indexmap 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 513c19d20a8373690c66fa99a0251db934298589a19139c2b77654340ce7006a
-  data.tar.gz: '087bd725e6ecaf81ff07510f78f7c5fa1d613730cd7b735c9f0ed60ecb3f4676'
+  metadata.gz: 9b0f3c8b9175d0c18c39e52b61b3934129dfa8b8b637d06ad3d0d9adc30eb995
+  data.tar.gz: 3baf06c566ce17d63e189aabfdd7f3e7b4047d5908fc6a58f3e017da5ecef1de
 SHA512:
-  metadata.gz: 2f4065163991559ca5a1df38f1f01aafbdc539936f40aa81d78a3c5aa4abe34bdbc7cdb0df25d970a8a243e1b552c1946ec97c640f8d64350a46ef0d8de36006
-  data.tar.gz: d0ebff2036cefb30689a22ebddf313c89ac45a6dda11277a4a5322b6c39c6257e6d05e3615e0167ca876f985b14dc5ac21eba096f947876ab72be32bc6a73c33
+  metadata.gz: 700e0cd5485cd433ceaa520a2d634eb4e5ccf93d4d8993224fae61acdf7dacd73c91029e24ff750cc58ce8704a5b00bb4ed66eff113d0693c46df75fc5aea4df
+  data.tar.gz: aa51396dad778e50b18a53606d316d5f9008ed358cecb7b75c0f7dc72f24d47a3959750102fdddafe50fbb31688256e16b07ec9c9c0ae53cb9431148593bb250

data/CHANGELOG.md

@@ -5,12 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.4.1] - 2026-04-22
+## [0.4.2] - 2026-04-23
 
 
-### Added
+### Fixed
 
-- add output to ping tasks (#6)
+- harden sitemap pinging and indexnow key handling (#7)
 
 
 

data/lib/indexmap/pinger/google.rb

@@ -38,7 +38,7 @@ module Indexmap
         sitemap_url = URI.join(host, File.basename(sitemap_file)).to_s
 
         unless authorized?
-          logger.error("Google Search Console does not have access to the site: #{root_domain}")
+          logger.debug("Google Search Console does not have access to the site: #{root_domain}")
           return {
             status: :failed,
             reason: :unauthorized,
@@ -62,7 +62,7 @@ module Indexmap
       end
 
       def authorized?
-        webmasters_service.list_sites.site_entry.any? { |site| site.site_url.include?(root_domain) }
+        @authorized ||= accessible_site_urls.include?(property_identifier)
       end
 
       def property_identifier
@@ -104,6 +104,10 @@ module Indexmap
           failures: failures
         }
       end
+
+      def accessible_site_urls
+        @accessible_site_urls ||= Array(webmasters_service.list_sites.site_entry).map(&:site_url)
+      end
     end
   end
 end

data/lib/indexmap/pinger/index_now.rb

@@ -8,6 +8,8 @@ require "time"
 module Indexmap
   module Pinger
     class IndexNow < Base
+      KEY_FORMAT = /\A[a-f0-9]{32}\z/
+
       def initialize(configuration: Indexmap.configuration, connection: nil)
         super(configuration: configuration)
         @connection = connection
@@ -41,20 +43,21 @@ module Indexmap
       end
 
       def write_key_file(key: index_now_configuration.key, path: nil)
-        key = key.to_s.strip
+        key = normalized_configured_key(key)
         return if key.empty?
 
         path ||= index_now_configuration.key_path(public_path: configuration.public_path, key: key)
         FileUtils.mkdir_p(path.dirname)
-        File.write(path, "#{key}\n")
+        File.write(path, key)
         path
       end
 
       def ensure_key_file
-        configured_key = index_now_configuration.key.to_s.strip
+        configured_key = normalized_configured_key(index_now_configuration.key)
         return write_key_file(key: configured_key) unless configured_key.empty?
 
-        return existing_key_file if existing_key_file
+        existing_path = existing_key_file
+        return existing_path if existing_path
 
         key = generated_key
         write_key_file(key: key, path: configuration.public_path.join("#{key}.txt"))
@@ -143,6 +146,9 @@ module Indexmap
 
       def submit_batch(api_key:, urls:)
         payload = {host: hostname, key: api_key, urlList: urls}
+        location = key_location(api_key: api_key)
+        payload[:keyLocation] = location if location
+
         response = index_now_connection.post("/indexnow") do |request|
           request.headers["Content-Type"] = "application/json"
           request.body = payload.to_json
@@ -168,30 +174,50 @@ module Indexmap
       end
 
       def read_api_key
-        configured_key = index_now_configuration.key.to_s.strip
+        configured_key = normalized_configured_key(index_now_configuration.key)
         return configured_key unless configured_key.empty?
 
-        existing_key_file&.read&.strip
+        existing_key_file&.read
       end
 
       def existing_key_file
         configured_path = index_now_configuration.key_path(public_path: configuration.public_path)
         return configured_path if valid_key_file?(configured_path)
 
-        configuration.public_path.glob("*.txt").find { |file| valid_key_file?(file) }
+        configuration.public_path.glob("*.txt").sort.find { |file| valid_key_file?(file) }
+      end
+
+      def key_location(api_key:)
+        path = index_now_configuration.key_path(public_path: configuration.public_path, key: api_key) || existing_key_file
+        return unless path
+
+        public_path = configuration.public_path.expand_path
+        key_path = path.expand_path
+        relative_path = key_path.relative_path_from(public_path)
+
+        URI.join("#{host}/", relative_path.to_s).to_s
+      rescue ArgumentError
+        nil
       end
 
       def valid_key_file?(path)
         return false unless path&.file?
 
         filename = path.basename(".txt").to_s
-        return false unless filename.match?(/\A[a-zA-Z0-9-]{8,128}\z/)
+        return false unless filename.match?(KEY_FORMAT)
 
-        path.read.strip == filename
+        path.read == filename
       end
 
       def generated_key
-        SecureRandom.uuid
+        SecureRandom.hex(16)
+      end
+
+      def normalized_configured_key(value)
+        key = value.to_s.strip
+        return key if key.empty? || key.match?(KEY_FORMAT)
+
+        raise ConfigurationError, "IndexNow key must be a 32-character lowercase hexadecimal string"
       end
 
       def summarize_results(results)

data/lib/indexmap/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Indexmap
-  VERSION = "0.4.1"
+  VERSION = "0.4.2"
 end

data/lib/indexmap/writer.rb

@@ -82,7 +82,8 @@ module Indexmap
       sitemap_sections.each do |section|
         lines << "  <sitemap>"
         lines << "    <loc>#{escape(index_loc(section.filename))}</loc>"
-        lines << "    <lastmod>#{format_lastmod(section_lastmod(section))}</lastmod>"
+        lastmod = section_lastmod(section)
+        lines << "    <lastmod>#{format_lastmod(lastmod)}</lastmod>" if lastmod
         lines << "  </sitemap>"
       end
 
@@ -102,7 +103,7 @@ module Indexmap
 
     def section_lastmod(section)
       timestamps = Array(section.entries).map { |entry| comparable_lastmod(normalize_entry(entry).lastmod) }.compact
-      timestamps.max || Time.now.utc
+      timestamps.max
     end
 
     def format_lastmod(value)

data/test/indexmap/pinger/google_test.rb

@@ -8,13 +8,15 @@ class IndexmapPingerGoogleTest < Minitest::Test
 
   class FakeWebmastersService
     attr_accessor :authorization
-    attr_reader :submitted
+    attr_reader :submitted, :list_sites_calls
 
     def initialize(site_urls:)
       @site_urls = site_urls
+      @list_sites_calls = 0
     end
 
     def list_sites
+      @list_sites_calls += 1
       SiteList.new(@site_urls.map { |site_url| SiteEntry.new(site_url) })
     end
 
@@ -51,6 +53,7 @@ class IndexmapPingerGoogleTest < Minitest::Test
       assert_equal ["sc-domain:example.com", "https://www.example.com/sitemap.xml"], service.submitted
       assert_equal :submitted, result[:status]
       assert_equal 1, result[:sitemap_count]
+      assert_equal 1, service.list_sites_calls
     end
   end
 
@@ -114,4 +117,27 @@ class IndexmapPingerGoogleTest < Minitest::Test
       assert_nil service.submitted
     end
   end
+
+  def test_google_authorization_requires_exact_property_match
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+      public_path.join("sitemap.xml").write("<sitemapindex/>")
+
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = public_path
+      configuration.google.credentials = "{\"type\":\"service_account\"}"
+
+      service = FakeWebmastersService.new(site_urls: ["sc-domain:myexample.com"])
+      result = Indexmap::Pinger::Google.new(
+        configuration: configuration,
+        service: service,
+        credentials_builder: ->(**) { :fake_authorizer }
+      ).ping
+
+      assert_equal :failed, result[:status]
+      assert_equal :unauthorized, result[:failures].first[:reason]
+      assert_nil service.submitted
+    end
+  end
 end

data/test/indexmap/pinger/index_now_test.rb

@@ -3,17 +3,19 @@
 require "test_helper"
 
 class IndexmapPingerIndexNowTest < Minitest::Test
+  VALID_KEY = "1234567890abcdef1234567890abcdef"
+
   def test_writes_key_file_from_configuration
     Dir.mktmpdir do |dir|
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = Pathname(dir)
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       path = Indexmap::Pinger::IndexNow.new(configuration: configuration).write_key_file
 
-      assert_equal Pathname(dir).join("test-key.txt"), path
-      assert_equal "test-key\n", path.read
+      assert_equal Pathname(dir).join("#{VALID_KEY}.txt"), path
+      assert_equal VALID_KEY, path.read
     end
   end
 
@@ -25,16 +27,16 @@ class IndexmapPingerIndexNowTest < Minitest::Test
 
       path = Indexmap::Pinger::IndexNow.new(configuration: configuration).ensure_key_file
 
-      assert_match(/\A[a-z0-9-]{8,128}\.txt\z/, path.basename.to_s)
-      assert_equal "#{path.basename(".txt")}\n", path.read
+      assert_match(/\A[a-f0-9]{32}\.txt\z/, path.basename.to_s)
+      assert_equal path.basename(".txt").to_s, path.read
     end
   end
 
   def test_pings_using_existing_key_file_when_key_is_not_configured
     Dir.mktmpdir do |dir|
       public_path = Pathname(dir)
-      key_path = public_path.join("test-key-123.txt")
-      key_path.write("test-key-123\n")
+      key_path = public_path.join("#{VALID_KEY}.txt")
+      key_path.write(VALID_KEY)
       write_sitemap_files(
         public_path,
         marketing_lastmod: "2026-04-18T00:00:00Z",
@@ -52,7 +54,8 @@ class IndexmapPingerIndexNowTest < Minitest::Test
 
       assert_requested(:post, indexnow_url, times: 1) do |request|
         payload = JSON.parse(request.body)
-        assert_equal "test-key-123", payload.fetch("key")
+        assert_equal VALID_KEY, payload.fetch("key")
+        assert_equal "https://www.example.com/#{VALID_KEY}.txt", payload.fetch("keyLocation")
       end
       assert_equal :submitted, result[:status]
       assert_equal 2, result[:url_count]
@@ -60,6 +63,24 @@ class IndexmapPingerIndexNowTest < Minitest::Test
     end
   end
 
+  def test_ignores_existing_key_file_with_trailing_newline
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+      invalid_key_path = public_path.join("1234567890abcdef1234567890abcdef.txt")
+      invalid_key_path.write("#{VALID_KEY}\n")
+
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = public_path
+
+      path = Indexmap::Pinger::IndexNow.new(configuration: configuration).ensure_key_file
+
+      refute_equal invalid_key_path, path
+      assert_match(/\A[a-f0-9]{32}\.txt\z/, path.basename.to_s)
+      assert_equal path.basename(".txt").to_s, path.read
+    end
+  end
+
   def test_pings_all_sitemap_urls_when_no_cutoff_is_provided
     Dir.mktmpdir do |dir|
       public_path = Pathname(dir)
@@ -72,7 +93,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       indexnow_url = "https://api.indexnow.org/indexnow"
       stub_request(:post, indexnow_url).to_return(status: 200, body: "", headers: {})
@@ -85,6 +106,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
           "https://www.example.com/pages/features",
           "https://www.example.com/insights/us/restaurants/overview"
         ].sort, payload.fetch("urlList").sort
+        assert_equal "https://www.example.com/#{VALID_KEY}.txt", payload.fetch("keyLocation")
       end
       assert_equal :submitted, result[:status]
       assert_equal 2, result[:url_count]
@@ -104,7 +126,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       indexnow_url = "https://api.indexnow.org/indexnow"
       stub_request(:post, indexnow_url).to_return(status: 200, body: "", headers: {})
@@ -155,7 +177,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       with_env("INDEXNOW_DRY_RUN" => "1") do
         result = Indexmap::Pinger::IndexNow.new(configuration: configuration).ping
@@ -179,7 +201,7 @@ class IndexmapPingerIndexNowTest < Minitest::Test
       configuration = Indexmap::Configuration.new
       configuration.base_url = "https://www.example.com"
       configuration.public_path = public_path
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       indexnow_url = "https://api.indexnow.org/indexnow"
       stub_request(:post, indexnow_url).to_return(status: 500, body: "boom", headers: {})
@@ -192,6 +214,37 @@ class IndexmapPingerIndexNowTest < Minitest::Test
     end
   end
 
+  def test_rejects_invalid_configured_key
+    Dir.mktmpdir do |dir|
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = Pathname(dir)
+      configuration.index_now.key = "test-key"
+
+      error = assert_raises(Indexmap::ConfigurationError) do
+        Indexmap::Pinger::IndexNow.new(configuration: configuration).ping
+      end
+
+      assert_equal "IndexNow key must be a 32-character lowercase hexadecimal string", error.message
+    end
+  end
+
+  def test_reuses_existing_key_file_deterministically
+    Dir.mktmpdir do |dir|
+      public_path = Pathname(dir)
+      public_path.join("ffffffffffffffffffffffffffffffff.txt").write("ffffffffffffffffffffffffffffffff")
+      public_path.join("00000000000000000000000000000000.txt").write("00000000000000000000000000000000")
+
+      configuration = Indexmap::Configuration.new
+      configuration.base_url = "https://www.example.com"
+      configuration.public_path = public_path
+
+      path = Indexmap::Pinger::IndexNow.new(configuration: configuration).ensure_key_file
+
+      assert_equal public_path.join("00000000000000000000000000000000.txt"), path
+    end
+  end
+
   private
 
   def with_env(overrides)

data/test/indexmap/task_runner_test.rb

@@ -3,6 +3,8 @@
 require "test_helper"
 
 class IndexmapTaskRunnerTest < Minitest::Test
+  VALID_KEY = "1234567890abcdef1234567890abcdef"
+
   def test_create_removes_existing_sitemap_files_writes_new_sitemap_and_key_file
     Dir.mktmpdir do |dir|
       public_path = Pathname(dir)
@@ -18,15 +20,15 @@ class IndexmapTaskRunnerTest < Minitest::Test
           entries: [Indexmap::Entry.new(loc: "https://example.com/about")]
         )
       ]
-      configuration.index_now.key = "test-key"
+      configuration.index_now.key = VALID_KEY
 
       result = Indexmap::TaskRunner.new(configuration: configuration).create
 
       assert_equal false, public_path.join("sitemap-pages.xml.gz").exist?
       assert_includes public_path.join("sitemap.xml").read, "<sitemapindex"
-      assert_equal "test-key\n", public_path.join("test-key.txt").read
+      assert_equal VALID_KEY, public_path.join("#{VALID_KEY}.txt").read
       assert_equal [public_path.join("sitemap-pages.xml").to_s, public_path.join("sitemap.xml").to_s], result[:files]
-      assert_equal public_path.join("test-key.txt"), result[:index_now_key_path]
+      assert_equal public_path.join("#{VALID_KEY}.txt"), result[:index_now_key_path]
     end
   end
 
@@ -56,8 +58,8 @@ class IndexmapTaskRunnerTest < Minitest::Test
 
       result = Indexmap::TaskRunner.new(configuration: configuration).write_index_now_key(generate_if_missing: true)
 
-      assert_match(/\A[a-z0-9-]{8,128}\.txt\z/, result.basename.to_s)
-      assert_equal "#{result.basename(".txt")}\n", result.read
+      assert_match(/\A[a-f0-9]{32}\.txt\z/, result.basename.to_s)
+      assert_equal result.basename(".txt").to_s, result.read
     end
   end
 end

data/test/indexmap/writer_test.rb

@@ -77,4 +77,23 @@ class IndexmapWriterTest < Minitest::Test
       refute File.exist?(File.join(directory, "sitemap-pages.xml"))
     end
   end
+
+  def test_omits_sitemap_index_lastmod_when_sections_have_no_lastmod
+    Dir.mktmpdir do |directory|
+      Indexmap::Writer.new(
+        sections: [
+          Indexmap::Section.new(
+            filename: "sitemap-pages.xml",
+            entries: [Indexmap::Entry.new(loc: "https://example.com/about")]
+          )
+        ],
+        public_path: directory,
+        base_url: "https://example.com"
+      ).write
+
+      index_xml = File.read(File.join(directory, "sitemap.xml"))
+
+      refute_includes index_xml, "<lastmod>"
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: indexmap
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Paulo Fidalgo