robust_server_socket 0.3.3 → 0.4.3

data/lib/robust_server_socket/cacher.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+module RobustServerSocket
+  module Cacher # rubocop:disable Metrics/ModuleLength
+    class RedisConnectionError < StandardError; end
+
+    CLOCK_SKEW_MS = 30_000
+
+    class << self # rubocop:disable Metrics/ClassLength
+      def atomic_validate_and_log(key, ttl, timestamp_ms, expiration_time)
+        current_ms = Process.clock_gettime(Process::CLOCK_REALTIME, :millisecond)
+        redis.with do |conn|
+          conn.eval(lua_atomic_validate_and_log, keys: [key],
+                                                 argv: [ttl, timestamp_ms, expiration_time, current_ms])
+        end
+      rescue ::Redis::BaseConnectionError => e
+        handle_redis_error(e, 'atomic_validate_and_log')
+        raise RedisConnectionError, "Failed to validate token: #{e.message}"
+      end
+
+      def incr_sliding_window_count(key, window_seconds)
+        now_ns = Process.clock_gettime(Process::CLOCK_REALTIME, :nanosecond)
+        redis.with do |conn|
+          conn.eval(lua_sliding_window, keys: [key],
+                                        argv: [now_ns, window_seconds * 1_000_000_000, window_seconds, now_ns.to_s])
+        end
+      rescue ::Redis::BaseConnectionError => e
+        handle_redis_error(e, 'incr_sliding_window_count')
+        raise RedisConnectionError, "Failed to count sliding window: #{e.message}"
+      end
+
+      def get(key)
+        redis.with do |conn|
+          conn.get(key)
+        end
+      rescue ::Redis::BaseConnectionError => e
+        handle_redis_error(e, 'get')
+        nil
+      end
+
+      def health_check
+        redis.with do |conn|
+          conn.ping == 'PONG'
+        end
+      rescue ::Redis::BaseConnectionError
+        false
+      end
+
+      def with_redis(&block)
+        redis.with(&block)
+      rescue ::Redis::BaseConnectionError => e
+        handle_redis_error(e, 'with_redis')
+        raise RedisConnectionError, "Redis operation failed: #{e.message}"
+      end
+
+      # Clear cached Redis connection pool (useful for hot reloading in development)
+      def clear_redis_pool_cache!
+        @redis = nil
+      end
+
+      private
+
+      def lua_sliding_window
+        <<~LUA
+          local key = KEYS[1]
+          local now_ns = tonumber(ARGV[1])
+          local window_ns = tonumber(ARGV[2])
+          local window_s = tonumber(ARGV[3])
+          local member = ARGV[4]
+
+          redis.call('ZREMRANGEBYSCORE', key, '-inf', now_ns - window_ns)
+          redis.call('ZADD', key, now_ns, member)
+          redis.call('EXPIRE', key, window_s)
+          return redis.call('ZCARD', key)
+        LUA
+      end
+
+      def lua_atomic_validate_and_log
+        <<~LUA
+          local key = KEYS[1]
+          local ttl = tonumber(ARGV[1])
+          local timestamp_ms = tonumber(ARGV[2])
+          local expiration_ms = tonumber(ARGV[3]) * 1000
+          local current_ms = tonumber(ARGV[4])
+
+          if timestamp_ms > current_ms + #{CLOCK_SKEW_MS} then
+            return 'stale'
+          end
+
+          if expiration_ms <= (current_ms - timestamp_ms) then
+            return 'stale'
+          end
+
+          -- Check if token was already used
+          local current = redis.call('GET', key)
+          if current and tonumber(current) > 0 then
+            return 'used'
+          end
+
+          -- Mark token as used
+          redis.call('INCRBY', key, 1)
+          redis.call('EXPIRE', key, ttl)
+
+          return 'ok'
+        LUA
+      end
+
+      # Cache Redis connection pool at module level for the lifetime of the Rails process
+      # This avoids recreating the connection pool on every Redis operation
+      def redis
+        @redis ||= ::ConnectionPool::Wrapper.new(**pool_config) do
+          ::Redis.new(redis_config)
+        end
+      end
+
+      def pool_config
+        {
+          size: ENV.fetch('REDIS_POOL_SIZE', 25).to_i,
+          timeout: ENV.fetch('REDIS_POOL_TIMEOUT', 1).to_f
+        }
+      end
+
+      def redis_config
+        config = {
+          url: ::RobustServerSocket.configuration.redis_url,
+          reconnect_attempts: 3,
+          timeout: 1.0,
+          connect_timeout: 2.0
+        }
+
+        password = ::RobustServerSocket.configuration.redis_pass
+        config[:password] = password if password && !password.empty?
+
+        config
+      end
+
+      def handle_redis_error(error, operation)
+        warn "Redis operation '#{operation}' failed: #{error.class} - #{error.message}"
+      end
+    end
+  end
+end

data/lib/robust_server_socket/client_token.rb

@@ -1,20 +1,13 @@
-require_relative 'secure_token/cacher'
-require_relative 'secure_token/decrypt'
-require_relative 'rate_limiter'
+# frozen_string_literal: true
 
 module RobustServerSocket
   class ClientToken
     TOKEN_REGEXP = /\A(.+)_(\d{10,})\z/.freeze
 
     InvalidToken = Class.new(StandardError)
-    UnauthorizedClient = Class.new(StandardError)
-    UsedToken = Class.new(StandardError)
-    StaleToken = Class.new(StandardError)
 
     def self.validate!(secure_token)
-      new(secure_token).tap do |instance|
-        instance.validate!
-      end
+      new(secure_token).tap(&:validate!)
     end
 
     def initialize(secure_token)
@@ -23,34 +16,25 @@ module RobustServerSocket
     end
 
     def validate!
-      raise InvalidToken unless decrypted_token
-      raise UnauthorizedClient unless client
-
-      RateLimiter.check!(client)
-
-      result = atomic_validate_and_log_token
-
-      case result
-      when 'stale'
-        raise StaleToken
-      when 'used'
-        raise UsedToken
-      when 'ok'
-        true
-      else
-        raise InvalidToken, "Unexpected validation result: #{result}"
-      end
+      modules_checks!
+    rescue SecureToken::InvalidToken => e
+      raise InvalidToken, e.message
     end
 
     def valid?
-      !!(decrypted_token &&
-        client &&
-        RateLimiter.check(client) &&
-        atomic_validate_and_log_token == 'ok')
+      modules_checks
     rescue StandardError
       false
     end
 
+    def modules_checks
+      true
+    end
+
+    def modules_checks!
+      true
+    end
+
     def client
       @client ||= begin
         target = client_name.strip
@@ -58,19 +42,6 @@ module RobustServerSocket
       end
     end
 
-    def token_not_expired?
-      token_expiration_time > Time.now.utc.to_i - timestamp
-    end
-
-    def atomic_validate_and_log_token
-      SecureToken::Cacher.atomic_validate_and_log(
-        decrypted_token,
-        token_expiration_time + 300,
-        timestamp,
-        token_expiration_time
-      )
-    end
-
     def decrypted_token
       @decrypted_token ||= SecureToken::Decrypt.call(@secure_token)
     end
@@ -93,6 +64,7 @@ module RobustServerSocket
       @split_token ||= begin
         match_data = decrypted_token.to_s.match(TOKEN_REGEXP)
         raise InvalidToken, 'Invalid token format' unless match_data
+
         match_data.captures
       end
     end
@@ -114,6 +86,9 @@ module RobustServerSocket
       raise InvalidToken, 'Token cannot be empty' if token.empty?
       raise InvalidToken, 'Token too long' if token.length > 2048
 
+      # Check for null-byte injection
+      raise InvalidToken, 'Token contains invalid characters' if token.include?("\x00")
+
       token
     end
   end

data/lib/robust_server_socket/configuration.rb

@@ -1,12 +1,25 @@
+# frozen_string_literal: true
+
 module RobustServerSocket
   module Configuration
     MIN_KEY_SIZE = 2048
 
+    ConfigurationError = Class.new(StandardError)
+
     attr_reader :configuration, :configured
 
+    def _push_modules_check_code(code)
+      configuration._modules_check_rows.push(code)
+    end
+
+    def _push_bang_modules_check_code(code)
+      configuration._bang_modules_check_rows.push(code)
+    end
+
     def configure
       @configuration ||= ConfigStore.new
       yield(configuration)
+      validate_configuration!
       validate_key_security!
 
       @configured = true
@@ -29,13 +42,25 @@ module RobustServerSocket
 
     private
 
+    def validate_configuration!
+      validate_positive!(:rate_limit_max_requests)
+      validate_positive!(:rate_limit_window_seconds)
+      validate_positive!(:token_expiration_time)
+    end
+
+    def validate_positive!(attr)
+      return if configuration.public_send(attr).to_i.positive?
+
+      raise ConfigurationError, "#{attr} must be positive"
+    end
+
     def validate_key_security!
       key = ::OpenSSL::PKey::RSA.new(configuration.private_key)
       key_bits = key.n.num_bits
 
       if key_bits < MIN_KEY_SIZE
         raise SecurityError,
-          "RSA key size (#{key_bits} bits) below minimum (#{MIN_KEY_SIZE} bits)"
+              "RSA key size (#{key_bits} bits) below minimum (#{MIN_KEY_SIZE} bits)"
       end
     rescue ::OpenSSL::PKey::RSAError => e
       raise SecurityError, "Invalid private key: #{e.message}"
@@ -43,13 +68,19 @@ module RobustServerSocket
   end
 
   class ConfigStore
-    attr_accessor :allowed_services, :private_key, :token_expiration_time, :redis_url, :redis_pass,
-                  :rate_limit_enabled, :rate_limit_max_requests, :rate_limit_window_seconds
+    attr_accessor :allowed_services, :private_key, :token_expiration_time,
+                  :redis_url, :redis_pass,
+                  :rate_limit_max_requests, :rate_limit_window_seconds, :using_modules
+
+    attr_reader :_modules_check_rows, :_bang_modules_check_rows
 
     def initialize
-      @rate_limit_enabled = false
       @rate_limit_max_requests = 100
       @rate_limit_window_seconds = 60
+      @token_expiration_time = 10
+      @using_modules = %i[client_auth_protection rate_limit_protection replay_attack_protection]
+      @_modules_check_rows = []
+      @_bang_modules_check_rows = []
     end
   end
 end

data/lib/robust_server_socket/modules/client_auth_protection.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module RobustServerSocket
+  module Modules
+    module ClientAuthProtection
+      UnauthorizedClient = Class.new(StandardError)
+
+      def self.included(_base)
+        RobustServerSocket._push_modules_check_code('validate_client')
+        RobustServerSocket._push_bang_modules_check_code("validate_client!\n")
+      end
+
+      def validate_client
+        !!client
+      end
+
+      def validate_client!
+        raise UnauthorizedClient unless validate_client
+      end
+    end
+  end
+end

data/lib/robust_server_socket/modules/rate_limit_protection.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative '../cacher'
+require_relative '../rate_limiter'
+
+module RobustServerSocket
+  module Modules
+    module RateLimitProtection
+      def self.included(_base)
+        RobustServerSocket._push_modules_check_code('validate_rate_limit')
+        RobustServerSocket._push_bang_modules_check_code("validate_rate_limit!\n")
+      end
+
+      def validate_rate_limit
+        RateLimiter.check(client)
+      end
+
+      def validate_rate_limit!
+        RateLimiter.check!(client)
+      end
+    end
+  end
+end

data/lib/robust_server_socket/modules/replay_attack_protection.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative '../cacher'
+
+module RobustServerSocket
+  module Modules
+    module ReplayAttackProtection
+      UsedToken = Class.new(StandardError)
+      StaleToken = Class.new(StandardError)
+
+      def self.included(_base)
+        RobustServerSocket._push_modules_check_code('atomic_validate_and_log_token')
+        RobustServerSocket._push_bang_modules_check_code("atomic_validate_and_log_token!\n")
+      end
+
+      def atomic_validate_and_log_token!
+        result = Cacher.atomic_validate_and_log(
+          decrypted_token, store_used_token_time, timestamp, token_expiration_time
+        )
+        handle_validation_result!(result)
+      end
+
+      def atomic_validate_and_log_token
+        Cacher.atomic_validate_and_log(
+          decrypted_token,
+          store_used_token_time,
+          timestamp,
+          token_expiration_time
+        ) == 'ok'
+      end
+
+      private
+
+      def handle_validation_result!(result)
+        case result
+        when 'ok' then true
+        when 'stale' then raise StaleToken
+        when 'used' then raise UsedToken
+        else raise StandardError, "Unexpected result: #{result}"
+        end
+      end
+
+      def store_used_token_time
+        RobustServerSocket.configuration.token_expiration_time + Cacher::CLOCK_SKEW_MS / 1000
+      end
+    end
+  end
+end

data/lib/robust_server_socket/rate_limiter.rb

@@ -1,4 +1,4 @@
-require_relative 'secure_token/cacher'
+# frozen_string_literal: true
 
 module RobustServerSocket
   class RateLimiter
@@ -6,64 +6,40 @@ module RobustServerSocket
 
     class << self
       def check!(client_name)
-        unless (attempts = check(client_name))
-          actual_attempts = current_attempts(client_name)
-          raise RateLimitExceeded, "Rate limit exceeded for #{client_name}: #{actual_attempts}/#{max_requests} requests per #{window_seconds}s"
-        end
+        return if check(client_name)
 
-        attempts
+        raise RateLimitExceeded,
+              "Rate limit exceeded for #{client_name}: max #{max_requests} per #{window_seconds}s"
       end
 
       def check(client_name)
-        return 0 unless rate_limit_enabled?
-
-        key = rate_limit_key(client_name)
-        attempts = increment_attempts(key)
-
-        return false if attempts > max_requests
-
-        attempts
-      end
-
-      def current_attempts(client_name)
-        return 0 unless rate_limit_enabled?
-
-        key = rate_limit_key(client_name)
-        SecureToken::Cacher.get(key).to_i
+        attempts = record_attempt(client_name)
+        attempts <= max_requests
       end
 
       def reset!(client_name)
         key = rate_limit_key(client_name)
-        SecureToken::Cacher.with_redis do |conn|
+        Cacher.with_redis do |conn|
           conn.del(key)
         end
-      rescue SecureToken::Cacher::RedisConnectionError => e
+      rescue Cacher::RedisConnectionError => e
         handle_redis_error(e, 'reset')
         nil
       end
 
       private
 
-      def increment_attempts(key)
-        SecureToken::Cacher.with_redis do |conn|
-          attempts = conn.incr(key)
-          # Set expiration only on first attempt to ensure atomic window
-          conn.expire(key, window_seconds) if attempts == 1
-          attempts
-        end
-      rescue SecureToken::Cacher::RedisConnectionError => e
-        handle_redis_error(e, 'increment_attempts')
-        0 # Fail open: allow request if Redis is down
+      def record_attempt(client_name)
+        Cacher.incr_sliding_window_count(rate_limit_key(client_name), window_seconds)
+      rescue Cacher::RedisConnectionError => e
+        handle_redis_error(e, 'record_attempt')
+        0
       end
 
       def rate_limit_key(client_name)
         "rate_limit:#{client_name}"
       end
 
-      def rate_limit_enabled?
-        RobustServerSocket.configuration.rate_limit_enabled
-      end
-
       def max_requests
         RobustServerSocket.configuration.rate_limit_max_requests
       end

data/lib/robust_server_socket/secure_token/decrypt.rb

@@ -1,22 +1,18 @@
-require 'openssl'
+# frozen_string_literal: true
 
 module RobustServerSocket
   module SecureToken
-    BASE64_REGEXP = /\A[A-Za-z0-9+\/]*={0,2}\z/.freeze
+    BASE64_REGEXP = %r{\A[A-Za-z0-9+/]+={0,2}\z}.freeze
     InvalidToken = Class.new(StandardError)
 
     module Decrypt
       class << self
         def call(token)
-          unless token.is_a?(String) && token.match?(BASE64_REGEXP)
-            raise InvalidToken, 'Invalid token format'
-          end
+          raise InvalidToken, 'Invalid token format' unless token.is_a?(String) && token.match?(BASE64_REGEXP)
 
           decoded_token = ::Base64.strict_decode64(token)
 
-          if decoded_token.bytesize > 1024
-            raise InvalidToken, 'Token too large'
-          end
+          raise InvalidToken, 'Token too large' if decoded_token.bytesize > 1024
 
           private_key.private_decrypt(decoded_token, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING).force_encoding('UTF-8')
         rescue ::OpenSSL::PKey::RSAError, ArgumentError

data/lib/robust_server_socket.rb

@@ -1,21 +1,37 @@
 # frozen_string_literal: true
 
+require 'base64'
+require 'openssl'
+require 'redis'
+require 'connection_pool'
+
 require_relative 'robust_server_socket/configuration'
+require_relative 'robust_server_socket/secure_token/decrypt'
+require_relative 'robust_server_socket/client_token'
 
 module RobustServerSocket
   extend RobustServerSocket::Configuration
 
   module_function
 
-  def load!
+  def load! # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength
     raise 'You must correctly configure RobustServerSocket first!' unless configured?
 
-    require 'openssl'
-    require 'base64'
-    require 'redis'
-    require 'connection_pool'
+    configuration.using_modules.each do |mod|
+      raise ArgumentError, 'Module must be a Symbol!' unless mod.is_a?(Symbol)
+
+      require_relative "robust_server_socket/modules/#{mod}"
+      ClientToken.include const_get(mod.to_s.split('_').map(&:capitalize).unshift('Modules::').join)
+    end
+
+    ClientToken.class_eval(<<~METHOD, __FILE__, __LINE__ + 1)
+      def modules_checks
+        #{(RobustServerSocket.configuration._modules_check_rows.empty? ? ['true'] : RobustServerSocket.configuration._modules_check_rows.map(&:strip)).join(' && ')}
+      end
 
-    require_relative 'robust_server_socket/rate_limiter'
-    require_relative 'robust_server_socket/client_token'
+      def modules_checks!
+        #{(RobustServerSocket.configuration._bang_modules_check_rows.empty? ? ['true'] : RobustServerSocket.configuration._bang_modules_check_rows).join}
+      end
+    METHOD
   end
 end

data/lib/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RobustServerSocket
-  VERSION = '0.3.3'
+  VERSION = '0.4.3'
 end

data/robust_server_socket.gemspec

@@ -1,16 +1,16 @@
 # frozen_string_literal: true
 
-require "./lib/version"
+require './lib/version'
 
 Gem::Specification.new do |spec|
-  spec.name = "robust_server_socket"
+  spec.name = 'robust_server_socket'
   spec.version = RobustServerSocket::VERSION
-  spec.authors = ["tee_zed"]
-  spec.email = ["tee0zed@gmail.com"]
-  spec.description = "Robust Server Socket"
-  spec.summary = "Robust Server Socket gem for RobustPro"
-  spec.license = "MIT"
-  spec.required_ruby_version = ">= 2.7.0"
+  spec.authors = ['tee_zed']
+  spec.email = ['tee0zed@gmail.com']
+  spec.description = 'Robust Server Socket'
+  spec.summary = 'Robust Server Socket gem for RobustPro'
+  spec.license = 'MIT'
+  spec.required_ruby_version = '>= 2.7.0'
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
@@ -20,13 +20,13 @@ Gem::Specification.new do |spec|
         f.start_with?(*%w[bin/ test/ spec/ features/ .git .circleci appveyor Gemfile])
     end
   end
-  spec.bindir = "exe"
+  spec.bindir = 'exe'
   spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
-  spec.add_dependency 'rspec'
+  spec.require_paths = ['lib']
+  spec.add_dependency 'hiredis'
   spec.add_dependency 'rake'
   spec.add_dependency 'redis'
-  spec.add_dependency 'hiredis'
+  spec.add_dependency 'rspec'
 
   # Uncomment to register a new dependency of your gem
   # spec.add_dependency "example-gem", "~> 1.0"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: robust_server_socket
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.3
 platform: ruby
 authors:
 - tee_zed
@@ -10,7 +10,7 @@ cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: rspec
+  name: hiredis
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -52,7 +52,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: hiredis
+  name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -73,16 +73,21 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".rspec"
+- ".rubocop.yml"
+- ".ruby-version"
 - CODE_OF_CONDUCT.md
 - LICENSE.txt
 - README.en.md
 - README.md
 - Rakefile
 - lib/robust_server_socket.rb
+- lib/robust_server_socket/cacher.rb
 - lib/robust_server_socket/client_token.rb
 - lib/robust_server_socket/configuration.rb
+- lib/robust_server_socket/modules/client_auth_protection.rb
+- lib/robust_server_socket/modules/rate_limit_protection.rb
+- lib/robust_server_socket/modules/replay_attack_protection.rb
 - lib/robust_server_socket/rate_limiter.rb
-- lib/robust_server_socket/secure_token/cacher.rb
 - lib/robust_server_socket/secure_token/decrypt.rb
 - lib/version.rb
 - robust_server_socket.gemspec
@@ -103,7 +108,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Robust Server Socket gem for RobustPro
 test_files: []