securial 0.4.2 → 0.6.1

data/lib/securial/config/validation.rb

@@ -0,0 +1,249 @@
+require "securial/logger"
+
+module Securial
+  module Config
+    module Validation
+      class << self # rubocop:disable Metrics/ClassLength
+        def validate_all!(config)
+          validate_admin_role!(config)
+          validate_session_config!(config)
+          validate_mailer_sender!(config)
+          validate_password_config!(config)
+          validate_response_config!(config)
+          validate_security_config!(config)
+        end
+
+        private
+
+        def validate_admin_role!(config)
+          if config.admin_role.nil? || config.admin_role.to_s.strip.empty?
+            error_message = "Admin role is not set."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigAdminRoleError, error_message
+          end
+
+          unless config.admin_role.is_a?(Symbol) || config.admin_role.is_a?(String)
+            error_message = "Admin role must be a Symbol or String."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigAdminRoleError, error_message
+          end
+
+          if config.admin_role.to_s.pluralize.downcase == "accounts"
+            error_message = "The admin role cannot be 'account' or 'accounts' as it conflicts with the default routes."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigAdminRoleError, error_message
+          end
+        end
+
+        def validate_session_config!(config)
+          validate_session_expiry_duration!(config)
+          validate_session_algorithm!(config)
+          validate_session_secret!(config)
+        end
+
+        def validate_session_expiry_duration!(config)
+          if config.session_expiration_duration.nil?
+            error_message = "Session expiration duration is not set."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSessionExpirationDurationError, error_message
+          end
+          if config.session_expiration_duration.class != ActiveSupport::Duration
+            error_message = "Session expiration duration must be an ActiveSupport::Duration."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSessionExpirationDurationError, error_message
+          end
+          if config.session_expiration_duration <= 0
+            Securial::ENGINE_LOGGER.fatal("Session expiration duration must be greater than 0.")
+            raise Securial::Config::Errors::ConfigSessionExpirationDurationError, "Session expiration duration must be greater than 0."
+          end
+        end
+
+        def validate_session_algorithm!(config)
+          if config.session_algorithm.blank?
+            error_message = "Session algorithm is not set."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSessionAlgorithmError, error_message
+          end
+          unless config.session_algorithm.is_a?(Symbol)
+            error_message = "Session algorithm must be a Symbol."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSessionAlgorithmError, error_message
+          end
+          valid_algorithms = Securial::Config::VALID_SESSION_ENCRYPTION_ALGORITHMS
+          unless valid_algorithms.include?(config.session_algorithm)
+            error_message = "Invalid session algorithm. Valid options are: #{valid_algorithms.map(&:inspect).join(', ')}."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSessionAlgorithmError, error_message
+          end
+        end
+
+        def validate_session_secret!(config)
+          if config.session_secret.blank?
+            error_message = "Session secret is not set."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSessionSecretError, error_message
+          end
+          unless config.session_secret.is_a?(String)
+            error_message = "Session secret must be a String."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSessionSecretError, error_message
+          end
+        end
+
+        def validate_mailer_sender!(config)
+          if config.mailer_sender.blank?
+            error_message = "Mailer sender is not set."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigMailerSenderError, error_message
+          end
+          if config.mailer_sender !~  URI::MailTo::EMAIL_REGEXP
+            error_message = "Mailer sender is not a valid email address."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigMailerSenderError, error_message
+          end
+        end
+
+        def validate_password_config!(config)
+          validate_password_reset_subject!(config)
+          validate_password_min_max_length!(config)
+          validate_password_complexity!(config)
+          validate_password_expiration!(config)
+          validate_password_reset_token!(config)
+        end
+
+        def validate_password_reset_token!(config)
+          if config.reset_password_token_secret.blank?
+            error_message = "Reset password token secret is not set."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+          unless config.reset_password_token_secret.is_a?(String)
+            error_message = "Reset password token secret must be a String."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+        end
+
+        def validate_password_reset_subject!(config)
+          if config.password_reset_email_subject.blank?
+            error_message = "Password reset email subject is not set."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+          unless config.password_reset_email_subject.is_a?(String)
+            error_message = "Password reset email subject must be a String."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+        end
+
+        def validate_password_min_max_length!(config)
+          unless config.password_min_length.is_a?(Integer) && config.password_min_length > 0
+            error_message = "Password minimum length must be a positive integer."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+          unless config.password_max_length.is_a?(Integer) && config.password_max_length >= config.password_min_length
+            error_message = "Password maximum length must be an integer greater than or equal to the minimum length."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+        end
+
+        def validate_password_complexity!(config)
+          if config.password_complexity.nil? || !config.password_complexity.is_a?(Regexp)
+            error_message = "Password complexity regex is not set or is not a valid Regexp."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+        end
+
+        def validate_password_expiration!(config)
+          unless config.password_expires.is_a?(TrueClass) || config.password_expires.is_a?(FalseClass)
+            error_message = "Password expiration must be a boolean value."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+
+          if config.password_expires == true && (
+              config.password_expires_in.nil? ||
+              !config.password_expires_in.is_a?(ActiveSupport::Duration) ||
+              config.password_expires_in <= 0
+            )
+            error_message = "Password expiration duration is not set or is not a valid ActiveSupport::Duration."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+        end
+
+        def validate_response_config!(config)
+          validate_response_keys_format!(config)
+          validate_timestamps_in_response!(config)
+        end
+
+        def validate_response_keys_format!(config)
+          valid_formats = Securial::Config::VALID_RESPONSE_KEYS_FORMATS
+          unless valid_formats.include?(config.response_keys_format)
+            error_message = "Invalid response_keys_format option. Valid options are: #{valid_formats.map(&:inspect).join(', ')}."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigResponseError, error_message
+          end
+        end
+
+        def validate_timestamps_in_response!(config)
+          valid_options = Securial::Config::VALID_TIMESTAMP_OPTIONS
+          unless valid_options.include?(config.timestamps_in_response)
+            error_message = "Invalid timestamps_in_response option. Valid options are: #{valid_options.map(&:inspect).join(', ')}."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigResponseError, error_message
+          end
+        end
+
+        def validate_security_config!(config)
+          validate_security_headers!(config)
+          validate_rate_limiting!(config)
+        end
+
+        def validate_security_headers!(config)
+          valid_options = Securial::Config::VALID_SECURITY_HEADERS
+          unless valid_options.include?(config.security_headers)
+            error_message = "Invalid security_headers option. Valid options are: #{valid_options.map(&:inspect).join(', ')}."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+        end
+
+        def validate_rate_limiting!(config) # rubocop:disable Metrics/MethodLength
+          unless config.rate_limiting_enabled.is_a?(TrueClass) || config.rate_limiting_enabled.is_a?(FalseClass)
+            error_message = "rate_limiting_enabled must be a boolean value."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+
+          return unless config.rate_limiting_enabled
+
+          unless
+              config.rate_limit_requests_per_minute.is_a?(Integer) &&
+              config.rate_limit_requests_per_minute > 0
+
+            error_message = "rate_limit_requests_per_minute must be a positive integer when rate limiting is enabled."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+
+          unless config.rate_limit_response_status.is_a?(Integer) && config.rate_limit_response_status.between?(400, 599)
+            error_message = "rate_limit_response_status must be an HTTP status code between 4xx and 5xx."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+
+          unless config.rate_limit_response_message.is_a?(String) && !config.rate_limit_response_message.strip.empty?
+            error_message = "rate_limit_response_message must be a non-empty String."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+        end
+      end
+    end
+  end
+end

data/lib/securial/engine.rb

@@ -1,22 +1,22 @@
 require_relative "./logger"
+require_relative "./key_transformer"
+require_relative "./config/_index"
+require_relative "./helpers/_index"
+require_relative "./auth/_index"
+require_relative "./inspectors/_index"
 
-Dir[File.join(__dir__, "errors", "*.rb")].each { |f| require_relative f }
-
-require_relative "./configuration"
-
-require_relative "./helpers/auth_helper"
-require_relative "./helpers/normalizing_helper"
-require_relative "./helpers/regex_helper"
-
-require_relative "./route_inspector"
-
-require_relative "./middleware/request_logger_tag"
+require_relative "./middleware/_index"
 require "jwt"
 
 module Securial
   class Engine < ::Rails::Engine
     isolate_namespace Securial
 
+    # Set API-only mode and autoload custom generator paths
+    config.api_only = true
+    config.generators.api_only = true
+    config.autoload_paths += Dir["#{config.root}/lib/generators"]
+
     initializer "securial.filter_parameters" do |app|
       app.config.filter_parameters += [
         :password,
@@ -30,37 +30,47 @@ module Securial
       Securial.const_set(:ENGINE_LOGGER, Securial::Logger.build)
     end
 
-    initializer "securial.engine_initialized" do |app|
-      Securial::ENGINE_LOGGER.info("[Securial] Engine mounted. Host app: #{app.class.name}")
+    initializer "securial.log_initialization" do |app|
+      log "[Initializing Engine] Host app: #{app.class.name}"
     end
 
-    initializer "securial.factories", after: "factory_bot.set_factory_paths" do
-      if defined?(FactoryBot)
-        FactoryBot.definition_file_paths << Engine.root.join("lib", "securial", "factories")
-      end
+    initializer "securial.validate_config" do
+      log "[Validating configuration] from `config/initializers/securial.rb`..."
+      Securial::Config::Validation.validate_all!(Securial.configuration)
+    end
+
+    initializer "securial.extend_application_controller" do
+      ActiveSupport.on_load(:action_controller_base) { include Securial::Identity }
+      ActiveSupport.on_load(:action_controller_api)  { include Securial::Identity }
     end
 
-    initializer "securial.load_factory_bot_generator" do
+    initializer "securial.factory_bot", after: "factory_bot.set_factory_paths" do
+      FactoryBot.definition_file_paths << Engine.root.join("lib", "securial", "factories") if defined?(FactoryBot)
+    end
+
+    initializer "securial.factory_bot_generator" do
       require_relative "../generators/factory_bot/model/model_generator"
     end
 
-    initializer "securial.extend_application_controller" do
-      ActiveSupport.on_load(:action_controller_base) do
-        include Securial::Identity
+    initializer "securial.middleware" do |app|
+      middleware.use Securial::Middleware::RequestLoggerTag
+      middleware.use Securial::Middleware::TransformRequestKeys
+      middleware.use Securial::Middleware::TransformResponseKeys
+      if Securial.configuration.rate_limiting_enabled
+        require "rack/attack"
+        require_relative "./rack_attack"
+        middleware.use Rack::Attack
       end
+    end
 
-      ActiveSupport.on_load(:action_controller_api) do
-        include Securial::Identity
+    initializer "securial.log_ready", after: :load_config_initializers do
+      Rails.application.config.after_initialize do
+        log "[Engine fully initialized] Environment: #{Rails.env}"
       end
     end
 
-    config.generators.api_only = true
-
-    config.autoload_paths += Dir["#{config.root}/lib/generators"]
-
     config.generators do |g|
       g.orm :active_record, primary_key_type: :string
-
       g.test_framework :rspec,
                        fixtures: false,
                        view_specs: false,
@@ -69,21 +79,14 @@ module Securial
                        controller_specs: true,
                        request_specs: true,
                        model_specs: true
-
       g.fixture_replacement :factory_bot, dir: "lib/securial/factories"
-
-      # Add JBuilder configuration
       g.template_engine :jbuilder
     end
 
-    initializer "securial.middleware" do |app|
-      app.middleware.use Securial::Middleware::RequestLoggerTag
-    end
+    private
 
-    initializer "securial.log_engine_loaded", after: :load_config_initializers do
-      Rails.application.config.after_initialize do
-        Securial::ENGINE_LOGGER.info("[Securial] Engine fully initialized in #{Rails.env} environment.")
-      end
+    def log(message)
+      Securial::ENGINE_LOGGER.info("[Securial] #{message}")
     end
   end
 end

data/lib/securial/helpers/_index.rb

@@ -0,0 +1,2 @@
+require_relative "normalizing_helper"
+require_relative "regex_helper"

data/lib/securial/helpers/regex_helper.rb

@@ -4,14 +4,14 @@ module Securial
     USERNAME_REGEX = /\A(?![0-9])[a-zA-Z](?:[a-zA-Z0-9]|[._](?![._]))*[a-zA-Z0-9]\z/
     PASSWORD_REGEX = %r{\A(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[^a-zA-Z0-9])[a-zA-Z].*\z}
 
-    module_function
+    class << self
+      def valid_email?(email)
+        email.match?(EMAIL_REGEX)
+      end
 
-    def valid_email?(email)
-      email.match?(EMAIL_REGEX)
-    end
-
-    def valid_username?(username)
-      username.match?(USERNAME_REGEX)
+      def valid_username?(username)
+        username.match?(USERNAME_REGEX)
+      end
     end
   end
 end

data/lib/securial/inspectors/_index.rb

@@ -0,0 +1 @@
+require_relative "route_inspector"

data/lib/securial/inspectors/route_inspector.rb

@@ -0,0 +1,52 @@
+module Securial
+  module Inspectors
+    module RouteInspector
+      def self.print_routes(controller: nil)
+        filtered = Securial::Engine.routes.routes.select do |r|
+          ctrl = r.defaults[:controller]
+          controller.nil? || ctrl == "securial/#{controller}"
+        end
+
+        print_headers(filtered, controller)
+        print_details(filtered, controller)
+        true
+      end
+
+      class << self
+        private
+
+        # rubocop:disable Rails/Output
+        def print_headers(filtered, controller)
+          Securial::ENGINE_LOGGER.debug "Securial engine routes:"
+          Securial::ENGINE_LOGGER.debug "Total routes: #{filtered.size}"
+          Securial::ENGINE_LOGGER.debug "Filtered by controller: #{controller}" if controller
+          Securial::ENGINE_LOGGER.debug "Filtered routes: #{filtered.size}" if controller
+          Securial::ENGINE_LOGGER.debug "-" * 120
+          Securial::ENGINE_LOGGER.debug "#{'Verb'.ljust(8)} #{'Path'.ljust(45)} #{'Controller#Action'.ljust(40)} Name"
+          Securial::ENGINE_LOGGER.debug "-" * 120
+        end
+
+        def print_details(filtered, controller) # rubocop:disable Rails/Output
+          if filtered.empty?
+            if controller
+              Securial::ENGINE_LOGGER.debug "No routes found for controller: #{controller}"
+            else
+              Securial::ENGINE_LOGGER.debug "No routes found for Securial engine"
+            end
+            Securial::ENGINE_LOGGER.debug "-" * 120
+            return
+          end
+
+          Securial::ENGINE_LOGGER.debug filtered.map { |r|
+            name = r.name || ""
+            verb = r.verb.to_s.ljust(8)
+            path = r.path.spec.to_s.sub(/\(\.:format\)/, "").ljust(45)
+            ctrl_action = "#{r.defaults[:controller]}##{r.defaults[:action]}"
+            "#{verb} #{path} #{ctrl_action.ljust(40)} #{name}"
+          }.join("\n")
+        end
+        # rubocop:enable Rails/Output
+      end
+    end
+  end
+end

data/lib/securial/key_transformer.rb

@@ -0,0 +1,32 @@
+# lib/securial/key_transformer.rb
+module Securial
+  module KeyTransformer
+    def self.camelize(str, format)
+      return str unless str.is_a?(String)
+
+      case format
+      when :lowerCamelCase
+        str.camelize(:lower)
+      when :UpperCamelCase
+        str.camelize
+      else
+        str
+      end
+    end
+
+    def self.underscore(str)
+      str.to_s.underscore
+    end
+
+    def self.deep_transform_keys(obj, &block)
+      case obj
+      when Hash
+        obj.transform_keys(&block).transform_values { |v| deep_transform_keys(v, &block) }
+      when Array
+        obj.map { |e| deep_transform_keys(e, &block) }
+      else
+        obj
+      end
+    end
+  end
+end

data/lib/securial/logger.rb

@@ -7,13 +7,13 @@ module Securial
     def self.build
       outputs = []
 
-      if Securial.configuration.log_to_file
+      unless Securial.configuration.log_to_file == false
         log_file = Rails.root.join("log", "securial.log").open("a")
         log_file.sync = true
         outputs << log_file
       end
 
-      if Securial.configuration.log_to_stdout
+      unless Securial.configuration.log_to_stdout == false
         outputs << STDOUT
       end
 

data/lib/securial/middleware/_index.rb

@@ -0,0 +1,3 @@
+require_relative "./transform_request_keys"
+require_relative "./transform_response_keys"
+require_relative "./request_logger_tag"

data/lib/securial/middleware/transform_request_keys.rb

@@ -0,0 +1,33 @@
+# lib/securial/middleware/transform_request_keys.rb
+require "json"
+
+module Securial
+  module Middleware
+    class TransformRequestKeys
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        if env["CONTENT_TYPE"]&.include?("application/json") && Securial.configuration.response_keys_format != :snake_case
+          req = Rack::Request.new(env)
+          if (req.body&.size || 0) > 0
+            raw = req.body.read
+            req.body.rewind
+            begin
+              parsed = JSON.parse(raw)
+              transformed = Securial::KeyTransformer.deep_transform_keys(parsed) do |key|
+                Securial::KeyTransformer.underscore(key)
+              end
+              env["rack.input"] = StringIO.new(JSON.dump(transformed))
+              env["rack.input"].rewind
+            rescue JSON::ParserError
+              # noop
+            end
+          end
+        end
+        @app.call(env)
+      end
+    end
+  end
+end

data/lib/securial/middleware/transform_response_keys.rb

@@ -0,0 +1,45 @@
+# lib/securial/middleware/transform_response_keys.rb
+require "json"
+
+module Securial
+  module Middleware
+    class TransformResponseKeys
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        status, headers, response = @app.call(env)
+
+        if json_response?(headers)
+          body = extract_body(response)
+
+          if body.present?
+            format = Securial.configuration.response_keys_format
+            transformed = KeyTransformer.deep_transform_keys(JSON.parse(body)) do |key|
+              KeyTransformer.camelize(key, format)
+            end
+
+            new_body = [JSON.generate(transformed)]
+            headers["Content-Length"] = new_body.first.bytesize.to_s
+            return [status, headers, new_body]
+          end
+        end
+
+        [status, headers, response]
+      end
+
+      private
+
+      def json_response?(headers)
+        headers["Content-Type"]&.include?("application/json")
+      end
+
+      def extract_body(response)
+        response_body = ""
+        response.each { |part| response_body << part }
+        response_body
+      end
+    end
+  end
+end

data/lib/securial/rack_attack.rb

@@ -0,0 +1,48 @@
+Rails.application.config.to_prepare do
+  class Rack::Attack
+    limit = Securial.configuration.rate_limit_requests_per_minute
+    resp_status = Securial.configuration.rate_limit_response_status
+    resp_message = Securial.configuration.rate_limit_response_message
+
+    ### Throttle login attempts by IP ###
+    throttle("securial/logins/ip", limit: limit, period: 1.minute) do |req|
+      if req.path.include?("sessions/login") && req.post?
+        req.ip
+      end
+    end
+
+    ### Throttle login attempts by username ###
+    throttle("securial/logins/email", limit: 5, period: 1.minute) do |req|
+      if req.path.include?("sessions/login") && req.post?
+        req.params["email_address"].to_s.downcase.strip
+      end
+    end
+
+    ### TODO: Add throttling for other endpoints as needed ###
+    # Example: Throttle password reset requests by email
+    throttle("securial/password_resets/ip", limit: 5, period: 1.minute) do |req|
+      if req.path.include?("password/forgot") && req.post?
+        req.ip
+      end
+    end
+
+    throttle("securial/password_resets/email", limit: 5, period: 1.minute) do |req|
+      if req.path.include?("password/forgot") && req.post?
+        req.params["email_address"].to_s.downcase.strip
+      end
+    end
+
+    ### Custom response ###
+    self.throttled_responder = lambda do |request|
+      retry_after = (request.env["rack.attack.match_data"] || {})[:period]
+      [
+        resp_status,
+        {
+          "Content-Type" => "application/json",
+          "Retry-After" => retry_after.to_s,
+        },
+        [{ error: resp_message }.to_json]
+      ]
+    end
+  end
+end

data/lib/securial/version.rb

@@ -1,3 +1,3 @@
 module Securial
-  VERSION = "0.4.2"
+  VERSION = "0.6.1".freeze
 end