heroku-bouncer 0.4.3 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 415f3f61030a94fb1e1eb0a4481be6fb8d60b5cd
-  data.tar.gz: 7cc105448d3d48f17ac0271ce336bb355245631e
+  metadata.gz: 1c2e6354ce81c7a731c46a10e0edd91c685f13d3
+  data.tar.gz: 0300b9cf964ea44056ce82053d5bf02af00c15d6
 SHA512:
-  metadata.gz: c977a0ea26bdac8fd14863a761a34492f9155b341171f707544bb9a816032f82bc29ba5414f0013168bcab71801a8ef0dcca56f20caea249a9b89eac9f577063
-  data.tar.gz: aa0ce2396d42163f876f37c9f3ae01c7d831250f26e664411a8aa56782101d065582c3351b705256c5bd322d6c99b2cd5a14e0b5a3cb755a5155b98c227d7e20
+  metadata.gz: 5d51fd44281f27481049a5a0b960c0c24db85f7c0f699d4c41a7b39932f205bfbc1d7aa66f4f2dc8fc9e326e3607760ee99673ce87dbb0c52fe3ec1408eda816
+  data.tar.gz: 212d42f2bf85cac32982e732c23e7d310ed2def34d800f5486b8f64f8b9f7f5823c1a18333df2c64eec21df8479564e72c4baaf5a94ffa2215c518823bfcf4b4

data/CHANGELOG.md

@@ -0,0 +1,76 @@
+# 0.5.0
+
+Adds `allow_if` option, and deprecates `herokai_only` (#35). Thanks
+@stillinbeta!
+
+# 0.4.3
+
+This release addresses options hash re-use (#34). Thanks @gregburek for
+reporting!
+
+# 0.4.2
+
+This release limits the size of the URL stored in the session, which
+could result in a cookie overflow condition
+
+# 0.4.1
+
+This release addresses an open redirect security vulernability
+addressed in #31. Thanks @raul!
+
+# 0.4.0
+
+This is nearly 1.0 ready, but I would like to see some additional
+changes in the following areas:
+
+* Option refactoring. We have a huge number of options now.
+* Extensibility. It should be easier to extend/inherit from
+  Heroku::Bouncer to tweak its behavior. This was possible under 0.3.x
+  but is no longer true in 0.4.0.
+* Remove backwards compatibility support (i.e. ENV vars)
+
+To those upgrading, please note that a great deal has changed. Backwards
+compatibility with warnings has been maintained in this version, but not
+throughly tested. Extensibility has not - you'll need to do some new
+tricks if you have extended Heroku::Bouncer in your app.
+
+# 0.4.0.pre\*
+
+Pre-releases changes were not documented. See 0.4.0 for details.
+
+# 0.3.4
+
+Fix a redirect loop (#16).
+
+# 0.3.3
+
+Fix bug with `herokai_only` writing to session even if the user is not
+Herokai.
+
+# 0.3.2
+
+Fix bug with creating an anonymous Module object for the `Heroku`
+constant.
+
+# 0.3.1
+
+Fix a bug with session destruction.
+
+# 0.3.0
+
+Switch to using the encrypted cookie gem for session storage.
+
+# 0.2.1
+
+Don't store data in the session until after checking email address.
+
+# 0.2.0
+
+* Prefer `HEROKU_OAUTH_ID` and `HEROKU_OAUTH_SECRET` environment
+  variables.
+* Check these variables for values, and disable middleware if they are
+  not present.
+
+# 0.1.0
+
+First "production" release.

data/README.md

@@ -90,22 +90,35 @@ use Heroku::Bouncer,
   secret: ENV['HEROKU_BOUNCER_SECRET']
 ```
 
-There are 8 additional options you can pass to the middleware:
+Here are the supported options you can pass to the middleware:
 
 * `oauth[:scope]`: The [OAuth scope][] to use when requesting the OAuth
   token. Default: `identity`.
-* `herokai_only`: Automatically redirects non-Heroku accounts to
-  `www.heroku.com`. Alternatively, pass a valid URL and non-Herokai will
-  be redirected there. Default: `false`
+* `allow_if`: A lambda that takes an email address. If the lambda evaluates to
+  true, allow the user through. If false, redirects to `redirect_url`.
+  By default, all users are allowed through after authenticating.
+* `redirect_url`: Where unauthorized users are redirected to. Defaults to
+  `www.heroku.com`.
 * `expose_token`: Expose the OAuth token in the session, allowing you to
   make API calls as the user. Default: `false`
 * `expose_email`: Expose the user's email address in the session.
   Default: `true`
 * `expose_user`: Expose the user attributes in the session. Default:
   `true`
-* `session_sync_nonce`: If present, determines the name of a cookie shared across properties under a same domain in order to keep their sessions synchronized. Default: `nil`
-* `allow_anonymous`: Accepts a lambda that gets called with each request. If the lambda evals to true, the request will not enforce authentication (e.g: `allow_anonymous: lambda { |req| !/\A\/admin/.match(req.fullpath) }` will allow anonymous requests except those with under the `/admin` path). Default: `nil`, which does not allow anonymous access to any URL.
-* `skip`: Accepts a lambda that gets called with each request's `env`. If the lambda gets evaluated to true, heroku-bouncer's middleware will be completely skipped. Default: 'false', which applies heroku-bouncer to all requests.
+* `session_sync_nonce`: If present, determines the name of a cookie
+  shared across properties under a same domain in order to keep their
+  sessions synchronized. Default: `nil`
+* `allow_anonymous`: Accepts a lambda that gets called with each
+  request. If the lambda evals to true, the request will not enforce
+  authentication (e.g:
+  `allow_anonymous: lambda { |req| !/\A\/admin/.match(req.fullpath) }`
+  will allow anonymous requests except those with under the `/admin`
+  path). Default: `nil`, which does not allow anonymous access to any
+  URL.
+* `skip`: Accepts a lambda that gets called with each request's `env`.
+  If the lambda gets evaluated to true, heroku-bouncer's middleware will
+  be completely skipped. Default: 'false', which applies heroku-bouncer
+  to all requests.
 
 You use these by passing a hash to the `use` call, for example:
 
@@ -157,8 +170,8 @@ logging in again.
 > Alternatively, [use inheritance to extend the middleware to act any way
 > you like][inheritance].
 
-Due to changes in how the middleware stack is built, this is currently
-broken in the 0.4.0 prereleases.
+Due to changes in how the middleware stack is built, this is not trivial
+in the 0.4.x releases.
 
 ## Security Model: A Tale of Three Secrets
 

data/lib/heroku/bouncer/middleware.rb

@@ -20,7 +20,20 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
     else
       super(app)
       @cookie_secret = extract_option(options, :secret, SecureRandom.base64(32))
-      @herokai_only = extract_option(options, :herokai_only, false)
+      @allow_if = extract_option(options, :allow_if, nil)
+      @redirect_url = extract_option(options, :redirect_url, 'https://www.heroku.com')
+
+      # backwards-compatibilty for `herokai_only`:
+      #  * check email for ending with `@heroku.com`
+      #  * The redirect URL can be passed as a string value to `herokai_only`
+      herokai_only = extract_deprecated_option("please use `allow_if` instead", options, :herokai_only, false)
+      if herokai_only
+        if herokai_only.is_a?(String) && !options[:redirect_url]
+          @redirect_url = herokai_only
+        end
+        @allow_if ||= lambda { |email| email.end_with?("@heroku.com") }
+      end
+
       @expose_token = extract_option(options, :expose_token, false)
       @expose_email = extract_option(options, :expose_email, true)
       @expose_user = extract_option(options, :expose_user, true)
@@ -64,11 +77,11 @@ class Heroku::Bouncer::Middleware < Sinatra::Base
   # callback when successful, time to save data
   get '/auth/heroku/callback' do
     token = request.env['omniauth.auth']['credentials']['token']
-    if @expose_email || @expose_user || @herokai_only
+    if @expose_email || @expose_user || !@allow_if.nil?
       user = fetch_user(token)
-      if @herokai_only && !user['email'].end_with?("@heroku.com")
-        url = @herokai_only.is_a?(String) ? @herokai_only : 'https://www.heroku.com'
-        redirect to(url) and return
+      # Wrapping lambda to prevent short-circut proc return
+      if @allow_if.respond_to?(:call) && !lambda{ @allow_if.call(user['email'])}.call
+        redirect to(@redirect_url) and return
       end
       @expose_user ? store_write(:user, user) : store_write(:user, true)
       store_write(:email, user['email']) if @expose_email
@@ -155,7 +168,12 @@ private
   end
 
   def extract_option(options, option, default = nil)
-    options.has_key?(option) ? options[option] : default
+    options.fetch(option, default)
+  end
+
+  def extract_deprecated_option(warning, options, option, default = nil)
+    $stderr.puts "[warn] heroku-bouncer: `#{option}` option is deprecated: #{warning}"
+    extract_option(options, option, default)
   end
 
   def fetch_user(token)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: heroku-bouncer
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.5.0
 platform: ruby
 authors:
 - Jonathan Dance
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-05-27 00:00:00.000000000 Z
+date: 2014-09-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-heroku
@@ -157,7 +157,9 @@ executables: []
 extensions: []
 extra_rdoc_files:
 - README.md
+- CHANGELOG.md
 files:
+- CHANGELOG.md
 - Gemfile
 - README.md
 - Rakefile