heroku-bouncer 0.4.0.pre3 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e309a66ada0259f78b01d8524259250a0cbba5ab
-  data.tar.gz: 66b98fb8a1fa87093aa6b632c1097077a3d13792
+  metadata.gz: 03abaeaa8715d6bcd3f72fad85fa58dd8f0645c0
+  data.tar.gz: 0debdadff5ca498f87a3f2d90a37b80dd00c84ce
 SHA512:
-  metadata.gz: c334ee9efd1af0e1c6e9e9d9ea72c3c26f63b514179cb6a163cd7bb58859b3b6497811f7fada20ff59ae571f963ec430d4f4929d5d9c99d282e81c9d65cd4143
-  data.tar.gz: dd1ce965ccea7181e62189b361b5125d730a0cb30c5fdf3cbb543d07cae42b5bd8604b546ca7cc70d3f6c04e1a4c1747316664cd018396e4d1268963385fa77c
+  metadata.gz: e1d4d8f927f12a89f3d4f2d6855129a14ac623a08b99e2e1cb81d9d82810e57b6cf727fdb99f3398696f19b3ba827f96af8e817c230f70a56d9dd5db80fe85ab
+  data.tar.gz: c018b6dc635a21cfeb88da1fb57869c40e8ef8d5eaa411b091ffea5fe0e2f3e453e110255d8777d89d91021c597e7fd03dfdba852c2692b599ad7d13f24e9de4

data/README.md

@@ -90,7 +90,7 @@ use Heroku::Bouncer,
   secret: ENV['HEROKU_BOUNCER_SECRET']
 ```
 
-There are 7 additional options you can pass to the middleware:
+There are 8 additional options you can pass to the middleware:
 
 * `oauth[:scope]`: The [OAuth scope][] to use when requesting the OAuth
   token. Default: `identity`.
@@ -105,7 +105,7 @@ There are 7 additional options you can pass to the middleware:
   `true`
 * `session_sync_nonce`: If present, determines the name of a cookie shared across properties under a same domain in order to keep their sessions synchronized. Default: `nil`
 * `allow_anonymous`: Accepts a lambda that gets called with each request. If the lambda evals to true, the request will not enforce authentication (e.g: `allow_anonymous: lambda { |req| !/\A\/admin/.match(req.fullpath) }` will allow anonymous requests except those with under the `/admin` path). Default: `nil`, which does not allow anonymous access to any URL.
-
+* `skip`: Accepts a lambda that gets called with each request's `env`. If the lambda gets evaluated to true, heroku-bouncer's middleware will be completely skipped. Default: 'false', which applies heroku-bouncer to all requests.
 
 You use these by passing a hash to the `use` call, for example:
 

data/lib/heroku/bouncer/middleware.rb

@@ -26,11 +26,12 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
       @expose_user = extract_option(options, :expose_user, true)
       @session_sync_nonce = extract_option(options, :session_sync_nonce, nil)
       @allow_anonymous = extract_option(options, :allow_anonymous, nil)
+      @skip = extract_option(options, :skip, false)
     end
   end
 
   def call(env)
-    if @disabled
+    if @disabled || skip?(env)
       @app.call(env)
     else
       unlock_session_data(env) do
@@ -39,45 +40,24 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
     end
   end
 
-  def unlock_session_data(env, &block)
-    decrypt_store(env)
-    return_value = yield
-    encrypt_store(env)
-    return_value
-  end
-
-  def auth_request?
-    %w[/auth/heroku/callback /auth/heroku /auth/failure /auth/sso-logout /auth/logout /auth/login].include?(request.path)
-  end
-
-  def session_nonce_mismatch?
-    (store_read(@session_sync_nonce.to_sym).to_s != session_nonce_cookie.to_s) && !auth_request?
-  end
-
-  def session_nonce_cookie
-    @session_sync_nonce && request.cookies[@session_sync_nonce]
-  end
-
-  def anonymous_request_allowed?
-    auth_request? || (@allow_anonymous && @allow_anonymous.call(request))
-  end
-
   before do
-    if @session_sync_nonce && session_nonce_mismatch?
-      if session_nonce_cookie.to_s.empty?
+    if session_nonce_mismatch?
+      if @session_sync_nonce && session_nonce_cookie.to_s.empty?
         destroy_session
         redirect to(request.url)
       else
-        store_write(:return_to, request.url)
-        redirect to('/auth/heroku')
+        require_authentication
       end
     end
 
     if store_read(:user)
-      expose_store
+      if expired? && !auth_request?
+        require_authentication
+      else
+        expose_store
+      end
     elsif !anonymous_request_allowed?
-      store_write(:return_to, request.url)
-      redirect to('/auth/heroku')
+      require_authentication
     end
   end
 
@@ -97,6 +77,7 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
     end
     store_write(@session_sync_nonce.to_sym, session_nonce_cookie) if @session_sync_nonce
     store_write(:token, token) if @expose_token
+    store_write(:expires_at, Time.now.to_i + 3600 * 8)
     redirect to(store_delete(:return_to) || '/')
   end
 
@@ -132,6 +113,43 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
 
 private
 
+  def unlock_session_data(env, &block)
+    decrypt_store(env)
+    yield
+  ensure
+    encrypt_store(env)
+  end
+
+  def auth_request?
+    %w[/auth/heroku/callback /auth/heroku /auth/failure /auth/sso-logout /auth/logout /auth/login].include?(request.path)
+  end
+
+  def session_nonce_mismatch?
+    @session_sync_nonce && (store_read(@session_sync_nonce.to_sym).to_s != session_nonce_cookie.to_s) && !auth_request?
+  end
+
+  def session_nonce_cookie
+    @session_sync_nonce && request.cookies[@session_sync_nonce]
+  end
+
+  def anonymous_request_allowed?
+    auth_request? || (@allow_anonymous && @allow_anonymous.call(request))
+  end
+
+  def expired?
+    ts = store_read(:expires_at)
+    ts.nil? || Time.now.to_i > ts
+  end
+
+  def skip?(env)
+    @skip && @skip.call(env)
+  end
+
+  def require_authentication
+    store_write(:return_to, request.url)
+    redirect to('/auth/heroku')
+  end
+
   def extract_option(options, option, default = nil)
     options.has_key?(option) ? options[option] : default
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heroku-bouncer
 version: !ruby/object:Gem::Version
-  version: 0.4.0.pre3
+  version: 0.4.0
 platform: ruby
 authors:
 - Jonathan Dance
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-12-09 00:00:00.000000000 Z
+date: 2014-01-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-heroku
@@ -136,6 +136,20 @@ dependencies:
     - - '>='
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: delorean
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: ID please.
 email:
 - jd@heroku.com
@@ -152,7 +166,6 @@ files:
 - lib/heroku/bouncer.rb
 - README.md
 - Gemfile
-- Gemfile.lock
 - Rakefile
 homepage: https://github.com/heroku/heroku-bouncer
 licenses:
@@ -169,9 +182,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>'
+  - - '>='
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.0.14
@@ -180,5 +193,4 @@ specification_version: 4
 summary: Rapidly add Heroku OAuth to your Ruby app.
 test_files:
 - Gemfile
-- Gemfile.lock
 - Rakefile

data/Gemfile.lock

@@ -1,62 +0,0 @@
-PATH
-  remote: .
-  specs:
-    heroku-bouncer (0.4.0.pre2)
-      faraday (~> 0.8)
-      omniauth-heroku (>= 0.1.0)
-      rack (~> 1.0)
-      sinatra (~> 1.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    faraday (0.8.8)
-      multipart-post (~> 1.2.0)
-    hashie (1.2.0)
-    httpauth (0.2.0)
-    jwt (0.1.8)
-      multi_json (>= 1.5)
-    metaclass (0.0.1)
-    minitest (5.0.8)
-    minitest-spec-context (0.0.3)
-    mocha (0.14.0)
-      metaclass (~> 0.0.1)
-    multi_json (1.8.2)
-    multipart-post (1.2.0)
-    oauth2 (0.8.1)
-      faraday (~> 0.8)
-      httpauth (~> 0.1)
-      jwt (~> 0.1.4)
-      multi_json (~> 1.0)
-      rack (~> 1.2)
-    omniauth (1.1.4)
-      hashie (>= 1.2, < 3)
-      rack
-    omniauth-heroku (0.1.1)
-      omniauth (~> 1.0)
-      omniauth-oauth2 (~> 1.0)
-    omniauth-oauth2 (1.1.1)
-      oauth2 (~> 0.8.0)
-      omniauth (~> 1.0)
-    rack (1.5.2)
-    rack-protection (1.5.0)
-      rack
-    rack-test (0.6.2)
-      rack (>= 1.0)
-    rake (10.1.0)
-    sinatra (1.4.4)
-      rack (~> 1.4)
-      rack-protection (~> 1.4)
-      tilt (~> 1.3, >= 1.3.4)
-    tilt (1.4.1)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  heroku-bouncer!
-  minitest (~> 5.0)
-  minitest-spec-context
-  mocha
-  rack-test
-  rake