securial 0.5.0 → 0.6.1

data/lib/securial/config/validation.rb

@@ -3,13 +3,14 @@ require "securial/logger"
 module Securial
   module Config
     module Validation
-      class << self
+      class << self # rubocop:disable Metrics/ClassLength
         def validate_all!(config)
           validate_admin_role!(config)
           validate_session_config!(config)
           validate_mailer_sender!(config)
           validate_password_config!(config)
-          validate_timestamps_in_response!(config)
+          validate_response_config!(config)
+          validate_security_config!(config)
         end
 
         private
@@ -17,19 +18,19 @@ module Securial
         def validate_admin_role!(config)
           if config.admin_role.nil? || config.admin_role.to_s.strip.empty?
             error_message = "Admin role is not set."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigAdminRoleError, error_message
           end
 
           unless config.admin_role.is_a?(Symbol) || config.admin_role.is_a?(String)
             error_message = "Admin role must be a Symbol or String."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigAdminRoleError, error_message
           end
 
           if config.admin_role.to_s.pluralize.downcase == "accounts"
             error_message = "The admin role cannot be 'account' or 'accounts' as it conflicts with the default routes."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigAdminRoleError, error_message
           end
         end
@@ -43,16 +44,16 @@ module Securial
         def validate_session_expiry_duration!(config)
           if config.session_expiration_duration.nil?
             error_message = "Session expiration duration is not set."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigSessionExpirationDurationError, error_message
           end
           if config.session_expiration_duration.class != ActiveSupport::Duration
             error_message = "Session expiration duration must be an ActiveSupport::Duration."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigSessionExpirationDurationError, error_message
           end
           if config.session_expiration_duration <= 0
-            Securial::ENGINE_LOGGER.error("Session expiration duration must be greater than 0.")
+            Securial::ENGINE_LOGGER.fatal("Session expiration duration must be greater than 0.")
             raise Securial::Config::Errors::ConfigSessionExpirationDurationError, "Session expiration duration must be greater than 0."
           end
         end
@@ -60,18 +61,18 @@ module Securial
         def validate_session_algorithm!(config)
           if config.session_algorithm.blank?
             error_message = "Session algorithm is not set."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigSessionAlgorithmError, error_message
           end
           unless config.session_algorithm.is_a?(Symbol)
             error_message = "Session algorithm must be a Symbol."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigSessionAlgorithmError, error_message
           end
           valid_algorithms = Securial::Config::VALID_SESSION_ENCRYPTION_ALGORITHMS
           unless valid_algorithms.include?(config.session_algorithm)
             error_message = "Invalid session algorithm. Valid options are: #{valid_algorithms.map(&:inspect).join(', ')}."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigSessionAlgorithmError, error_message
           end
         end
@@ -79,12 +80,12 @@ module Securial
         def validate_session_secret!(config)
           if config.session_secret.blank?
             error_message = "Session secret is not set."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigSessionSecretError, error_message
           end
           unless config.session_secret.is_a?(String)
             error_message = "Session secret must be a String."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigSessionSecretError, error_message
           end
         end
@@ -92,12 +93,12 @@ module Securial
         def validate_mailer_sender!(config)
           if config.mailer_sender.blank?
             error_message = "Mailer sender is not set."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigMailerSenderError, error_message
           end
           if config.mailer_sender !~  URI::MailTo::EMAIL_REGEXP
             error_message = "Mailer sender is not a valid email address."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigMailerSenderError, error_message
           end
         end
@@ -113,12 +114,12 @@ module Securial
         def validate_password_reset_token!(config)
           if config.reset_password_token_secret.blank?
             error_message = "Reset password token secret is not set."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
           unless config.reset_password_token_secret.is_a?(String)
             error_message = "Reset password token secret must be a String."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
         end
@@ -126,12 +127,12 @@ module Securial
         def validate_password_reset_subject!(config)
           if config.password_reset_email_subject.blank?
             error_message = "Password reset email subject is not set."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
           unless config.password_reset_email_subject.is_a?(String)
             error_message = "Password reset email subject must be a String."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
         end
@@ -139,12 +140,12 @@ module Securial
         def validate_password_min_max_length!(config)
           unless config.password_min_length.is_a?(Integer) && config.password_min_length > 0
             error_message = "Password minimum length must be a positive integer."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
           unless config.password_max_length.is_a?(Integer) && config.password_max_length >= config.password_min_length
             error_message = "Password maximum length must be an integer greater than or equal to the minimum length."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
         end
@@ -152,25 +153,94 @@ module Securial
         def validate_password_complexity!(config)
           if config.password_complexity.nil? || !config.password_complexity.is_a?(Regexp)
             error_message = "Password complexity regex is not set or is not a valid Regexp."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
         end
 
         def validate_password_expiration!(config)
-          if config.password_expires_in.nil? || !config.password_expires_in.is_a?(ActiveSupport::Duration) || config.password_expires_in <= 0
+          unless config.password_expires.is_a?(TrueClass) || config.password_expires.is_a?(FalseClass)
+            error_message = "Password expiration must be a boolean value."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigPasswordError, error_message
+          end
+
+          if config.password_expires == true && (
+              config.password_expires_in.nil? ||
+              !config.password_expires_in.is_a?(ActiveSupport::Duration) ||
+              config.password_expires_in <= 0
+            )
             error_message = "Password expiration duration is not set or is not a valid ActiveSupport::Duration."
-            Securial::ENGINE_LOGGER.error(error_message)
+            Securial::ENGINE_LOGGER.fatal(error_message)
             raise Securial::Config::Errors::ConfigPasswordError, error_message
           end
         end
 
+        def validate_response_config!(config)
+          validate_response_keys_format!(config)
+          validate_timestamps_in_response!(config)
+        end
+
+        def validate_response_keys_format!(config)
+          valid_formats = Securial::Config::VALID_RESPONSE_KEYS_FORMATS
+          unless valid_formats.include?(config.response_keys_format)
+            error_message = "Invalid response_keys_format option. Valid options are: #{valid_formats.map(&:inspect).join(', ')}."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigResponseError, error_message
+          end
+        end
+
         def validate_timestamps_in_response!(config)
           valid_options = Securial::Config::VALID_TIMESTAMP_OPTIONS
           unless valid_options.include?(config.timestamps_in_response)
             error_message = "Invalid timestamps_in_response option. Valid options are: #{valid_options.map(&:inspect).join(', ')}."
-            Securial::ENGINE_LOGGER.error(error_message)
-            raise Securial::Config::Errors::ConfigTimestampsInResponseError, error_message
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigResponseError, error_message
+          end
+        end
+
+        def validate_security_config!(config)
+          validate_security_headers!(config)
+          validate_rate_limiting!(config)
+        end
+
+        def validate_security_headers!(config)
+          valid_options = Securial::Config::VALID_SECURITY_HEADERS
+          unless valid_options.include?(config.security_headers)
+            error_message = "Invalid security_headers option. Valid options are: #{valid_options.map(&:inspect).join(', ')}."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+        end
+
+        def validate_rate_limiting!(config) # rubocop:disable Metrics/MethodLength
+          unless config.rate_limiting_enabled.is_a?(TrueClass) || config.rate_limiting_enabled.is_a?(FalseClass)
+            error_message = "rate_limiting_enabled must be a boolean value."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+
+          return unless config.rate_limiting_enabled
+
+          unless
+              config.rate_limit_requests_per_minute.is_a?(Integer) &&
+              config.rate_limit_requests_per_minute > 0
+
+            error_message = "rate_limit_requests_per_minute must be a positive integer when rate limiting is enabled."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+
+          unless config.rate_limit_response_status.is_a?(Integer) && config.rate_limit_response_status.between?(400, 599)
+            error_message = "rate_limit_response_status must be an HTTP status code between 4xx and 5xx."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
+          end
+
+          unless config.rate_limit_response_message.is_a?(String) && !config.rate_limit_response_message.strip.empty?
+            error_message = "rate_limit_response_message must be a non-empty String."
+            Securial::ENGINE_LOGGER.fatal(error_message)
+            raise Securial::Config::Errors::ConfigSecurityError, error_message
           end
         end
       end

data/lib/securial/engine.rb

@@ -1,16 +1,22 @@
 require_relative "./logger"
+require_relative "./key_transformer"
 require_relative "./config/_index"
 require_relative "./helpers/_index"
-require_relative "./sessions/_index"
+require_relative "./auth/_index"
 require_relative "./inspectors/_index"
 
-require_relative "./middleware/request_logger_tag"
+require_relative "./middleware/_index"
 require "jwt"
 
 module Securial
   class Engine < ::Rails::Engine
     isolate_namespace Securial
 
+    # Set API-only mode and autoload custom generator paths
+    config.api_only = true
+    config.generators.api_only = true
+    config.autoload_paths += Dir["#{config.root}/lib/generators"]
+
     initializer "securial.filter_parameters" do |app|
       app.config.filter_parameters += [
         :password,
@@ -24,42 +30,47 @@ module Securial
       Securial.const_set(:ENGINE_LOGGER, Securial::Logger.build)
     end
 
-    initializer "securial.engine_initialized" do |app|
-      Securial::ENGINE_LOGGER.info("[Securial] Initializing Engine... Host app: #{app.class.name}")
+    initializer "securial.log_initialization" do |app|
+      log "[Initializing Engine] Host app: #{app.class.name}"
     end
 
-    initializer "securial.config" do
-      Securial::ENGINE_LOGGER.info("[Securial] Validating configuration in `config/initializers/securial.rb`...")
+    initializer "securial.validate_config" do
+      log "[Validating configuration] from `config/initializers/securial.rb`..."
       Securial::Config::Validation.validate_all!(Securial.configuration)
     end
 
-    initializer "securial.factories", after: "factory_bot.set_factory_paths" do
-      if defined?(FactoryBot)
-        FactoryBot.definition_file_paths << Engine.root.join("lib", "securial", "factories")
-      end
+    initializer "securial.extend_application_controller" do
+      ActiveSupport.on_load(:action_controller_base) { include Securial::Identity }
+      ActiveSupport.on_load(:action_controller_api)  { include Securial::Identity }
     end
 
-    initializer "securial.load_factory_bot_generator" do
+    initializer "securial.factory_bot", after: "factory_bot.set_factory_paths" do
+      FactoryBot.definition_file_paths << Engine.root.join("lib", "securial", "factories") if defined?(FactoryBot)
+    end
+
+    initializer "securial.factory_bot_generator" do
       require_relative "../generators/factory_bot/model/model_generator"
     end
 
-    initializer "securial.extend_application_controller" do
-      ActiveSupport.on_load(:action_controller_base) do
-        include Securial::Identity
+    initializer "securial.middleware" do |app|
+      middleware.use Securial::Middleware::RequestLoggerTag
+      middleware.use Securial::Middleware::TransformRequestKeys
+      middleware.use Securial::Middleware::TransformResponseKeys
+      if Securial.configuration.rate_limiting_enabled
+        require "rack/attack"
+        require_relative "./rack_attack"
+        middleware.use Rack::Attack
       end
+    end
 
-      ActiveSupport.on_load(:action_controller_api) do
-        include Securial::Identity
+    initializer "securial.log_ready", after: :load_config_initializers do
+      Rails.application.config.after_initialize do
+        log "[Engine fully initialized] Environment: #{Rails.env}"
       end
     end
 
-    config.generators.api_only = true
-
-    config.autoload_paths += Dir["#{config.root}/lib/generators"]
-
     config.generators do |g|
       g.orm :active_record, primary_key_type: :string
-
       g.test_framework :rspec,
                        fixtures: false,
                        view_specs: false,
@@ -68,21 +79,14 @@ module Securial
                        controller_specs: true,
                        request_specs: true,
                        model_specs: true
-
       g.fixture_replacement :factory_bot, dir: "lib/securial/factories"
-
-      # Add JBuilder configuration
       g.template_engine :jbuilder
     end
 
-    initializer "securial.middleware" do |app|
-      app.middleware.use Securial::Middleware::RequestLoggerTag
-    end
+    private
 
-    initializer "securial.log_engine_loaded", after: :load_config_initializers do
-      Rails.application.config.after_initialize do
-        Securial::ENGINE_LOGGER.info("[Securial] Engine fully initialized in #{Rails.env} environment.")
-      end
+    def log(message)
+      Securial::ENGINE_LOGGER.info("[Securial] #{message}")
     end
   end
 end

data/lib/securial/key_transformer.rb

@@ -0,0 +1,32 @@
+# lib/securial/key_transformer.rb
+module Securial
+  module KeyTransformer
+    def self.camelize(str, format)
+      return str unless str.is_a?(String)
+
+      case format
+      when :lowerCamelCase
+        str.camelize(:lower)
+      when :UpperCamelCase
+        str.camelize
+      else
+        str
+      end
+    end
+
+    def self.underscore(str)
+      str.to_s.underscore
+    end
+
+    def self.deep_transform_keys(obj, &block)
+      case obj
+      when Hash
+        obj.transform_keys(&block).transform_values { |v| deep_transform_keys(v, &block) }
+      when Array
+        obj.map { |e| deep_transform_keys(e, &block) }
+      else
+        obj
+      end
+    end
+  end
+end

data/lib/securial/middleware/_index.rb

@@ -0,0 +1,3 @@
+require_relative "./transform_request_keys"
+require_relative "./transform_response_keys"
+require_relative "./request_logger_tag"

data/lib/securial/middleware/transform_request_keys.rb

@@ -0,0 +1,33 @@
+# lib/securial/middleware/transform_request_keys.rb
+require "json"
+
+module Securial
+  module Middleware
+    class TransformRequestKeys
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        if env["CONTENT_TYPE"]&.include?("application/json") && Securial.configuration.response_keys_format != :snake_case
+          req = Rack::Request.new(env)
+          if (req.body&.size || 0) > 0
+            raw = req.body.read
+            req.body.rewind
+            begin
+              parsed = JSON.parse(raw)
+              transformed = Securial::KeyTransformer.deep_transform_keys(parsed) do |key|
+                Securial::KeyTransformer.underscore(key)
+              end
+              env["rack.input"] = StringIO.new(JSON.dump(transformed))
+              env["rack.input"].rewind
+            rescue JSON::ParserError
+              # noop
+            end
+          end
+        end
+        @app.call(env)
+      end
+    end
+  end
+end

data/lib/securial/middleware/transform_response_keys.rb

@@ -0,0 +1,45 @@
+# lib/securial/middleware/transform_response_keys.rb
+require "json"
+
+module Securial
+  module Middleware
+    class TransformResponseKeys
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        status, headers, response = @app.call(env)
+
+        if json_response?(headers)
+          body = extract_body(response)
+
+          if body.present?
+            format = Securial.configuration.response_keys_format
+            transformed = KeyTransformer.deep_transform_keys(JSON.parse(body)) do |key|
+              KeyTransformer.camelize(key, format)
+            end
+
+            new_body = [JSON.generate(transformed)]
+            headers["Content-Length"] = new_body.first.bytesize.to_s
+            return [status, headers, new_body]
+          end
+        end
+
+        [status, headers, response]
+      end
+
+      private
+
+      def json_response?(headers)
+        headers["Content-Type"]&.include?("application/json")
+      end
+
+      def extract_body(response)
+        response_body = ""
+        response.each { |part| response_body << part }
+        response_body
+      end
+    end
+  end
+end

data/lib/securial/rack_attack.rb

@@ -0,0 +1,48 @@
+Rails.application.config.to_prepare do
+  class Rack::Attack
+    limit = Securial.configuration.rate_limit_requests_per_minute
+    resp_status = Securial.configuration.rate_limit_response_status
+    resp_message = Securial.configuration.rate_limit_response_message
+
+    ### Throttle login attempts by IP ###
+    throttle("securial/logins/ip", limit: limit, period: 1.minute) do |req|
+      if req.path.include?("sessions/login") && req.post?
+        req.ip
+      end
+    end
+
+    ### Throttle login attempts by username ###
+    throttle("securial/logins/email", limit: 5, period: 1.minute) do |req|
+      if req.path.include?("sessions/login") && req.post?
+        req.params["email_address"].to_s.downcase.strip
+      end
+    end
+
+    ### TODO: Add throttling for other endpoints as needed ###
+    # Example: Throttle password reset requests by email
+    throttle("securial/password_resets/ip", limit: 5, period: 1.minute) do |req|
+      if req.path.include?("password/forgot") && req.post?
+        req.ip
+      end
+    end
+
+    throttle("securial/password_resets/email", limit: 5, period: 1.minute) do |req|
+      if req.path.include?("password/forgot") && req.post?
+        req.params["email_address"].to_s.downcase.strip
+      end
+    end
+
+    ### Custom response ###
+    self.throttled_responder = lambda do |request|
+      retry_after = (request.env["rack.attack.match_data"] || {})[:period]
+      [
+        resp_status,
+        {
+          "Content-Type" => "application/json",
+          "Retry-After" => retry_after.to_s,
+        },
+        [{ error: resp_message }.to_json]
+      ]
+    end
+  end
+end

data/lib/securial/version.rb

@@ -1,3 +1,3 @@
 module Securial
-  VERSION = "0.5.0"
+  VERSION = "0.6.1".freeze
 end

data/lib/securial.rb

@@ -5,12 +5,17 @@ require "jbuilder"
 
 module Securial
   class << self
-    attr_writer :configuration
+    attr_accessor :configuration
 
     def configuration
       @configuration ||= Securial::Config::Configuration.new
     end
 
+    def configuration=(config)
+      @configuration = config
+      Securial::Config::Validation.validate_all!(configuration)
+    end
+
     def configure
       yield(configuration)
     end