flu-rails 8.0.2 → 8.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fde08f865924f75af0fc55c572bb6d10c617275772848055f838234cbf64a515
-  data.tar.gz: f675884b945492c91c6dbb8713156e2559da185d3b585aac2598525f61ae0d3d
+  metadata.gz: 5fadf301a677ec0ec47d67f9eb8159aac7dfab535c268030331ce4d54c391e58
+  data.tar.gz: 90c8b9dc6c71fa9f01630b1e183114132ec1d63735cdc2cb62c5974750f3ff49
 SHA512:
-  metadata.gz: 4084a87a8b3ac4b9b3de65b6fd3e0c0c2cf6cc912afcb0570212dc38baa706fac873033cda2fd38e177659c62d0fe8e5f7fef941feee8419874b9064d865b32b
-  data.tar.gz: c4648f491c6d74e4f0a48cbcc5cedd164aee43b9e615f6c51108fdb5390869a96332b758a87c9b1203a65d9b96e35f7061e0bee317ed94b76535b26aa00add34
+  metadata.gz: 2a8f50d7eb2796ce8408f3a1ca36b68d55020d8858134fc136cef7be6fcb7978c316e99298a2d394ef0f0555602c1a955b3ff497b0a72e9b1f49ddf23ec4e1b8
+  data.tar.gz: dbc5b57979a4ebe601b8df0c26822c7dfa127c44f7292b97b654aff0363d04266552a60c2bda0d0ea00b2865421e47677d4f66592bf8c9e36bf6820f1ea290e8

data/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+### [8.0.4] - 2026-08-01
+
+**Security**
+
+* Honour the host application's `config.filter_parameters` when publishing a `request` event.
+
+**Fixed**
+
+* Stop opening two RabbitMQ connections on every boot. The railtie called `Flu.start
+* Close the publisher that `Flu.init` replaces.
+
+**Added**
+
+* `EventPublisher#disconnect` and `EventPublisher#connected?`.
+
+**Changed**
+
+* `ignored_request_params` and `default_ignored_request_params` are now matched as strings.
+* A published `request` event may now carry `"[FILTERED]"` in place of a param value. 
+* `EventPublisher#connect` is now idempotent: calling it on a connected publisher does nothing
+  instead of opening a second connection.
+
+**Tests**
+
+* Cover the connection lifecycle against a real broker: redundant `connect` calls, `disconnect`,
+  `connected?`, and reconnection after a disconnect — including an example asserting that no session
+  is left open behind the publisher.
+* Cover `Flu.init` disconnecting the publisher it replaces.
+
+### [8.0.3] - 2026-08-01
+
+* Use `uuid_v7` as Event ID (requires Ruby 3.3)
+
 ### [8.0.2] - 2026-08-01
 
 **Fixed**

data/README.md

@@ -164,7 +164,7 @@ All options have a default value. However, all of them can be changed in your in
 | `rabbitmq_exchange_durable` | `true` | Boolean | Optional | Make the RabbitMQ's exchange durable or not. From RabbitMQ's [documentation](https://www.rabbitmq.com/tutorials/amqp-concepts.html#exchanges): _"Durable exchanges survive broker restart whereas transient exchanges do not (they have to be redeclared when broker comes back online)."_ | `false` |
 | `auto_connect_to_exchange` | `true`| Boolean | Optional | Thanks to `Railties`, `flu-rails` starts automatically when the Rails app boots. However, this can be useful to not connect RabbitMQ at start up. To do so, set `auto_connect_to_exchange` to `false`.  | `false` |
 | `default_ignored_model_changes` | `[:password, :password_confirmation, :created_at, :updated_at]` | Boolean | Optional | By default, all these attributes will be ignored from model changes when creating an event. For instance, this means that timestamp fields (`created_at` and `updated_at`) are not monitored when they change. | `[]` |
-| `default_ignored_request_params` | `[:password, :password_confirmation, :controller, :action]` | Boolean | Optional | By default, all these parameters will be ignored from controller request's `params` when creating an event. | `false` |
+| `default_ignored_request_params` | `[:password, :password_confirmation, :controller, :action]` | Boolean | Optional | By default, all these parameters will be ignored from controller request's `params` when creating an event. Independently of this option, any parameter your Rails application already masks through `config.filter_parameters` (passwords, tokens,...) is replaced with `"[FILTERED]"` in the event too, including inside nested params. | `false` |
 | `application_name` | `Rails.application.class.module_parent_name`, resolved on startup | String | Required | Is used as `emitter` for each event created by `flu-rails`, if not overriden by the `track_met`. | `my_app` |
 | `bunny_options` | `{}` | Hash of symbols | Optional | Additional options to add when connecting the RabbitMQ broker. This overrides the existing options with the same name. | `{ verify_peer: true }` |
 
@@ -304,8 +304,8 @@ scoped RubyGems credential.
 3. Tag the commit and push the tag:
 
 ```
-  $ git tag -a v8.0.2 -m "Version 8.0.2"
-  $ git push origin v8.0.2
+  $ git tag -a v8.0.4 -m "Version 8.0.4"
+  $ git push origin v8.0.4
 ```
 
 The workflow then checks that the tag matches `Flu::VERSION`, runs the tests, builds the gem

data/lib/flu-rails/action_controller_extender.rb

@@ -1,5 +1,7 @@
 require "active_support/core_ext/string/inflections"
 require "active_support/core_ext/time/zones"
+require "random/formatter"
+require "securerandom"
 
 module Flu
   class ActionControllerExtender
@@ -28,7 +30,7 @@ module Flu
             # landed on ActionController::Base itself, leaking onto every controller of the host
             # application. Here 'self' is the class calling 'track_requests', which is where they belong.
             define_method(:flu_define_request_id) do
-              request_id      = SecureRandom.uuid
+              request_id      = Random.respond_to?(:uuid_v7) ? Random.uuid_v7 : SecureRandom.uuid
               @flu_request_id = request_id
               Flu::CoreExt.flu_tracker_request_id = request_id
             end

data/lib/flu-rails/dummy/in_memory_event_publisher.rb

@@ -20,7 +20,14 @@ module Flu
   
       def connect
       end
-  
+
+      def connected?
+        true
+      end
+
+      def disconnect
+      end
+
       def events_count
         @published_events_by_routing_key.map do | key, value |
           value.size

data/lib/flu-rails/event_factory.rb

@@ -11,7 +11,7 @@ module Flu
       @configuration                  = configuration
       @emitter                        = configuration.application_name
       @default_ignored_model_changes  = configuration.default_ignored_model_changes.map(&:to_s)
-      @default_ignored_request_params = configuration.default_ignored_request_params
+      @default_ignored_request_params = configuration.default_ignored_request_params.map(&:to_s)
     end
 
     def build_request_event(data)
@@ -50,7 +50,8 @@ module Flu
       final_emitter     = overriden_emitter.blank? ? original_emitter : overriden_emitter
       # 'overriden_emitter' selects the emitter of the event, it is not part of what is tracked:
       # it is dropped from the payload instead of being published as an 'overridenEmitter' key.
-      Event.new(SecureRandom.uuid, final_emitter, kind, name, deep_camelize(data.except(:overriden_emitter)))
+      uuid = Random.respond_to?(:uuid_v7) ? Random.uuid_v7 : SecureRandom.uuid
+      Event.new(uuid, final_emitter, kind, name, deep_camelize(data.except(:overriden_emitter)))
     end
 
     def create_data_from_entity_changes(action_name, entity, request_id, request_entity_metadata, changes, user_metadata_lambda, association_columns, ignored_model_changes, flu_overriden_emitter_lambda)
@@ -76,15 +77,15 @@ module Flu
         response_code:   response.status,
         user_agent:      request.user_agent,
         duration:        Time.zone.now - request_start_time,
-        params:          extract_params(params, ignored_request_params)
+        params:          extract_params(request, ignored_request_params)
       }
     end
 
     private
 
-    def extract_params(params, ignored_request_params)
-      remaining = params.except(*ignored_request_params).except(*@default_ignored_request_params)
-      remaining.respond_to?(:to_unsafe_h) ? remaining.to_unsafe_h.to_h : remaining.to_h
+    def extract_params(request, ignored_request_params)
+      excluded_params = ignored_request_params.map(&:to_s) + @default_ignored_request_params
+      request.filtered_parameters.except(*excluded_params)
     end
 
     def deep_camelize(value)

data/lib/flu-rails/event_publisher.rb

@@ -17,18 +17,41 @@ module Flu
     end
 
     def connect
-      connected = false
-      while !connected
-        begin
-          connect_to_exchange
-          connected = true
-        rescue Bunny::TCPConnectionFailedForAllHosts
-          @logger.warn("RabbitMQ connection failed, try again in 1 second.")
-          sleep 1
+      unless connected?
+        connected = false
+        while !connected
+          begin
+            connect_to_exchange
+            connected = true
+          rescue Bunny::TCPConnectionFailedForAllHosts
+            @logger.warn("RabbitMQ connection failed, try again in 1 second.")
+            sleep 1
+          end
         end
       end
     end
 
+    def connected?
+      if @connection.nil? || @exchange.nil?
+        false
+      else
+        @connection.open?
+      end
+    end
+
+    # Closing the connection closes the channel opened on it, and stops the heartbeat and recovery
+    # threads Bunny runs alongside it.
+    # The guard is on the connection alone, not on 'connected?': a connection that was opened before
+    # the exchange could be declared still has to be closed.
+    def disconnect
+      if !@connection.nil? && @connection.open?
+        @connection.close 
+      end
+      @connection = nil
+      @channel    = nil
+      @exchange   = nil
+    end
+
     private
 
     def connect_to_exchange

data/lib/flu-rails/railtie.rb

@@ -2,13 +2,16 @@ module Flu
   class Railtie < Rails::Railtie
     railtie_name :flu
 
+    # 'to_prepare' runs before eager loading, so that 'track_entity_changes' and 'track_requests'
+    # exist by the time the application's models and controllers are loaded. It runs again on every
+    # code reload, where 'Flu.init' builds a new publisher which has to be connected too.
+    #
+    # There is deliberately no 'after_initialize' hook here: it also runs at boot, right after this
+    # one, and the 'Flu.start' it used to make opened a second connection that replaced — and
+    # therefore leaked — the connection opened above.
     config.to_prepare do
       Flu.init
       Flu.start
     end
-
-    config.after_initialize do
-      Flu.start
-    end
   end
 end

data/lib/flu-rails/version.rb

@@ -1,3 +1,3 @@
 module Flu
-  VERSION = "8.0.2"
+  VERSION = "8.0.4"
 end

data/lib/flu-rails.rb

@@ -38,6 +38,10 @@ module Flu
     raise "configuration.application_name must not be nil" if @configuration.application_name.nil?
     @logger          = @configuration.logger
     @event_factory   = Flu::EventFactory.new(@configuration)
+    # The railtie re-runs 'init' on every code reload. The publisher being replaced owns an open
+    # connection, its channel and Bunny's heartbeat thread: dropping the reference to it without
+    # closing it leaks all three for the lifetime of the process.
+    @event_publisher&.disconnect
     @event_publisher = create_event_publisher(@configuration)
     extend_models_and_controllers
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: flu-rails
 version: !ruby/object:Gem::Version
-  version: 8.0.2
+  version: 8.0.4
 platform: ruby
 authors:
 - Loïc Vigneron