roo_on_rails 1.11.1 → 1.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 71e9f8c88b0d2cc851905371ded727515b81655f
-  data.tar.gz: 0ca3d032fd13e53e14888833024b50bf068348f4
+  metadata.gz: 05edf07734c3e18175c4b7f10d220b4443e8b23f
+  data.tar.gz: fd09c771c91cfb18b2c1cc31ec0566f4585eee19
 SHA512:
-  metadata.gz: 82ec9396a7be546d406db40f8eebb252569a40c87824cd8394312d9cbff625406f81401a4e85b9cc8fa619732bda1452c613174e72cf410dffc38dd07d4cd6f3
-  data.tar.gz: 2dd9ddcd748498df776be201a5a2b34345580119ca2a0dc6728150c67152c0c3a678d7b7710c50f895de058eb6536a6134cab5b07471485d41a0161b8583fcfb
+  metadata.gz: 9bbcfae06c1983dddf2bf86a037207bd93dc59ec86ba9772320a8e90e1d16bf6b034b848cf23292f755eb6e50557a99a0c6952d3099d5070386838db3904e404
+  data.tar.gz: d7c935d825c03932d8cea692b4f9fefd8b971433283b4e4fe480143d3e4f043ae5260c4240a29369add01af2e62110d5fbef0062400dcca4b5b3daf88f366e14

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+# v1.12.0 (2017-09-27)
+
+Features (library):
+- Provides API authentication concern for controllers. (#67)
+
 # v1.11.1 (2017-09-11)
 
 Bug fixes:

data/README.md

@@ -256,6 +256,34 @@ When `ROUTEMASTER_ENABLED` is set to `true` we attempt to configure [`routemaste
 
 If you then want to enable the publishing of events onto the event bus, you need to set `ROUTEMASTER_PUBLISHING_ENABLED` to `true` and implement publishers as needed. An example of how to do this is detailed in [`README.routemaster_client.md`](README.routemaster_client.md).
 
+### API Authentication
+
+RooOnRails provides a concern which will make adding rotatable API authentication to your service a breeze:
+
+```ruby
+require 'roo_on_rails/concerns/require_api_key'
+
+class ThingController < ActionController::Base
+  require_api_key
+  # or
+  require_api_key(only: :update)
+  # or
+  require_api_key(only_services: %i(service_1 service_2))
+
+  def index
+    # etc
+end
+```
+
+Keys are specified in environment variables ending with `_CLIENT_KEY`, where the value is a comma separated list of keys which the specified service can authenticate with. This means that if your service has the environment variables:
+
+```
+SERVICE_1_CLIENT_KEY=abc123abc123,def456def456
+SERVICE_2_CLIENT_KEY=I-never-could-get-the-hang-of-Thursdays
+```
+
+Then, for any controller where this concern has been initiated, Basic Authentication will be required and only `service_1:abc123abc123`, `service_1:def456def456` and `service_2:I-never-could-get-the-hang-of-Thursdays` will be allowed access.
+
 ## Command features
 
 ### Usage

data/lib/roo_on_rails/concerns/require_api_key.rb

@@ -0,0 +1,108 @@
+require 'active_support/concern'
+require 'action_controller/metal/http_authentication'
+
+module RooOnRails
+  module Concerns
+    # This concern allows API authentication in a consistent manner.
+    #
+    # If a service connects with basic auth using the username "service" then the
+    # `SERVICE_CLIENT_KEY` environment variable must have the given password as one of
+    # the comma separated strings within it or a 403 will be raised.
+    #
+    # @example: Any service with an acceptable key can access routes
+    #
+    #     class ThingController < ApplicationController
+    #       include RooOnRails::Concerns::RequireApiKey
+    #       require_api_key
+    #
+    #       # etc
+    #     end
+    #
+    # @example: Only the specified clients can access specific routes in this controller
+    #
+    #     class ThingController < ApplicationController
+    #       include RooOnRails::Concerns::RequireApiKey
+    #       require_api_key(only_services: :my_service, only: :create)
+    #
+    #       # etc
+    #     end
+    module RequireApiKey
+      extend ActiveSupport::Concern
+      include ActionController::HttpAuthentication::Basic::ControllerMethods
+
+      attr_reader :current_client
+
+      module ClassMethods
+        # Declares that routes on the controller must have access credentials specified
+        # in the request that match the approparite environment variables.
+        #
+        # @param :only_services (#to_s,Array<#to_s>) Restricts the services which will be accepted
+        # @see AbstractController::Callbacks::ClassMethods#before_action for additional scoping opts
+        def require_api_key(only_services: nil, **options)
+          before_action(**options) do
+            authenticate_or_request_with_http_basic('Authenitcation required') do |service_name, client_key|
+              Authenticator.new([*only_services]).valid?(service_name, client_key).tap do |is_valid|
+                @current_client = OpenStruct.new(name: service_name).freeze if is_valid
+              end
+            end
+          end
+        end
+      end
+
+      # This functionality pulled out into a new class for testability
+      class Authenticator
+        def initialize(whitelisted_clients)
+          @whitelisted_clients = whitelisted_clients.map(&:to_s)
+        end
+
+        def valid?(service_name, client_key)
+          return false unless whitelisted?(service_name)
+
+          NewRelic::Agent.add_custom_attributes(httpBasicUserId: service_name) if defined?(NewRelic)
+          ClientApiKeys.instance.valid?(service_name, client_key)
+        end
+
+        private
+
+        def whitelisted?(service_name)
+          return true if @whitelisted_clients.empty?
+          @whitelisted_clients.include?(service_name)
+        end
+      end
+
+      class ClientApiKeys
+        include Singleton
+
+        CLIENT_KEY_NAME_SUFFIX_REGEX = /_CLIENT_KEY\Z/
+
+        def initialize
+          @cache = ENV.select { |key| key =~ CLIENT_KEY_NAME_SUFFIX_REGEX }
+                      .map { |k, v| [service_name(k), parse_client_keys(v)] }
+                      .to_h
+                      .freeze
+        end
+
+        def valid?(service_name, client_key)
+          return false if service_name == '' || client_key == ''
+
+          client_keys = @cache[normalize(service_name)]
+          client_keys && client_keys.include?(client_key)
+        end
+
+        private
+
+        def service_name(client_key_name)
+          normalize(client_key_name.sub(CLIENT_KEY_NAME_SUFFIX_REGEX, ''))
+        end
+
+        def normalize(service_name)
+          service_name.upcase.gsub(/[A-Z0-9]+/, '_')
+        end
+
+        def parse_client_keys(str)
+          (str || '').split(',').map(&:strip).to_set.freeze
+        end
+      end
+    end
+  end
+end

data/lib/roo_on_rails/version.rb

@@ -1,3 +1,3 @@
 module RooOnRails
-  VERSION = '1.11.1'.freeze
+  VERSION = '1.12.0'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: roo_on_rails
 version: !ruby/object:Gem::Version
-  version: 1.11.1
+  version: 1.12.0
 platform: ruby
 authors:
 - Julien Letessier
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-09-11 00:00:00.000000000 Z
+date: 2017-09-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dotenv-rails
@@ -415,6 +415,7 @@ files:
 - lib/roo_on_rails/checks/papertrail/token.rb
 - lib/roo_on_rails/checks/sidekiq/settings.rb
 - lib/roo_on_rails/checks/sidekiq/sidekiq.rb
+- lib/roo_on_rails/concerns/require_api_key.rb
 - lib/roo_on_rails/config.rb
 - lib/roo_on_rails/context_logging.rb
 - lib/roo_on_rails/default.env