heroku-bouncer 0.7.1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 273b79408c5b9a14c9c90997c17b3b6a67edeedc
-  data.tar.gz: 18c20c30803bee8462c96b65db39828d1b30ec38
+  metadata.gz: 85c6929c3208eb743c042d9dbef6f9d43db08987
+  data.tar.gz: b08dd7bac4866f854c050a65011ec6403936cb93
 SHA512:
-  metadata.gz: cbd28dc5744698aeee1f7774099bfa0c3ced1fb61f6f3cf436512918cafc63c6728be4f79bf04e6d519129044e1647be68dd1ed497ded8c909ad93ad51a06d7a
-  data.tar.gz: 66d0740ba41638219edb4c7988fdb6b7d897c3b2d84c1eeb264792e922b50523ab560711d27e1430bd1f30480628c80de4edf80bc681f26dde4714e4fee06156
+  metadata.gz: 5370531c477251b6247116d86597c9cc4d35ade54fa1dd5bb513e2c51a5db3f09b926a99cf573a5b1674c5dcc0980887c41db12598d9f9459c8f93ae011e17c2
+  data.tar.gz: a748a855a7be7e07e9756c5e9407f2db0a08d12dedff83f0fe4473a53ecc205058a6b1eb2113f7ff524bb5fae25d642dc83fcc1dc18e23d3bb1218319dbf671b

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+# 0.8.0
+
+* #55: Ruby >= 2.4 support and Ruby <2.2 deprecation. Thanks @maxbeizer!
+* #52: Rack 2 / Rails 5 support. Thanks @jkutner!
+
 # 0.7.1
 
 * #48: Address potential errors when making API call

data/README.md

@@ -6,6 +6,14 @@
 Heroku Bouncer is a Rack middleware (implemented in Sinatra) that
 requires Heroku OAuth on all requests.
 
+## Ruby and Rack compatibility
+
+* **Ruby**: Versions >= 0.8.0 require Ruby >= 2.2. If you need a version
+  that works with prior versions of Ruby, please use version `~> 0.7.1`.
+  Note, however, that 0.7.1 does not support Rack 2 (Rails 5).
+
+* **Rack**: Rack 1 and 2 are supported.
+
 ## Demo
 
 [heroku-bouncer-demo](https://github.com/schneems/heroku-bouncer-demo) is a
@@ -16,7 +24,7 @@ Sinatra app that uses heroku-bouncer.
 1. Install the Heroku OAuth CLI plugin.
 
     ```sh
-    heroku plugins:install git://github.com/heroku/heroku-oauth.git
+    heroku plugins:install heroku-cli-oauth
     ```
 
 2. Create your OAuth client using `/auth/heroku/callback` as your
@@ -24,10 +32,12 @@ Sinatra app that uses heroku-bouncer.
    for local development with Foreman.
 
     ```sh
-    heroku clients:register localhost http://localhost:5000/auth/heroku/callback
-    heroku clients:register myapp https://myapp.herokuapp.com/auth/heroku/callback
+    heroku clients:create localhost http://localhost:5000/auth/heroku/callback
+    heroku clients:create myapp https://myapp.herokuapp.com/auth/heroku/callback
     ```
 
+    See https://github.com/heroku/heroku-cli-oauth#clients for more details.
+
 3. Configure the middleware as follows:
 
     **Rack**
@@ -98,8 +108,8 @@ Here are the supported options you can pass to the middleware:
 * `allow_if`: A lambda that takes an email address. If the lambda evaluates to
   true, allow the user through. If false, redirects to `redirect_url`.
   By default, all users are allowed through after authenticating.
-* `allow_if_user`: A lambda that takes the 
-  [account resource](https://devcenter.heroku.com/articles/platform-api-reference#account) 
+* `allow_if_user`: A lambda that takes the
+  [account resource](https://devcenter.heroku.com/articles/platform-api-reference#account)
   representing the user. If the lambda evaluates to true, allow the user
   through. If false, redirects to `redirect_url`. By default, all users are
   allowed through after authenticating.

data/lib/heroku/bouncer/lockbox.rb

@@ -7,8 +7,8 @@ class Heroku::Bouncer::Lockbox < BasicObject
   end
 
   def lock(str)
-    aes = ::OpenSSL::Cipher::Cipher.new('aes-128-cbc').encrypt
-    aes.key = @key
+    aes = cipher.encrypt
+    aes.key = @key.size > 32 ? @key[0..31] : @key
     iv = ::OpenSSL::Random.random_bytes(aes.iv_len)
     aes.iv = iv
     [iv + (aes.update(str) << aes.final)].pack('m0')
@@ -21,8 +21,8 @@ class Heroku::Bouncer::Lockbox < BasicObject
   # decrypt is too short to possibly be good aes data.
   def unlock(str)
     str = str.unpack('m0').first
-    aes = ::OpenSSL::Cipher::Cipher.new('aes-128-cbc').decrypt
-    aes.key = @key
+    aes = cipher.decrypt
+    aes.key = @key.size > 32 ? @key[0..31] : @key
     iv = str[0, aes.iv_len]
     aes.iv = iv
     crypted_text = str[aes.iv_len..-1]
@@ -34,6 +34,20 @@ class Heroku::Bouncer::Lockbox < BasicObject
 
 private
 
+  def cipher
+    # OpenSSL::Cipher::Cipher is deprecated for Ruby >= 2.4
+    # https://ruby.github.io/openssl/OpenSSL/Cipher/Cipher.html
+    if ruby_two_point_four_or_above?
+      ::OpenSSL::Cipher.new('aes-256-cbc')
+    else
+      ::OpenSSL::Cipher::Cipher.new('aes-256-cbc')
+    end
+  end
+
+  def ruby_two_point_four_or_above?
+    ::RUBY_VERSION.to_f >= 2.4
+  end
+
   def self.generate_hmac(data, key)
     ::OpenSSL::HMAC.hexdigest(::OpenSSL::Digest::SHA1.new, key, data)
   end

data/lib/heroku/bouncer/middleware.rb

@@ -20,7 +20,7 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
       # super is not called; we're not using sinatra if we're disabled
     else
       super(app)
-      @cookie_secret = extract_option(options, :secret, SecureRandom.base64(32))
+      @cookie_secret = extract_option(options, :secret, SecureRandom.hex(64))
       @allow_if_user = extract_option(options, :allow_if_user, nil)
       @redirect_url = extract_option(options, :redirect_url, 'https://www.heroku.com')
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heroku-bouncer
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.8.0
 platform: ruby
 authors:
 - Jonathan Dance
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-29 00:00:00.000000000 Z
+date: 2017-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-heroku
@@ -28,16 +28,22 @@ dependencies:
   name: sinatra
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement
@@ -56,16 +62,22 @@ dependencies:
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -183,7 +195,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="