heimdall_auth 1.8.0 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62917a5dfbec560e91964ae280d362973e51c3fd7aec9fa39012fcba2053fb96
-  data.tar.gz: d902146d018ba779759c7bef16e7807266d1960a49127961d587a791f131ee41
+  metadata.gz: 224f15277c180a85265f085959acfbf033543335add8a4989717c4eb486b3a0a
+  data.tar.gz: b7fb140f8184ace1ed89f04054f7d3c2abfdb503aef9aa3b68d2bf4911f89406
 SHA512:
-  metadata.gz: b47b0dfd4f6db45ab8a1d5a34626e1529dcba2811901c36e3ba9a1534e5a814b7c163a4ed433198c66462575feb2eadbd60792ac604f53703381c88cf0282cbc
-  data.tar.gz: 97c6c1a896670c6e224725d848e30340cf30baeecca65a24d7f12275d8040ad1ebdd1bc75156295eda8b94c847901a34802e0542145a2a02a75fdc09a38de91a
+  metadata.gz: 16c9d7755c9bfaaa4ab9d80b8737554ec9319eb768fa4ae48e87ca1dd7641d500706e60a39e666116efb3e1508601454b663f0f3d90b86418a5f8ebbd082ef05
+  data.tar.gz: 9d1b07f0e74d1bdc07594f68d2e2ef9041e73c0ffd4039e2cf428dab480a6516a44fdb5fd8f065b6a428291d7ece97fa7e2c9761c136ec90416b56c9c79551a4

data/README.md

@@ -5,6 +5,11 @@ This makes it easy to equip an empty rails application with our Heimdall Auth fe
 Use it like so in `config/routes.rb`:
 ```
 mount_heimdall_auth_secured Sidekiq::Web => '/sidekiq', :manage => :sidekiq
+
+or
+
+# The /sidekiq/stats path gets available for services like Datadog
+mount_heimdall_auth_secured Sidekiq::Web => '/sidekiq', :manage => :sidekiq, accessible_via_token: {'/sidekiq/stats': ENV['SIDEKIQ_STATS_TOKEN_FOR_WATCHDOG']}
 ```
 instead of the known:
 ```
@@ -18,11 +23,18 @@ if user.is_admin
 end
 ```
 
+and the password in `.env` and `.env.example` if you used it:
+```
+SIDEKIQ_STATS_TOKEN_FOR_WATCHDOG=halloweltrandomstring
+```
+
 Options:
-- mount_heimdall_auth_secured ENGINE => PATH, ACTION => RESOURCE
-- ENGINE - any mountable Engine like `Sidekiq::Web`
-- PATH - where to mount the engine
-- ACTION & RESOURCE - like any action and resource in cancancan
+- mount_heimdall_auth_secured ENGINE => PATH, ACTION => RESOURCE, accessible_via_token: {EXCEPTION_PATH: EXCEPTION_PASSWORD, EXCEPTION_PATH2: EXCEPTION_PASSWORD2}
+  - ENGINE - any mountable Engine like `Sidekiq::Web`
+  - PATH - where to mount the engine
+  - ACTION & RESOURCE - like any action and resource in cancancan
+- :accessible_via_token -> Defines paths that are available via a particular token. e.g. for Watchdog services like Datadog
+  - URL needs then to have the token as `?token=secretpassword` in the query params. Like: `https://webhook.vesputi-abc.de/sidekiq/stats?token=secretpassword`
 
 ## Installation and Usage
 
@@ -103,3 +115,26 @@ RSpec.describe "/foobar", type: :request do
   before { allow_any_instance_of(ApplicationController).to receive(:current_user) { HeimdallAuth::User.new(is_editor: true) } }
 end
 ```
+
+# Usage with RSpec
+## Simulate an Admin user
+
+See the example:
+```ruby
+require 'rails_helper'
+
+RSpec.describe "/cards", type: :request do
+
+  let(:admin_user) {
+    HeimdallAuth::User.new(email: "foo@bar.com", is_admin: true)
+  }
+
+  describe "GET /index" do
+    before(:each) do
+      allow_any_instance_of( HeimdallAuth::ControllerAdditions ).to receive(:current_user).and_return(admin_user)
+    end
+
+    it "renders a successful response" do
+      Card.create! valid_attributes
+      get cards_url
+```

data/app/controllers/heimdall_auth/sessions_controller.rb

@@ -14,7 +14,7 @@ class HeimdallAuth::SessionsController < ApplicationController
 
   def create
     auth = request.env["omniauth.auth"]
-    session[:access_token] = auth.credentials.token
+    session[:access_token] = auth&.credentials&.token
     redirect_to( session[:last_url] || request.base_url, allow_other_host: true)
   end
 

data/lib/heimdall_auth/authentication_additions.rb

@@ -29,7 +29,7 @@ module HeimdallAuth
 
     def current_environment
       begin
-        @current_environment ||= current_user.key_environment || params[:environment]
+        @current_environment ||= current_user.app_environment || params[:environment]
       rescue NoMethodError, Exception => e
         nil
       end

data/lib/heimdall_auth/rails/routes.rb

@@ -12,16 +12,19 @@ module HeimdallAuth
 
 
         def mount_heimdall_auth_secured(options = {}, &block)
-          mount_element = options.keys.first
-          path = options[mount_element]
+          accessible_via_token = options.extract!(:accessible_via_token)[:accessible_via_token]
+
+          engine = options.keys.first #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
+          path = options.values.first #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
+
+          action = options.keys.second #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
+          resource = options.values.second #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
 
-          action = options.keys.second
-          resource = options.values.second
           if action.nil? || resource.nil?
             puts "WARNING: It seems you missed the cancancan rights. Use: `mount_heimdall_auth_secured Sidekiq::Web => '/sidekiq', :manage => :sidekiq`"
           end
 
-          mount mount_element => path, constraints: HeimdallAuth::RouteConstraint.new(action, resource)
+          mount engine => path, constraints: HeimdallAuth::RouteConstraint.new(action, resource, accessible_via_token)
            get "#{path}", to: redirect('/signin')
            get "#{path}/*rest", to: redirect('/signin')
         end

data/lib/heimdall_auth/route_constraint.rb

@@ -32,12 +32,24 @@ module HeimdallAuth
 
   class RouteConstraint
 
-    def initialize(action, resource)
+    def initialize(action, resource, accessible_via_token)
       @action = action
       @resource = resource
+      @accessible_via_token = accessible_via_token
     end
 
     def matches?(matching_request)
+      if @accessible_via_token && matching_request.query_parameters["token"]
+        @accessible_via_token.keys.each do |path|
+          if path.to_s == matching_request.path.to_s
+            expected_token = @accessible_via_token[path]
+            if expected_token && ActiveSupport::SecurityUtils.secure_compare(matching_request.query_parameters["token"], expected_token)
+              return true
+            end
+          end
+        end
+      end
+
       AuthenticationChecker.new(matching_request).can?(@action, @resource)
     end
 

data/lib/heimdall_auth/version.rb

@@ -1,3 +1,3 @@
 module HeimdallAuth
-  VERSION = '1.8.0'
+  VERSION = '1.10.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heimdall_auth
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.10.0
 platform: ruby
 authors:
 - René Meye
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-28 00:00:00.000000000 Z
+date: 2026-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -139,7 +139,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.3.27
 signing_key:
 specification_version: 4
 summary: Summary of HeimdallAuth.