rack-forward-auth 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 9b6993db0bada29f5dc632c204127b2c0d1e67d6ad3c6527fc009ff511a78cc5
+  data.tar.gz: 6c32e2a9ff3a086ec54e7d2cbaf4fb8f8bd70a90884303c4e72b368188cab096
+SHA512:
+  metadata.gz: 43675eed58c75857f7f7f65e0817c5c1438218f11465c3b0e68b24f8d30ecd02e97cbf72487d6f4a9d9b47cd9c39ccdb1b2314f993ee4a07071023b142682481
+  data.tar.gz: 609bafb9ec9f80ca256227dff0de937b44189ac617fa147854b86e6d6e91c9ad45df2d67eefaf4d5c85c1053f2fc05f7ca7fc820b432d7cd02c307632614654c

data/Rakefile

@@ -0,0 +1,11 @@
+require "bundler/setup"
+require "bundler/gem_tasks"
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << "test"
+  t.pattern = "test/**/*_test.rb"
+  t.verbose = false
+end
+
+task default: :test

data/lib/rack/forward_auth/middleware.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Rack
+  module ForwardAuth
+    # Production middleware that reads forward-auth headers set by a reverse
+    # proxy (Authelia, Authentik, Caddy, Traefik, etc.) and exposes parsed
+    # user attributes in the Rack env.
+    #
+    # By default, attributes are stored in env["forward_auth.user"] as a Hash:
+    #
+    #   { uid: "nathan", email: "nathan@example.com",
+    #     display_name: "Nathan", groups: ["admin", "users"] }
+    #
+    # You can provide an optional +on_user+ callback (proc/lambda) that
+    # receives the attributes hash and returns whatever object you want
+    # stored in the env key. This is how the host app hooks in its own
+    # User model upsert logic:
+    #
+    #   use Rack::ForwardAuth::Middleware, on_user: ->(attrs) {
+    #     User.find_or_initialize_by(uid: attrs[:uid]).tap { |u|
+    #       u.assign_attributes(attrs.except(:uid))
+    #       u.save! if u.changed?
+    #     }
+    #   }
+    #
+    class Middleware
+      def initialize(app, env_key: ForwardAuth::ENV_KEY, on_user: nil)
+        @app     = app
+        @env_key = env_key
+        @on_user = on_user
+      end
+
+      def call(env)
+        uid = env[ForwardAuth::REMOTE_USER]
+
+        if uid && !uid.empty?
+          attrs = {
+            uid:          uid,
+            email:        env[ForwardAuth::REMOTE_EMAIL],
+            display_name: env[ForwardAuth::REMOTE_NAME],
+            groups:       parse_groups(env[ForwardAuth::REMOTE_GROUPS]),
+          }
+
+          env[@env_key] = @on_user ? @on_user.call(attrs) : attrs
+        end
+
+        # Also set under the legacy key for backwards compat
+        env["authelia.user"] = env[@env_key] if @env_key != "authelia.user"
+
+        @app.call(env)
+      end
+
+      private
+
+      def parse_groups(raw)
+        return [] if raw.nil? || raw.empty?
+        raw.split(",").map(&:strip).reject(&:empty?)
+      end
+    end
+  end
+end

data/lib/rack/forward_auth/test_stub.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Rack
+  module ForwardAuth
+    # Development/test middleware that injects default forward-auth headers
+    # so you don't need an actual auth proxy running locally.
+    #
+    # Wraps Rack::ForwardAuth::Middleware — injects defaults then delegates.
+    #
+    #   use Rack::ForwardAuth::TestStub, on_user: ->(attrs) { ... }
+    #
+    # Customize defaults:
+    #
+    #   use Rack::ForwardAuth::TestStub, defaults: {
+    #     "HTTP_REMOTE_USER" => "testdev",
+    #     "HTTP_REMOTE_EMAIL" => "testdev@localhost",
+    #   }
+    #
+    class TestStub
+      DEFAULT_HEADERS = {
+        ForwardAuth::REMOTE_USER   => "dev",
+        ForwardAuth::REMOTE_EMAIL  => "dev@localhost",
+        ForwardAuth::REMOTE_GROUPS => "lldap_admin",
+        ForwardAuth::REMOTE_NAME   => "Dev User",
+      }.freeze
+
+      def initialize(app, defaults: DEFAULT_HEADERS, **middleware_opts)
+        @defaults   = defaults
+        @middleware  = Middleware.new(app, **middleware_opts)
+      end
+
+      def call(env)
+        @defaults.each do |key, value|
+          env[key] ||= value
+        end
+
+        @middleware.call(env)
+      end
+    end
+  end
+end

data/lib/rack/forward_auth/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Rack
+  module ForwardAuth
+    VERSION = "0.1.0"
+  end
+end

data/lib/rack/forward_auth/version.rb.erb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Rack
+  module ForwardAuth
+    VERSION = "<%= version %>"
+  end
+end

data/lib/rack_forward_auth.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'rack/forward_auth/version'
+require 'rack/forward_auth/middleware'
+
+module Rack
+  module ForwardAuth
+    # Default env key where parsed user attributes are stored.
+    ENV_KEY = 'forward_auth.user'
+
+    # Header constants (as Rack env keys).
+    REMOTE_USER   = 'HTTP_REMOTE_USER'
+    REMOTE_EMAIL  = 'HTTP_REMOTE_EMAIL'
+    REMOTE_GROUPS = 'HTTP_REMOTE_GROUPS'
+    REMOTE_NAME   = 'HTTP_REMOTE_NAME'
+  end
+end
+
+require 'rack/forward_auth/test_stub'

metadata

@@ -0,0 +1,48 @@
+--- !ruby/object:Gem::Specification
+name: rack-forward-auth
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Nathan Kidd
+bindir: bin
+cert_chain: []
+date: 1980-01-01 00:00:00.000000000 Z
+dependencies: []
+description: Pure Rack middleware that reads forward-auth headers (Remote-User, Remote-Email,
+  Remote-Groups, Remote-Name) and exposes parsed user attributes in the Rack env.
+  Includes a test stub for development environments. No Rails dependency.
+email:
+- nathankidd@hey.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- Rakefile
+- lib/rack/forward_auth/middleware.rb
+- lib/rack/forward_auth/test_stub.rb
+- lib/rack/forward_auth/version.rb
+- lib/rack/forward_auth/version.rb.erb
+- lib/rack_forward_auth.rb
+homepage: https://github.com/n-at-han-k/rack-forward-auth
+licenses:
+- Apache-2.0
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.7.2
+specification_version: 4
+summary: Rack middleware for forward-auth proxies (Authelia, Authentik, etc.)
+test_files: []