shugoi 0.4.4 → 0.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c1cc48590ec64ab1cd428412be9c433254941c76889714824b0bf890c089bc7
-  data.tar.gz: 248ef9edf7a911da8a8e599c8b33aacb856b1947eb39eda08637b6029dfa8f60
+  metadata.gz: 1fed8134e1b44b241b81bdd0a952990e0eccfc0ebd91f71b9b62efed9423e5a4
+  data.tar.gz: 80437795cd3df67c8d4eda321ba7c40a627606fac5fe0c442f9fccde65329348
 SHA512:
-  metadata.gz: 6039c75a4545db93ae574b201f1a0f5593284a8ee996b9faaadb091fbec8ab7571ab275e1780374be5af5cbd59116e9dd497c07a5ef6d7d3e32854603c717297
-  data.tar.gz: 0e26ba289183b2751e163ced12d650d3456e7bbb74baab0dccfaa8baee8de61c8bb0b290b5c8bad6e0d5e26331ff1fd34cacecbb3290d84b92de542aa7c33b40
+  metadata.gz: 26525fb2017f8e612a7db75d0715cf4d72f1c3aa5bc3dd149c42b515f602b3c5b3d0e9c65d949cf10c9c2f6b7f9f67d99f8b89bbe093cae19636d698c472c0cd
+  data.tar.gz: 5ca32db03ce5d92a2e7f40e3845d3f691feb9bfc26336472979b1b6ec707b3ae75888e898b20352d7960b5266a8ff5fe4227782bf899a0094b8d6cf275ebcc2a

data/lib/shugoi/api_client.rb

@@ -14,9 +14,14 @@ module Shugoi
       @debug = debug
     end
 
-    # GET /whitelist?key=... → { whitelistedMachines, detectionFlags, skipPaths }
-    def fetch_whitelist(site_key)
-      json = get("/whitelist", key: site_key)
+    # GET /whitelist?key=...&cb=...&sig=... → { detectionFlags, skipPaths }
+    # La siteKey est publique ; la configuration serveur doit prouver la possession
+    # du secret de signature (parité Node/PHP, F2/F3).
+    def fetch_whitelist(site_key, secret = nil)
+      cb = SecureRandom.hex(4)
+      params = { key: site_key, cb: cb.to_s }
+      params[:sig] = Utils.hmac_hex(secret, cb.to_s) if secret && !secret.empty?
+      json = get("/whitelist", params)
       {
         whitelist: json["whitelistedMachines"] || [],
         flags: json["detectionFlags"] || json["flags"] || {},

data/lib/shugoi/config_cache.rb

@@ -7,8 +7,9 @@ module Shugoi
     TTL_MS = 30_000
     STALE_MAX_MS = 600_000
 
-    def initialize(api_client)
+    def initialize(api_client, signing_secret = nil)
       @api_client = api_client
+      @signing_secret = signing_secret
       @mutex = Mutex.new
       @whitelist = []
       @flags = {}
@@ -30,7 +31,7 @@ module Shugoi
     private
 
     def refresh(site_key)
-      data = @api_client.fetch_whitelist(site_key)
+      data = @api_client.fetch_whitelist(site_key, @signing_secret)
       @whitelist = data[:whitelist]
       @flags = data[:flags]
       @skip_paths = data[:skip_paths]

data/lib/shugoi/html_store.rb

@@ -24,7 +24,7 @@ module Shugoi
         evict_expired
         size = html.bytesize
         while (@entries.size >= MAX_ENTRIES || @total_bytes + size > MAX_TOTAL_BYTES) && !@entries.empty?
-          drop(@entries.keys.first)
+          drop_unlocked(@entries.keys.first)
         end
         @entries[token] = Entry.new(html, Utils.now_ms + TOKEN_TTL_MS, 0)
         @site_cache[site_key] = html
@@ -50,10 +50,7 @@ module Shugoi
     end
 
     def drop(token)
-      @mutex.synchronize do
-        entry = @entries.delete(token)
-        @total_bytes -= entry.html.bytesize if entry
-      end
+      @mutex.synchronize { drop_unlocked(token) }
     end
 
     private
@@ -61,15 +58,20 @@ module Shugoi
     def evict_expired
       @entries.each_key do |token|
         entry = @entries[token]
-        drop(token) if Utils.now_ms > entry.expires_at
+        drop_unlocked(token) if Utils.now_ms > entry.expires_at
       end
     end
 
     def drop_and_nil(token)
-      drop(token)
+      drop_unlocked(token)
       nil
     end
 
+    def drop_unlocked(token)
+      entry = @entries.delete(token)
+      @total_bytes -= entry.html.bytesize if entry
+    end
+
     def write_disk(token, html)
       return unless @disk_path
       path = File.join(@disk_path, Utils.sha256_hex(token))

data/lib/shugoi/rack/middleware.rb

@@ -21,7 +21,7 @@ module Shugoi
         # le deadlock (appels serveur→serveur qui repasseraient par le middleware public).
         @api_internal = ApiClient.new(@config.internal_url, debug: @config.debug)
         @guard_cache = GuardCache.new(@api_client)
-        @config_cache = ConfigCache.new(@api_internal)
+        @config_cache = ConfigCache.new(@api_internal, @config.signing_secret)
         @token_signer = TokenSigner.new(@config.signing_secret)
         # multi_process → stockage disque du HTML (nécessaire en cluster PM2, parité
         # enableDiskStore(true) du module Node).

data/lib/shugoi/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Shugoi
-  VERSION = "0.4.4"
+  VERSION = "0.4.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shugoi
 version: !ruby/object:Gem::Version
-  version: 0.4.4
+  version: 0.4.6
 platform: ruby
 authors:
 - Shugoi