cronwatch 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f515d13b757f2063defbf1c390f41d8970417a02991d5f137639221daa095c9
-  data.tar.gz: 8843a960d7249f58200456b706ce60cc8ecd5cb7490be84639aed8ff0bf5b639
+  metadata.gz: 4717ad1d0fcfb080755faed7d4f018257f1b382e3076ab3e16d6830d9f985732
+  data.tar.gz: a907c315c80b237b09eb40087cfa7f28f5ed261494686b00f4c6df3710afeaf1
 SHA512:
-  metadata.gz: d95b276c86d464ab53c871f1967c5880822bcf677c7a96384cf7ee42f6d02f73da7eccf244aaceff5e4bd72ee06886f1dc025fe342e239b28ae5d74c87a5caf8
-  data.tar.gz: 16c1ac8fcb3f1e18b1f81e7447d7a237fd80e4acc5276e06d99e55a2802b2cea3aca40372a4fd7b7679e3558072cdb31e0bfd1a6dda6aa1321ad73bd2e995247
+  metadata.gz: 201500f44422be56f7c741a3dfd200ef7b0eabd893b3ea7466b8c3504f36d834f07d2a3a41e55d5035255abba46c0462498c9920c8c0d12e19843f9e3d8b1daa
+  data.tar.gz: c6fd81253765bd342f698cfa93ff66a87b13e20fee82d7d6c48972d8c25769b8cb48db1971bc082cfb0fc1660f1900535279135169514615724668b1aa21e0c4

data/README.md

@@ -168,7 +168,7 @@ Rails.application.routes.draw do
 end
 ```
 
-Set `CRONWATCH_TOKEN` to a long random string and open `/cronwatch?token=<it>` once; the browser keeps a cookie. Without a token, while `RAILS_ENV` or `RACK_ENV` is `development` or `test`, it makes a token of its own and prints a sign-in link to standard output on its first request (open it once); anywhere else it answers 503. To rely on the app's own sign in, mount it behind that (Devise's `authenticate` block, or a routing constraint) and pass `token: nil`. The URLs, JSON shapes, headers and CSRF rules are the SDK's, so the MCP server reads it unchanged. The request's origin, which the CSRF check compares against, is what Rack reports and so already follows `X-Forwarded-Host` and `X-Forwarded-Proto`; pass `origin: "https://app.example.com"` to pin it instead. `GET /cronwatch/api/check` with a bearer (the token or `CRON_SECRET`) runs the check, for an outside cron.
+Set `CRONWATCH_TOKEN` to a long random string and open `/cronwatch?token=<it>` once; the browser keeps a cookie. Without a token, while `RAILS_ENV` or `RACK_ENV` is `development` or `test`, it makes a token of its own and prints a sign-in link to standard output on its first request (open it once; unless `origin:` is set or the request's host is loopback, the link leaves the host out, since a client chooses it); anywhere else it answers 503. To rely on the app's own sign in, mount it behind that (Devise's `authenticate` block, or a routing constraint) and pass `token: nil`. The URLs, JSON shapes, headers and CSRF rules are the SDK's, so the MCP server reads it unchanged. The request's origin, which the CSRF check compares against, is what Rack reports and so already follows `X-Forwarded-Host` and `X-Forwarded-Proto`; pass `origin: "https://app.example.com"` to pin it instead. `GET /cronwatch/api/check` with a bearer (the token or `CRON_SECRET`) runs the check, for an outside cron.
 
 There is no `handler()` as in the TypeScript SDK: for a job triggered over HTTP, wrap the controller action's body in `CW.job(...).run` (declared once, at boot) and check the bearer in the controller.
 

data/lib/cronwatch/duration.rb

@@ -5,6 +5,12 @@ module Cronwatch
   module Duration
     UNIT_MS = { "ms" => 1, "s" => 1000, "m" => 60_000, "h" => 3_600_000, "d" => 86_400_000, "w" => 604_800_000 }.freeze
     PART = Regexp.new("(\\d+(?:\\.\\d+)?)[#{JS::WHITESPACE}]*(ms|s|m|h|d|w)")
+    # The longest duration string read, in characters. No real duration
+    # comes near it, and PART is quadratic on a long run of digits, so a
+    # longer string is refused before it is read.
+    MAX_LENGTH = 64
+    # How much of a refused, overlong string its error quotes.
+    QUOTED = 32
 
     module_function
 
@@ -29,6 +35,10 @@ module Cronwatch
         raise ArgumentError, "#{label} \"#{value}\" is not a duration like \"15m\", \"1h30m\" or \"90s\""
       end
 
+      if value.length > MAX_LENGTH
+        raise ArgumentError, "#{label} \"#{value[0, QUOTED]}...\" is too long for a duration (more than #{MAX_LENGTH} characters)"
+      end
+
       text = JS.trim(value).downcase
       raise ArgumentError, "#{label} is empty" if text.empty?
 

data/lib/cronwatch/serialize.rb

@@ -4,6 +4,15 @@ module Cronwatch
   module Serialize
     module_function
 
+    # How long one expect pattern may take over a run's output, in seconds.
+    # Onigmo memoizes most patterns into linear time, but not one with a
+    # backreference or a lookaround, which can backtrack for minutes over an
+    # output it does not match. A match that times out does not match, so
+    # the run fails as the other ports' bounded engines fail it. A pattern
+    # with a shorter timeout of its own (or a shorter Regexp.timeout) keeps
+    # it.
+    PATTERN_TIMEOUT = 1.0
+
     # A definition as a store can hold it: `expect` becomes a description, and
     # moves to the end, as it does in the SDK.
     def to_stored(definition)
@@ -36,7 +45,7 @@ module Cronwatch
         # match? keeps no position between calls (JavaScript's /g and /y do,
         # which is why the SDK resets lastIndex) and does not touch $~, so
         # every run is checked from the start whatever the flags.
-        expect.match?(text) ? nil : "Output did not match #{expect.inspect}"
+        matches?(expect, text) ? nil : "Output did not match #{expect.inspect}"
       else
         ok = false
         begin
@@ -47,5 +56,13 @@ module Cronwatch
         ok ? nil : "Output did not pass the expect() check"
       end
     end
+
+    # Whether the pattern matches within PATTERN_TIMEOUT; a timeout is no.
+    def matches?(pattern, text)
+      limit = [pattern.timeout, Regexp.timeout, PATTERN_TIMEOUT].compact.min
+      Regexp.new(pattern, timeout: limit).match?(text)
+    rescue Regexp::TimeoutError
+      false
+    end
   end
 end

data/lib/cronwatch/version.rb

@@ -2,5 +2,5 @@
 
 module Cronwatch
   # Kept in step with @cronwatch/sdk.
-  VERSION = "0.6.1"
+  VERSION = "0.7.0"
 end

data/lib/cronwatch/web/app.rb

@@ -92,12 +92,36 @@ module Cronwatch
     end
 
     # The line a development token is announced with, printed once to stdout
-    # on the app's first request. `origin` is that request's origin (scheme,
-    # host and any port), `base` the base path without a trailing slash (""
-    # when mounted at the root).
+    # on the app's first request. `origin` is the `origin:` option when set,
+    # otherwise that request's origin (scheme, host and any port) when its
+    # host is loopback, and nil for any other host: the request's host is
+    # the client's to choose, so the line then leaves it out rather than
+    # point the link, token and all, somewhere else. `base` is the base path
+    # without a trailing slash ("" when mounted at the root).
     def self.development_sign_in_line(origin, base, token)
-      "[cronwatch] CRONWATCH_TOKEN is not set, so this development server made a token for the dashboard. " \
-        "Sign in: #{origin}#{base}/?token=#{token}"
+      intro = "[cronwatch] CRONWATCH_TOKEN is not set, so this development server made a token for the dashboard. Sign in: "
+      return "#{intro}#{base}/?token=#{token} on this server (the first request's host is not local, so the link leaves it out)" if origin.nil?
+
+      "#{intro}#{origin}#{base}/?token=#{token}"
+    end
+
+    # Whether an origin's host is loopback: "localhost", a name ending in
+    # ".localhost", an IPv4 address in 127.0.0.0/8, or the IPv6 address ::1.
+    # Only an origin that reads as one counts: a Host header is anyone's to
+    # send, and one such as "evil.example/.localhost" or
+    # "localhost:1@evil.example" must not put the development token in a
+    # link to another host.
+    def self.loopback_origin?(origin)
+      bare = Origin.bare(origin.to_s)
+      return false if bare.nil?
+
+      authority = bare.sub(%r{\A[a-z]+://}, "")
+      host = authority.start_with?("[") ? authority[0..(authority.index("]") || -1)] : authority.split(":", 2).first.to_s
+      host = host.downcase
+      return true if host == "localhost" || host.end_with?(".localhost") || host == "[::1]"
+
+      octets = /\A127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\z/.match(host)
+      !octets.nil? && octets.captures.all? { |o| o.to_i <= 255 }
     end
 
     # The `origin` option, normalised to scheme://host[:port], or nil when
@@ -319,7 +343,8 @@ module Cronwatch
       end
       return unless first
 
-      $stdout.puts(Web.development_sign_in_line(public_origin(request), base, @token))
+      shown = @origin || (Web.loopback_origin?(request.origin) ? request.origin : nil)
+      $stdout.puts(Web.development_sign_in_line(shown, base, @token))
       $stdout.flush
     end
 

data/lib/cronwatch/web/origin.rb

@@ -39,6 +39,33 @@ module Cronwatch
         "#{scheme}://#{host}#{port}"
       end
 
+      # scheme://host[:port] for text that is a scheme and a bare host, or nil
+      # when it carries credentials, a path, a query or a fragment, or is not
+      # an http or https URL.
+      def bare(value)
+        return nil unless value.is_a?(String)
+
+        text = value.sub(/\A[\x00-\x20]+/, "").sub(/[\x00-\x20]+\z/, "").delete("\t\n\r")
+        match = text.match(%r{\A[A-Za-z][A-Za-z0-9+.\-]*:[/\\]*([^/\\?#]*)(.*)\z}m)
+        return nil if match.nil?
+
+        userinfo, at, = match[1].rpartition("@")
+        return nil if !at.empty? && !userinfo.empty? && userinfo != ":"
+        return nil if past_host?(match[2])
+
+        parse(text)
+      rescue ArgumentError
+        nil
+      end
+
+      # Whether what follows the host would show in the URL: a path other
+      # than "/", a query or a fragment.
+      def past_host?(after)
+        path, hash, fragment = after.partition("#")
+        path, _, query = path.partition("?")
+        (!path.empty? && path != "/" && path != "\\") || !query.empty? || (!hash.empty? && !fragment.empty?)
+      end
+
       # [host, port] with the scheme's default port when none is given.
       def split_port(authority, value)
         if authority.start_with?("[")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cronwatch
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.7.0
 platform: ruby
 authors:
 - Jon C. Phillips