devise_masquerade 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3d9619a76cbee988888a5168f0cf57b74a59fd7b5c3cfbbac3113458c5cb60c
-  data.tar.gz: 9d04f07b596f095533e4e766f0ed1e0672f0078ae5fcecf696571326ed3d3b8d
+  metadata.gz: 9b0f25fa4c2e5b41336a6b39bb4eab9dc8cc9a90544de0dffec1cd95d2b8b7f6
+  data.tar.gz: 96073dd0fb8c13658d7f9b6e156aeb9a9fd90d0aa3e5360fe8416e698b00ceb6
 SHA512:
-  metadata.gz: 82d09ecc8063ce935f4125d7c8ecd73772a5d7ad5e5a9e6a909cb18e899793229a473ffdceb6a1c5a1eb36ddd244c2646f248e205f62b4d0c70ad47ef1cadbe9
-  data.tar.gz: 8c9456b986f8761a5258d1099777d0e8a0d71974de41e1e220c50e6cd7cfec362956d5f41b7ab1466cddbc7d49c350c04febe852f9920bca99a27c1e043ce024
+  metadata.gz: 243f3b4580c80bbf3c281df44bb7fba95d18ac67e0a547e925eb50d784bf05d7364c64ad439c45486473d38481f22b45aa44a9d152eddd67759e6792cf956bb4
+  data.tar.gz: 3f48a1f7d0a79f2b220380e6aa357ae3a9d937d817b00040b106b7e539d2ed651c61aec2da24626d8a58c9626a30ee958cb752dc779ed3195e09cf1b91177cdd

data/.github/FUNDING.yml

@@ -0,0 +1 @@
+patreon: oivoodoo

data/.github/workflows/brakeman-analysis.yml

@@ -0,0 +1,44 @@
+# This workflow integrates Brakeman with GitHub's Code Scanning feature
+# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications
+
+name: Brakeman Scan
+
+# This section configures the trigger for the workflow. Feel free to customize depending on your convention
+on:
+  push:
+    branches: [ "master", "main" ]
+  pull_request:
+    branches: [ "master", "main" ]
+
+jobs:
+  brakeman-scan:
+    name: Brakeman Scan
+    runs-on: ubuntu-latest
+    steps:
+    # Checkout the repository to the GitHub Actions runner
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    # Customize the ruby version depending on your needs
+    - name: Setup Ruby
+      uses: actions/setup-ruby@v1
+      with:
+        ruby-version: '2.7'
+
+    - name: Setup Brakeman
+      env:
+        BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+
+      run: |
+        gem install brakeman --version $BRAKEMAN_VERSION
+
+    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
+    - name: Scan
+      continue-on-error: true
+      run: |
+        brakeman -f sarif -o output.sarif.json .
+
+    # Upload the SARIF file generated in the previous step
+    - name: Upload SARIF
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: output.sarif.json

data/.github/workflows/rubocop-analysis.yml

@@ -0,0 +1,39 @@
+name: "Rubocop"
+
+on: push
+
+jobs:
+  rubocop:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    # If running on a self-hosted runner, check it meets the requirements
+    # listed at https://github.com/ruby/setup-ruby#using-self-hosted-runners
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: 2.6
+
+    # This step is not necessary if you add the gem to your Gemfile
+    - name: Install Code Scanning integration
+      run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+
+    - name: Install dependencies
+      run: bundle install
+
+    - name: Rubocop run
+      run: |
+        bash -c "
+          bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
+          [[ $? -ne 2 ]]
+        "
+
+    - name: Upload Sarif output
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: rubocop.sarif

data/.ruby-version

@@ -1 +1 @@
-2.6.0
+2.7.2

data/Gemfile

@@ -36,4 +36,6 @@ group :test do
   gem 'selenium-webdriver'
   gem 'chromedriver-helper'
   gem 'launchy'
+
+  gem "nokogiri", ">= 1.10.8"
 end

data/Gemfile.lock

@@ -52,8 +52,9 @@ GIT
 PATH
   remote: .
   specs:
-    devise_masquerade (1.2.0)
+    devise_masquerade (1.3.0)
       devise (>= 4.7.0)
+      globalid (>= 0.3.6)
       railties (>= 5.2.0)
 
 GEM
@@ -97,7 +98,7 @@ GEM
     archive-zip (0.12.0)
       io-like (~> 0.3.0)
     backports (3.15.0)
-    bcrypt (3.1.13)
+    bcrypt (3.1.16)
     bson (1.12.5)
     bson_ext (1.12.5)
       bson (~> 1.12.5)
@@ -141,7 +142,7 @@ GEM
     cucumber-tag_expressions (1.1.1)
     cucumber-wire (0.0.1)
     database_cleaner (1.0.1)
-    devise (4.7.1)
+    devise (4.7.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0)
@@ -189,7 +190,7 @@ GEM
     listen (3.2.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    loofah (2.3.0)
+    loofah (2.3.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     lumberjack (1.0.13)
@@ -205,7 +206,7 @@ GEM
     multi_json (1.14.1)
     multi_test (0.1.2)
     nenv (0.3.0)
-    nokogiri (1.10.4)
+    nokogiri (1.10.8)
       mini_portile2 (~> 2.4.0)
     notiffany (0.1.3)
       nenv (~> 0.1)
@@ -219,7 +220,7 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.10)
     public_suffix (4.0.1)
-    rack (2.0.7)
+    rack (2.2.3)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
     rails-dom-testing (2.0.3)
@@ -238,7 +239,7 @@ GEM
     rb-inotify (0.10.0)
       ffi (~> 1.0)
     regexp_parser (1.6.0)
-    responders (3.0.0)
+    responders (3.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
     rubyzip (2.0.0)
@@ -259,8 +260,8 @@ GEM
     thread_safe (0.3.6)
     tzinfo (1.2.5)
       thread_safe (~> 0.1)
-    warden (1.2.8)
-      rack (>= 2.0.6)
+    warden (1.2.9)
+      rack (>= 2.0.9)
     xpath (3.2.0)
       nokogiri (~> 1.8)
     zeitwerk (2.2.0)
@@ -285,6 +286,7 @@ DEPENDENCIES
   guard-cucumber
   guard-rspec (~> 4.7)
   launchy
+  nokogiri (>= 1.10.8)
   pry
   pry-byebug
   rb-fsevent
@@ -300,4 +302,4 @@ DEPENDENCIES
   test-unit
 
 BUNDLED WITH
-   2.0.2
+   2.1.4

data/README.md

@@ -179,6 +179,14 @@ in `routes.rb`:
 And check http://localhost:3000/, use for login user1@example.com and
 'password'
 
+## Troubleshooting
+
+Are you working in development mode and wondering why masquerade attempts result in a [Receiving "You are already signed in" flash[:error]](https://github.com/oivoodoo/devise_masquerade/issues/58) message? `Filter chain halted as :require_no_authentication rendered or redirected` showing up in your logfile? Chances are that you need to enable caching:
+
+    rails dev:cache
+
+This is a one-time operation, so you can set it and forget it. Should you ever need to disable caching in development, you can re-run the command as required.
+
 ## Test project
 
     make test

data/app/controllers/devise/masquerades_controller.rb

@@ -28,15 +28,9 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def back
-    user_id = session[session_key]
+    self.resource = find_owner_resource
 
-    resource = if user_id.present?
-      masquerading_resource_class.to_adapter.find_first(:id => user_id)
-    else
-      send(:"current_#{masquerading_resource_name}")
-    end
-
-    if masquerading_resource_class != masqueraded_resource_class
+    if resource.class != masqueraded_resource_class
       sign_out(send("current_#{masqueraded_resource_name}"))
     end
 
@@ -57,10 +51,11 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def find_resource
-    masqueraded_resource_class.
-      find_by_masquerade_key(params[Devise.masquerade_param]).
-      where(id: params[:id]).
-      first
+    GlobalID::Locator.locate_signed params[Devise.masquerade_param], for: 'masquerade'
+  end
+
+  def find_owner_resource
+    GlobalID::Locator.locate_signed(Rails.cache.read(session_key), for: 'masquerade')
   end
 
   def go_back(user, path:)
@@ -126,15 +121,20 @@ class Devise::MasqueradesController < DeviseController
   end
 
   def save_masquerade_owner_session
+    resource_gid = send("current_#{masquerading_resource_name}").to_sgid(
+      expires_in: Devise.masquerade_expires_in, for: 'masquerade')
+    # skip sharing owner id via session
+    Rails.cache.write(session_key, resource_gid, expires_in: Devise.masquerade_expires_in)
+
     unless session.key?(session_key)
-      session[session_key] = send("current_#{masquerading_resource_name}").id
       session[session_key_masquerading_resource_class] = masquerading_resource_class.name
       session[session_key_masqueraded_resource_class] = masqueraded_resource_class.name
     end
   end
 
   def cleanup_masquerade_owner_session
-    session.delete(session_key)
+    Rails.cache.delete(session_key)
+
     session.delete(session_key_masqueraded_resource_class)
     session.delete(session_key_masquerading_resource_class)
   end

data/devise_masquerade.gemspec

@@ -24,4 +24,5 @@ Gem::Specification.new do |gem|
 
   gem.add_runtime_dependency('railties', '>= 5.2.0')
   gem.add_runtime_dependency('devise', '>= 4.7.0')
+  gem.add_runtime_dependency('globalid', '>= 0.3.6')
 end

data/lib/devise_masquerade/controllers/helpers.rb

@@ -20,7 +20,7 @@ module DeviseMasquerade
             end
             return unless klass
 
-            resource = klass.find_by_masquerade_key(params["#{Devise.masquerade_param}"]).first
+            resource = GlobalID::Locator.locate_signed params[Devise.masquerade_param], for: 'masquerade'
 
             if resource
               masquerade_sign_in(resource)
@@ -30,7 +30,7 @@ module DeviseMasquerade
           def masquerade_#{name}!
             return if params["#{Devise.masquerade_param}"].blank?
 
-            resource = ::#{class_name}.find_by_masquerade_key(params["#{Devise.masquerade_param}"]).first
+            resource = GlobalID::Locator.locate_signed params[Devise.masquerade_param], for: 'masquerade'
 
             if resource
               masquerade_sign_in(resource)
@@ -38,12 +38,12 @@ module DeviseMasquerade
           end
 
           def #{name}_masquerade?
-            session[:"devise_masquerade_#{name}"].present?
+            ::Rails.cache.exist?(:"devise_masquerade_#{name}").present?
           end
 
           def #{name}_masquerade_owner
             return nil unless send(:#{name}_masquerade?)
-            ::#{class_name}.to_adapter.find_first(id: session[:"devise_masquerade_#{name}"])
+            GlobalID::Locator.locate_signed(Rails.cache.read(:"devise_masquerade_#{name}"), for: 'masquerade')
           end
 
           private

data/lib/devise_masquerade/controllers/url_helpers.rb

@@ -10,7 +10,6 @@ module DeviseMasquerade
         opts = args.first || {}
         opts.merge!(masqueraded_resource_class: resource.class.name)
 
-        resource.masquerade!
         opts.merge!(Devise.masquerade_param => resource.masquerade_key)
 
         send("#{scope}_masquerade_path", resource, opts, *args)

data/lib/devise_masquerade/models/masqueradable.rb

@@ -4,44 +4,10 @@ module DeviseMasquerade
       extend ActiveSupport::Concern
 
       included do
-        attr_reader :masquerade_key
-
-        def masquerade!
-          @masquerade_key = SecureRandom.urlsafe_base64(
-            Devise.masquerade_key_size)
-          cache_key = self.class.cache_masquerade_key_by(@masquerade_key)
-          ::Rails.cache.write(
-            cache_key, id, expires_in: Devise.masquerade_expires_in)
+        def masquerade_key
+          to_sgid(expires_in: Devise.masquerade_expires_in, for: 'masquerade')
         end
       end
-
-      module ClassMethods
-        def cache_masquerade_key_by(key)
-          "#{self.name.pluralize.underscore}:#{key}:masquerade"
-        end
-
-        def remove_masquerade_key!(key)
-          ::Rails.cache.delete(cache_masquerade_key_by(key))
-        end
-
-        def find_by_masquerade_key(key)
-          id = ::Rails.cache.read(cache_masquerade_key_by(key))
-
-          # clean up the cached masquerade key value
-          remove_masquerade_key!(key)
-
-          where(id: id)
-        end
-
-        def find_by_masquerade_key(key)
-          id = ::Rails.cache.read(cache_masquerade_key_by(key))
-
-          # clean up the cached masquerade key value
-          remove_masquerade_key!(key)
-
-          where(id: id)
-        end
-      end # ClassMethods
     end
   end
 end

data/lib/devise_masquerade/version.rb

@@ -1,3 +1,3 @@
 module DeviseMasquerade
-  VERSION = '1.2.0'.freeze
+  VERSION = '1.3.0'.freeze
 end

data/spec/controllers/admin/dashboard_controller_spec.rb

@@ -8,8 +8,6 @@ describe Admin::DashboardController, type: :controller do
       let!(:mask) { create(:admin_user) }
 
       before do
-        mask.masquerade!
-
         get :index, params: { masquerade: mask.masquerade_key, masqueraded_resource_class: 'Admin::User' }
       end
 

data/spec/controllers/dashboard_controller_spec.rb

@@ -8,8 +8,6 @@ describe DashboardController, type: :controller do
       let!(:mask) { create(:user) }
 
       before do
-        mask.masquerade!
-
         get :index, params: { masquerade: mask.masquerade_key }
       end
 

data/spec/controllers/devise/masquerades_controller_spec.rb

@@ -10,13 +10,11 @@ describe Devise::MasqueradesController, type: :controller do
       context 'with masqueradable_class param' do
         let(:mask) { create(:student) }
 
-        before { mask.masquerade! }
-
         before do
           get :show, params: { id: mask.to_param, masqueraded_resource_class: mask.class.name, masquerade: mask.masquerade_key }
         end
 
-        it { expect(session.keys).to include('devise_masquerade_student') }
+        it { expect(Rails.cache.read('devise_masquerade_student')).to be }
 
         it 'should have warden keys defined' do
           expect(session["warden.user.student.key"].first.first).to eq(mask.id)
@@ -28,13 +26,11 @@ describe Devise::MasqueradesController, type: :controller do
       describe '#masquerade user' do
         let(:mask) { create(:user) }
 
-        before { mask.masquerade! }
-
         before do
           get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
         end
 
-        it { expect(session.keys).to include('devise_masquerade_user') }
+        it { expect(Rails.cache.read('devise_masquerade_user')).to be }
         it { expect(session["warden.user.user.key"].first.first).to eq(mask.id) }
         it { should redirect_to('/') }
 
@@ -43,7 +39,7 @@ describe Devise::MasqueradesController, type: :controller do
 
           it { should redirect_to(masquerade_page) }
           it { expect(current_user.reload).to eq(@user) }
-          it { expect(session.keys).not_to include('devise_masquerade_user') }
+          it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
         end
       end
 
@@ -55,8 +51,6 @@ describe Devise::MasqueradesController, type: :controller do
 
         after { Devise.masquerade_routes_back = false }
 
-        before { mask.masquerade! }
-
         context 'show' do
           context 'with http referrer' do
             before do
@@ -80,13 +74,19 @@ describe Devise::MasqueradesController, type: :controller do
         end # context
 
         context 'and back' do
-          before { get :back }
+          before do
+            get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
+
+            get :back
+          end
 
           it { should redirect_to(masquerade_page) }
         end # context
 
         context 'and back fallback if http_referer not present' do
           before do
+            get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
+
             @request.env['HTTP_REFERER'] = 'previous_location'
             get :back
           end

data/spec/controllers/masquerades_tests_controller_spec.rb

@@ -13,12 +13,10 @@ describe MasqueradesTestsController, type: :controller do
 
     let(:mask) { create(:user) }
 
-    before { mask.masquerade! }
-
     before { get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key } }
 
     it { expect(response.status).to eq(403) }
-    it { expect(session.keys).not_to include('devise_masquerade_user') }
+    it { expect(Rails.cache.read('devise_masquerade_user')).not_to be }
     it { expect(session['warden.user.user.key'].first.first).not_to eq(mask.id) }
   end
 
@@ -32,14 +30,12 @@ describe MasqueradesTestsController, type: :controller do
 
     let(:mask) { create(:user) }
 
-    before { mask.masquerade! }
-
     before do
       get :show, params: { id: mask.to_param, masquerade: mask.masquerade_key }
     end
 
     it { expect(response.status).to eq(302) }
-    it { expect(session.keys).to include('devise_masquerade_user') }
+    it { expect(Rails.cache.read('devise_masquerade_user')).to be }
     it { expect(session['warden.user.user.key'].first.first).to eq(mask.id) }
   end
 end

data/spec/models/user_spec.rb

@@ -3,37 +3,10 @@ require 'spec_helper'
 describe User do
   let!(:user) { create(:user) }
 
-  describe '#masquerade!' do
+  describe '#masquerade_key' do
     it 'should cache special key on masquerade' do
-      expect(SecureRandom).to receive(:urlsafe_base64).with(16) { "secure_key" }
-      user.masquerade!
-    end
-  end
-
-  describe '#remove_masquerade_key' do
-    before { allow(SecureRandom).to receive(:urlsafe_base64) { "secure_key" } }
-
-    let(:key) { 'users:secure_key:masquerade' }
-
-    it 'should be possible to remove cached masquerade key' do
-      user.masquerade!
-      expect(Rails.cache.exist?(key)).to eq(true)
-
-      User.remove_masquerade_key!('secure_key')
-      expect(Rails.cache.exist?(key)).to eq(false)
-    end
-  end
-
-  describe '#find_by_masquerade_key' do
-    it 'should be possible to find user by generate masquerade key' do
-      user.masquerade!
-
-      allow(Rails.cache).to receive(:read).with("users:#{user.masquerade_key}:masquerade") { user.id }
-      allow(Rails.cache).to receive(:delete).with("users:#{user.masquerade_key}:masquerade")
-
-      new_user = User.find_by_masquerade_key(user.masquerade_key).first
-
-      expect(new_user).to eq(user)
+      expect(user).to receive(:to_sgid).with(expires_in: 1.minute, for: 'masquerade') { "secure_key" }
+      user.masquerade_key
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_masquerade
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Alexandr Korsak
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-10-23 00:00:00.000000000 Z
+date: 2021-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -52,6 +52,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 4.7.0
+- !ruby/object:Gem::Dependency
+  name: globalid
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.6
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.6
 description: devise masquerade library
 email:
 - alex.korsak@gmail.com
@@ -59,6 +73,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/FUNDING.yml"
+- ".github/workflows/brakeman-analysis.yml"
+- ".github/workflows/rubocop-analysis.yml"
 - ".gitignore"
 - ".rspec"
 - ".ruby-version"
@@ -144,7 +161,7 @@ homepage: http://github.com/oivoodoo/devise_masquerade
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -159,8 +176,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.1
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: use for login as functionallity on your admin users pages
 test_files: