rails_vitals 0.6.2 → 0.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c655986f52ddc0e0848b8e67c28d603ccea2a97dc6b85d9157a7a670fd298fc6
-  data.tar.gz: 49bbb1b8fc0041bd75edb7d3d990ed517dcd907f64b7f99af95eb2d33dbdee80
+  metadata.gz: 7fb9a7c51b933da864e0f8ce0cfce6b0035cd1b47d90bf438115338cdb64cba2
+  data.tar.gz: c0a6a58e6ca56c35708a5132a9352fed34552d8a3ae33fc7033c7604b7fa6cf2
 SHA512:
-  metadata.gz: 7e905ff8aa217f398c7521b677c088f637b5483cd153af51db1453fbee560476d32b230a3a9d432d975910f60fd9992cd4368a79b6be07abb4a6f676cff5c866
-  data.tar.gz: fcd80c62bc58c1adfed045eb3764f29918705d6b9e0952af68f0f2601197f3af5079ca5abbe62aa6361c950b188711102f96ba3e36b28fa2766138b1fb69ce1d
+  metadata.gz: f5d40cc9d798c5c5fa4f2a02d173ff8c9991b273c66e50a81e201b987b46d5ac642a9b1e64d2e578c2055ce29b69abacfa373eb8b7bab4d22e4d6dc5966804d7
+  data.tar.gz: 717c9ca8d3d1f6561325635be1df4c53bd1c758295b95f29150b022dc8ab81c219abb6c49762f090b5a74b0f9c3b37b91f97f57be33867fb3c4a3555f76a7491

data/app/controllers/rails_vitals/application_controller.rb

@@ -13,8 +13,8 @@ module RailsVitals
         true
       when :basic
         authenticate_or_request_with_http_basic("RailsVitals") do |username, password|
-          username == RailsVitals.config.basic_auth_username &&
-            password == RailsVitals.config.basic_auth_password
+          ActiveSupport::SecurityUtils.secure_compare(username, RailsVitals.config.basic_auth_username.to_s) &
+            ActiveSupport::SecurityUtils.secure_compare(password, RailsVitals.config.basic_auth_password.to_s)
         end
       when Proc
         unless auth.call(self)

data/app/controllers/rails_vitals/mcp_controller.rb

@@ -13,11 +13,12 @@ module RailsVitals
     private
 
     def verify_environment
-      if Rails.env.production?
+      unless RailsVitals.config.permitted_environment?
         render json: ResponseBuilder.error(
           nil,
           ResponseBuilder::AUTH_ERROR,
-          "RailsVitals MCP is not available in production"
+          "RailsVitals MCP is not available in this environment. " \
+          "Permitted: #{RailsVitals::Configuration::PERMITTED_ENVIRONMENTS.join(', ')}"
         ), status: :forbidden
       end
     end

data/app/controllers/rails_vitals/playgrounds_controller.rb

@@ -10,6 +10,26 @@ module RailsVitals
     def create
       expression = params[:expression].to_s.strip
       clean_expr = clean_expression(expression)
+
+      unless params[:confirmed] == "1"
+        @expression = clean_expr
+        @result = Playground::Sandbox::Result.new(
+          error: "Please confirm that you understand this runs real queries",
+          queries: [], query_count: 0, duration_ms: 0,
+          model_name: nil, record_count: 0, score: nil, n1_patterns: []
+        )
+        model_name = Playground::Sandbox.extract_model_name(clean_expr)
+        if model_name
+          @available_assocs = associations_for_model(model_name)
+          @prechecked_assocs = Array(params[:access_associations]).reject(&:blank?)
+        else
+          build_index_data
+        end
+
+        render :index
+        return
+      end
+
       access_associations = Array(params[:access_associations]).reject(&:blank?)
 
       result = Playground::Sandbox.run(
@@ -17,7 +37,7 @@ module RailsVitals
         access_associations: access_associations
       )
 
-      model_name = Playground::Sandbox.extract_model_name(expression)
+      model_name = Playground::Sandbox.extract_model_name(clean_expr)
       @available_assocs = associations_for_model(model_name)
       @prechecked_assocs = access_associations
 
@@ -116,5 +136,12 @@ module RailsVitals
         }
       end
     end
+
+    def build_index_data
+      @default_query = default_query
+      @default_model = default_model_name
+      @available_assocs = associations_for_model(@default_model)
+      @prechecked_assocs = prechecked_associations
+    end
   end
 end

data/app/views/rails_vitals/playgrounds/index.html.erb

@@ -57,6 +57,18 @@
       Queries run against real data with a 100-record cap and 2s timeout.
     </div>
 
+    <label class="flex items-center gap-8 mb-16" style="cursor:pointer;font-size:13px;color:#a0aec0;">
+      <% if params[:confirmed] %>
+        <input type="checkbox" name="confirmed" value="1"
+               style="accent-color:#68d391;width:16px;height:16px;"
+               checked>
+      <% else %>
+        <input type="checkbox" name="confirmed" value="1"
+               style="accent-color:#68d391;width:16px;height:16px;">
+      <% end %>
+      I understand this runs real queries against my database
+    </label>
+
     <button type="submit" class="run-btn" id="run-btn">▶ Run</button>
   <% end %>
 </div>

data/lib/rails_vitals/analyzers/explain_analyzer.rb

@@ -1,8 +1,6 @@
 module RailsVitals
   module Analyzers
     class ExplainAnalyzer
-      SUPPORTED_ENVIRONMENTS = %w[development test].freeze
-
       COLOR_DANGER = "#fc8181"
       COLOR_HEALTHY = "#68d391"
       COLOR_WARNING = "#f6ad55"
@@ -225,7 +223,7 @@ module RailsVitals
       private
 
       def self.supported_environment?
-        SUPPORTED_ENVIRONMENTS.include?(Rails.env.to_s)
+        RailsVitals.config&.permitted_environment? || false
       end
 
       def self.select_query?(sql)
@@ -393,7 +391,8 @@ module RailsVitals
 
       def self.unsupported_env
         Result.new(
-          error: "EXPLAIN is only available in development and test environments.",
+          error: "EXPLAIN is only available in permitted environments: " \
+                 "#{RailsVitals::Configuration::PERMITTED_ENVIRONMENTS.join(', ')}.",
           sql: nil, plan: nil, warnings: [], suggestions: [],
           total_cost: nil, actual_time_ms: nil, rows_examined: nil
         )

data/lib/rails_vitals/configuration.rb

@@ -15,8 +15,10 @@ module RailsVitals
                   :mcp_max_log_size,
                   :mcp_slow_query_threshold_ms
 
+    PERMITTED_ENVIRONMENTS = %w[development test].freeze
+
     def initialize
-      @enabled                  = defined?(Rails) && !Rails.env.production?
+      @enabled                  = defined?(Rails) && permitted_environment?
       @store_size               = 200
       @store_enabled            = true
       @auth                     = :none
@@ -33,5 +35,9 @@ module RailsVitals
       @mcp_max_log_size            = 100
       @mcp_slow_query_threshold_ms = 100
     end
+
+    def permitted_environment?
+      PERMITTED_ENVIRONMENTS.include?(Rails.env.to_s)
+    end
   end
 end

data/lib/rails_vitals/engine.rb

@@ -16,7 +16,15 @@ module RailsVitals
 
     initializer "rails_vitals.mcp" do
       if RailsVitals.config.mcp_enabled
-        raise "RailsVitals MCP cannot run in production" if Rails.env.production?
+        unless RailsVitals.config.permitted_environment?
+          raise "RailsVitals MCP cannot run in #{Rails.env} environment. " \
+                "Permitted: #{RailsVitals::Configuration::PERMITTED_ENVIRONMENTS.join(', ')}"
+        end
+
+        token = RailsVitals.config.mcp_auth_token
+        if token.blank? || token.length < 16
+          raise "RailsVitals MCP requires mcp_auth_token to be at least 16 characters"
+        end
 
         require "rails_vitals/mcp/auth"
         require "rails_vitals/mcp/response_builder"

data/lib/rails_vitals/playground/sandbox.rb

@@ -4,7 +4,14 @@ module RailsVitals
       BLOCKED_PATTERNS = [
         /\b(insert|update|delete|destroy|drop|truncate|create|alter)\b/i,
         /\.save/i, /\.save!/i, /\.update/i, /\.delete/i,
-        /\.destroy/i, /`/
+        /\.destroy/i, /`/,
+        /\.connection\b/i, /\.execute\b/i, /\.exec\b/i,
+        /\.send\b/i, /\.public_send\b/i, /\.__send__\b/i,
+        /\.send_data\b/i, /\.open\b/i,
+        /\.instance_eval\b/i, /\.class_eval\b/i, /\.module_eval\b/i,
+        /\.define_method\b/i, /\.method_missing\b/i,
+        /\bsystem\b/i, /\beval\b/i, /\bfork\b/i, /\bspawn\b/i,
+        /\bIO\b/i, /\bFile\b/i, /\bThread\b/i, /\bProcess\b/i
       ].freeze
 
       SAFE_EXPRESSION_PATTERN = /\A[a-zA-Z0-9_\.\s\(\),:\[\]{}'"!?=<>|&*+\-\/\\%]+\z/

data/lib/rails_vitals/version.rb

@@ -1,3 +1,3 @@
 module RailsVitals
-  VERSION = "0.6.2"
+  VERSION = "0.6.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_vitals
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.6.4
 platform: ruby
 authors:
 - David Sanchez