rails_health_checks 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a376b4d6a5d680684058c1c123903ebc889e48ffa38cfd937cec29d53ebdaf6
-  data.tar.gz: c5aabce9da9a24785ae363f97cf0781f6a26184a53bfaa6d629fcea671c80189
+  metadata.gz: 128aa6485e85de5719cfb25c05192f5dd0277f8277bc6c8b4f74a095402f5f4b
+  data.tar.gz: e3b5eb28dd364012552e7f91e3e3b01f9d1db3778b4f7d0fe88662aed45c4073
 SHA512:
-  metadata.gz: 35b074807441355e162b1c9bdccf1303ed3ce9c8b125fd6043676261e297c362cce28d3fb651555476c2a14f84ab282a18f1e59bf6b2e10a2e4c7268cab13603
-  data.tar.gz: e5c9a043d6627f7bbfc8015d6104b679c1f80b99ec23952b353024c037e2c50954af36f1926e404005ab83a8637c360b92dd66e9aaa3722d852b865cd7111beb
+  metadata.gz: 02001fd4bbb80bc41567c449c4653aef0afa72766b1413cabe9cbbe61a248d2ef6c86bc1ae18bd2fad378b46748b9550e0b74001026514233de55aa04cc4f6ea
+  data.tar.gz: 34460c74d90057174f63461569e2132e320ec4440141e7914fa9c82075b6268f46680514f667dfe9a8eb6932964ab30ffa1d80f071bf8f22e15f9e8a5f6aaa0b

data/README.md

@@ -1,11 +1,10 @@
 # RailsHealthChecks
 
 [![CI](https://github.com/eclectic-coding/rails_health_checks/actions/workflows/ci.yml/badge.svg)](https://github.com/eclectic-coding/rails_health_checks/actions/workflows/ci.yml)
-[![gem](https://badge.fury.io/rb/rails_health_checks.svg)](https://badge.fury.io/rb/rails_health_checks)
+[![gem](https://img.shields.io/gem/v/rails_health_checks.svg)](https://rubygems.org/gems/rails_health_checks)
 [![downloads](https://img.shields.io/gem/dt/rails_health_checks.svg)](https://rubygems.org/gems/rails_health_checks)
 [![ruby](https://img.shields.io/badge/ruby-%3E%3D%203.3-ruby.svg)](https://www.ruby-lang.org)
 [![codecov](https://codecov.io/gh/eclectic-coding/rails_health_checks/branch/main/graph/badge.svg)](https://codecov.io/gh/eclectic-coding/rails_health_checks)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 A Rails engine providing structured, pluggable health check endpoints for monitoring application status. Goes beyond Rails' built-in `/up` endpoint with per-check diagnostics, latency tracking, and a configurable check registry.
 
@@ -14,6 +13,7 @@ A Rails engine providing structured, pluggable health check endpoints for monito
 - [Installation](#installation)
 - [Endpoints](#endpoints)
 - [Configuration](#configuration)
+- [Authentication](#authentication)
 - [Built-in Checks](#built-in-checks)
 - [Contributing](#contributing)
 - [License](#license)
@@ -85,6 +85,42 @@ end
 
 ---
 
+## Authentication
+
+By default health endpoints are public. Use one of the following strategies to restrict access. Unauthenticated requests receive `401 Unauthorized`.
+
+### Bearer token
+
+```ruby
+RailsHealthChecks.configure do |config|
+  config.token = ENV["HEALTH_TOKEN"]
+end
+```
+
+Requests must include `Authorization: Bearer <token>`.
+
+### IP allowlist
+
+```ruby
+RailsHealthChecks.configure do |config|
+  config.allowed_ips = ["127.0.0.1", "10.0.0.0/8"]  # exact IPs or CIDR ranges
+end
+```
+
+### Custom block
+
+```ruby
+RailsHealthChecks.configure do |config|
+  config.authenticate { |request| request.headers["X-Internal"] == "true" }
+end
+```
+
+The block receives the `ActionDispatch::Request` object and must return a truthy value to allow access.
+
+[↑ Back to top](#table-of-contents)
+
+---
+
 ## Built-in Checks
 
 | Check | Description |

data/app/controllers/rails_health_checks/application_controller.rb

@@ -2,5 +2,7 @@
 
 module RailsHealthChecks
   class ApplicationController < ActionController::API
+    include Authentication
+    before_action :authenticate!
   end
 end

data/lib/rails_health_checks/authentication.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module RailsHealthChecks
+  module Authentication
+    def authenticate!
+      config = RailsHealthChecks.configuration
+      return unless auth_configured?(config)
+      head :unauthorized unless authorized?(config)
+    end
+
+    private
+
+    def auth_configured?(config)
+      config.authenticate_block || config.token || config.allowed_ips
+    end
+
+    def authorized?(config)
+      if config.authenticate_block
+        config.authenticate_block.call(request)
+      elsif config.token
+        request.headers["Authorization"] == "Bearer #{config.token}"
+      elsif config.allowed_ips
+        ip_allowed?(config.allowed_ips)
+      end
+    end
+
+    def ip_allowed?(allowed_ips)
+      client_ip = IPAddr.new(request.ip)
+      allowed_ips.any? { |entry| IPAddr.new(entry).include?(client_ip) }
+    rescue IPAddr::InvalidAddressError
+      false
+    end
+  end
+end

data/lib/rails_health_checks/configuration.rb

@@ -2,11 +2,19 @@
 
 module RailsHealthChecks
   class Configuration
-    attr_accessor :checks, :timeout
+    attr_accessor :checks, :timeout, :allowed_ips, :token
+    attr_reader :authenticate_block
 
     def initialize
       @checks = [:database]
       @timeout = 5
+      @allowed_ips = nil
+      @token = nil
+      @authenticate_block = nil
+    end
+
+    def authenticate(&block)
+      @authenticate_block = block
     end
   end
 end

data/lib/rails_health_checks/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsHealthChecks
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/rails_health_checks.rb

@@ -3,6 +3,7 @@
 require "rails_health_checks/version"
 require "rails_health_checks/engine"
 require "rails_health_checks/configuration"
+require "rails_health_checks/authentication"
 require "rails_health_checks/check"
 require "rails_health_checks/checks/database_check"
 require "rails_health_checks/check_registry"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_health_checks
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Chuck Smith
@@ -41,6 +41,7 @@ files:
 - app/models/rails_health_checks/application_record.rb
 - config/routes.rb
 - lib/rails_health_checks.rb
+- lib/rails_health_checks/authentication.rb
 - lib/rails_health_checks/check.rb
 - lib/rails_health_checks/check_registry.rb
 - lib/rails_health_checks/checks/database_check.rb