rails-approvals 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c0e56b07cc8c4d9151cccbee4622d717b3ba527397e8f12b8cac425fff17a62d
+  data.tar.gz: acd5ac125333c3bb721c1acdb4c756601d88ed4760014b108e28f4006755811b
+SHA512:
+  metadata.gz: 6feac08e64f30352c6dcfaba67ef7adf37ee1db1bf2cc9fdf9a1f6395337e6c03106a3687667091f46ddcdd25e127f61572531484a5ab9158daa6ffe71e58018
+  data.tar.gz: 34789331f20daeea988c3533ed191be9f14ed4339ddbcc2723a1877ab4f41bd8510f3ae9813173644aa4c2d367384102a49c22806436463ba6185c801a278a87

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2021 Garrett Bjerkhoel
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,164 @@
+# Rails::Approvals
+
+Add approval processes for Rails console access, running database migrations, and more in production. Be notified of approval requests and respond to them directly in Slack.
+
+<img width="868" alt="CleanShot 2021-06-25 at 20 37 49@2x" src="https://user-images.githubusercontent.com/79995/123500785-5eda4a00-d5f5-11eb-9c39-5b704f62d2b5.png">
+
+## Installation
+
+Rails::Approvals requires a Slack application installed in your Slack workspace. The Slack application gives Rails::Approvals the ability to post approval requests to your configured Slack channel and other workspace users can respond to approval requests.
+
+This guide will walk you through the process of installing the gem, configuring Slack, and `rails-approvals` to meet your needs.
+
+### Install the rails-approvals gem
+
+First, you must add the following line to your application's Gemfile to install `rails-approvals`:
+
+```ruby
+gem 'rails-approvals'
+```
+
+And then execute:
+
+```bash
+$ bundle
+```
+
+Or add it `rails-approvals` automatically to your `Gemfile` with:
+
+```bash
+$ bundle add rails-approvals
+```
+
+### Create Slack application
+
+Now that you have the gem installed, it's time to create the Rails Approvals Slack application for your Slack workspace. To create a Slack application you must be a Slack workspace administrator.
+
+Using the link below a new Slack application will be prefilled with all settings and scopes required for Rails::Approvals to work. Slack will prompt you to verify the permissions that will be granted before you create the Slack application.
+
+<a href="https://api.slack.com/apps?new_app=1&manifest_json=%7B%0A%20%20%22_metadata%22%3A%20%7B%0A%20%20%20%20%22major_version%22%3A%201%2C%0A%20%20%20%20%22minor_version%22%3A%201%0A%20%20%7D%2C%0A%20%20%22display_information%22%3A%20%7B%0A%20%20%20%20%22name%22%3A%20%22Rails%20Approvals%22%0A%20%20%7D%2C%0A%20%20%22features%22%3A%20%7B%0A%20%20%20%20%22app_home%22%3A%20%7B%0A%20%20%20%20%20%20%22home_tab_enabled%22%3A%20false%2C%0A%20%20%20%20%20%20%22messages_tab_enabled%22%3A%20true%2C%0A%20%20%20%20%20%20%22messages_tab_read_only_enabled%22%3A%20true%0A%20%20%20%20%7D%2C%0A%20%20%20%20%22bot_user%22%3A%20%7B%0A%20%20%20%20%20%20%22display_name%22%3A%20%22Rails%20Approvals%22%2C%0A%20%20%20%20%20%20%22always_online%22%3A%20false%0A%20%20%20%20%7D%0A%20%20%7D%2C%0A%20%20%22oauth_config%22%3A%20%7B%0A%20%20%20%20%22scopes%22%3A%20%7B%0A%20%20%20%20%20%20%22bot%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%22chat%3Awrite%22%0A%20%20%20%20%20%20%5D%0A%20%20%20%20%7D%0A%20%20%7D%2C%0A%20%20%22settings%22%3A%20%7B%0A%20%20%20%20%22interactivity%22%3A%20%7B%0A%20%20%20%20%20%20%22is_enabled%22%3A%20true%2C%0A%20%20%20%20%20%20%22request_url%22%3A%20%22https%3A%2F%2Fwebsite.com%2Frails%2Fapprovals%2Fslack%2Fwebhook%22%0A%20%20%20%20%7D%2C%0A%20%20%20%20%22org_deploy_enabled%22%3A%20false%2C%0A%20%20%20%20%22socket_mode_enabled%22%3A%20false%0A%20%20%7D%0A%7D%0A"><img alt="Add to Slack" height="40" width="139" src="https://platform.slack-edge.com/img/add_to_slack@2x.png" /></a>
+
+Later in this installation guide you will be instructed to configure the webhook URL that Rails::Approvals needs to handle approval request responses within Slack's settings.
+
+If you'd like to setup the Slack application manually you can do so following [Setup Slack Application](#setup-slack-application) guide below.
+
+### Configuring rails-approvals
+
+Rails::Approvals needs three things to work:
+
+1. The **Slack Bot User OAuth Token** generated after installing the Slack application to your workspace. This lets the gem publish messages to your configured Slack channel.
+1. The **Webhook signing secret** generated by Slack.
+1. The **Slack channel** you'd like to send approval requests to.
+
+Each of these can be configured by environment variables or manually in your environment file. We strongly do not recommend checking in any API tokens into version control and using environment variables to configure them.
+
+```ruby
+Rails.application.configure do
+  # Enabled by default in production. If you'd like to enable approvals in
+  # staging or other environments you can do so here.
+  config.rails.approvals.enabled = true
+
+  # Can be configured with RAILS_APPROVALS_SLACK_CHANNEL by default, or provided
+  # explicitely.
+  config.rails.approvals.slack.channel = "#rails-approvals"
+
+  # Can be configured with RAILS_APPROVALS_SLACK_TOKEN. Strongly do not
+  # recommended checking this into version control.
+  config.rails.approvals.slack.token = ENV['RAILS_APPROVALS_SLACK_TOKEN']
+
+  # Can be configured with RAILS_APPROVALS_SLACK_SIGNING_SECRET. Strongly do not
+  # recommended checking this into version control.
+  config.rails.approvals.slack.signing_secret = ENV['RAILS_APPROVALS_SLACK_SIGNING_SECRET']
+end
+```
+
+There are [additional settings](https://github.com/cased/rails-approvals/blob/main/lib/rails/approvals/engine.rb) you can configure should you like, such as:
+
+- How long approval requests are valid for (defaults to 10 minutes)
+- If the user is prompted to identify who they are (defaults to $USER)
+- If a reason is required.
+
+### Mounting the Rails::Approvals engine
+
+When you respond to approval requests within Slack, Slack will deliver a webhook
+message to your configured application to permit or deny access accordingly. Rails::Approvals includes a built in controller to verify the message from Slack using the required signing secret, lookup the approval request, and handle the approved/denied response.
+
+You will want to mount the `Rails::Approvals::Engine` within your `config/routes.rb` file:
+
+```ruby
+Rails.application.routes.draw do
+  mount Rails::Approvals::Engine => "/rails/approvals"
+
+  # existing routes here
+end
+```
+
+For Slack to know where to send approval request responses you must provide a webhook URL. Using the URL below, replace `example.com` with your application's domain and enter it within the **Interactivity & Shortcuts** section of your Slack application settings:
+
+```
+https://example.com/rails/approvals/slack/webhook
+```
+
+### Run the database migration
+
+Rails::Approvals uses an ActiveRecord model to keep track of all pending approval requests, who requested them, the reason provided and more. Install and run the required database migration below:
+
+```
+bin/rails railsapprovals:install:migrations
+bin/rails db:migrate
+```
+
+You are welcome to check out the [migration](https://github.com/cased/rails-approvals/blob/main/db/migrate/20210624220156_create_rails_approvals_requests.rb) before running
+it.
+
+### Deploy
+
+Now that you've installed `rails-approvals`, setup your Slack application & installed it to your workspace, you're ready to go!
+
+## How does Rails::Approvals work?
+
+Rails::Approvals works by adding a blocking approval request before a Rails console can be started.
+
+```ruby
+module Rails
+  module Approvals
+    class Railtie < ::Rails::Railtie
+      console do
+        Rails::Approvals.start!
+      end
+    end
+  end
+end
+```
+
+An [`Rails::Approvals::Request`](https://github.com/cased/rails-approvals/blob/main/app/models/rails/approvals/request.rb) record is created which publishes the approval request to Slack and waits for someone to respond.
+
+When an approval request is ✅ _approved_, the console session will continue as normal. When an approval response is 🛑 _denied_ or ⚠️ _times out_, the process will exit immediately.
+
+## Setup Slack Application
+
+If you'd like to create your Slack application manually, you can do so by following the instructions below:
+
+1. Create a [new Slack application](https://api.slack.com/apps?new_app=1) for your desired Slack workspace.
+1. Next, under **Features**, select **OAuth & Permissions**.
+1. Add the `chat:write` scope under **Bot Token Scopes**. This is the only permission you need.
+1. Now that you've added the required permission for Rails::Approvals to work, you must install the new application in your Slack workspace.
+1. Under **Settings**, select **Install App**.
+1. Install your Slack application to your workspace by following the prompt after clicking **Install to Workspace**.
+1. Copy the **Bot User OAuth Token** and configure a `RAILS_APPROVALS_SLACK_TOKEN` environment variable for your application.
+1. Next, under **Features**, select **Interactivity & Shortcuts**.
+1. Enable **Interactivity** and provide the **Request URL** per the [webhook URL instructions above](#mounting-the-railsapprovals-engine).
+1. Next, under **Settings**, select **Basic Information**.
+1. Copy the **Signing Secret** under **App Credentials** and configure your `RAILS_APPROVALS_SLACK_SIGNING_SECRET` environment variable.
+
+## Contributing
+
+1. Fork it ( https://github.com/cased/rails-approvals/fork )
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create a new Pull Request
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,18 @@
+require "bundler/setup"
+
+APP_RAKEFILE = File.expand_path("test/dummy/Rakefile", __dir__)
+load "rails/tasks/engine.rake"
+
+load "rails/tasks/statistics.rake"
+
+require "bundler/gem_tasks"
+
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'test'
+  t.pattern = 'test/**/*_test.rb'
+  t.verbose = false
+end
+
+task default: :test

data/app/assets/config/rails_approvals_manifest.js

@@ -0,0 +1 @@
+//= link_directory ../stylesheets/rails/approvals .css

data/app/assets/stylesheets/rails/approvals/application.css

@@ -0,0 +1,15 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ *
+ * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
+ * or any plugin's vendor/assets/stylesheets directory can be referenced here using a relative path.
+ *
+ * You're free to add application-wide styles to this file and they'll appear at the bottom of the
+ * compiled file so the styles you add here take precedence over styles defined in any other CSS/SCSS
+ * files in this directory. Styles in this file should be added after the last require_* statement.
+ * It is generally better to create a new file per style scope.
+ *
+ *= require_tree .
+ *= require_self
+ */

data/app/controllers/rails/approvals/application_controller.rb

@@ -0,0 +1,6 @@
+module Rails
+  module Approvals
+    class ApplicationController < ActionController::Base
+    end
+  end
+end

data/app/controllers/rails/approvals/slack_controller.rb

@@ -0,0 +1,56 @@
+module Rails
+  module Approvals
+    class SlackController < ApplicationController
+      skip_before_action :verify_authenticity_token
+      before_action :verify_slack_request
+
+      # Make sure to handle errors from request and return.
+      unless Rails.env.development?
+        rescue_from StandardError do |_exception|
+          render json: {
+            response_type: 'ephemeral',
+            replace_original: false,
+            text: "Sorry, that didn't work. Please try again.",
+          }
+        end
+      end
+
+      def create
+        payload = JSON.parse(params[:payload])
+        response = SlackResponse.new(payload)
+
+        if response.perform
+          head :ok
+        else
+          head :bad_request
+        end
+      end
+
+      private
+
+      def verify_slack_request
+        return if valid_slack_request?
+
+        head :unauthorized
+      end
+
+      def valid_slack_request?
+        timestamp = request.headers['X-Slack-Request-Timestamp']
+
+        # Prevent replay attacks by only processing requests from the last 5
+        # minutes
+        if Time.zone.at(timestamp.to_i) < 5.minutes.ago
+          return false
+        end
+
+        signature = request.headers['X-Slack-Signature']
+        basestring = ['v0', timestamp, request.body.read].join(':')
+        signing_secret = Rails.application.config.rails.approvals.slack.signing_secret
+        hd = OpenSSL::HMAC.hexdigest('SHA256', signing_secret, basestring)
+        computed_signature = ['v0', hd].join('=')
+
+        computed_signature == signature
+      end
+    end
+  end
+end

data/app/helpers/rails/approvals/application_helper.rb

@@ -0,0 +1,6 @@
+module Rails
+  module Approvals
+    module ApplicationHelper
+    end
+  end
+end

data/app/jobs/rails/approvals/application_job.rb

@@ -0,0 +1,6 @@
+module Rails
+  module Approvals
+    class ApplicationJob < ActiveJob::Base
+    end
+  end
+end

data/app/mailers/rails/approvals/application_mailer.rb

@@ -0,0 +1,8 @@
+module Rails
+  module Approvals
+    class ApplicationMailer < ActionMailer::Base
+      default from: 'from@example.com'
+      layout 'mailer'
+    end
+  end
+end

data/app/models/rails/approvals/application_record.rb

@@ -0,0 +1,7 @@
+module Rails
+  module Approvals
+    class ApplicationRecord < ActiveRecord::Base
+      self.abstract_class = true
+    end
+  end
+end

data/app/models/rails/approvals/request.rb

@@ -0,0 +1,88 @@
+module Rails
+  module Approvals
+    class Request < ApplicationRecord
+      enum state: {
+        requested: 102,
+        approved: 202,
+        denied: 401,
+        timed_out: 408,
+        canceled: 410,
+      }
+
+      validates :requester, presence: true
+      validates :reason, presence: ::Rails.application.config.rails.approvals.reasons.required
+
+      before_validation :prompt_for_requester
+      before_validation :prompt_for_reason
+      after_commit :publish_message_to_slack, on: %i[create update]
+
+      def self.request!
+        create!(
+          requester: ENV['USER'],
+          command: [$PROGRAM_NAME, *ARGV].join(' '),
+        )
+      end
+
+      def expired?
+        return false unless requested?
+
+        timeout_duration = Rails.application.config.rails.approvals.timeout_duration
+        return false if !timeout_duration
+
+        unless timeout_duration.is_a?(Numeric) || timeout_duration.is_a?(ActiveSupport::Duration)
+          raise ArgumentError, "expected ActiveSupport::Duration or Numeric value"
+        end
+
+        expires_at = created_at + Rails.application.config.rails.approvals.timeout_duration
+        expires_at <= Time.zone.now
+      end
+
+      private
+
+      def prompt_for_requester
+        return if requester? && !Rails.application.config.rails.approvals.requester.prompt
+
+        prompt = TTY::Prompt.new
+        response = prompt.multiline("Who are you?", help: '(Press Ctrl+D or Ctrl+Z to submit)')
+
+        self.requester = response.join("\n")
+      end
+
+      def prompt_for_reason
+        # We already have a reason, prompting for one is unnecessary.
+        return if reason?
+
+        reason_required = ::Rails.application.config.rails.approvals.reasons.required
+        reason_prompt = ::Rails.application.config.rails.approvals.reasons.prompt
+        return if !reason_required && !reason_prompt
+
+        prompt = TTY::Prompt.new
+        response = prompt.multiline("Please enter a reason for running #{command}:", help: '(Press Ctrl+D or Ctrl+Z to submit)')
+
+        self.reason = response.join("\n")
+      end
+
+      def publish_message_to_slack
+        # The initial request has already been sent to Slack, we now need to
+        # update it as the request state has changed.
+        if slack_message_ts?
+          Rails::Approvals.slack.chat_update(
+            channel: slack_channel_id,
+            ts: slack_message_ts,
+            blocks: SlackMessage.new(self).as_json,
+          )
+        else
+          message = Rails::Approvals.slack.chat_postMessage(
+            channel: Rails.application.config.rails.approvals.slack.channel,
+            blocks: SlackMessage.new(self).as_json,
+          )
+
+          update!(
+            slack_message_ts: message.ts,
+            slack_channel_id: message.channel,
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/rails/approvals/slack_message.rb

@@ -0,0 +1,107 @@
+module Rails
+  module Approvals
+    class SlackMessage
+      attr_reader :request
+
+      def initialize(request)
+        @request = request
+      end
+
+      def as_json
+        metadata_fields = [].tap do |metadata|
+          if request.reason?
+            metadata << {
+              type: 'mrkdwn',
+              text: "*Reason:*\n#{request.reason}",
+            }
+          end
+        end
+
+        blocks = [
+          {
+            type: 'section',
+            text: {
+              type: 'mrkdwn',
+              text: "*#{request.requester}* is requesting to run *#{request.command}*.",
+            },
+          },
+        ]
+
+        if metadata_fields.any?
+          blocks << {
+            type: 'section',
+            fields: metadata_fields,
+          }
+        end
+
+        blocks << {
+          type: 'divider',
+        }
+
+        if request.requested?
+          global_id = request.to_global_id
+          blocks << {
+            type: "actions",
+            block_id: global_id.to_s,
+            elements: [
+              {
+                type: "button",
+                text: {
+                  type: "plain_text",
+                  emoji: true,
+                  text: "Approve"
+                },
+                style: "primary",
+                value: "approve"
+              },
+              {
+                type: "button",
+                text: {
+                  type: "plain_text",
+                  emoji: true,
+                  text: "Deny"
+                },
+                style: "danger",
+                value: "deny"
+              }
+            ]
+          }
+        elsif request.approved?
+          blocks << {
+            type: 'section',
+            text: {
+              type: 'mrkdwn',
+              text: "✅ *#{request.responder}* has approved the session.",
+            },
+          }
+        elsif request.denied?
+          blocks << {
+            type: 'section',
+            text: {
+              type: 'mrkdwn',
+              text: "🛑 *#{request.responder}* has denied the session.",
+            },
+          }
+        elsif request.canceled?
+          blocks << {
+            type: 'section',
+            text: {
+              type: 'mrkdwn',
+              text: "Request was canceled by *#{request.requester}*.",
+            },
+          }
+        elsif request.timed_out?
+          blocks << {
+            type: 'section',
+            text: {
+              type: 'mrkdwn',
+              text: '🛑 Session timed out.',
+            },
+          }
+        end
+
+        blocks
+      end
+    end
+  end
+end

data/app/models/rails/approvals/slack_response.rb

@@ -0,0 +1,32 @@
+module Rails
+  module Approvals
+    class SlackResponse
+      attr_reader :payload
+      attr_reader :responder
+
+      def initialize(payload)
+        @payload = payload
+        @responder = payload['user']['username']
+      end
+
+      def perform
+        payload['actions'].all? do |action|
+          request = GlobalID::Locator.locate(action['block_id'])
+
+          case action['value']
+          when 'approve'
+            request.update!(
+              responder: responder,
+              state: :approved,
+            )
+          when 'deny'
+            request.update!(
+              responder: responder,
+              state: :denied,
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/views/layouts/rails/approvals/application.html.erb

@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Rails approvals</title>
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+
+  <%= stylesheet_link_tag    "rails/approvals/application", media: "all" %>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>

data/config/routes.rb

@@ -0,0 +1,3 @@
+Rails::Approvals::Engine.routes.draw do
+  post '/slack/webhook' => 'slack#create'
+end

data/db/migrate/20210624220156_create_rails_approvals_requests.rb

@@ -0,0 +1,21 @@
+class CreateRailsApprovalsRequests < ActiveRecord::Migration[6.1]
+  def change
+    create_table :rails_approvals_requests do |t|
+      t.integer :state, null: false, default: 102
+      t.string :command, null: true
+      t.text :reason, null: true
+      t.string :requester, null: false
+
+      # Responder
+      t.string :responder, null: true
+      t.datetime :responded_at, null: true, precision: 6
+
+      # The timestamp necessary for rails-approvals to update the request
+      # message.
+      t.string :slack_channel_id, null: true
+      t.string :slack_message_ts, null: true
+
+      t.timestamps null: false, precision: 6
+    end
+  end
+end

data/lib/rails/approvals.rb

@@ -0,0 +1,88 @@
+require "rails/approvals/version"
+require "rails/approvals/engine"
+require "rails/approvals/railtie"
+require "tty/prompt"
+require "slack-ruby-client"
+
+module Rails
+  module Approvals
+    def self.start!
+      # We only want to start an approval request if it's enabled.
+      return unless ::Rails.application.config.rails.approvals.enabled
+
+      if Rails.application.config.rails.approvals.slack.token.blank?
+        msg = <<~MSG
+        Please provide your Slack API token either in the `RAILS_APPROVALS_SLACK_TOKEN` environment variable, or configured in your environment file:
+
+        Rails.application.configure do
+          config.rails.approvals.enabled = true
+          config.rails.approvals.slack.channel = "#rails-approvals"
+          config.rails.approvals.slack.token = "your-token-here"
+        end
+        MSG
+
+        puts msg
+        exit 1
+      end
+
+      request = Rails::Approvals.await
+      case
+      when request.approved?
+        puts "✅ Request to run #{request.command} approved by #{request.responder}."
+      when request.denied?
+        puts "🛑 Request to run #{request.command} denied by #{request.responder}."
+        exit 1
+      when request.timed_out?
+        puts "⚠️ Request to run #{request.command} timed out."
+        exit 1
+      when request.canceled?
+        puts "👋 You canceled your approval request to run #{request.command}."
+        exit 0
+      end
+    rescue TTY::Reader::InputInterrupt
+      exit 0
+    rescue Slack::Web::Api::Errors::ChannelNotFound
+      channel = Rails.application.config.rails.approvals.slack.channel
+      puts "Rails::Approvals was configured to send approval requests to #{channel} in your Slack workspace but it either does not exist or the Slack workspace user needs to be invited to the room."
+      exit 1
+    end
+
+    def self.await
+      request = Rails::Approvals::Request.request!
+      poll = request.requested?
+      canceled = false
+
+      Signal.trap('SIGINT') do
+        # Stop the polling
+        poll = false
+
+        # Canceling the request inside of a trap will fail if it results in
+        # any log output. Cancel the request outside of the scope of the trap
+        # and everything will work as expected.
+        canceled = true
+      end
+
+      while poll
+        if request.expired?
+          request.timed_out!
+          break
+        end
+
+        request.reload
+        poll = request.requested?
+
+        sleep 0.1
+      end
+
+      if canceled
+        request.canceled!
+      end
+
+      request
+    end
+
+    def self.slack
+      @slack ||= Slack::Web::Client.new(token: Rails.application.config.rails.approvals.slack.token)
+    end
+  end
+end

data/lib/rails/approvals/engine.rb

@@ -0,0 +1,68 @@
+module Rails
+  module Approvals
+    class Engine < ::Rails::Engine
+      isolate_namespace Rails::Approvals
+
+      engine_name 'railsapprovals'
+
+      config.rails = ActiveSupport::OrderedOptions.new
+      config.rails.approvals = ActiveSupport::OrderedOptions.new
+      config.rails.approvals.enabled = ::Rails.env.production?
+
+      # How long you'd like approvals to last before they timed out and have to
+      # be requested again. Can disable timeouts by setting this to `false`.
+      config.rails.approvals.timeout_duration = 10.minutes
+
+      # Requester
+      config.rails.approvals.requester = ActiveSupport::OrderedOptions.new
+
+      # Some environments can be trusted that the user will be present in the
+      # USER environment variable. In environments where there are not per-user
+      # accounts or shared environments such as Heroku, prompting the user for
+      # who they are may be necessary.
+      #
+      # This is enabled by default for users who've installed the Dyno metadata
+      # buildpack: https://devcenter.heroku.com/articles/dyno-metadata
+      heroku = ENV['HEROKU_APP_NAME'].present?
+
+      # If you are on AWS and have not set up per-user accounts, prompts will be
+      # enabled by default.
+      default_user = %w[ec2-user root].include?(ENV['USER'])
+
+      config.rails.approvals.requester.prompt = heroku || default_user
+
+      # Reason
+      config.rails.approvals.reasons = ActiveSupport::OrderedOptions.new
+      config.rails.approvals.reasons.required = true
+
+      # When a reason is required, this option is ignored. If a reason is not
+      # required, you can choose to prompt for a reason or not.
+      config.rails.approvals.reasons.prompt = true
+
+      # Slack
+      config.rails.approvals.slack = ActiveSupport::OrderedOptions.new
+
+      # The Slack channel you wish to send approval requests to. If the channel
+      # is private you must invite the bot user associated with your Slack
+      # application before rails-approvals can send messages to the channel.
+      #
+      # @example
+      #   #approvals
+      config.rails.approvals.slack.channel = ENV['RAILS_APPROVALS_SLACK_CHANNEL']
+
+      # For rails-approvals to be authenticated for your Slack workspace, you
+      # must provide the Bot User OAuth Token obtained after installing the
+      # Slack application to your workspace.
+      #
+      # @see https://api.slack.com/apps/$app/oauth
+      config.rails.approvals.slack.token = ENV['RAILS_APPROVALS_SLACK_TOKEN']
+
+      # The signing secret is used to verify the webhook message from Slack
+      # before handling it. You can obtain this from the Basic Information tab
+      # within your application's Settings.
+      #
+      # @see https://api.slack.com/apps/$appid/general
+      config.rails.approvals.slack.signing_secret = ENV['RAILS_APPROVALS_SLACK_SIGNING_SECRET']
+    end
+  end
+end

data/lib/rails/approvals/railtie.rb

@@ -0,0 +1,12 @@
+require 'rails/railtie'
+
+module Rails
+  module Approvals
+    class Railtie < ::Rails::Railtie
+      # :nocov:
+      console do
+        Rails::Approvals.start!
+      end
+    end
+  end
+end

data/lib/rails/approvals/version.rb

@@ -0,0 +1,5 @@
+module Rails
+  module Approvals
+    VERSION = '0.1.0'
+  end
+end

data/lib/tasks/rails/approvals_tasks.rake

@@ -0,0 +1,4 @@
+desc 'Add an approval processes to a Rake task'
+task :require_approval do
+  Rails::Approvals.start!
+end

metadata

@@ -0,0 +1,110 @@
+--- !ruby/object:Gem::Specification
+name: rails-approvals
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Garrett Bjerkhoel
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2021-06-26 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 6.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 6.0.0
+- !ruby/object:Gem::Dependency
+  name: slack-ruby-client
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.15.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.15.0
+- !ruby/object:Gem::Dependency
+  name: tty-prompt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.23.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.23.0
+description: Add an approval process to rails console in production.
+email:
+- me@garrettbjerkhoel.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- MIT-LICENSE
+- README.md
+- Rakefile
+- app/assets/config/rails_approvals_manifest.js
+- app/assets/stylesheets/rails/approvals/application.css
+- app/controllers/rails/approvals/application_controller.rb
+- app/controllers/rails/approvals/slack_controller.rb
+- app/helpers/rails/approvals/application_helper.rb
+- app/jobs/rails/approvals/application_job.rb
+- app/mailers/rails/approvals/application_mailer.rb
+- app/models/rails/approvals/application_record.rb
+- app/models/rails/approvals/request.rb
+- app/models/rails/approvals/slack_message.rb
+- app/models/rails/approvals/slack_response.rb
+- app/views/layouts/rails/approvals/application.html.erb
+- config/routes.rb
+- db/migrate/20210624220156_create_rails_approvals_requests.rb
+- lib/rails/approvals.rb
+- lib/rails/approvals/engine.rb
+- lib/rails/approvals/railtie.rb
+- lib/rails/approvals/version.rb
+- lib/tasks/rails/approvals_tasks.rake
+homepage: https://github.com/cased/rails-console-approval
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/cased/rails-console-approval
+  source_code_uri: https://github.com/cased/rails-console-approval
+  changelog_uri: https://github.com/cased/rails-console-approval/tags
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.3
+signing_key: 
+specification_version: 4
+summary: Add an approval process to rails console in production.
+test_files: []