forest_admin_rpc_agent 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dce86f43a17822742d269f5ed0fe0e0b1e872103c2ca757223da9ba206d6cd5e
-  data.tar.gz: 84f854406e55262bd66e0a46d4fed20a8ac38f666d27ff79525e504f1582a36e
+  metadata.gz: 4e52fd0a839e769c9fd90ce4753b6b15f21651a2ed54bf4f7ae4e2de95cd209e
+  data.tar.gz: 69ff2cfc82494cfc16186a6c2fe8b0c3cc7a325139ccc50ab1d2ad397b3a9c9b
 SHA512:
-  metadata.gz: 80b7b5bdca2c923d5ae8042d3e02cc261c70e9299348bf08269968c8c508c92d214a9c242714e7aa5ecaf5cc30be189e5b05297d8062de2d454bd160f4d1d051
-  data.tar.gz: 1ca233e4b72ccf48bbc01e27d67dec93df43090410d779b5f447150a2c7b38f4715c93cdb99d7c55e219f255fbc03a258c64e82894bffb7b839d7a4f959e1391
+  metadata.gz: 7a5836d6419f13ac7b1ef93be88073e0cd1723bee3ce60f0301d32e239f9b7382df9f806149dc08e6765a59c32efa804682b26f2e783f97be190066de301b093
+  data.tar.gz: 58712d1f4db5abef1e0e9ef618bb53f5c8344473032876c079859c6ea7ae7d0574565fe81d9a832e4d5b8cb969f98676af34f46518bd2ca9ab7d76479067c506

data/lib/forest_admin_rpc_agent/middleware/authentication.rb

@@ -4,6 +4,7 @@ module ForestAdminRpcAgent
       ALLOWED_TIME_DIFF = 300
       SIGNATURE_REUSE_WINDOW = 5
       @@used_signatures = {}
+      @@signatures_mutex = Mutex.new
 
       def initialize(app)
         @app = app
@@ -32,33 +33,45 @@ module ForestAdminRpcAgent
         return false unless Rack::Utils.secure_compare(signature, expected_signature)
 
         # check if this signature has already been used (replay attack)
-        if @@used_signatures.key?(signature)
-          last_used = @@used_signatures[signature]
-          return false if Time.now.utc.to_i - last_used > SIGNATURE_REUSE_WINDOW
-        end
-        @@used_signatures[signature] = Time.now.utc.to_i
+        # Reject if signature was used recently (within SIGNATURE_REUSE_WINDOW seconds)
+        # Use mutex to prevent race conditions in multi-threaded environments
+        now = current_time_in_seconds
+
+        @@signatures_mutex.synchronize do
+          if @@used_signatures.key?(signature)
+            last_used = @@used_signatures[signature]
+            time_since_last_use = now - last_used
+            return false if time_since_last_use <= SIGNATURE_REUSE_WINDOW
+          end
+          @@used_signatures[signature] = now
 
-        cleanup_old_signatures
+          cleanup_old_signatures
+        end
 
         true
       end
 
       def valid_timestamp?(timestamp)
         time = begin
-          Time.iso8601(timestamp)
-        rescue StandardError
+          Time.iso8601(timestamp).utc
+        rescue ArgumentError
           nil
         end
         return false if time.nil?
 
-        (Time.now.utc.to_i - time.to_i).abs <= ALLOWED_TIME_DIFF
+        (current_time_in_seconds - time.to_i).abs <= ALLOWED_TIME_DIFF
       end
 
       def cleanup_old_signatures
-        now = Time.now.utc.to_i
+        # Should be called within mutex synchronize block
+        now = current_time_in_seconds
         @@used_signatures.delete_if { |_signature, last_used| now - last_used > ALLOWED_TIME_DIFF }
       end
 
+      def current_time_in_seconds
+        defined?(Time.current) ? Time.current.to_i : Time.now.utc.to_i
+      end
+
       def auth_secret
         ForestAdminRpcAgent.config.auth_secret
       end

data/lib/forest_admin_rpc_agent/version.rb

@@ -1,3 +1,3 @@
 module ForestAdminRpcAgent
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_admin_rpc_agent
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Matthieu
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-10-03 00:00:00.000000000 Z
+date: 2025-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-configurable