forest_admin_rpc_agent 1.30.4 → 1.30.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd30b9ebff36413cfe4e1bd1ae0e5b06683273ba7f9ba9be13a2e4b208fee7f2
-  data.tar.gz: f85a704df4609325c50c85cb0fd61b9b543b3bb8e7fd88db0f8a2318148a9c22
+  metadata.gz: 53b5e12f818c23964ae83123b35aa0c519c3ff2ac455ba2c518fea37b37e4d2c
+  data.tar.gz: fd85d6d60ab150a0375dbfb9681696b28b6f93c4f1e94a30646e2e34c3a8adad
 SHA512:
-  metadata.gz: 93097366142e92fb3f3636262f76666903d18cdd7d01e35a8a4d4719f204c9639448959afec7f2a3c475291423cfc1b5f8852d080a19b13607c07f45da25087f
-  data.tar.gz: e933c8b5e1f911e88ec3b9b0ea8ecef28c763817e832743b9de3729135026e84294fb4798c1de2046cbdcb196bb579e8e1a4b667accaba47d4b5b4447b2ab19c
+  metadata.gz: 80e426d3044d3d93494696987be64a46d2033d8547bb5aecb09cb101b69268864d450fc8a4a7c17ac813a1c1db56a173f82a699d4a6ff2b4b73aa420451338c6
+  data.tar.gz: 739cd6a8a363d9bc8ebb28480d958f5aed1fd488021cba32ee1568512c5a11517698f9d2f856776dcfcd0f4ab6936f1640c780c3c78e2ef3246aea0a282a8e86

data/lib/forest_admin_rpc_agent/middleware/authentication.rb

@@ -4,9 +4,6 @@ module ForestAdminRpcAgent
   module Middleware
     class Authentication
       ALLOWED_TIME_DIFF = 300
-      SIGNATURE_REUSE_WINDOW = 5
-      @@used_signatures = {}
-      @@signatures_mutex = Mutex.new
 
       def initialize(app)
         @app = app
@@ -41,25 +38,7 @@ module ForestAdminRpcAgent
 
         expected_signature = OpenSSL::HMAC.hexdigest('SHA256', auth_secret, timestamp)
 
-        return false unless Rack::Utils.secure_compare(signature, expected_signature)
-
-        # check if this signature has already been used (replay attack)
-        # Reject if signature was used recently (within SIGNATURE_REUSE_WINDOW seconds)
-        # Use mutex to prevent race conditions in multi-threaded environments
-        now = current_time_in_seconds
-
-        @@signatures_mutex.synchronize do
-          if @@used_signatures.key?(signature)
-            last_used = @@used_signatures[signature]
-            time_since_last_use = now - last_used
-            return false if time_since_last_use <= SIGNATURE_REUSE_WINDOW
-          end
-          @@used_signatures[signature] = now
-
-          cleanup_old_signatures
-        end
-
-        true
+        Rack::Utils.secure_compare(signature, expected_signature)
       end
 
       def valid_timestamp?(timestamp)
@@ -73,12 +52,6 @@ module ForestAdminRpcAgent
         (current_time_in_seconds - time.to_i).abs <= ALLOWED_TIME_DIFF
       end
 
-      def cleanup_old_signatures
-        # Should be called within mutex synchronize block
-        now = current_time_in_seconds
-        @@used_signatures.delete_if { |_signature, last_used| now - last_used > ALLOWED_TIME_DIFF }
-      end
-
       def current_time_in_seconds
         defined?(Time.current) ? Time.current.to_i : Time.now.utc.to_i
       end

data/lib/forest_admin_rpc_agent/routes/action_execute.rb

@@ -12,8 +12,6 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         datasource = ForestAdminRpcAgent::Facades::Container.datasource
         collection = get_collection_safe(datasource, args[:params]['collection_name'])
         filter = FilterFactory.from_plain_object(args[:params]['filter'])

data/lib/forest_admin_rpc_agent/routes/action_form.rb

@@ -12,8 +12,6 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         datasource = ForestAdminRpcAgent::Facades::Container.datasource
         collection = get_collection_safe(datasource, args[:params]['collection_name'])
         filter = FilterFactory.from_plain_object(args[:params]['filter'])

data/lib/forest_admin_rpc_agent/routes/aggregate.rb

@@ -12,15 +12,13 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         datasource = ForestAdminRpcAgent::Facades::Container.datasource
         collection = get_collection_safe(datasource, args[:params]['collection_name'])
 
         aggregation = Aggregation.new(
           operation: args[:params]['aggregation']['operation'],
           field: args[:params]['aggregation']['field'],
-          groups: args[:params]['aggregation']['groups']
+          groups: args[:params]['aggregation']['groups'] || []
         )
         filter = FilterFactory.from_plain_object(args[:params]['filter'])
 

data/lib/forest_admin_rpc_agent/routes/base_route.rb

@@ -39,16 +39,16 @@ module ForestAdminRpcAgent
 
           # Skip authentication for health check (root path)
           if @url == '/'
-            params = deep_symbolize_keys(request.query_parameters.merge(request.request_parameters))
-            result = handle_request({ params: params.with_indifferent_access, caller: nil, request: request })
+            params = extract_request_params(request)
+            result = handle_request({ params: params, caller: nil, request: request })
             build_rails_response(result)
           else
             auth_middleware = ForestAdminRpcAgent::Middleware::Authentication.new(->(_env) { [200, {}, ['OK']] })
             status, headers, response = auth_middleware.call(request.env)
 
             if status == 200
-              params = deep_symbolize_keys(request.query_parameters.merge(request.request_parameters))
-              result = handle_request({ params: params.with_indifferent_access, caller: headers[:caller], request: request })
+              params = extract_request_params(request)
+              result = handle_request({ params: params, caller: headers[:caller], request: request })
               build_rails_response(result)
             else
               [status, headers, response]
@@ -87,15 +87,15 @@ module ForestAdminRpcAgent
 
       private
 
-      def deep_symbolize_keys(obj)
-        case obj
-        when Hash
-          obj.transform_keys(&:to_sym).transform_values { |v| deep_symbolize_keys(v) }
-        when Array
-          obj.map { |v| deep_symbolize_keys(v) }
-        else
-          obj
-        end
+      # Merge path params (e.g. :collection_name from the URL) with query and body params so
+      # consumers that don't duplicate `collection_name` in the body (the Node datasource-rpc)
+      # still resolve the route correctly.
+      def extract_request_params(request)
+        request.path_parameters
+               .except(:controller, :action, :format)
+               .merge(request.query_parameters)
+               .merge(request.request_parameters)
+               .with_indifferent_access
       end
 
       def serialize_response(result)

data/lib/forest_admin_rpc_agent/routes/chart.rb

@@ -10,8 +10,6 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         chart_name = args[:params]['chart']
         parameters = args[:params]['parameters']
         datasource = ForestAdminRpcAgent::Facades::Container.datasource

data/lib/forest_admin_rpc_agent/routes/create.rb

@@ -8,8 +8,6 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         datasource = ForestAdminRpcAgent::Facades::Container.datasource
         collection = get_collection_safe(datasource, args[:params]['collection_name'])
 

data/lib/forest_admin_rpc_agent/routes/delete.rb

@@ -12,8 +12,6 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         datasource = ForestAdminRpcAgent::Facades::Container.datasource
         collection = get_collection_safe(datasource, args[:params]['collection_name'])
         filter = FilterFactory.from_plain_object(args[:params]['filter'])

data/lib/forest_admin_rpc_agent/routes/list.rb

@@ -12,8 +12,6 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         datasource = ForestAdminRpcAgent::Facades::Container.datasource
         collection = get_collection_safe(datasource, args[:params]['collection_name'])
         projection = Projection.new(args[:params]['projection'])

data/lib/forest_admin_rpc_agent/routes/update.rb

@@ -10,8 +10,6 @@ module ForestAdminRpcAgent
       end
 
       def handle_request(args)
-        return {} unless args[:params]['collection_name']
-
         datasource = ForestAdminRpcAgent::Facades::Container.datasource
         collection = get_collection_safe(datasource, args[:params]['collection_name'])
         filter = FilterFactory.from_plain_object(args[:params]['filter'])

data/lib/forest_admin_rpc_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminRpcAgent
-  VERSION = "1.30.4"
+  VERSION = "1.30.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_rpc_agent
 version: !ruby/object:Gem::Version
-  version: 1.30.4
+  version: 1.30.6
 platform: ruby
 authors:
 - Matthieu