katalyst-basic-auth 0.3.2 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 42a7c271d2cff6d64ef648d0137bf97aa0bad05304140dca22cf0eca7540e721
-  data.tar.gz: cff3c9af52be2633129eb88b26ae7afd82eefe2f0f5631caa48adf7678882ee7
+  metadata.gz: 41f54ddbd66ceccb23388677ecf248089a03302ec1bf0a000c93d0e5d4ec251a
+  data.tar.gz: 4183373946dd4df7848c0988b00beb95f144b1341d58cff5f3024458ec935dc7
 SHA512:
-  metadata.gz: 0ca93649e6378df0b81d42799226fc3609137abcb0ae97224866bae219905e7395cc62012c34ac07fa0e8ee8431688fd7a86538ddcaa87b1e509df79b31775d6
-  data.tar.gz: 9035f91c1b3655a51fe8353ef535147c687a68b6582c659f4eb09a048da3ee2994ae782d605596befdad112eff4c507b24d762bba02fa15edd1f8312775cd32f
+  metadata.gz: 334cf7d8ab929fa675f2179e85743423f9fa50e15f528c403b1e8b627ce6a4b1816bbce85a69a99bdbd40163f2ba0c1c9889f370d6390a6322abaf7f1e4fe6e3
+  data.tar.gz: 7b4d85c560cebf72d748e9e65bae30ce9216e5292a80913aa86919bb24b2b250404199ad960dfa4bb8a1fe20d5e2c7efecb8bede9b18fdbdfe66be8eccbb5ad1

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [0.5.0] - 2024-04-26
+
+- Add `/up` as a default allowed path (Rails 7.1+ health check)
+
+## [0.4.0] - 2022-06-10
+
+- Add support for IP address allowlists
+
 ## [0.3.2] - 2022-03-25
 
 - Publish to RubyGems

data/README.md

@@ -32,6 +32,7 @@ The following environment variables can optionally be defined to configure the g
 | KATALYST_BASIC_AUTH_ENABLED | If "yes" or "true", the middleware will be enabled. By default, the middleware is enabled on staging and uat Rails environments |
 | KATALYST_BASIC_AUTH_USER | The username for basic authentication. Default is the Rails application name in lowercase. |
 | KATALYST_BASIC_AUTH_PASS | The password for basic authentication. A password will be generated if not set. |
+| KATALYST_BASIC_AUTH_IP_ALLOWLIST | Comma or space separated list of IP addresses or CIDR ranges to allow without basic auth |
 
 The gem provides a rake task that can be used to query basic auth settings:
 
@@ -55,7 +56,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/katalyst/katalyst-basic-auth. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/katalyst-basic-auth/blob/master/CODE_OF_CONDUCT.md).
+Bug reports and pull requests are welcome on GitHub at https://github.com/katalyst/basic-auth. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/katalyst-basic-auth/blob/master/CODE_OF_CONDUCT.md).
 
 ## License
 

data/lib/katalyst/basic/auth/config.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
 
 require "digest"
+require "ipaddr"
+require "rack"
 
 module Katalyst
   module Basic
     module Auth
-      class Config
+      class Config # rubocop:disable Metrics/ClassLength
         DEFAULT_USERNAME = "katalyst"
         ROOT_PATH        = "/"
 
@@ -26,19 +28,34 @@ module Katalyst
             all[0]
           end
 
-          def add(path:, username: nil, password: nil, enabled: nil)
-            config = new(path: path, username: username, password: password, enabled: enabled)
+          # @param path [String] Relative path
+          # @param username [String] Basic auth user name
+          # @param password [String] Basic auth password
+          # @param enabled [Boolean] True to enable basic auth for this path
+          # @param ip_allowlist [Array<String>] List of IP addresses or network ranges to allow without basic auth
+          def add(path:, username: nil, password: nil, enabled: nil, ip_allowlist: nil)
+            config = new(
+              path:         path,
+              username:     username,
+              password:     password,
+              enabled:      enabled,
+              ip_allowlist: ip_allowlist
+            )
             all.delete(all.detect { |i| i.path == config.path })
             all << config
             config
           end
 
+          def up(path = "/up")
+            new(path: path, enabled: false)
+          end
+
           def all
-            @all ||= [new]
+            @all ||= [new, up]
           end
 
           def reset!
-            @all = [new]
+            @all = [new, up]
           end
 
           def each(&block)
@@ -48,10 +65,7 @@ module Katalyst
           def description
             output = ["Basic auth settings:", ""]
             all.each do |config|
-              output << "path:     #{config.root_path? ? "(global)" : config.path}"
-              output << "enabled:  #{config.enabled?}"
-              output << "username: #{config.username}"
-              output << "password: #{config.password}"
+              output << config.description
               output << ""
             end
             output.join("\n")
@@ -96,9 +110,13 @@ module Katalyst
               ENV["SECRET_KEY_BASE"]
             end
           end
+
+          def default_ip_allowlist
+            ENV.fetch("KATALYST_BASIC_AUTH_IP_ALLOWLIST", "").split(/[\s,]+/)
+          end
         end
 
-        attr_reader :path, :username, :password
+        attr_reader :path, :username, :password, :ip_allowlist
 
         def enabled?
           @enabled
@@ -108,13 +126,37 @@ module Katalyst
           path == ROOT_PATH
         end
 
+        def allow_ip?(env)
+          request = ::Rack::Request.new(env)
+          return false unless request.ip
+
+          remote_ip = IPAddr.new(request.ip)
+          ip_allowlist.any? { |i| i.include?(remote_ip) }
+        end
+
+        def description
+          output = []
+          output << "path:         #{root_path? ? "(global)" : path}"
+          output << "enabled:      #{enabled?}"
+          output << "username:     #{username}"
+          output << "password:     #{password}"
+          output << "ip allowlist: #{ip_allowlist.inspect}"
+          output.join("\n")
+        end
+
         private
 
-        def initialize(path: nil, username: nil, password: nil, enabled: nil)
-          @path     = sanitize_path(path)
-          @username = username || self.class.default_username
-          @password = password || self.class.default_password(@username)
-          @enabled  = enabled.nil? ? (!root_path? || self.class.enabled?) : enabled
+        # @param path [String] Relative path
+        # @param username [String] Basic auth user name
+        # @param password [String] Basic auth password
+        # @param enabled [Boolean] True to enable basic auth for this path
+        # @param ip_allowlist [Array<String>] List of IP addresses or network ranges to allow without basic auth
+        def initialize(path: nil, username: nil, password: nil, enabled: nil, ip_allowlist: nil)
+          @path         = sanitize_path(path)
+          @username     = username || self.class.default_username
+          @password     = password || self.class.default_password(@username)
+          @enabled      = enabled.nil? ? (!root_path? || self.class.enabled?) : enabled
+          @ip_allowlist = initialize_ip_allowlist(ip_allowlist)
         end
 
         def sanitize_path(path)
@@ -123,6 +165,10 @@ module Katalyst
           path = "/#{path}" unless path.start_with?("/")
           path
         end
+
+        def initialize_ip_allowlist(ip_allowlist)
+          (ip_allowlist || self.class.default_ip_allowlist).map { |i| IPAddr.new(i) }
+        end
       end
     end
   end

data/lib/katalyst/basic/auth/middleware.rb

@@ -13,6 +13,7 @@ module Katalyst
         def call(env)
           config = Config.for_path(env["PATH_INFO"])
           return @app.call(env) unless config.enabled?
+          return @app.call(env) if config.allow_ip?(env)
 
           auth = Rack::Auth::Basic.new(app) do |u, p|
             u == config.username && p == config.password

data/lib/katalyst/basic/auth.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "auth/version"
 require_relative "auth/config"
 require_relative "auth/middleware"
 require_relative "auth/rails" if defined?(Rails)
@@ -10,11 +9,20 @@ module Katalyst
     module Auth
       class << self
         # Add a path to be protected by basic authentication
-        def add(path, username: nil, password: nil)
-          Config.add(path: path, username: username, password: password)
+        # @param path [String] Relative path
+        # @param username [String] Basic auth user name
+        # @param password [String] Basic auth password
+        # @param ip_allowlist [Array<String>] List of IP addresses or network ranges to allow without basic auth
+        def add(path, username: nil, password: nil, ip_allowlist: nil)
+          Config.add(path:         path,
+                     username:     username,
+                     password:     password,
+                     enabled:      true,
+                     ip_allowlist: ip_allowlist)
         end
 
         # Add a path to be excluded from basic authentication
+        # @param path [String] Relative path
         def exclude(path)
           Config.add(path: path, enabled: false)
         end

metadata

@@ -1,18 +1,32 @@
 --- !ruby/object:Gem::Specification
 name: katalyst-basic-auth
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.5.0
 platform: ruby
 authors:
 - Katalyst Interactive
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-03-25 00:00:00.000000000 Z
-dependencies: []
+date: 2024-04-26 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Makes it easy to add basic auth on staging and development apps.
 email:
-- admin@katalyst.com.au
+- developers@katalyst.com.au
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -25,7 +39,6 @@ files:
 - lib/katalyst/basic/auth/middleware.rb
 - lib/katalyst/basic/auth/rails.rb
 - lib/katalyst/basic/auth/tasks/auth.rake
-- lib/katalyst/basic/auth/version.rb
 homepage: https://github.com/katalyst/katalyst-basic-auth
 licenses:
 - MIT
@@ -33,8 +46,8 @@ metadata:
   allowed_push_host: https://rubygems.org
   rubygems_mfa_required: 'true'
   homepage_uri: https://github.com/katalyst/katalyst-basic-auth
-  source_code_uri: https://github.com/katalyst/katalyst-basic-auth
-  changelog_uri: https://github.com/katalyst/katalyst-basic-auth/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/katalyst/basic-auth
+  changelog_uri: https://github.com/katalyst/basic-auth/blob/main/CHANGELOG.md
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -50,7 +63,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: Gem to add basic auth on staging websites

data/lib/katalyst/basic/auth/version.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-module Katalyst
-  module Basic
-    module Auth
-      VERSION = "0.3.2"
-    end
-  end
-end