dedupe_requests 1.0.0.pre1

data/lib/dedupe_requests/redis_store.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module DedupeRequests
+  # Redis-backed claim/release store.
+  #
+  # - claim:   atomic SET key <token> NX EX <ttl>. Returns the token on success,
+  #            false if the key already exists (duplicate), or :error if Redis is
+  #            unreachable (fail open).
+  # - release: token-safe check-and-del via a Lua script — only deletes the key
+  #            if it still holds OUR token, so a slow request whose TTL expired
+  #            cannot wipe a newer request's fresh claim.
+  class RedisStore
+    RELEASE_SCRIPT = <<~LUA
+      if redis.call("get", KEYS[1]) == ARGV[1] then
+        return redis.call("del", KEYS[1])
+      else
+        return 0
+      end
+    LUA
+
+    # Wraps a bare Redis client so it responds to #with like a connection pool,
+    # giving one uniform access path regardless of what the user injected.
+    class NullPool
+      def initialize(redis)
+        @redis = redis
+      end
+
+      def with
+        yield @redis
+      end
+    end
+
+    def initialize(redis_or_pool, namespace: "dedupe_requests", logger: nil)
+      @pool = redis_or_pool.respond_to?(:with) ? redis_or_pool : NullPool.new(redis_or_pool)
+      @namespace = namespace
+      @logger = logger
+    end
+
+    def claim(fingerprint, ttl:)
+      token = SecureRandom.hex(16)
+      ok = @pool.with { |r| r.set(key(fingerprint), token, nx: true, ex: ttl) }
+      ok ? token : false
+    rescue StandardError => e
+      log(e)
+      :error
+    end
+
+    def release(fingerprint, token)
+      @pool.with { |r| r.eval(RELEASE_SCRIPT, keys: [key(fingerprint)], argv: [token]) }
+      true
+    rescue StandardError => e
+      log(e)
+      false
+    end
+
+    def key(fingerprint)
+      "#{@namespace}:dedup:#{fingerprint}"
+    end
+
+    private
+
+    def log(error)
+      @logger&.warn("[dedupe_requests] redis error: #{error.class}: #{error.message}")
+    end
+  end
+end

data/lib/dedupe_requests/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module DedupeRequests
+  VERSION = "1.0.0.pre1"
+end

data/lib/dedupe_requests.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "dedupe_requests/version"
+require "dedupe_requests/fingerprint"
+require "dedupe_requests/redis_store"
+require "dedupe_requests/configuration"
+require "dedupe_requests/guard"
+
+module DedupeRequests
+  class Error < StandardError; end
+
+  # The only verbs ever guarded. GET and DELETE are deliberately never deduped.
+  MUTATING_VERBS = %w[POST PUT PATCH].freeze
+
+  class << self
+    def config
+      @config ||= Configuration.new
+    end
+    alias configuration config
+
+    def configure
+      yield config
+      config
+    end
+
+    def reset_configuration!
+      @config = Configuration.new
+    end
+  end
+end
+
+# The controller concern needs ActiveSupport (a runtime dependency).
+require "dedupe_requests/controller"

metadata

@@ -0,0 +1,103 @@
+--- !ruby/object:Gem::Specification
+name: dedupe_requests
+version: !ruby/object:Gem::Version
+  version: 1.0.0.pre1
+platform: ruby
+authors:
+- Tilo Sloboda
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.2'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: Detects and rejects duplicate inbound POST/PUT/PATCH requests with a
+  409/conflict, with no client-side idempotency key required. The server auto-computes
+  a fingerprint of each mutating request, claims it atomically in Redis, and short-circuits
+  duplicates seen within a configurable time window, so they don't overwhelm your
+  server or cause 5xx errors.
+email:
+- tilo.sloboda@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- examples/README.md
+- examples/config.ru
+- examples/end_to_end_test.rb
+- lib/dedupe_requests.rb
+- lib/dedupe_requests/configuration.rb
+- lib/dedupe_requests/controller.rb
+- lib/dedupe_requests/fingerprint.rb
+- lib/dedupe_requests/guard.rb
+- lib/dedupe_requests/redis_store.rb
+- lib/dedupe_requests/version.rb
+homepage: https://github.com/tilo/dedupe_requests
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/tilo/dedupe_requests
+  source_code_uri: https://github.com/tilo/dedupe_requests
+  rubygems_mfa_required: 'false'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.6'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Automatic server-side de-duplication of inbound mutating Rails requests (POST/PUT/PATCH)
+  via a payload fingerprint and Redis.
+test_files: []