         end
         @privilege
@@ -91,9 +93,15 @@ module Conjur
         args = [ token ]
         args.push remote_ip if remote_ip
         api = cls.new_from_token(*args)
-        api = api.with_privilege(privilege) if privilege
-        api = api.with_audit_resources(audit_resources) if audit_resources
-        api = api.with_audit_roles(audit_roles) if audit_roles
+
+        # These are features not present in some API versions.
+        # Test for them and only apply if it makes sense. Ignore otherwise.
+        %i(privilege audit_resources audit_roles).each do |feature|
+          meth = "with_#{feature}".intern
+          if api.respond_to?(meth) && (value = send(feature))
+            api = api.send meth, value
+          end
+        end
 
         api
       end

data/lib/conjur/rack/version.rb

@@ -1,5 +1,5 @@
 module Conjur
   module Rack
-    VERSION = "3.1.0"
+    VERSION = "4.0.0"
   end
 end

data/publish.sh

@@ -0,0 +1,7 @@
+#!/bin/bash -ex
+
+docker pull registry.tld/conjurinc/publish-rubygem
+
+summon --yaml "RUBYGEMS_API_KEY: !var rubygems/api-key" \
+  docker run --rm --env-file @SUMMONENVFILE -v "$(pwd)":/opt/src \
+  registry.tld/conjurinc/publish-rubygem conjur-rack

data/spec/rack/user_spec.rb

@@ -69,22 +69,34 @@ describe Conjur::Rack::User do
   end
   
   describe "#global_reveal?" do
+    let(:api){ double "conjur-api" }
+    before { allow(subject).to receive(:api).and_return(api) }
+
     context "with global privilege" do
       let(:privilege) { "reveal" }
-      let(:api){ Conjur::API.new_from_token "the-token" }
-      before do
-        allow(subject).to receive(:api).and_return(api)
+
+      context "when not supported" do
+        before { expect(api).not_to respond_to :global_privilege_permitted? }
+        it "simply returns false" do
+          expect(subject.global_reveal?).to be false
+        end
       end
-      it "checks the API function global_privilege_permitted?" do
-        expect(api).to receive(:resource).with("!:!:conjur").and_return(resource = double(:resource))
-        expect(resource).to receive(:permitted?).with("reveal").and_return(true)
-        expect(subject.global_reveal?).to be true
-        # The result is cached
-        subject.global_reveal?
+
+      context "when supported" do
+        before do
+          allow(api).to receive(:global_privilege_permitted?).with('reveal') { true }
+        end
+        it "checks the API function global_privilege_permitted?" do
+          expect(subject.global_reveal?).to be true
+          # The result is cached
+          expect(api).not_to receive :global_privilege_permitted?
+          subject.global_reveal?
+        end
       end
     end
+
     context "without a global privilege" do
-      it "simply returns nil" do
+      it "simply returns false" do
         expect(subject.global_reveal?).to be false
       end
     end
@@ -98,51 +110,71 @@ describe Conjur::Rack::User do
         expect(subject.api(cls)).to eq('the api')
       end
     end
+
     context 'when not given args' do
-      shared_examples_for "builds the api" do
-        its(:api) { should == 'the api' }
+      let(:api) { double :api }
+      before do
+        allow(Conjur::API).to receive(:new_from_token).with(token).and_return(api)
       end
-      
-      context "with no extra args" do
-        before {
-          expect(Conjur::API).to receive(:new_from_token).with(token).and_return('the api')
-        }
-        it_should_behave_like "builds the api"
+
+      it "builds the api from token" do
+        expect(subject.api).to eq api
       end
+
       context "with remote_ip" do
         let(:remote_ip) { "the-ip" }
-        before {
-          expect(Conjur::API).to receive(:new_from_token).with(token, 'the-ip').and_return('the api')
-        }
-        it_should_behave_like "builds the api"
+        it "passes the IP to the API constructor" do
+          expect(Conjur::API).to receive(:new_from_token).with(token, 'the-ip').and_return(api)
+          expect(subject.api).to eq api
+        end
       end
+
       context "with privilege" do
         let(:privilege) { "elevate" }
-        before {
-          expect(Conjur::API).to receive(:new_from_token).with(token).and_return(api = double(:api))
-          expect(api).to receive(:with_privilege).with("elevate").and_return('the api')
-        }
-        it_should_behave_like "builds the api"
+        it "applies the privilege on the API object" do
+          expect(api).to receive(:with_privilege).with("elevate").and_return "privileged api"
+          expect(subject.api).to eq "privileged api"
+        end
       end
 
-      context "with audit resource" do
-        let (:audit_resources) {  'food:bacon' }
-        before {
-          expect(Conjur::API).to receive(:new_from_token).with(token).and_return(api = double(:api))
-          expect(api).to receive(:with_audit_resources).with(['food:bacon']).and_return('the api')
-        }
-        it_should_behave_like "builds the api"
+      context "when audit supported" do
+        before do
+          # If we're testing on an API version that doesn't
+          # support audit this method will be missing, so stub.
+          unless Conjur::API.respond_to? :decode_audit_ids
+            # not exactly a faithful reimplementation, but good enough for here
+            allow(Conjur::API).to receive(:decode_audit_ids) {|x|[x]}
+          end
+        end
+
+        context "with audit resource" do
+          let (:audit_resources) { 'food:bacon' }
+          it "applies the audit resource on the API object" do
+            expect(api).to receive(:with_audit_resources).with(['food:bacon']).and_return('the api')
+            expect(subject.api).to eq 'the api'
+          end
+        end
+
+        context "with audit roles" do
+          let (:audit_roles) { 'user:cook' }
+          it "applies the audit role on the API object" do
+            expect(api).to receive(:with_audit_roles).with(['user:cook']).and_return('the api')
+            expect(subject.api).to eq 'the api'
+          end
+        end
       end
 
-      context "with audit roles" do
-        let (:audit_roles) {  'user:cook' }
-        before {
-          expect(Conjur::API).to receive(:new_from_token).with(token).and_return(api = double(:api))
-          expect(api).to receive(:with_audit_roles).with(['user:cook']).and_return('the api')
-        }
-        it_should_behave_like "builds the api"
+      context "when audit not supported" do
+        before do
+          expect(api).not_to respond_to :with_audit_resources
+          expect(api).not_to respond_to :with_audit_roles
+        end
+        let (:audit_resources) { 'food:bacon' }
+        let (:audit_roles) { 'user:cook' }
+        it "ignores audit roles and resources" do
+          expect(subject.api).to eq api
+        end
       end
-
     end
   end
 

data/{jenkins.sh → test.sh}

@@ -9,4 +9,4 @@ docker run --rm \
   -w /usr/src/app \
   -e CONJUR_ENV=ci \
   $TEST_IMAGE \
-  bash -c "bundle update && bundle exec rake spec"
+  bash -c "gem install bundler && bundle update && bundle exec rake spec"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: conjur-rack
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 4.0.0
 platform: ruby
 authors:
 - Kevin Gilpin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-18 00:00:00.000000000 Z
+date: 2018-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: slosilo
@@ -44,28 +44,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '2'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.16'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '1.16'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -147,21 +147,23 @@ files:
 - ".project"
 - CHANGELOG.md
 - Gemfile
+- Jenkinsfile
 - LICENSE.txt
 - README.md
 - Rakefile
 - conjur-rack.gemspec
-- jenkins.sh
 - lib/conjur/rack.rb
 - lib/conjur/rack/authenticator.rb
 - lib/conjur/rack/path_prefix.rb
 - lib/conjur/rack/user.rb
 - lib/conjur/rack/version.rb
+- publish.sh
 - spec/rack/authenticator_spec.rb
 - spec/rack/path_prefix_spec.rb
 - spec/rack/user_spec.rb
 - spec/rack_spec.rb
 - spec/spec_helper.rb
+- test.sh
 homepage: http://github.com/conjurinc/conjur-rack
 licenses:
 - Private
@@ -182,7 +184,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.13
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Rack authenticator and basic User struct