otto 2.4.0 → 2.6.0

data/lib/otto/security/middleware/csrf_middleware.rb

@@ -7,10 +7,18 @@ require_relative '../config'
 class Otto
   module Security
     module Middleware
-      # Middleware that provides Cross-Site Request Forgery (CSRF) protection
+      # Global middleware that injects CSRF tokens into HTML responses.
+      #
+      # Token *enforcement* deliberately does NOT live here. This middleware
+      # runs ahead of route matching, so it cannot see per-route options like
+      # +csrf=exempt+ (issue #186); enforcing globally would block routes an
+      # operator explicitly exempted. Enforcement is applied after matching by
+      # +Otto::Security::CSRFEnforcementWrapper+ at the handler layer, where the
+      # route definition is available. This middleware keeps only the
+      # response-shaping half — injecting a fresh token into HTML responses so
+      # forms and meta tags can carry it — which is method/content-type based
+      # and correctly stays global.
       class CSRFMiddleware
-        SAFE_METHODS = %w[GET HEAD OPTIONS TRACE].freeze
-
         def initialize(app, config = nil)
           @app    = app
           @config = config || Otto::Security::Config.new
@@ -19,60 +27,14 @@ class Otto
         def call(env)
           return @app.call(env) unless @config.csrf_enabled?
 
-          request = Otto::Request.new(env)
-
-          # Skip CSRF protection for safe methods
-          if safe_method?(request.request_method)
-            response = @app.call(env)
-            response = inject_csrf_token(request, response) if html_response?(response)
-            return response
-          end
-
-          # Validate CSRF token for unsafe methods
-          unless valid_csrf_token?(request)
-            # Log CSRF validation failure
-            Otto.structured_log(:warn, "CSRF validation failed",
-              Otto::LoggingHelpers.request_context(env).merge(
-                referrer: request.referrer
-              )
-            )
-            return csrf_error_response
-          end
-
-          @app.call(env)
+          request  = Otto::Request.new(env)
+          response = @app.call(env)
+          response = inject_csrf_token(request, response) if html_response?(response)
+          response
         end
 
         private
 
-        def safe_method?(method)
-          SAFE_METHODS.include?(method.upcase)
-        end
-
-        def valid_csrf_token?(request)
-          token = extract_csrf_token(request)
-          return false if token.nil? || token.empty?
-
-          session_id = @config.get_or_create_session_id(request)
-          @config.verify_csrf_token(token, session_id)
-        end
-
-        def extract_csrf_token(request)
-          # Try form parameter first
-          token = request.params[@config.csrf_token_key]
-
-          # Try header if not in params
-          token ||= request.env[@config.csrf_header_key]
-
-          # Try alternative header format
-          token ||= request.env['HTTP_X_CSRF_TOKEN'] if request.env['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest'
-
-          token
-        end
-
-        def extract_session_id(request)
-          @config.get_or_create_session_id(request)
-        end
-
         def inject_csrf_token(request, response)
           return response unless response.is_a?(Array) && response.length >= 3
 
@@ -138,24 +100,6 @@ class Otto
           content_type = headers.find { |k, _v| k.downcase == 'content-type' }&.last
           content_type&.include?('text/html')
         end
-
-        def csrf_error_response
-          [
-            403,
-            {
-              'content-type' => 'application/json',
-              'content-length' => csrf_error_body.bytesize.to_s,
-            },
-            [csrf_error_body],
-          ]
-        end
-
-        def csrf_error_body
-          {
-            error: 'CSRF token validation failed',
-            message: 'The request could not be authenticated. Please refresh the page and try again.',
-          }.to_json
-        end
       end
     end
   end

data/lib/otto/security/middleware/ip_privacy_middleware.rb

@@ -69,12 +69,6 @@ class Otto
 
         private
 
-        # Apply privacy settings to environment
-        #
-        # @param env [Hash] Rack environment
-        # Apply privacy settings to environment
-        #
-        # @param env [Hash] Rack environment
         # Apply privacy settings to environment
         #
         # @param env [Hash] Rack environment
@@ -116,6 +110,15 @@ class Otto
               # Canonical client IP downstream reads (exempt: not masked)
               env['otto.client_ip'] = client_ip
               # Don't mask forwarded headers for private IPs
+              #
+              # This early return also means NONE of the privacy fingerprint
+              # values are produced for exempt IPs — no otto.privacy.fingerprint,
+              # masked_ip, hashed_ip, geo_country, or correlation_hash. That is
+              # intentional and consistent: the correlation hash targets public
+              # audit-trail traffic, so req.ip_correlation_hash is nil for
+              # localhost / RFC-1918 addresses (the default dev path) even when a
+              # correlation_secret is configured. Set mask_private_ips to treat
+              # private IPs as public and run them through the full path below.
               Otto.logger.debug "[IPPrivacyMiddleware] Private/localhost IP exempted: #{client_ip}" if Otto.debug
               return
             end
@@ -134,6 +137,14 @@ class Otto
           env['otto.privacy.hashed_ip'] = fingerprint.hashed_ip
           env['otto.privacy.geo_country'] = fingerprint.country
 
+          # Fingerprint the FULL client IP here — while client_ip is still the
+          # real address, before REMOTE_ADDR is masked below — so it identifies
+          # the visitor, not just their /24. Uses the caller's stable secret
+          # (unlike hashed_ip's daily key), so the same IP matches across days.
+          # nil when no secret is set. The real IP is never written to env; only
+          # this hash leaves the middleware.
+          env['otto.privacy.correlation_hash'] = correlation_hash(client_ip)
+
           # CRITICAL: Replace REMOTE_ADDR and forwarded headers with masked values
           # This ensures downstream code (rate limiting, auth, logging, Rack's request.ip)
           # automatically uses the masked values without modification
@@ -158,6 +169,23 @@ class Otto
           # or env['otto.original_referer']. This prevents accidental leakage of the real values.
         end
 
+        # Fingerprint of the full client IP, keyed with the caller's stable
+        # correlation secret (not hashed_ip's daily-rotating key). The same IP
+        # and secret always produce the same value, so it can match a visitor
+        # across days — which the daily hash can't.
+        #
+        # Returns nil when no secret is configured. An empty key is never used
+        # to hash (that would let anyone reverse it); we return nil rather than
+        # raise, since "no secret" just means the feature is off.
+        #
+        # @param client_ip [String] Resolved full client IP (pre-masking)
+        # @return [String, nil] Hex HMAC-SHA256 digest, or nil when unconfigured
+        def correlation_hash(client_ip)
+          secret = @config.correlation_secret
+          return nil if secret.nil? || secret.empty?
+
+          Otto::Privacy::IPPrivacy.hash_ip(client_ip, secret)
+        end
 
         # Set or clear a Rack env header in a SPEC-compliant way.
         #

data/lib/otto/security.rb

@@ -9,6 +9,7 @@ require_relative 'security/authorization_error'
 require_relative 'security/config'
 require_relative 'security/configurator'
 require_relative 'security/middleware/csrf_middleware'
+require_relative 'security/csrf_enforcement_wrapper'
 require_relative 'security/middleware/validation_middleware'
 require_relative 'security/middleware/rate_limit_middleware'
 require_relative 'security/middleware/ip_privacy_middleware'

data/lib/otto/version.rb

@@ -3,5 +3,5 @@
 # frozen_string_literal: true
 
 class Otto
-  VERSION = '2.4.0'
+  VERSION = '2.6.0'
 end

data/lib/otto.rb

@@ -2,6 +2,7 @@
 #
 # frozen_string_literal: true
 
+require 'concurrent'
 require 'json'
 require 'logger'
 require 'securerandom'
@@ -75,7 +76,8 @@ class Otto
            end
   @logger = Logger.new($stdout, Logger::INFO)
 
-  attr_reader :routes, :routes_literal, :routes_static, :route_definitions, :option,
+  attr_reader :routes, :routes_literal, :routes_static, :route_definitions,
+              :routes_by_definition, :option,
               :static_route, :security_config, :locale_config, :auth_config,
               :route_handler_factory, :mcp_server, :caddy_tls_server, :security, :middleware,
               :error_handlers, :request_class, :response_class
@@ -107,6 +109,10 @@ class Otto
   end
   alias options option
 
+  # Read-only view of assembled instance options. LambdaHandler resolves its
+  # registry via otto_instance.config[:lambda_handlers].
+  alias config option
+
   # Main Rack application interface
   def call(env)
     # Freeze configuration on first request (thread-safe).
@@ -166,10 +172,24 @@ class Otto
   private
 
   def initialize_core_state
-    @routes_static     = { GET: {} }
+    # The GET cache is a Concurrent::Map, not a plain Hash: lazy static-file
+    # discovery (Core::Router#handle_request, Core::FileSafety#add_static_path)
+    # writes into it at request time, after freeze_configuration! has already
+    # deep-frozen the rest of the routing state. Deep-freezing this cache too
+    # would turn every as-yet-uncached static file request into a 500
+    # (FrozenError) in production (issue #185), so it is intentionally excluded
+    # from deep_freeze_value in Configuration#freeze_configuration! and kept as
+    # a structure that is both mutable post-freeze and safe under concurrent
+    # request threads.
+    @routes_static     = { GET: Concurrent::Map.new }
     @routes            = { GET: [] }
     @routes_literal    = { GET: {} }
     @route_definitions = {}
+    # All routes per definition string, in load order. A definition string is
+    # not unique — the same handler can be mounted at several verb/path pairs —
+    # so reverse lookups (Otto#uri) consult this index instead of the
+    # single-route @route_definitions entry (issue #190).
+    @routes_by_definition = {}
     @security_config   = Otto::Security::Config.new
     @middleware        = Otto::Core::MiddlewareStack.new
     # Initialize @auth_config first so it can be shared with the configurator
@@ -234,6 +254,10 @@ class Otto
 
     # Initialize MCP server
     configure_mcp(opts)
+
+    # Validate and freeze the lambda handler registry (issue #41).
+    # Runs last so misconfiguration fails fast at construction.
+    configure_lambda_handlers(opts)
   end
 
   class << self

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: otto
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.6.0
 platform: ruby
 authors:
 - Delano Mandelbaum
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-01 00:00:00.000000000 Z
+date: 2026-07-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -203,6 +203,10 @@ files:
 - examples/caddy_tls_demo/routes
 - examples/caddy_tls_demo/standalone.ru
 - examples/error_handler_registration.rb
+- examples/lambda_handlers/README.md
+- examples/lambda_handlers/config.ru
+- examples/lambda_handlers/handlers.rb
+- examples/lambda_handlers/routes
 - examples/logging_improvements.rb
 - examples/mcp_demo/README.md
 - examples/mcp_demo/app.rb
@@ -254,6 +258,7 @@ files:
 - lib/otto/privacy/geo_resolver.rb
 - lib/otto/privacy/ip_privacy.rb
 - lib/otto/privacy/redacted_fingerprint.rb
+- lib/otto/privacy/user_agent_privacy.rb
 - lib/otto/request.rb
 - lib/otto/response.rb
 - lib/otto/response_handlers.rb
@@ -294,10 +299,16 @@ files:
 - lib/otto/security/constant_resolver.rb
 - lib/otto/security/core.rb
 - lib/otto/security/csp.rb
+- lib/otto/security/csp/emit_middleware.rb
+- lib/otto/security/csp/nonce.rb
 - lib/otto/security/csp/parser.rb
+- lib/otto/security/csp/policy.rb
 - lib/otto/security/csp/report.rb
 - lib/otto/security/csp/report_middleware.rb
+- lib/otto/security/csp/writer.rb
 - lib/otto/security/csrf.rb
+- lib/otto/security/csrf_enforcement_wrapper.rb
+- lib/otto/security/csrf_validation.rb
 - lib/otto/security/middleware/csrf_middleware.rb
 - lib/otto/security/middleware/ip_privacy_middleware.rb
 - lib/otto/security/middleware/rate_limit_middleware.rb