roo_on_rails 1.15.0 → 1.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 350514c8b5824a6829103a912a01e155aa18074f
-  data.tar.gz: 827cb9bec23c0d69bab1e2df74024e63861853ce
+  metadata.gz: 6cff300e49683272e9b7624135b56e0e62ffbeda
+  data.tar.gz: 78b553933ddb68cc54b5082352a9faf96edccdea
 SHA512:
-  metadata.gz: 5954c887ece5accaeaf6b9acb328ef24978f6d5673ae2ba2ae2cb8d29f0bcc83f1b55346fb500371cba87ad3e8ebeeba2f44d6b0503c96ae7c696a594e03e768
-  data.tar.gz: 38aaf68d5cf8271b15597ba0145088f272ceb52cdbeb03602b38fb215dbf4b2220cb6d95008676bfad9062c2a4e831994b6bc1837d450fdc9366819943a701fe
+  metadata.gz: b9f54d9e74c746a4f920aee6769c6f97bbf31ba15c859fe42aa0c6adbf29a997a92c6b7ae9a6cb8d78867efc83b9454926e27f0bc8b5d65416de2f86d872092b
+  data.tar.gz: b922a04d6238856b3d956539a9b8b3f379f85932792cc78f7c6136370b0069ed0c7f6794e4df74431dfdb3ee7f856e7b51d1faa3cea05fea26bd28d626669aab

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 # HEAD
 
-_A description of your awesome new stuff here!_
+_A description of your awesome work here!_
+
+# v1.16.0 (2017-11-17)
+
+Features:
+
+- Allow SSL enforcement to be disabled via `ROO_ON_RAILS_DISABLE_SSL_ENFORCEMENT` environment variable (#82)
+
+Bug fix:
+
+- Ensure we can distinguish between environments' identity services (#81)
 
 # v1.15.0
 

data/README.md

@@ -91,6 +91,14 @@ We'll insert the following middlewares into the rails stack:
    with `ROO_ON_RAILS_RACK_DEFLATE` (default: 'YES').
 4. Optional middlewares for Google Oauth2 (more below).
 
+
+#### Disabling SSL enforcement
+
+If you're running your application on Hopper, you'll need to turn off SSL enforcement
+as we do that at edge level in Cloudflare rather than the application code itself,
+which must be served over HTTP to its associated ALB, which handles SSL termination.
+To do this, you can set the `ROO_ON_RAILS_DISABLE_SSL_ENFORCEMENT` to `YES`.
+
 ### Database configuration
 
 The database statement timeout will be set to a low value by default. Use
@@ -227,6 +235,13 @@ available:
 require 'roo_on_rails/railties/roo_identity'
 ```
 
+In non-development environments you must also set the `VALID_IDENTITY_URL_PREFIXES` environment
+variable to be a comma separasted list of the URL prefixes which valid JWTs come from, eg:
+
+```
+https://deliveroo.co.uk/identity-keys/,https://identity.deliveroo.com/jwks/
+```
+
 Any inbound request which has a valid JWT will have the claims made available:
 
 ```ruby

data/lib/roo_on_rails/rack/populate_env_from_jwt.rb

@@ -6,10 +6,6 @@ module RooOnRails
   module Rack
     class PopulateEnvFromJWT
       UnacceptableKeyError = Class.new(RuntimeError)
-      # Hardcoded URLs for valid keys per environment. These will change very infrequently.
-      VALID_JWK_URL_PREFIXES = YAML.load(
-        File.read(File.expand_path('../valid_identity_service_prefixes.yml', __FILE__))
-      ).freeze
 
       def initialize(app, logger:, skip_sig_verify: true)
         @app = app
@@ -21,6 +17,11 @@ module RooOnRails
           @verify_sigs = false
         else
           @verify_sigs = true
+          @key_prefixes = ENV['VALID_IDENTITY_URL_PREFIXES'].split(',')
+
+          if @key_prefixes.empty?
+            raise "No identity service URLs have been set: ENV['VALID_IDENTITY_URL_PREFIXES']"
+          end
         end
       end
 
@@ -62,7 +63,6 @@ module RooOnRails
 
       def acceptable_key?(key_url)
         return false if key_url.nil?
-        @key_prefixes ||= VALID_JWK_URL_PREFIXES[ENV['RACK_ENV']]
         @key_prefixes.any? { |acceptable| key_url.starts_with?(acceptable) }
       end
 

data/lib/roo_on_rails/railties/http.rb

@@ -18,7 +18,7 @@ module RooOnRails
             ::Rack::Timeout
           )
 
-          middleware_to_insert_before = Rails::VERSION::MAJOR < 4 ? ::ActionDispatch::Cookies : ::Rack::Head 
+          middleware_to_insert_before = Rails::VERSION::MAJOR < 4 ? ::ActionDispatch::Cookies : ::Rack::Head
 
           # This needs to be inserted low in the stack, before Rails returns the
           # thread-current connection to the pool.
@@ -34,7 +34,8 @@ module RooOnRails
           end
 
           # Don't use SslEnforcer in test environment as it breaks Capybara
-          unless Rails.env.test?
+          unless Rails.env.test? ||
+                 ENV.fetch('ROO_ON_RAILS_DISABLE_SSL_ENFORCEMENT', '') =~ /\A(YES|TRUE|ON|1)\Z/i
             app.config.middleware.insert_before(
               middleware_to_insert_before,
               ::Rack::SslEnforcer

data/lib/roo_on_rails/version.rb

@@ -1,3 +1,3 @@
 module RooOnRails
-  VERSION = '1.15.0'.freeze
+  VERSION = '1.16.0'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: roo_on_rails
 version: !ruby/object:Gem::Version
-  version: 1.15.0
+  version: 1.16.0
 platform: ruby
 authors:
 - Julien Letessier
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-11-08 00:00:00.000000000 Z
+date: 2017-11-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dotenv-rails
@@ -455,7 +455,6 @@ files:
 - lib/roo_on_rails/papertrail_client.rb
 - lib/roo_on_rails/rack/populate_env_from_jwt.rb
 - lib/roo_on_rails/rack/safe_timeouts.rb
-- lib/roo_on_rails/rack/valid_identity_service_prefixes.yml
 - lib/roo_on_rails/railties/database.rb
 - lib/roo_on_rails/railties/env.rb
 - lib/roo_on_rails/railties/google_oauth.rb

data/lib/roo_on_rails/rack/valid_identity_service_prefixes.yml

@@ -1,6 +0,0 @@
-production:
-  - https://deliveroo.co.uk/identity-keys/
-  - https://identity.deliveroo.net/identity/keys/
-staging:
-  - https://test.deliveroo.co.uk/identity-keys/
-  - https://identity-staging.deliveroo.net/identity-keys/