machina-auth 1.0.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ef95dc9a17c0abc2f72fd81cc6bc78ca5baea5a058fb8800087c0ab1753fa8f
-  data.tar.gz: 85e89ffab0def4950f3da9ad9513d0cca3475cd222af0cd7fa12f9c56a8e18f7
+  metadata.gz: dc18de6ee1048be86f05320f0a2864092dce1b886689a98e042bb4b68385649f
+  data.tar.gz: 0657bf99e18fe6418ee481e3234ffe3a0dc5ae27fe9aab6dfff6363b7e682c56
 SHA512:
-  metadata.gz: b58c5c91d1ca06f6d5d050f79e200c3c012473d262a2a5231c8cc3b3a2dc0c799b1f163dffb4963e243bfe2c8d5d915e87ac74db516a4f1f493cdb34c55510a4
-  data.tar.gz: 2e8113a5ccfef4f7a6c07bba04127e746256da82ba8f0d79d7529625e5cb92acf2ac621beffacf80f552923e1b7858aae65f4de243d67f1d0775dbc01e43710a
+  metadata.gz: 6fb9094979c7931d23102d76f4a4da200943ac503c36ba165ee9bd20fa605a737a16cbada861890e1529434972fbf8c64f3f222cf85389bae462276f2387e734
+  data.tar.gz: 061dc831c51829d43b2e9a7f1f91a22b8ff41eade182ffb25ac2f53c0b8958c4a1189003e15403130d27b1808f63305835da2ac2330623b3c38527397617c070

data/README.md

@@ -11,7 +11,7 @@ Rails engine that integrates product apps with the Machina Console identity serv
 - **`Machina::ControllerHelpers`** — `require_authorized!` and `authorize!` for controllers
 - **`Machina::WorkspaceScoped`** — concern that filters ActiveRecord queries to the current workspace
 - **Webhook receiver** — verifies HMAC signatures and invalidates cached sessions on permission/membership changes
-- **Permission sync** — pushes a YAML manifest of permissions and policies to the Console on boot
+- **Permission sync** — pushes a YAML manifest of permissions and policies to the Console on boot (production servers/workers only by default — never under rake or `rails console`; see `sync_on_boot`) or via `rake machina:sync_permissions`
 
 ## Installation
 
@@ -35,6 +35,7 @@ Machina.configure do |config|
   config.service_token = ENV["MACHINA_SERVICE_TOKEN"]
   config.product_slug = "my-app"
   config.manifest = Rails.root.join("config/machina.yml")
+  config.sync_on_boot = Rails.env.production? # the default; sync the manifest in a background thread on boot
 end
 ```
 

data/app/controllers/machina/callbacks_controller.rb

@@ -6,11 +6,17 @@ module Machina
   # echoed back or the token is rejected (login-CSRF / session fixation).
   # The engine has no ApplicationController; Base is required for cookies.
   class CallbacksController < ActionController::Base # rubocop:disable Rails/ApplicationController
+    include Machina::ControllerHelpers
+
+    # Duplicate callbacks from the same browser (a double-submitted Console
+    # picker) arrive within seconds; the state stays valid this long after use.
+    STATE_GRACE_PERIOD = 1.minute
+
     def show
       return reject('missing token') if params[:token].blank?
-      return reject('state mismatch') unless valid_state?
+      return restart_handshake('state mismatch') unless valid_state?
 
-      cookies.delete(:machina_state)
+      extend_state_cookie
       reset_session
       store_session_cookie
       redirect_to safe_return_to
@@ -30,6 +36,23 @@ module Machina
       render plain: 'Invalid authentication callback', status: :unprocessable_content
     end
 
+    # A stale, overwritten or missing state proves nothing either way, so
+    # re-run the handshake with a fresh nonce instead of dead-ending.
+    def restart_handshake(reason)
+      Rails.logger.warn("[machina] Auth callback rejected: #{reason}; restarting handshake")
+      redirect_to Machina.authorize_url(return_to: safe_return_to, state: issue_state), allow_other_host: true
+    end
+
+    def extend_state_cookie
+      cookies.signed[:machina_state] = {
+        value: cookies.signed[:machina_state],
+        httponly: true,
+        same_site: :lax,
+        secure: Machina.secure_cookies?,
+        expires: STATE_GRACE_PERIOD
+      }
+    end
+
     def store_session_cookie
       cookies[:machina_session] = {
         value: params[:token],

data/lib/generators/machina/templates/machina.rb.tt

@@ -6,4 +6,6 @@ Machina.configure do |config|
   config.cache_store = Rails.cache
   config.cache_ttl = 5.minutes
   config.manifest = Rails.root.join("config/machina.yml")
+  # Sync the manifest to the Console on boot (default: production only).
+  # config.sync_on_boot = Rails.env.production?
 end

data/lib/machina/configuration.rb

@@ -15,10 +15,17 @@ module Machina
                   :skip_paths,
                   :identity_callback_uri
 
+    attr_writer :sync_on_boot
+
     def initialize
       @cache_ttl = 5.minutes
       @negative_cache_ttl = 30.seconds
       @skip_paths = []
     end
+
+    # Resolved on read so Rails.env reflects the booted app, not gem load time.
+    def sync_on_boot
+      @sync_on_boot.nil? ? Rails.env.production? : @sync_on_boot
+    end
   end
 end

data/lib/machina/controller_helpers.rb

@@ -40,7 +40,7 @@ module Machina
       if token.present?
         Machina.cache.delete("machina:session:#{token}")
         begin
-          Machina.identity_client.revoke_session(token)
+          Machina.identity_client.revoke_session(token) if Machina::IdentityClient.console_token?(token)
         rescue StandardError
           # Best-effort: local logout succeeds even if Console is unreachable
         end
@@ -50,7 +50,7 @@ module Machina
 
     private
 
-    # Mints the single-use CSRF state for the auth handshake. The value rides
+    # Mints the CSRF state for the auth handshake. The value rides
     # on the callback URL through Console; the callback rejects a redirect
     # whose state does not match this cookie.
     def issue_state

data/lib/machina/engine.rb

@@ -16,18 +16,29 @@ module Machina
       end
     end
 
-    # Sync the permission manifest to the Console on boot when configured.
+    # Sync the permission manifest to the Console on boot when enabled.
     # Runs in a background thread so it doesn't block server startup.
-    # Skipped when manifest is not set.
-    config.after_initialize do
-      next if Machina.config.manifest.blank?
+    config.after_initialize { Machina::Engine.sync_permissions_on_boot }
+
+    def self.sync_permissions_on_boot
+      return unless Machina.config.sync_on_boot && Machina.config.manifest.present?
+      return if rake_or_console?
 
       Thread.new do
-        Machina::PermissionSync.call!
-        Rails.logger.info('[machina] Permission manifest synced to Console')
+        response = Machina::PermissionSync.call!
+        if response.success?
+          Rails.logger.info('[machina] Permission manifest synced to Console')
+        else
+          Rails.logger.warn("[machina] Permission sync failed on boot: #{Machina::PermissionSync.failure_summary(response)}")
+        end
       rescue StandardError => e
-        Rails.logger.warn("[machina] Permission sync failed on boot: #{e.message}")
+        Rails.logger.warn("[machina] Permission sync failed on boot: #{e.class}: #{e.message}")
       end
     end
+
+    # Rake tasks (incl. machina:sync_permissions) and consoles boot the app too; only servers/workers sync.
+    def self.rake_or_console?
+      defined?(Rails::Console) || (defined?(Rake.application) && Rake.application.top_level_tasks.any?)
+    end
   end
 end

data/lib/machina/identity_client.rb

@@ -4,6 +4,9 @@ module Machina
   # HTTP client for communicating with the Machina Console identity service.
   # Handles session resolution, revocation, and permission syncing.
   class IdentityClient
+    # Session tokens (ps_) and API keys (mk_); the Console resolves nothing else.
+    TOKEN_PREFIXES = %w[ps_ mk_].freeze
+
     Response = Struct.new(:status, :body) do
       def success?
         status.between?(200, 299)
@@ -14,12 +17,16 @@ module Machina
       end
     end
 
+    def self.console_token?(token)
+      token.start_with?(*TOKEN_PREFIXES)
+    end
+
     def initialize(config: Machina.config, connection: nil)
       @config = config
       @connection = connection
     end
 
-    # @param token [String] raw session token (ps_) or API key (mk_)
+    # @param token [String] raw session token (ps_) or API key (mk_), see TOKEN_PREFIXES
     # @param workspace_id [String, nil] optional workspace UUID hint for org-scoped API keys
     # @param workspace_slug [String, nil] optional workspace slug hint (alternative to id)
     # @param organization_slug [String, nil] optional organization slug; identity service

data/lib/machina/middleware/authentication.rb

@@ -33,7 +33,8 @@ module Machina
       private
 
       def dispatch_session(env, request, token, hints)
-        session_data = resolve_session(token, hints)
+        # A foreign token would only 404; leave it nil (rejected) without a Console call.
+        session_data = resolve_session(token, hints) if Machina::IdentityClient.console_token?(token)
 
         if session_data.is_a?(Hash)
           Machina::Current.authorized = Machina::Authorized.new(session_data)

data/lib/machina/permission_sync.rb

@@ -11,6 +11,10 @@ module Machina
       new.call!
     end
 
+    def self.failure_summary(response)
+      "HTTP #{response.status}: #{response.body.to_s.truncate(200)}"
+    end
+
     def call!
       manifest = load_manifest
 

data/lib/machina/tasks/sync.rake

@@ -3,7 +3,9 @@
 namespace :machina do
   desc 'Sync permission manifest to Console'
   task sync_permissions: :environment do
-    Machina::PermissionSync.call!
+    response = Machina::PermissionSync.call!
+    abort "Permission sync failed: #{Machina::PermissionSync.failure_summary(response)}" unless response.success?
+
     puts 'Permissions synced successfully.'
   end
 end

data/lib/machina/test_helpers.rb

@@ -51,8 +51,7 @@ module Machina
     #
     # @return [Machina::Authorized]
     #
-    # rubocop:disable Metrics/AbcSize, Metrics/ParameterLists
-    def sign_in_as_machina(
+    def sign_in_as_machina( # rubocop:disable Metrics/AbcSize, Metrics/ParameterLists
       tenant_ref = nil,
       user: {},
       organization: {},
@@ -72,8 +71,7 @@ module Machina
       authorized = Machina::Authorized.new(data)
       Machina::Current.authorized = authorized
       authorized
-    end
-    # rubocop:enable Metrics/AbcSize, Metrics/ParameterLists
+    end # rubocop:enable Metrics/AbcSize, Metrics/ParameterLists
 
     # Clears the current authenticated context.
     def sign_out_machina

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '1.0.2'
+  VERSION = '1.2.0'
 end

data/spec/machina/configuration_spec.rb

@@ -18,4 +18,22 @@ RSpec.describe Machina::Configuration do
     config.identity_callback_uri = 'http://localhost:3000/auth/machina/callback'
     expect(config.identity_callback_uri).to eq('http://localhost:3000/auth/machina/callback')
   end
+
+  it 'defaults sync_on_boot to false outside production' do
+    expect(described_class.new.sync_on_boot).to be(false)
+  end
+
+  it 'defaults sync_on_boot to true in production' do
+    allow(Rails).to receive(:env).and_return(ActiveSupport::EnvironmentInquirer.new('production'))
+
+    expect(described_class.new.sync_on_boot).to be(true)
+  end
+
+  it 'lets sync_on_boot be overridden' do
+    config = described_class.new
+    config.sync_on_boot = false
+    allow(Rails).to receive(:env).and_return(ActiveSupport::EnvironmentInquirer.new('production'))
+
+    expect(config.sync_on_boot).to be(false)
+  end
 end

data/spec/machina/controller_helpers_spec.rb

@@ -111,6 +111,25 @@ RSpec.describe Machina::ControllerHelpers, type: :controller do
       expect(response.cookies['machina_session']).to be_nil
     end
 
+    it 'does not send a non-Console bearer token to the identity service' do
+      request.cookies.delete(:machina_session)
+      request.headers['Authorization'] = 'Bearer eyJhbGciOiJIUzI1NiJ9.e30.sig'
+
+      delete :destroy
+
+      expect(response).to have_http_status(:ok)
+      expect(identity_client).not_to have_received(:revoke_session)
+    end
+
+    it 'revokes a Console bearer token' do
+      request.cookies.delete(:machina_session)
+      request.headers['Authorization'] = 'Bearer ps_bearer_token'
+
+      delete :destroy
+
+      expect(identity_client).to have_received(:revoke_session).with('ps_bearer_token')
+    end
+
     it 'handles missing token gracefully' do
       request.cookies.delete(:machina_session)
 

data/spec/machina/engine_spec.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require_relative '../rails_helper'
+require 'rake'
+
+RSpec.describe Machina::Engine do
+  describe '.sync_permissions_on_boot' do
+    let(:response) { Machina::IdentityClient::Response.new(status: 200, body: '{}') }
+
+    before do
+      allow(Machina::PermissionSync).to receive(:call!) { response }
+      allow(Rails.logger).to receive(:info)
+      allow(Rails.logger).to receive(:warn)
+    end
+
+    it 'syncs the manifest when sync_on_boot is true' do
+      Machina.config.sync_on_boot = true
+
+      described_class.sync_permissions_on_boot.join
+
+      expect(Machina::PermissionSync).to have_received(:call!)
+      expect(Rails.logger).to have_received(:info).with('[machina] Permission manifest synced to Console')
+    end
+
+    it 'skips the sync when sync_on_boot is false' do
+      Machina.config.sync_on_boot = false
+
+      expect(described_class.sync_permissions_on_boot).to be_nil
+      expect(Machina::PermissionSync).not_to have_received(:call!)
+    end
+
+    it 'skips the sync when no manifest is configured' do
+      Machina.config.sync_on_boot = true
+      Machina.config.manifest = nil
+
+      expect(described_class.sync_permissions_on_boot).to be_nil
+      expect(Machina::PermissionSync).not_to have_received(:call!)
+    end
+
+    it 'skips the sync when booted by a rake task' do
+      Machina.config.sync_on_boot = true
+      allow(Rake.application).to receive(:top_level_tasks).and_return(['machina:sync_permissions'])
+
+      expect(described_class.sync_permissions_on_boot).to be_nil
+      expect(Machina::PermissionSync).not_to have_received(:call!)
+    end
+
+    it 'skips the sync when booted by a Rails console' do
+      Machina.config.sync_on_boot = true
+      stub_const('Rails::Console', Class.new)
+
+      expect(described_class.sync_permissions_on_boot).to be_nil
+      expect(Machina::PermissionSync).not_to have_received(:call!)
+    end
+
+    context 'when the Console rejects the sync' do
+      let(:response) { Machina::IdentityClient::Response.new(status: 422, body: '{"error":"invalid manifest"}') }
+
+      it 'logs a failure with the status and body, not success' do
+        Machina.config.sync_on_boot = true
+
+        described_class.sync_permissions_on_boot.join
+
+        expect(Rails.logger).to have_received(:warn)
+          .with('[machina] Permission sync failed on boot: HTTP 422: {"error":"invalid manifest"}')
+        expect(Rails.logger).not_to have_received(:info)
+      end
+    end
+
+    it 'logs the exception class when the sync raises' do
+      Machina.config.sync_on_boot = true
+      allow(Machina::PermissionSync).to receive(:call!).and_raise(Faraday::ConnectionFailed, 'refused')
+
+      described_class.sync_permissions_on_boot.join
+
+      expect(Rails.logger).to have_received(:warn)
+        .with('[machina] Permission sync failed on boot: Faraday::ConnectionFailed: refused')
+    end
+  end
+end

data/spec/machina/identity_client_spec.rb

@@ -82,6 +82,18 @@ RSpec.describe Machina::IdentityClient do
     expect(response.parsed.dig('data', 'session_id')).to eq('d4e5f6a7-b8c9-0123-def0-1234567890ab')
   end
 
+  describe '.console_token?' do
+    it 'accepts session tokens and API keys' do
+      expect(described_class.console_token?('ps_123')).to be(true)
+      expect(described_class.console_token?('mk_123')).to be(true)
+    end
+
+    it 'rejects any other token' do
+      expect(described_class.console_token?('eyJhbGciOiJIUzI1NiJ9.e30.sig')).to be(false)
+      expect(described_class.console_token?('PS_123')).to be(false)
+    end
+  end
+
   it 'raises when required configuration is missing' do
     Machina.configure do |config|
       config.identity_service_url = nil

data/spec/machina/middleware/authentication_spec.rb

@@ -154,6 +154,56 @@ RSpec.describe Machina::Middleware::Authentication do
     expect(JSON.parse(body.first)).to eq('user_id' => nil, 'permissions' => nil)
   end
 
+  describe 'tokens without a Console prefix' do
+    before { allow(identity_client).to receive(:resolve_session) }
+
+    it 'passes through unauthenticated without calling the identity service' do
+      env = Rack::MockRequest.env_for('/resource', 'HTTP_AUTHORIZATION' => 'Bearer eyJhbGciOiJIUzI1NiJ9.e30.sig')
+      status, _headers, body = middleware.call(env)
+
+      expect(status).to eq(200)
+      expect(JSON.parse(body.first)).to eq('user_id' => nil, 'permissions' => nil)
+      expect(identity_client).not_to have_received(:resolve_session)
+      expect(Machina.cache.read('machina:session:eyJhbGciOiJIUzI1NiJ9.e30.sig')).to be_nil
+    end
+
+    it 'deletes a cookie-sourced token like a Console rejection' do
+      env = Rack::MockRequest.env_for('/resource', 'HTTP_COOKIE' => 'machina_session=legacy_token')
+      _status, headers, _body = middleware.call(env)
+
+      expect(identity_client).not_to have_received(:resolve_session)
+      expect(headers['set-cookie']).to include('max-age=0')
+    end
+
+    it 'skips a non-prefixed X-Api-Key without caching it' do
+      env = Rack::MockRequest.env_for('/resource', 'HTTP_X_API_KEY' => 'sk_live_foreign')
+      _status, _headers, body = middleware.call(env)
+
+      expect(JSON.parse(body.first)['user_id']).to be_nil
+      expect(identity_client).not_to have_received(:resolve_session)
+      expect(Machina.cache.read('machina:session:sk_live_foreign')).to be_nil
+    end
+
+    it 'writes no negative cache entry for a non-prefixed cookie' do
+      env = Rack::MockRequest.env_for('/resource', 'HTTP_COOKIE' => 'machina_session=legacy_token')
+      middleware.call(env)
+
+      expect(Machina.cache.exist?('machina:session:legacy_token')).to be(false)
+    end
+
+    it 'still resolves an mk_ API key sent via X-Api-Key' do
+      allow(identity_client).to receive(:resolve_session).with('mk_abc').and_return(
+        Machina::IdentityClient::Response.new(status: 200, body: MockResponses.session_resolution_minimal),
+      )
+
+      env = Rack::MockRequest.env_for('/resource', 'HTTP_X_API_KEY' => 'mk_abc')
+      _status, _headers, body = middleware.call(env)
+
+      expect(identity_client).to have_received(:resolve_session).with('mk_abc').once
+      expect(JSON.parse(body.first)['user_id']).to be_present
+    end
+  end
+
   it 'negative-caches the rejection and passes through when Console returns non-200 on stale re-fetch' do
     token = 'ps_stale_token'
     cache_key = "machina:session:#{token}"

data/spec/machina/sync_task_spec.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative '../rails_helper'
+require 'rake'
+
+RSpec.describe 'machina:sync_permissions' do
+  let(:task) do
+    Rake::Task.define_task(:environment)
+    unless Rake::Task.task_defined?('machina:sync_permissions')
+      load File.expand_path('../../lib/machina/tasks/sync.rake', __dir__)
+    end
+    Rake::Task['machina:sync_permissions']
+  end
+
+  after { task.reenable }
+
+  it 'reports success on a 2xx response' do
+    allow(Machina::PermissionSync).to receive(:call!)
+      .and_return(Machina::IdentityClient::Response.new(status: 200, body: '{}'))
+
+    expect { task.invoke }.to output("Permissions synced successfully.\n").to_stdout
+  end
+
+  it 'exits non-zero with the status on a non-2xx response' do
+    allow(Machina::PermissionSync).to receive(:call!)
+      .and_return(Machina::IdentityClient::Response.new(status: 500, body: 'boom'))
+
+    expect { task.invoke }
+      .to raise_error(SystemExit) { |e| expect(e.status).to eq(1) }
+      .and output("Permission sync failed: HTTP 500: boom\n").to_stderr
+  end
+end

data/spec/requests/machina/callbacks_spec.rb

@@ -29,10 +29,21 @@ RSpec.describe Machina::CallbacksController, type: :controller do
       expect(set_cookie).to match(/machina_session=.*httponly/i)
     end
 
-    it 'clears the state cookie' do
+    it 'keeps the state cookie so a duplicate callback still succeeds' do
       get :show, params: { token:, state: }
 
-      expect(response.cookies).to include('machina_state' => nil)
+      expect(response.cookies['machina_state']).to be_present
+    end
+
+    it 'accepts a repeated callback and stores the newest token' do
+      get :show, params: { token: 'ps_first', state: }
+      request.cookies['machina_state'] = response.cookies['machina_state']
+      request.cookies['machina_session'] = 'ps_first'
+
+      get :show, params: { token: 'ps_second', state:, return_to: '/dashboard' }
+
+      expect(response).to redirect_to('/dashboard')
+      expect(response.cookies['machina_session']).to eq('ps_second')
     end
 
     it 'resets the session on credential swap' do
@@ -77,38 +88,54 @@ RSpec.describe Machina::CallbacksController, type: :controller do
   end
 
   describe 'with an invalid state' do
-    it 'rejects a mismatched state' do
-      sign_state_cookie(state)
+    before { Machina.config.identity_callback_uri = 'http://localhost:3000/machina/callback' }
+
+    shared_examples 'restarts the handshake' do
+      it 'redirects to Console with a fresh state and no session cookie' do
+        expect(response).to redirect_to(%r{\Ahttps://machina\.example\.test/authorize\?redirect_to=})
+        expect(CGI.unescape(response.location)).to include('return_to=%2Fdashboard', 'state=')
+        expect(response.cookies['machina_state']).to be_present
+        expect(response.cookies['machina_session']).to be_nil
+      end
+    end
 
-      get :show, params: { token:, state: 'forged' }
+    context 'with a mismatched state' do
+      before do
+        sign_state_cookie(state)
+        get :show, params: { token:, state: 'forged', return_to: '/dashboard' }
+      end
 
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      include_examples 'restarts the handshake'
     end
 
-    it 'rejects a missing state param' do
-      sign_state_cookie(state)
+    context 'with a missing state param' do
+      before do
+        sign_state_cookie(state)
+        get :show, params: { token:, return_to: '/dashboard' }
+      end
 
-      get :show, params: { token: }
-
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      include_examples 'restarts the handshake'
     end
 
-    it 'rejects when no state cookie was issued' do
-      get :show, params: { token:, state: }
+    context 'when no state cookie was issued' do
+      before { get :show, params: { token:, state:, return_to: '/dashboard' } }
 
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      include_examples 'restarts the handshake'
     end
 
-    it 'rejects a tampered (unsigned) state cookie' do
-      request.cookies['machina_state'] = state
+    context 'with a tampered (unsigned) state cookie' do
+      before do
+        request.cookies['machina_state'] = state
+        get :show, params: { token:, state:, return_to: '/dashboard' }
+      end
 
-      get :show, params: { token:, state: }
+      include_examples 'restarts the handshake'
+    end
+
+    it 'does not reflect an unsafe return_to into the restarted handshake' do
+      get :show, params: { token:, state:, return_to: '//evil.example.com/' }
 
-      expect(response).to have_http_status(:unprocessable_content)
-      expect(response.cookies['machina_session']).to be_nil
+      expect(CGI.unescape(response.location)).to include('return_to=%2F&').or include('return_to=%2F"')
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.2.0
 platform: ruby
 authors:
 - ZAR
@@ -181,10 +181,12 @@ files:
 - spec/machina/configuration_spec.rb
 - spec/machina/controller_helpers_spec.rb
 - spec/machina/current_spec.rb
+- spec/machina/engine_spec.rb
 - spec/machina/identity_client_spec.rb
 - spec/machina/middleware/authentication_spec.rb
 - spec/machina/middleware/skip_paths_spec.rb
 - spec/machina/permission_sync_spec.rb
+- spec/machina/sync_task_spec.rb
 - spec/machina/test_helpers_spec.rb
 - spec/machina/webhook_receiver_spec.rb
 - spec/machina/workspace_scoped_spec.rb