rails_vitals 0.6.2 → 0.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c655986f52ddc0e0848b8e67c28d603ccea2a97dc6b85d9157a7a670fd298fc6
-  data.tar.gz: 49bbb1b8fc0041bd75edb7d3d990ed517dcd907f64b7f99af95eb2d33dbdee80
+  metadata.gz: a4479577c80975bad32203d017cff00cf4070589c6059424b393796bb5f4b7a2
+  data.tar.gz: e96412a5354e3e79ae97e4957a8e4c96372ffabb705fb8cb52251bb9348a4d9d
 SHA512:
-  metadata.gz: 7e905ff8aa217f398c7521b677c088f637b5483cd153af51db1453fbee560476d32b230a3a9d432d975910f60fd9992cd4368a79b6be07abb4a6f676cff5c866
-  data.tar.gz: fcd80c62bc58c1adfed045eb3764f29918705d6b9e0952af68f0f2601197f3af5079ca5abbe62aa6361c950b188711102f96ba3e36b28fa2766138b1fb69ce1d
+  metadata.gz: 9d7f670412fc9caaf74d8310161f246eb5d7f2d20a433a9eae01fa10350602afcfabbddb89048920b54a136001d0aaee0338c642ca6826dff3a8a99f133ee175
+  data.tar.gz: b46385277f03c958362eff854389098c921f6b7bdaf490ddbb41212c255a14c60c3c48c45c7a10fd290361dbd58d9a8619865c154b2a020b7daeb6bc342e9b66

data/app/controllers/rails_vitals/mcp_controller.rb

@@ -13,11 +13,12 @@ module RailsVitals
     private
 
     def verify_environment
-      if Rails.env.production?
+      unless RailsVitals.config.permitted_environment?
         render json: ResponseBuilder.error(
           nil,
           ResponseBuilder::AUTH_ERROR,
-          "RailsVitals MCP is not available in production"
+          "RailsVitals MCP is not available in this environment. " \
+          "Permitted: #{RailsVitals::Configuration::PERMITTED_ENVIRONMENTS.join(', ')}"
         ), status: :forbidden
       end
     end

data/lib/rails_vitals/analyzers/explain_analyzer.rb

@@ -1,8 +1,6 @@
 module RailsVitals
   module Analyzers
     class ExplainAnalyzer
-      SUPPORTED_ENVIRONMENTS = %w[development test].freeze
-
       COLOR_DANGER = "#fc8181"
       COLOR_HEALTHY = "#68d391"
       COLOR_WARNING = "#f6ad55"
@@ -225,7 +223,7 @@ module RailsVitals
       private
 
       def self.supported_environment?
-        SUPPORTED_ENVIRONMENTS.include?(Rails.env.to_s)
+        RailsVitals.config&.permitted_environment? || false
       end
 
       def self.select_query?(sql)
@@ -393,7 +391,8 @@ module RailsVitals
 
       def self.unsupported_env
         Result.new(
-          error: "EXPLAIN is only available in development and test environments.",
+          error: "EXPLAIN is only available in permitted environments: " \
+                 "#{RailsVitals::Configuration::PERMITTED_ENVIRONMENTS.join(', ')}.",
           sql: nil, plan: nil, warnings: [], suggestions: [],
           total_cost: nil, actual_time_ms: nil, rows_examined: nil
         )

data/lib/rails_vitals/configuration.rb

@@ -15,8 +15,10 @@ module RailsVitals
                   :mcp_max_log_size,
                   :mcp_slow_query_threshold_ms
 
+    PERMITTED_ENVIRONMENTS = %w[development test].freeze
+
     def initialize
-      @enabled                  = defined?(Rails) && !Rails.env.production?
+      @enabled                  = defined?(Rails) && permitted_environment?
       @store_size               = 200
       @store_enabled            = true
       @auth                     = :none
@@ -33,5 +35,9 @@ module RailsVitals
       @mcp_max_log_size            = 100
       @mcp_slow_query_threshold_ms = 100
     end
+
+    def permitted_environment?
+      PERMITTED_ENVIRONMENTS.include?(Rails.env.to_s)
+    end
   end
 end

data/lib/rails_vitals/engine.rb

@@ -16,7 +16,10 @@ module RailsVitals
 
     initializer "rails_vitals.mcp" do
       if RailsVitals.config.mcp_enabled
-        raise "RailsVitals MCP cannot run in production" if Rails.env.production?
+        unless RailsVitals.config.permitted_environment?
+          raise "RailsVitals MCP cannot run in #{Rails.env} environment. " \
+                "Permitted: #{RailsVitals::Configuration::PERMITTED_ENVIRONMENTS.join(', ')}"
+        end
 
         require "rails_vitals/mcp/auth"
         require "rails_vitals/mcp/response_builder"

data/lib/rails_vitals/playground/sandbox.rb

@@ -4,7 +4,14 @@ module RailsVitals
       BLOCKED_PATTERNS = [
         /\b(insert|update|delete|destroy|drop|truncate|create|alter)\b/i,
         /\.save/i, /\.save!/i, /\.update/i, /\.delete/i,
-        /\.destroy/i, /`/
+        /\.destroy/i, /`/,
+        /\.connection\b/i, /\.execute\b/i, /\.exec\b/i,
+        /\.send\b/i, /\.public_send\b/i, /\.__send__\b/i,
+        /\.send_data\b/i, /\.open\b/i,
+        /\.instance_eval\b/i, /\.class_eval\b/i, /\.module_eval\b/i,
+        /\.define_method\b/i, /\.method_missing\b/i,
+        /\bsystem\b/i, /\beval\b/i, /\bfork\b/i, /\bspawn\b/i,
+        /\bIO\b/i, /\bFile\b/i, /\bThread\b/i, /\bProcess\b/i
       ].freeze
 
       SAFE_EXPRESSION_PATTERN = /\A[a-zA-Z0-9_\.\s\(\),:\[\]{}'"!?=<>|&*+\-\/\\%]+\z/

data/lib/rails_vitals/version.rb

@@ -1,3 +1,3 @@
 module RailsVitals
-  VERSION = "0.6.2"
+  VERSION = "0.6.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_vitals
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.6.3
 platform: ruby
 authors:
 - David Sanchez