macaw_framework 1.2.4 → 1.2.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17a2ff330e9f546997fcbbcbbc8bc0e08af19c08980056999b60f3307aaf898d
-  data.tar.gz: 2af901040509fcd7feecaa5bc9cc762967f9530cd6277b6fc0d4ac1fe5a3bb20
+  metadata.gz: 2353cd5ffe4a264a2eacab71fc2de65c5c4a6b2cd925666529e36b8bdde0ada6
+  data.tar.gz: 4855cf3e106380f6c6718058001cd6cbd888a6c0f1927f833da3bc97cf648785
 SHA512:
-  metadata.gz: 07127b57e24d02a95a9bc444bc444bb3ce44d9f80c6fc9f08b5155c88a3355bd20ee93ae5831f028596b114a4cb200c31bd5247bff8ba043d65f844c426a6bd7
-  data.tar.gz: 4ca1a0f63ea1feb4de1b712f63b786286b791bc9df255011b4ef7acf5a740076c65821b13311bf5c3741bfde945ba0f83dae8ad0073bb56dab6962295b1dc7b5
+  metadata.gz: 85f5262044b8b3029ad507d501655f72ccd022630b34fc72a5606fe993d223a7e83b245b2ee858adbedf1723717d2d050e1276badf2a353d89612d2c544253a4
+  data.tar.gz: 31b67715e3f2b2c792262d53f6488ae0b8df38c2c1f700fd5590b45927f49dc47fa8c84db884d2ec560b0e981582091b3f38a0f8af06bbddb26efd26f33e2e58

data/CHANGELOG.md

@@ -128,3 +128,11 @@
 
 - Fixing small bug on lof during endpoint declaration
 - Disclosing security issue on session storage
+
+## [1.2.5]
+
+- Improvements to cache usability
+
+## [1.2.6]
+
+- Improving session strategy and fixing vulnerabilities on it.

data/README.md

@@ -104,7 +104,7 @@ m.start!
 ### Caching: Improve performance by caching responses and configuring cache invalidation
 
 ```ruby
-m.get('/cached_data', cache: true) do |context|
+m.get('/cached_data', cache: ["header_to_cache", "query_param_to_cache"]) do |context|
   # Retrieve data
 end
 ```
@@ -113,6 +113,15 @@ end
 
 ### Session management: Handle user sessions with server-side in-memory storage
 
+Session will only be enabled if it's configurations exists in the `application.json` file.
+The session mechanism works by recovering the Session ID from a client sent header. The default
+header is `X-Session-ID`, but it can be changed in the `application.json` file.
+
+This header will be sent back to the user on every response if Session is enabled. Also, the
+session ID will be automatically generated and sent to a client if this client does not provide
+a session id in the HTTP request. In the case of the client sending an ID of an expired session
+the framework will return a new session with a new ID.
+
 ```ruby
 m.get('/login') do |context|
   # Authenticate user
@@ -129,8 +138,6 @@ m.get('/dashboard') do |context|
 end
 ```
 
-**Caution: This feature is vulnerable to IP spoofing and may disrupt sessions on devices sharing the same network (e.g., Wi-Fi).**
-
 ### Configuration: Customize various aspects of the framework through the application.json configuration file, such as rate limiting, SSL support, and Prometheus integration
 
 ```json
@@ -140,11 +147,7 @@ end
     "bind": "localhost",
     "threads": 200,
     "cache": {
-      "cache_invalidation": 3600,
-      "ignore_headers": [
-        "header-to-be-ignored-from-caching-strategy",
-        "another-header-to-be-ignored-from-caching-strategy"
-      ]
+      "cache_invalidation": 3600
     },
     "prometheus": {
       "endpoint": "/metrics"
@@ -159,6 +162,10 @@ end
       "key_type": "EC",
       "cert_file_name": "path/to/cert/file/file.crt",
       "key_file_name": "path/to/cert/key/file.key"
+    },
+    "session": {
+      "secure_header": "X-Session-ID",
+      "invalidation_time": 3600
     }
   }
 }

data/lib/macaw_framework/aspects/cache_aspect.rb

@@ -6,7 +6,7 @@ module CacheAspect
   def call_endpoint(cache, *args)
     return super(*args) unless !cache[:cache].nil? && cache[:endpoints_to_cache]&.include?(args[0])
 
-    cache_filtered_name = cache_name_filter(args[1], cache[:ignored_headers])
+    cache_filtered_name = cache_name_filter(args[1], cache[:cached_methods][args[0]])
 
     cache[:cache].mutex.synchronize do
       return cache[:cache].cache[cache_filtered_name][0] unless cache[:cache].cache[cache_filtered_name].nil?
@@ -19,9 +19,10 @@ module CacheAspect
 
   private
 
-  def cache_name_filter(client_data, ignored_headers)
-    filtered_headers = client_data[:headers].filter { |key, _value| !ignored_headers&.include?(key) }
-    [{ body: client_data[:body], params: client_data[:params], headers: filtered_headers }].to_s.to_sym
+  def cache_name_filter(client_data, cached_methods_params)
+    filtered_headers = client_data[:headers]&.filter { |key, _value| cached_methods_params&.include?(key) }
+    filtered_params = client_data[:params]&.filter { |key, _value| cached_methods_params&.include?(key) }
+    [{ params: filtered_params, headers: filtered_headers }].to_s.to_sym
   end
 
   def should_cache_response?(status)

data/lib/macaw_framework/core/common/server_base.rb

@@ -8,6 +8,7 @@ require_relative "../../utils/supported_ssl_versions"
 require_relative "../../aspects/prometheus_aspect"
 require_relative "../../aspects/logging_aspect"
 require_relative "../../aspects/cache_aspect"
+require "securerandom"
 
 ##
 # Base module for Server classes. It contains
@@ -21,14 +22,14 @@ module ServerBase
 
   private
 
-  def call_endpoint(name, client_data, client_ip)
+  def call_endpoint(name, client_data, session_id, _client_ip)
     @macaw.send(
       name.to_sym,
       {
         headers: client_data[:headers],
         body: client_data[:body],
         params: client_data[:params],
-        client: @session[client_ip][0]
+        client: @session[session_id][0]
       }
     )
   end
@@ -42,12 +43,14 @@ module ServerBase
     raise EndpointNotMappedError unless @macaw.respond_to?(method_name)
     raise TooManyRequestsError unless @rate_limit.nil? || @rate_limit.allow?(client.peeraddr[3])
 
-    declare_client_session(client)
     client_data = get_client_data(body, headers, parameters)
+    session_id = declare_client_session(client_data[:headers], @macaw.secure_header) if @macaw.session
 
     @macaw_log&.info("Running #{path.gsub("\n", "").gsub("\r", "")}")
     message, status, response_headers = call_endpoint(@prometheus_middleware, @macaw_log, @cache,
-                                                      method_name, client_data, client.peeraddr[3])
+                                                      method_name, client_data, session_id, client.peeraddr[3])
+    response_headers ||= {}
+    response_headers[@macaw.secure_header] = session_id if @macaw.session
     status ||= 200
     message ||= nil
     response_headers ||= nil
@@ -69,9 +72,11 @@ module ServerBase
     end
   end
 
-  def declare_client_session(client)
-    @session[client.peeraddr[3]] ||= [{}, Time.now]
-    @session[client.peeraddr[3]] = [{}, Time.now] if @session[client.peeraddr[3]][0].nil?
+  def declare_client_session(headers, secure_header_name)
+    session_id = headers[secure_header_name] || SecureRandom.uuid
+    session_id = SecureRandom.uuid if @session[session_id].nil?
+    @session[session_id] ||= [{}, Time.now]
+    session_id
   end
 
   def set_rate_limiting
@@ -83,12 +88,6 @@ module ServerBase
     )
   end
 
-  def set_cache_ignored_h
-    return unless @macaw.config&.dig("macaw", "cache", "ignore_headers")
-
-    @macaw.config["macaw"]["cache"]["ignore_headers"] || []
-  end
-
   def set_ssl
     ssl_config = @macaw.config["macaw"]["ssl"] if @macaw.config&.dig("macaw", "ssl")
     ssl_config ||= nil
@@ -116,7 +115,7 @@ module ServerBase
   end
 
   def set_session
-    @session = {}
+    @session ||= {}
     inv = if @macaw.config&.dig("macaw", "session", "invalidation_time")
             MemoryInvalidationMiddleware.new(@macaw.config["macaw"]["session"]["invalidation_time"])
           else
@@ -128,7 +127,7 @@ module ServerBase
   def set_features
     @is_shutting_down = false
     set_rate_limiting
-    set_session
+    set_session if @macaw.session
     set_ssl
   end
 end

data/lib/macaw_framework/core/thread_server.rb

@@ -32,11 +32,13 @@ class ThreadServer
     @macaw_log = macaw.macaw_log
     @num_threads = macaw.threads
     @work_queue = Queue.new
-    ignored_headers = set_cache_ignored_h
     set_features
     @rate_limit ||= nil
-    ignored_headers ||= nil
-    @cache = { cache: cache, endpoints_to_cache: endpoints_to_cache || [], ignored_headers: ignored_headers }
+    @cache = {
+      cache: cache,
+      endpoints_to_cache: endpoints_to_cache || [],
+      cached_methods: macaw.cached_methods
+    }
     @prometheus = prometheus
     @prometheus_middleware = prometheus_mw
     @workers = []

data/lib/macaw_framework/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MacawFramework
-  VERSION = "1.2.4"
+  VERSION = "1.2.6"
 end

data/lib/macaw_framework.rb

@@ -19,30 +19,16 @@ module MacawFramework
   # Class responsible for creating endpoints and
   # starting the web server.
   class Macaw
-    ##
-    # Array containing the routes defined in the application
-    attr_reader :routes, :macaw_log, :config, :jobs
+    attr_reader :routes, :macaw_log, :config, :jobs, :cached_methods, :secure_header, :session
     attr_accessor :port, :bind, :threads
 
     ##
+    # Initialize Macaw Class
     # @param {Logger} custom_log
+    # @param {ThreadServer} server
+    # @param {String?} dir
     def initialize(custom_log: Logger.new($stdout), server: ThreadServer, dir: nil)
-      begin
-        @routes = []
-        @macaw_log ||= custom_log
-        @config = JSON.parse(File.read("application.json"))
-        @port = @config["macaw"]["port"] || 8080
-        @bind = @config["macaw"]["bind"] || "localhost"
-        @threads = @config["macaw"]["threads"] || 200
-        unless @config["macaw"]["cache"].nil?
-          @cache = MemoryInvalidationMiddleware.new(@config["macaw"]["cache"]["cache_invalidation"].to_i || 3_600)
-        end
-        @prometheus = Prometheus::Client::Registry.new if @config["macaw"]["prometheus"]
-        @prometheus_middleware = PrometheusMiddleware.new if @config["macaw"]["prometheus"]
-        @prometheus_middleware.configure_prometheus(@prometheus, @config, self) if @config["macaw"]["prometheus"]
-      rescue StandardError => e
-        @macaw_log&.warn(e.message)
-      end
+      apply_options(custom_log)
       create_endpoint_public_files(dir)
       @port ||= 8080
       @bind ||= "localhost"
@@ -65,7 +51,7 @@ module MacawFramework
     # macaw.get("/hello") do |context|
     #   return "Hello World!", 200, { "Content-Type" => "text/plain" }
     # end
-    def get(path, cache: false, &block)
+    def get(path, cache: [], &block)
       map_new_endpoint("get", cache, path, &block)
     end
 
@@ -81,7 +67,7 @@ module MacawFramework
     # macaw.post("/hello") do |context|
     #   return "Hello World!", 200, { "Content-Type" => "text/plain" }
     # end
-    def post(path, cache: false, &block)
+    def post(path, cache: [], &block)
       map_new_endpoint("post", cache, path, &block)
     end
 
@@ -96,7 +82,7 @@ module MacawFramework
     # macaw.put("/hello") do |context|
     #   return "Hello World!", 200, { "Content-Type" => "text/plain" }
     # end
-    def put(path, cache: false, &block)
+    def put(path, cache: [], &block)
       map_new_endpoint("put", cache, path, &block)
     end
 
@@ -111,7 +97,7 @@ module MacawFramework
     # macaw.patch("/hello") do |context|
     #   return "Hello World!", 200, { "Content-Type" => "text/plain" }
     # end
-    def patch(path, cache: false, &block)
+    def patch(path, cache: [], &block)
       map_new_endpoint("patch", cache, path, &block)
     end
 
@@ -126,7 +112,7 @@ module MacawFramework
     # macaw.delete("/hello") do |context|
     #   return "Hello World!", 200, { "Content-Type" => "text/plain" }
     # end
-    def delete(path, cache: false, &block)
+    def delete(path, cache: [], &block)
       map_new_endpoint("delete", cache, path, &block)
     end
 
@@ -191,12 +177,36 @@ module MacawFramework
 
     private
 
+    def apply_options(custom_log)
+      @routes = []
+      @cached_methods = {}
+      @macaw_log ||= custom_log
+      @config = JSON.parse(File.read("application.json"))
+      @port = @config["macaw"]["port"] || 8080
+      @bind = @config["macaw"]["bind"] || "localhost"
+      @session = false
+      unless @config["macaw"]["session"].nil?
+        @session = true
+        @secure_header = @config["macaw"]["session"]["secure_header"] || "X-Session-ID"
+      end
+      @threads = @config["macaw"]["threads"] || 200
+      unless @config["macaw"]["cache"].nil?
+        @cache = MemoryInvalidationMiddleware.new(@config["macaw"]["cache"]["cache_invalidation"].to_i || 3_600)
+      end
+      @prometheus = Prometheus::Client::Registry.new if @config["macaw"]["prometheus"]
+      @prometheus_middleware = PrometheusMiddleware.new if @config["macaw"]["prometheus"]
+      @prometheus_middleware.configure_prometheus(@prometheus, @config, self) if @config["macaw"]["prometheus"]
+    rescue StandardError => e
+      @macaw_log&.warn(e.message)
+    end
+
     def server_loop(server)
       server.run
     end
 
     def map_new_endpoint(prefix, cache, path, &block)
-      @endpoints_to_cache << "#{prefix}.#{RequestDataFiltering.sanitize_method_name(path)}" if cache
+      @endpoints_to_cache << "#{prefix}.#{RequestDataFiltering.sanitize_method_name(path)}" unless cache.empty?
+      @cached_methods["#{prefix}.#{RequestDataFiltering.sanitize_method_name(path)}"] = cache unless cache.empty?
       path_clean = RequestDataFiltering.extract_path(path)
       slash = path[0] == "/" ? "" : "/"
       @macaw_log&.info("Defining #{prefix.upcase} endpoint at #{slash}#{path}")

data/sig/macaw_framework/macaw.rbs

@@ -2,6 +2,7 @@ module MacawFramework
   class Macaw
     @bind: String
     @cache: untyped
+    @cached_methods: Hash[String, Array[String]]
     @config: Hash[String, untyped]
     @cron_runner: CronRunner
     @endpoints_to_cache: Array[String]
@@ -9,8 +10,11 @@ module MacawFramework
 
     @prometheus: untyped
     @prometheus_middleware: untyped
+    @secure_header: String
     @server: untyped
 
+    @server_class: untyped
+    @session: bool
     @threads: Integer
 
     attr_accessor bind: String

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: macaw_framework
 version: !ruby/object:Gem::Version
-  version: 1.2.4
+  version: 1.2.6
 platform: ruby
 authors:
 - Aria Diniz
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-02-18 00:00:00.000000000 Z
+date: 2024-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prometheus-client