rails_ai 0.1.0

data/lib/rails_ai/security/error_handler.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module RailsAi
+  module Security
+    class ErrorHandler
+      def self.handle_security_error(error, context = {})
+        # Log security error
+        AuditLogger.log_security_event(:security_error, {
+          error_class: error.class.name,
+          error_message: error.message,
+          context: context,
+          timestamp: Time.now
+        })
+        
+        # Return sanitized error message
+        sanitized_message = sanitize_error_message(error)
+        
+        # In production, don't expose internal details
+        if Rails.env.production?
+          case error
+          when ValidationError
+            "Invalid input provided"
+          when RateLimitError
+            "Rate limit exceeded. Please try again later"
+          when SecurityError
+            "Security error occurred"
+          else
+            "An error occurred while processing your request"
+          end
+        else
+          sanitized_message
+        end
+      end
+      
+      def self.sanitize_error_message(error)
+        message = error.message.to_s
+        
+        # Remove sensitive information
+        message = message.gsub(/api[_-]?key/i, 'API_KEY')
+        message = message.gsub(/password/i, 'PASSWORD')
+        message = message.gsub(/secret/i, 'SECRET')
+        message = message.gsub(/token/i, 'TOKEN')
+        
+        # Remove file paths
+        message = message.gsub(%r{/[a-zA-Z0-9_/.-]+}, '[PATH]')
+        
+        # Remove IP addresses
+        message = message.gsub(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/, '[IP]')
+        
+        # Remove URLs
+        message = message.gsub(%r{https?://[^\s]+}, '[URL]')
+        
+        message
+      end
+      
+      def self.log_and_raise(error, context = {})
+        handle_security_error(error, context)
+        raise error
+      end
+    end
+  end
+end

data/lib/rails_ai/security/input_validator.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+require 'uri'
+require 'ipaddr'
+
+module RailsAi
+  module Security
+    class InputValidator
+      MAX_FILE_SIZE = 50.megabytes
+      ALLOWED_IMAGE_TYPES = %w[image/jpeg image/png image/gif image/webp].freeze
+      ALLOWED_VIDEO_TYPES = %w[video/mp4 video/webm video/quicktime].freeze
+      ALLOWED_AUDIO_TYPES = %w[audio/mpeg audio/wav audio/ogg audio/mp4].freeze
+      
+      ALLOWED_SCHEMES = %w[http https].freeze
+      BLOCKED_HOSTS = %w[
+        localhost 127.0.0.1 0.0.0.0 ::1
+        10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+        metadata.google.internal
+        instance-data.ec2.internal
+      ].freeze
+
+      def self.validate_text_input(text, max_length: 10000)
+        raise ValidationError, "Text cannot be nil" if text.nil?
+        
+        text = text.to_s.strip
+        raise ValidationError, "Text cannot be empty" if text.empty?
+        raise ValidationError, "Text too long (max: #{max_length})" if text.length > max_length
+        
+        if text.match?(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/)
+          raise ValidationError, "Text contains invalid characters"
+        end
+        
+        text
+      end
+
+      def self.validate_file_path(path)
+        raise ValidationError, "File path cannot be nil" if path.nil?
+        
+        path = File.expand_path(path)
+        
+        if path.include?('..') || path.include?('~')
+          raise ValidationError, "Invalid file path: directory traversal detected"
+        end
+        
+        unless File.exist?(path) && File.readable?(path)
+          raise ValidationError, "File not found or not readable: #{path}"
+        end
+        
+        if File.size(path) > MAX_FILE_SIZE
+          raise ValidationError, "File too large (max: #{MAX_FILE_SIZE} bytes)"
+        end
+        
+        path
+      end
+
+      def self.validate_base64_data(data, expected_type: nil)
+        raise ValidationError, "Base64 data cannot be nil" if data.nil?
+        
+        unless data.match?(/\A[A-Za-z0-9+\/]*={0,2}\z/)
+          raise ValidationError, "Invalid base64 format"
+        end
+        
+        begin
+          decoded = Base64.strict_decode64(data)
+          if decoded.size > MAX_FILE_SIZE
+            raise ValidationError, "Base64 data too large (max: #{MAX_FILE_SIZE} bytes)"
+          end
+        rescue ArgumentError
+          raise ValidationError, "Invalid base64 data"
+        end
+        
+        if expected_type && data.start_with?("data:")
+          mime_type = data.split(';')[0].split(':')[1]
+          unless valid_mime_type?(mime_type, expected_type)
+            raise ValidationError, "Invalid MIME type: #{mime_type}"
+          end
+        end
+        
+        data
+      end
+
+      def self.validate_url(url)
+        raise ValidationError, "URL cannot be nil" if url.nil?
+        
+        begin
+          uri = URI.parse(url)
+        rescue URI::InvalidURIError
+          raise ValidationError, "Invalid URL format"
+        end
+        
+        unless ALLOWED_SCHEMES.include?(uri.scheme)
+          raise ValidationError, "Invalid URL scheme: #{uri.scheme}"
+        end
+        
+        if blocked_host?(uri.host)
+          raise ValidationError, "URL blocked for security reasons"
+        end
+        
+        if private_ip?(uri.host)
+          raise ValidationError, "Private IP addresses not allowed"
+        end
+        
+        url
+      end
+
+      def self.validate_messages(messages)
+        raise ValidationError, "Messages cannot be nil" if messages.nil?
+        raise ValidationError, "Messages must be an array" unless messages.is_a?(Array)
+        raise ValidationError, "Messages cannot be empty" if messages.empty?
+        raise ValidationError, "Too many messages (max: 100)" if messages.length > 100
+        
+        messages.each_with_index do |message, index|
+          validate_message(message, index)
+        end
+        
+        messages
+      end
+
+      private
+
+      def self.validate_message(message, index)
+        raise ValidationError, "Message #{index} must be a hash" unless message.is_a?(Hash)
+        raise ValidationError, "Message #{index} missing role" unless message[:role]
+        raise ValidationError, "Message #{index} missing content" unless message[:content]
+        
+        valid_roles = %w[system user assistant]
+        unless valid_roles.include?(message[:role])
+          raise ValidationError, "Message #{index} has invalid role: #{message[:role]}"
+        end
+        
+        validate_text_input(message[:content], max_length: 50000)
+      end
+
+      def self.valid_mime_type?(mime_type, expected_type)
+        case expected_type
+        when :image
+          ALLOWED_IMAGE_TYPES.include?(mime_type)
+        when :video
+          ALLOWED_VIDEO_TYPES.include?(mime_type)
+        when :audio
+          ALLOWED_AUDIO_TYPES.include?(mime_type)
+        else
+          true
+        end
+      end
+
+      def self.blocked_host?(host)
+        return true if host.nil?
+        
+        BLOCKED_HOSTS.any? do |blocked|
+          if blocked.include?('/')
+            begin
+              blocked_network = IPAddr.new(blocked)
+              blocked_network.include?(host)
+            rescue IPAddr::InvalidAddressError
+              false
+            end
+          else
+            host == blocked || host.end_with?(".#{blocked}")
+          end
+        end
+      end
+
+      def self.private_ip?(host)
+        return false if host.nil?
+        
+        begin
+          ip = IPAddr.new(host)
+          ip.private? || ip.loopback?
+        rescue IPAddr::InvalidAddressError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/rails_ai/security/secure_file_handler.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'tempfile'
+
+module RailsAi
+  module Security
+    class SecureFileHandler
+      def self.safe_file_read(path)
+        validate_path = InputValidator.validate_file_path(path)
+        
+        File.open(validate_path, 'rb') do |file|
+          content = file.read(InputValidator::MAX_FILE_SIZE)
+          if file.eof?
+            content
+          else
+            raise ValidationError, "File too large"
+          end
+        end
+      end
+
+      def self.safe_temp_file(content, extension = '.tmp')
+        temp_file = Tempfile.new(['rails_ai', extension])
+        temp_file.binmode
+        temp_file.write(content)
+        temp_file.rewind
+        temp_file
+      end
+
+      def self.safe_file_size(path)
+        File.size(InputValidator.validate_file_path(path))
+      end
+
+      def self.safe_file_exists?(path)
+        return false if path.nil?
+        
+        begin
+          InputValidator.validate_file_path(path)
+          true
+        rescue ValidationError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/rails_ai/security/secure_http_client.rb

@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+require 'net/http'
+require 'timeout'
+require 'uri'
+
+module RailsAi
+  module Security
+    class SecureHTTPClient
+      DEFAULT_TIMEOUT = 30
+      MAX_REDIRECTS = 5
+      
+      def self.make_request(url, options = {})
+        uri = URI.parse(url)
+        
+        # Security validations
+        validate_url(uri)
+        
+        http = create_secure_http_client(uri)
+        request = create_secure_request(uri, options)
+        
+        # Set security headers
+        set_security_headers(request)
+        
+        # Execute request with timeout
+        execute_with_timeout(http, request, options[:timeout] || DEFAULT_TIMEOUT)
+      end
+      
+      def self.make_streaming_request(url, options = {}, &block)
+        uri = URI.parse(url)
+        
+        # Security validations
+        validate_url(uri)
+        
+        http = create_secure_http_client(uri)
+        request = create_secure_request(uri, options)
+        
+        # Set security headers
+        set_security_headers(request)
+        
+        # Execute streaming request
+        execute_streaming_request(http, request, options[:timeout] || DEFAULT_TIMEOUT, &block)
+      end
+      
+      private
+      
+      def self.validate_url(uri)
+        unless %w[http https].include?(uri.scheme)
+          raise SecurityError, "Invalid URL scheme: #{uri.scheme}"
+        end
+        
+        if blocked_host?(uri.host)
+          raise SecurityError, "URL blocked for security reasons: #{uri.host}"
+        end
+        
+        if private_ip?(uri.host)
+          raise SecurityError, "Private IP addresses not allowed: #{uri.host}"
+        end
+      end
+      
+      def self.create_secure_http_client(uri)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = (uri.scheme == 'https')
+        
+        # Security settings
+        http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        http.verify_depth = 5
+        
+        # Timeout settings
+        http.read_timeout = DEFAULT_TIMEOUT
+        http.open_timeout = 10
+        http.ssl_timeout = 10
+        
+        # Disable SSL compression
+        http.ssl_version = :TLSv1_2
+        
+        http
+      end
+      
+      def self.create_secure_request(uri, options)
+        case options[:method]&.upcase || 'GET'
+        when 'GET'
+          Net::HTTP::Get.new(uri)
+        when 'POST'
+          request = Net::HTTP::Post.new(uri)
+          request.body = options[:body] if options[:body]
+          request
+        when 'PUT'
+          request = Net::HTTP::Put.new(uri)
+          request.body = options[:body] if options[:body]
+          request
+        else
+          raise SecurityError, "Unsupported HTTP method: #{options[:method]}"
+        end
+      end
+      
+      def self.set_security_headers(request)
+        request['User-Agent'] = 'RailsAI/1.0'
+        request['Accept'] = 'application/json'
+        request['Connection'] = 'close'
+        request['Cache-Control'] = 'no-cache'
+        
+        # Security headers
+        request['X-Requested-With'] = 'RailsAI'
+        request['X-Content-Type-Options'] = 'nosniff'
+        request['X-Frame-Options'] = 'DENY'
+        request['X-XSS-Protection'] = '1; mode=block'
+      end
+      
+      def self.execute_with_timeout(http, request, timeout)
+        Timeout.timeout(timeout) do
+          response = http.request(request)
+          validate_response(response)
+          response
+        end
+      rescue Timeout::Error
+        raise SecurityError, "Request timeout after #{timeout} seconds"
+      rescue => e
+        raise SecurityError, "HTTP request failed: #{e.message}"
+      end
+      
+      def self.execute_streaming_request(http, request, timeout, &block)
+        Timeout.timeout(timeout) do
+          http.request(request) do |response|
+            validate_response(response)
+            
+            response.read_body do |chunk|
+              block.call(chunk) if block
+            end
+          end
+        end
+      rescue Timeout::Error
+        raise SecurityError, "Streaming request timeout after #{timeout} seconds"
+      rescue => e
+        raise SecurityError, "Streaming request failed: #{e.message}"
+      end
+      
+      def self.validate_response(response)
+        case response.code.to_i
+        when 200..299
+          response
+        when 400..499
+          raise SecurityError, "Client error: #{response.code} #{response.message}"
+        when 500..599
+          raise SecurityError, "Server error: #{response.code} #{response.message}"
+        else
+          raise SecurityError, "Unexpected response: #{response.code} #{response.message}"
+        end
+      end
+      
+      def self.blocked_host?(host)
+        return true if host.nil?
+        
+        blocked_hosts = %w[
+          localhost 127.0.0.1 0.0.0.0 ::1
+          metadata.google.internal
+          instance-data.ec2.internal
+          169.254.169.254
+        ]
+        
+        blocked_hosts.any? { |blocked| host == blocked || host.end_with?(".#{blocked}") }
+      end
+      
+      def self.private_ip?(host)
+        return false if host.nil?
+        
+        require 'ipaddr'
+        begin
+          ip = IPAddr.new(host)
+          ip.private? || ip.loopback? || ip.link_local?
+        rescue IPAddr::InvalidAddressError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/rails_ai/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module RailsAi
+  VERSION = "0.1.0"
+end

data/lib/rails_ai/window_context.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module RailsAi
+  class WindowContext
+    attr_reader :controller, :action, :params, :request, :session, :cookies
+
+    def initialize(controller: nil, action: nil, params: {}, request: nil, session: {}, cookies: {})
+      @controller = controller
+      @action = action
+      @params = params || {}
+      @request = request
+      @session = session || {}
+      @cookies = cookies || {}
+    end
+
+    def to_h
+      {
+        controller: controller_name,
+        action: action_name,
+        route: route_info,
+        params: sanitized_params,
+        user_agent: user_agent,
+        referer: referer,
+        ip_address: ip_address,
+        session_data: sanitized_session,
+        cookies: sanitized_cookies,
+        timestamp: current_time.iso8601
+      }
+    end
+
+    def self.from_controller(controller)
+      new(
+        controller: controller.class.name,
+        action: controller.action_name,
+        params: extract_params(controller),
+        request: controller.request,
+        session: controller.session.to_h,
+        cookies: controller.cookies.to_h
+      )
+    end
+
+    private
+
+    def current_time
+      if defined?(Time.current)
+        Time.current
+      else
+        Time.now
+      end
+    end
+
+    def self.extract_params(controller)
+      if controller.params.respond_to?(:to_unsafe_h)
+        controller.params.to_unsafe_h
+      elsif controller.params.respond_to?(:to_h)
+        controller.params.to_h
+      else
+        controller.params
+      end
+    end
+
+    def controller_name
+      controller&.class&.name || 'Unknown'
+    end
+
+    def action_name
+      action || 'Unknown'
+    end
+
+    def route_info
+      return 'Unknown' unless request
+      
+      "#{request.method} #{request.path}"
+    end
+
+    def sanitized_params
+      # Remove sensitive parameters
+      params.except('password', 'password_confirmation', 'token', 'secret', 'key')
+    end
+
+    def user_agent
+      request&.user_agent || 'Unknown'
+    end
+
+    def referer
+      request&.referer || 'Direct'
+    end
+
+    def ip_address
+      request&.remote_ip || 'Unknown'
+    end
+
+    def sanitized_session
+      # Remove sensitive session data
+      session.except('password', 'token', 'secret', 'key', 'csrf_token')
+    end
+
+    def sanitized_cookies
+      # Remove sensitive cookies
+      cookies.except('_session_id', 'csrf_token', 'remember_token')
+    end
+  end
+end