otto 2.5.0 → 2.7.0

data/lib/otto/utils.rb

@@ -320,5 +320,105 @@ class Otto
     rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
       false
     end
+
+    # Whether an address falls inside any of the given CIDR ranges.
+    #
+    # The general-purpose CIDR-set matcher (allowlists, denylists, network
+    # zones), sharing the semantics of the trusted-proxy matcher: the client
+    # address is normalized (port stripped, validated) and folded via
+    # IPAddr#native so an IPv4-mapped IPv6 peer (::ffff:203.0.113.7) matches
+    # an IPv4 range; ranges of the other address family are skipped rather
+    # than raising.
+    #
+    # Ranges are folded through #native too, so the fold is symmetric: a
+    # mapped-IPv6 CIDR (::ffff:10.0.0.0/104) matches a plain IPv4 client just
+    # as a mapped client matches a plain IPv4 range. Folding only one side
+    # made the family check reject the pair and silently drop the entry —
+    # wrong verdict, not a raise. #native returns self for ranges that are
+    # not IPv4-mapped/compatible, so ordinary IPv4 and IPv6 CIDRs are
+    # untouched, and it returns a new IPAddr rather than mutating, so
+    # pre-parsed entries in a caller's configuration array stay intact.
+    #
+    # The fold needs the prefix to cover the mapped marker — /96 or longer.
+    # ::ffff:10.0.0.0/104 folds to 10.0.0.0/8; ::ffff:10.0.0.0/64 does not
+    # fold at all, because masking zeroes the ffff marker, and so matches
+    # neither an IPv4 client nor a mapped one. Write mapped ranges at /96+,
+    # or just write the IPv4 CIDR. ::ffff:0:0/96 is the whole mapped space
+    # and therefore matches every IPv4 address. Deprecated IPv4-compatible
+    # notation (::a.b.c.d) folds on the same terms, on both sides.
+    #
+    # Asymmetric strictness, on purpose:
+    # - `ip` is runtime data — nil, blank, or malformed input returns false
+    #   (fail-closed for allowlist callers).
+    # - `cidrs` entries are configuration — an invalid CIDR string raises
+    #   IPAddr::InvalidAddressError, because silently skipping an entry
+    #   narrows an allowlist or widens a denylist. Validate entries at
+    #   write/boot time; pre-parsed IPAddr entries skip re-parsing here.
+    #
+    # @param ip [String, IPAddr, nil] address to test (runtime data)
+    # @param cidrs [Enumerable<String, IPAddr>, nil] CIDR ranges or host
+    #   addresses (configuration)
+    # @return [Boolean] true when ip is inside at least one range
+    # @raise [IPAddr::InvalidAddressError] if a cidrs entry is not a valid
+    #   IP or CIDR string
+    def ip_in_cidrs?(ip, cidrs)
+      return false if cidrs.nil?
+
+      client =
+        if ip.is_a?(IPAddr)
+          ip.native
+        else
+          candidate = normalize_ip(ip&.to_s)
+          return false unless candidate
+
+          IPAddr.new(candidate).native
+        end
+
+      cidrs.any? do |entry|
+        range = entry.is_a?(IPAddr) ? entry : IPAddr.new(entry.to_s)
+        # IPAddr#native builds its result with #clone, which carries frozen
+        # state over and then fails to mutate it. Callers who freeze their
+        # range configuration (or pass it through Ractor.make_shareable) would
+        # hit FrozenError, so hand #native an unfrozen receiver. Gating the dup
+        # on a foldable-range predicate would cost more than it saves:
+        # #ipv4_compat? is deprecated and warns under -w, and #native already
+        # short-circuits to self for anything that does not fold.
+        range = range.dup if range.frozen?
+        range = range.native
+        range.family == client.family && range.include?(client)
+      end
+    end
+
+    # Whether an address is on the loopback interface.
+    #
+    # This is the RAW SOCKET PEER test used to authenticate a direct local call
+    # (Otto::CaddyTLS::LocalhostGuard) — and, because IPPrivacyMiddleware now
+    # runs outermost and rewrites REMOTE_ADDR, the same test IPPrivacyMiddleware
+    # applies to the original peer and records as the leak-free boolean
+    # env['otto.peer_loopback']. Shared here so the pre-masking record and the
+    # guard's own fallback cannot drift.
+    #
+    # Fails closed: a blank or unparseable value is non-loopback rather than
+    # raising on the hot path.
+    #
+    # #native folds IPv4-mapped IPv6 (::ffff:127.0.0.1, which dual-stack servers
+    # commonly present) so it is recognized as loopback; plain IPAddr#loopback?
+    # returns false for the mapped form.
+    #
+    # Deliberately does NOT strip a ':port' suffix (unlike #private_ip?): a
+    # conforming Rack server reports the peer port in REMOTE_PORT, so an
+    # unexpected format means something upstream is non-standard and denying is
+    # safer than coercing.
+    #
+    # @param address [String, nil] raw socket peer address
+    # @return [Boolean]
+    def loopback_address?(address)
+      addr = address.to_s.strip
+      return false if addr.empty?
+
+      IPAddr.new(addr).native.loopback?
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+      false
+    end
   end
 end

data/lib/otto/version.rb

@@ -3,5 +3,5 @@
 # frozen_string_literal: true
 
 class Otto
-  VERSION = '2.5.0'
+  VERSION = '2.7.0'
 end

data/lib/otto.rb

@@ -2,6 +2,7 @@
 #
 # frozen_string_literal: true
 
+require 'concurrent'
 require 'json'
 require 'logger'
 require 'securerandom'
@@ -75,7 +76,8 @@ class Otto
            end
   @logger = Logger.new($stdout, Logger::INFO)
 
-  attr_reader :routes, :routes_literal, :routes_static, :route_definitions, :option,
+  attr_reader :routes, :routes_literal, :routes_static, :route_definitions,
+              :routes_by_definition, :option,
               :static_route, :security_config, :locale_config, :auth_config,
               :route_handler_factory, :mcp_server, :caddy_tls_server, :security, :middleware,
               :error_handlers, :request_class, :response_class
@@ -107,6 +109,10 @@ class Otto
   end
   alias options option
 
+  # Read-only view of assembled instance options. LambdaHandler resolves its
+  # registry via otto_instance.config[:lambda_handlers].
+  alias config option
+
   # Main Rack application interface
   def call(env)
     # Freeze configuration on first request (thread-safe).
@@ -166,10 +172,24 @@ class Otto
   private
 
   def initialize_core_state
-    @routes_static     = { GET: {} }
+    # The GET cache is a Concurrent::Map, not a plain Hash: lazy static-file
+    # discovery (Core::Router#handle_request, Core::FileSafety#add_static_path)
+    # writes into it at request time, after freeze_configuration! has already
+    # deep-frozen the rest of the routing state. Deep-freezing this cache too
+    # would turn every as-yet-uncached static file request into a 500
+    # (FrozenError) in production (issue #185), so it is intentionally excluded
+    # from deep_freeze_value in Configuration#freeze_configuration! and kept as
+    # a structure that is both mutable post-freeze and safe under concurrent
+    # request threads.
+    @routes_static     = { GET: Concurrent::Map.new }
     @routes            = { GET: [] }
     @routes_literal    = { GET: {} }
     @route_definitions = {}
+    # All routes per definition string, in load order. A definition string is
+    # not unique — the same handler can be mounted at several verb/path pairs —
+    # so reverse lookups (Otto#uri) consult this index instead of the
+    # single-route @route_definitions entry (issue #190).
+    @routes_by_definition = {}
     @security_config   = Otto::Security::Config.new
     @middleware        = Otto::Core::MiddlewareStack.new
     # Initialize @auth_config first so it can be shared with the configurator
@@ -206,11 +226,19 @@ class Otto
     # before first request (before configuration freezing)
     finalize_request_response_classes
 
-    # Add IP Privacy middleware first in stack (privacy by default for public IPs)
-    # Private/localhost IPs are automatically exempted from masking
+    # IP Privacy is the ENTRY POINT of the stack: the first middleware to touch
+    # a request, so everything else — Otto's own middleware, an :outermost pin,
+    # and anything the app adds via Otto#use — observes the masked REMOTE_ADDR
+    # and the canonical env['otto.client_ip'] (privacy by default for public
+    # IPs; private/localhost IPs are automatically exempted from masking).
+    #
+    # NOT position: :first, which is first-in-ARRAY and therefore INNERMOST —
+    # it put IP masking closest to the app and left every other middleware
+    # reading the raw peer address (issue #219). See
+    # MiddlewareStack#add_with_position for the full position vocabulary.
     @middleware.add_with_position(
       Otto::Security::Middleware::IPPrivacyMiddleware,
-      position: :first
+      position: :entrypoint
     )
   end
 
@@ -234,6 +262,10 @@ class Otto
 
     # Initialize MCP server
     configure_mcp(opts)
+
+    # Validate and freeze the lambda handler registry (issue #41).
+    # Runs last so misconfiguration fails fast at construction.
+    configure_lambda_handlers(opts)
   end
 
   class << self

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: otto
 version: !ruby/object:Gem::Version
-  version: 2.5.0
+  version: 2.7.0
 platform: ruby
 authors:
 - Delano Mandelbaum
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-03 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -144,6 +143,9 @@ files:
 - changelog.d/README.md
 - changelog.d/scriv.ini
 - docs/.gitignore
+- docs/1108-STREAMING_ARCHITECTURE_ANALYSIS.md
+- docs/1108-STREAMING_SUPPORT_SUMMARY.md
+- docs/geo-country.md
 - docs/ipaddr-encoding-quirk.md
 - docs/migrating/v2.0.0-pre1.md
 - docs/migrating/v2.0.0-pre2.md
@@ -203,6 +205,10 @@ files:
 - examples/caddy_tls_demo/routes
 - examples/caddy_tls_demo/standalone.ru
 - examples/error_handler_registration.rb
+- examples/lambda_handlers/README.md
+- examples/lambda_handlers/config.ru
+- examples/lambda_handlers/handlers.rb
+- examples/lambda_handlers/routes
 - examples/logging_improvements.rb
 - examples/mcp_demo/README.md
 - examples/mcp_demo/app.rb
@@ -254,6 +260,7 @@ files:
 - lib/otto/privacy/geo_resolver.rb
 - lib/otto/privacy/ip_privacy.rb
 - lib/otto/privacy/redacted_fingerprint.rb
+- lib/otto/privacy/user_agent_privacy.rb
 - lib/otto/request.rb
 - lib/otto/response.rb
 - lib/otto/response_handlers.rb
@@ -302,6 +309,8 @@ files:
 - lib/otto/security/csp/report_middleware.rb
 - lib/otto/security/csp/writer.rb
 - lib/otto/security/csrf.rb
+- lib/otto/security/csrf_enforcement_wrapper.rb
+- lib/otto/security/csrf_validation.rb
 - lib/otto/security/middleware/csrf_middleware.rb
 - lib/otto/security/middleware/ip_privacy_middleware.rb
 - lib/otto/security/middleware/rate_limit_middleware.rb
@@ -320,7 +329,6 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -338,8 +346,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Define your rack-apps in plaintext.
 test_files: []