durable_streams-rails 0.2.3 → 0.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c92e0876c45c1275005ac561769b4653d63fb344518fa5158b10d79558fd4538
-  data.tar.gz: '09935cbb04fb7e94081d10d5313488c7eccb7113fd7a327d892b33fc7d8c3d5a'
+  metadata.gz: 32b7136264c3c58bf1d1abafec7d87de85527739a1eebfd099042df478fbeb9a
+  data.tar.gz: 4cad011b7effea1efeb9f9be19845ed8b5652e0ccce7e2c8971723d9fc661043
 SHA512:
-  metadata.gz: 91afdd838a384a32e001ce175fa3f5e0415953c1e60f28a9afaab9ebdd36aaa05a237fb0d735bf7be42cff3ac0c16746011bdd10e90c15a50234fa4b51a6a3a5
-  data.tar.gz: 68c5ba947c3821328d349034d106c18ab2004d1b44619396e2265337442510c82f7c439682d397769638554114cb5f61eb5914249af017fc822b1b76994c9882
+  metadata.gz: fb55c88972044fd2888e7798df09283878acaccfbd077330b2025908482f6fc9f82c90cdeb8cbd40aecf5cbc421728867da8495034c0e24ae2e6cf37e9a91441
+  data.tar.gz: b4a27e45cf852435c8a374654c8ddfb0fcb664a6a92712aa308ab9649bff4e091a7a0c11419d41c08b0632f0138608d7755c34a1d74300f7e68274fbf51b5a64

data/app/controllers/durable_streams/auth_controller.rb

@@ -1,7 +1,9 @@
 module DurableStreams
   class AuthController < ActionController::API
     def verify
-      if stream_name
+      if request.headers["X-Forwarded-Uri"]
+        stream_name ? head(:ok) : head(:unauthorized)
+      elsif valid_server_api_key?
         head :ok
       else
         head :unauthorized
@@ -10,14 +12,13 @@ module DurableStreams
 
     private
       def stream_name
-        if token = extract_token
-          DurableStreams.verified_stream_name(token)
-        end
+        DurableStreams.verify_signed_url(request.headers["X-Forwarded-Uri"])
       end
 
-      def extract_token
-        if uri = request.headers["X-Forwarded-Uri"]
-          DurableStreams.extract_token_from_url(uri)
+      def valid_server_api_key?
+        if auth_header = request.headers["Authorization"]
+          auth_header.start_with?("Bearer ") &&
+            ActiveSupport::SecurityUtils.secure_compare(auth_header.delete_prefix("Bearer "), DurableStreams.server_api_key)
         end
       end
   end

data/lib/durable_streams/engine.rb

@@ -42,6 +42,21 @@ module DurableStreams
       end
     end
 
+    initializer "durable_streams.server_api_key" do
+      config.after_initialize do
+        DurableStreams.server_api_key =
+          config.durable_streams.server_api_key ||
+          Rails.application.key_generator.generate_key("durable_streams/server_api_key").unpack1("H*")
+
+        if DurableStreams.base_url.present?
+          DurableStreams.configure do |c|
+            c.base_url = DurableStreams.base_url
+            c.default_headers = { "Authorization" => "Bearer #{DurableStreams.server_api_key}" }
+          end
+        end
+      end
+    end
+
     # No Action Cable dependency -- load test helpers directly.
     initializer "durable_streams.test_assertions" do
       ActiveSupport.on_load(:active_support_test_case) do

data/lib/durable_streams/version.rb

@@ -1,3 +1,3 @@
 module DurableStreams
-  RAILS_VERSION = "0.2.3"
+  RAILS_VERSION = "0.2.4"
 end

data/lib/durable_streams-rails.rb

@@ -14,7 +14,7 @@ module DurableStreams
   mattr_accessor :draw_routes, default: true
 
   class << self
-    attr_writer :signed_stream_verifier_key
+    attr_writer :signed_stream_verifier_key, :server_api_key
 
     def signed_stream_verifier
       @signed_stream_verifier ||= ActiveSupport::MessageVerifier.new(signed_stream_verifier_key, digest: "SHA256", serializer: JSON)
@@ -24,6 +24,10 @@ module DurableStreams
       @signed_stream_verifier_key or raise ArgumentError, "DurableStreams requires a signed_stream_verifier_key"
     end
 
+    def server_api_key
+      @server_api_key or raise ArgumentError, "DurableStreams requires a server_api_key"
+    end
+
     def signed_stream_url(*streamables, expires_in: 24.hours)
       path = stream_name_from(streamables)
       token = signed_stream_verifier.generate(path, expires_in: expires_in)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: durable_streams-rails
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.4
 platform: ruby
 authors:
 - tokimonki