heimdall_auth 1.8.0 → 1.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62917a5dfbec560e91964ae280d362973e51c3fd7aec9fa39012fcba2053fb96
-  data.tar.gz: d902146d018ba779759c7bef16e7807266d1960a49127961d587a791f131ee41
+  metadata.gz: '0904885207b67efe16aefc1bd5c37a57490f412c199bdf0275a22b56a3f90b84'
+  data.tar.gz: 278819290094fa8e3ae2e7640e423c48dbdbc926343c1896ca2ac9eb84b36e37
 SHA512:
-  metadata.gz: b47b0dfd4f6db45ab8a1d5a34626e1529dcba2811901c36e3ba9a1534e5a814b7c163a4ed433198c66462575feb2eadbd60792ac604f53703381c88cf0282cbc
-  data.tar.gz: 97c6c1a896670c6e224725d848e30340cf30baeecca65a24d7f12275d8040ad1ebdd1bc75156295eda8b94c847901a34802e0542145a2a02a75fdc09a38de91a
+  metadata.gz: ddb292841b5c583e820fecec2162263d8dd34fb125681bad493e80c73f00fcb242026b649d924b57a9abc5f2003b65bf918bb90c9d07816242831bc019bf0080
+  data.tar.gz: 6150a29eaab129ce489f897ab36106de8e46da278f14db29438a607bfe077f481527492d0089903b9df1e25fc0fdff52f24a87932326a326bdb3b891e4d25250

data/README.md

@@ -5,6 +5,11 @@ This makes it easy to equip an empty rails application with our Heimdall Auth fe
 Use it like so in `config/routes.rb`:
 ```
 mount_heimdall_auth_secured Sidekiq::Web => '/sidekiq', :manage => :sidekiq
+
+or
+
+# The /sidekiq/stats path gets available for services like Datadog
+mount_heimdall_auth_secured Sidekiq::Web => '/sidekiq', :manage => :sidekiq, accessible_via_token: {'/sidekiq/stats': ENV['SIDEKIQ_STATS_TOKEN_FOR_WATCHDOG']}
 ```
 instead of the known:
 ```
@@ -18,11 +23,17 @@ if user.is_admin
 end
 ```
 
+and the password in `.env` and `.env.example` if you used it:
+```
+SIDEKIQ_STATS_TOKEN_FOR_WATCHDOG=halloweltrandomstring
+```
+
 Options:
-- mount_heimdall_auth_secured ENGINE => PATH, ACTION => RESOURCE
-- ENGINE - any mountable Engine like `Sidekiq::Web`
-- PATH - where to mount the engine
-- ACTION & RESOURCE - like any action and resource in cancancan
+- mount_heimdall_auth_secured ENGINE => PATH, ACTION => RESOURCE, accessible_via_token: {EXCEPTION_PATH: EXCEPTION_PASSWORD, EXCEPTION_PATH2: EXCEPTION_PASSWORD2}
+  - ENGINE - any mountable Engine like `Sidekiq::Web`
+  - PATH - where to mount the engine
+  - ACTION & RESOURCE - like any action and resource in cancancan
+- :accessible_via_token -> Defines paths that are available via a particular token. e.g. for Watchdog services like Datadog
 
 ## Installation and Usage
 

data/lib/heimdall_auth/rails/routes.rb

@@ -12,16 +12,19 @@ module HeimdallAuth
 
 
         def mount_heimdall_auth_secured(options = {}, &block)
-          mount_element = options.keys.first
-          path = options[mount_element]
+          accessible_via_token = options.extract!(:accessible_via_token)[:accessible_via_token]
+
+          engine = options.keys.first #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
+          path = options.values.first #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
+
+          action = options.keys.second #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
+          resource = options.values.second #Syntax sugar ENGINE => PATH, ACTION => RESOURCE
 
-          action = options.keys.second
-          resource = options.values.second
           if action.nil? || resource.nil?
             puts "WARNING: It seems you missed the cancancan rights. Use: `mount_heimdall_auth_secured Sidekiq::Web => '/sidekiq', :manage => :sidekiq`"
           end
 
-          mount mount_element => path, constraints: HeimdallAuth::RouteConstraint.new(action, resource)
+          mount engine => path, constraints: HeimdallAuth::RouteConstraint.new(action, resource, accessible_via_token)
            get "#{path}", to: redirect('/signin')
            get "#{path}/*rest", to: redirect('/signin')
         end

data/lib/heimdall_auth/route_constraint.rb

@@ -32,12 +32,24 @@ module HeimdallAuth
 
   class RouteConstraint
 
-    def initialize(action, resource)
+    def initialize(action, resource, accessible_via_token)
       @action = action
       @resource = resource
+      @accessible_via_token = accessible_via_token
     end
 
     def matches?(matching_request)
+      if @accessible_via_token && matching_request.query_parameters["token"]
+        @accessible_via_token.keys.each do |path|
+          if path.to_s == matching_request.path.to_s
+            expected_token = @accessible_via_token[path]
+            if expected_token && ActiveSupport::SecurityUtils.secure_compare(matching_request.query_parameters["token"], expected_token)
+              return true
+            end
+          end
+        end
+      end
+
       AuthenticationChecker.new(matching_request).can?(@action, @resource)
     end
 

data/lib/heimdall_auth/version.rb

@@ -1,3 +1,3 @@
 module HeimdallAuth
-  VERSION = '1.8.0'
+  VERSION = '1.9.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heimdall_auth
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.9.0
 platform: ruby
 authors:
 - René Meye
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-28 00:00:00.000000000 Z
+date: 2023-02-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails