shugoi 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c7493ead28b354d7ba84019aaddae0419bf0481c4c12ac492218be2eed29d1fd
+  data.tar.gz: ea6965023bf27f8a66a039c794ab8137307b4662b77615ea1622f6b5d7548ee4
+SHA512:
+  metadata.gz: 59e8d7d5443fe2f6417753959365fc31650bc984c438905be06714cf491ab05f32c2fbc4b02cca82a83dabdfab32636bc976a3847781299f55c9eccb45d73df1
+  data.tar.gz: a8caed7dff122fe4da8909e19701447140f543659b0721b3325c869643657a667943159157a13bfc8a8cc3fdbbdb5fd33ba890e7f12bbe541aced4c3c1499712

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shugoi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,70 @@
+# Shugoi Ruby (Rails)
+
+Protection anti-abus Shugoi pour Ruby on Rails — **parité complète avec le module Node `shugoi`**.
+
+Bloque les bots, scrapers et clients headless avec :
+- **Pre-flight PoW challenge** (307 + tableau ASCII pour curl/view-source, JS de résolution inline pour les navigateurs)
+- **Machine fingerprinting** (guard-detect) + whitelist
+- **Render-grant HMAC** (lié au siteKey + token + IP + TTL) — anti-bypass "token-only"
+- **Split-render** : skeleton unicode injecté dans la page, remplacé par le contenu réel après vérification
+
+## Installation
+
+```ruby
+# Gemfile
+gem "shugoi"
+```
+
+## Configuration (Rails)
+
+```ruby
+# config/initializers/shugoi.rb
+Shugoi.configure do |config|
+  config.site_key = "sg_sk_live_…"
+  config.secret = "…"              # secret du site (signature des tokens)
+  config.debug = Rails.env.development?
+  # config.base_url = "https://shugoi.com/api/v1"
+  # config.allowlist = ["/api", "/legal"]
+end
+```
+
+Le railtie monte automatiquement le middleware sur l'app Rails.
+
+## Usage Rack pur
+
+```ruby
+# config.ru
+require "shugoi"
+use Shugoi, site_key: "sg_sk_live_…", signing_secret: "…"
+run MyApp
+```
+
+## Options
+
+| Option | Défaut | Description |
+|---|---|---|
+| `site_key` | — | Votre siteKey Shugoi (requis) |
+| `secret` | — | Secret du site |
+| `signing_secret` | `secret` | Secret HMAC de signature |
+| `base_url` | `https://shugoi.com/api/v1` | API Shugoi |
+| `allowlist` | `["/api", "/legal"]` | Chemins sans protection |
+| `auto_inject` | `true` | Injecte les guards dans le HTML |
+| `split_render` | `true` | Skeleton + render |
+| `restricted_access` | `false` | Page d'accès restreint |
+| `pow_difficulty` | `10` | Bits du proof-of-work |
+| `debug` | `false` | Logs console |
+
+## Tests
+
+```bash
+bundle install
+bundle exec rspec
+```
+
+## Parité avec le module Node
+
+Le flux réplique exactement `shugoi` 0.3.6 (npm) :
+- `core.evaluate` → challenge 307 / `/__sg_challenge` / blocage headless
+- `injectGuardScripts` → token signé + skeleton unicode
+- `renderResponseData` → vérification grant + token, service du HTML stocké
+- `verifyRenderGrant` → format `base36(ts):HMAC(secret, "render-grant:siteKey:mid:token:ip:ts")`

data/lib/shugoi/api_client.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+require "json"
+
+module Shugoi
+  # Client HTTP vers l'API Shugoi (parité avec fetch dans le module Node).
+  class ApiClient
+    TIMEOUT = 5.0
+
+    def initialize(base_url, debug: false)
+      @base_url = base_url.to_s
+      @debug = debug
+    end
+
+    # GET /whitelist?key=... → { whitelistedMachines, detectionFlags, skipPaths }
+    def fetch_whitelist(site_key)
+      json = get("/whitelist", key: site_key)
+      {
+        whitelist: json["whitelistedMachines"] || [],
+        flags: json["detectionFlags"] || json["flags"] || {},
+        skip_paths: json["skipPaths"] || []
+      }
+    rescue StandardError
+      { whitelist: [], flags: {}, skip_paths: [] }
+    end
+
+    # GET /guard-detect?key=...&raw=1&cb=...&sig=... → texte du guard
+    def fetch_guard_detect(site_key, secret = nil)
+      cb = Utils.now_ms
+      query = { key: site_key, raw: 1, cb: cb.to_s }
+      query[:sig] = Utils.hmac_hex(secret, cb.to_s) if secret && !secret.empty?
+      body = get_raw("/guard-detect", query)
+      body
+    rescue StandardError
+      nil
+    end
+
+    # POST /event — enregistrement d'un événement (block, headless…)
+    def post_event(site_key, reason, machine_id = "")
+      payload = { siteKey: site_key, reason: reason, machineId: machine_id }
+      post_json("/event", payload)
+    rescue StandardError
+      nil
+    end
+
+    # POST /validate-key — valide la clé
+    def validate_key(site_key, secret)
+      payload = { siteKey: site_key, secret: secret }
+      json = post_json("/validate-key", payload)
+      json
+    rescue StandardError
+      { "valid" => false, "reason" => "network" }
+    end
+
+    private
+
+    def get(path, params)
+      uri = build_uri(path, params)
+      log("GET #{uri}")
+      res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https", open_timeout: TIMEOUT, read_timeout: TIMEOUT) do |http|
+        http.get(uri.request_uri, "User-Agent" => "shugoi-ruby/#{VERSION}")
+      end
+      JSON.parse(res.body)
+    end
+
+    def get_raw(path, params)
+      uri = build_uri(path, params)
+      res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https", open_timeout: TIMEOUT, read_timeout: TIMEOUT) do |http|
+        http.get(uri.request_uri, "User-Agent" => "shugoi-ruby/#{VERSION}")
+      end
+      res.body.to_s
+    end
+
+    def post_json(path, payload)
+      uri = build_uri(path)
+      req = Net::HTTP::Post.new(uri.request_uri, "Content-Type" => "application/json", "User-Agent" => "shugoi-ruby/#{VERSION}")
+      req.body = JSON.generate(payload)
+      res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https", open_timeout: TIMEOUT, read_timeout: TIMEOUT) do |http|
+        http.request(req)
+      end
+      JSON.parse(res.body)
+    end
+
+    def build_uri(path, params = {})
+      uri = URI.join(@base_url, path)
+      uri.query = URI.encode_www_form(params) unless params.empty?
+      uri
+    end
+
+    def log(msg)
+      warn("[shugoi] #{msg}") if @debug
+    end
+  end
+end

data/lib/shugoi/config.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Options du middleware — parité avec ShugoiCoreOptions (module Node).
+  class Config
+    DEFAULTS = {
+      site_key: nil,
+      secret: nil,
+      signing_secret: nil,
+      allowlist: ["/api", "/legal"],
+      headless_patterns: Shugoi::DEFAULT_HEADLESS_PATTERNS,
+      bot_whitelist: Shugoi::DEFAULT_BOT_WHITELIST,
+      base_url: "https://shugoi.com/api/v1",
+      internal_url: nil,
+      debug: false,
+      auto_inject: true,
+      restricted_access: false,
+      extra_directives: {},
+      csp: true,
+      block_status: 403,
+      locale: nil,
+      block_page: nil,
+      split_render: true,
+      multi_process: false,
+      verify_bots: true,
+      pow_difficulty: 10,
+      pow_ttl_ms: 120_000
+    }.freeze
+
+    attr_reader :options
+
+    def initialize(options = {})
+      @options = DEFAULTS.merge(symbolize(options))
+      raise ConfigError, "site_key is required" if @options[:site_key].nil?
+    end
+
+    def site_key = @options[:site_key]
+    def secret = @options[:secret]
+    def signing_secret = @options[:signing_secret] || @options[:secret]
+    def allowlist = @options[:allowlist]
+    def headless_patterns = @options[:headless_patterns]
+    def bot_whitelist = @options[:bot_whitelist]
+    def base_url = @options[:base_url]
+    def internal_url = @options[:internal_url] || @options[:base_url]
+    def debug = @options[:debug]
+    def auto_inject = @options[:auto_inject]
+    def restricted_access = @options[:restricted_access]
+    def extra_directives = @options[:extra_directives]
+    def csp_enabled = @options[:csp]
+    def block_status = @options[:block_status]
+    def locale = @options[:locale]
+    def block_page = @options[:block_page]
+    def split_render = @options[:split_render]
+    def multi_process = @options[:multi_process]
+    def verify_bots = @options[:verify_bots]
+    def pow_difficulty = @options[:pow_difficulty]
+    def pow_ttl_ms = @options[:pow_ttl_ms]
+
+    def is_allowlisted?(path)
+      allowlist.any? { |p| path == p || path.start_with?("#{p}/") }
+    end
+
+    def is_whitelisted_bot?(ua)
+      bot_whitelist.any? { |p| p.match?(ua) }
+    end
+
+    def is_headless?(ua)
+      headless_patterns.any? { |p| p.match?(ua) }
+    end
+
+    private
+
+    def symbolize(h)
+      h.each_with_object({}) { |(k, v), acc| acc[k.to_sym] = v }
+    end
+  end
+end

data/lib/shugoi/config_cache.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Cache mémoire de la config (whitelist + flags + skipPaths).
+  # Parité avec _configCache (render.ts) : TTL 30s + stale-refresh.
+  class ConfigCache
+    TTL_MS = 30_000
+    STALE_MAX_MS = 600_000
+
+    def initialize(api_client)
+      @api_client = api_client
+      @mutex = Mutex.new
+      @whitelist = []
+      @flags = {}
+      @skip_paths = []
+      @fetched_at = 0
+    end
+
+    def fetch(site_key)
+      @mutex.synchronize do
+        if @fetched_at.zero? || (Utils.now_ms - @fetched_at > STALE_MAX_MS)
+          refresh(site_key)
+        elsif Utils.now_ms - @fetched_at > TTL_MS
+          Thread.new { refresh(site_key) }.abort_on_exception = false
+        end
+        { whitelist: @whitelist, flags: @flags, skip_paths: @skip_paths }
+      end
+    end
+
+    private
+
+    def refresh(site_key)
+      data = @api_client.fetch_whitelist(site_key)
+      @whitelist = data[:whitelist]
+      @flags = data[:flags]
+      @skip_paths = data[:skip_paths]
+      @fetched_at = Utils.now_ms
+    end
+  end
+end

data/lib/shugoi/constants.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Shugoi
+  BLOCK_PAGE = [
+    "+---------------------------------------------+",
+    "|           BLOCKED BY SHUGOI                 |",
+    "+---------------------------------------------+",
+    "|  Bots, scrapers and headless clients        |",
+    "|  are blocked by Shugoi protection.          |",
+    "|                                             |",
+    "|  Use a standard browser to access           |",
+    "|  this site.                                 |",
+    "|                                             |",
+    "|  - web: https://shugoi.com -                |",
+    "+---------------------------------------------+"
+  ].join("\n") + "\n"
+
+  DEFAULT_HEADLESS_PATTERNS = [
+    /^curl/i, /^wget/i, /^python/i, /^Go-http-client/i, /^Java\//,
+    /HTTPie/i, /^node-fetch/i, /axios/i, /^okhttp/i, /^scrapy/i,
+    /PowerShell/i, /WinHttp/i
+  ].freeze
+
+  DEFAULT_BOT_WHITELIST = [
+    /Googlebot/i, /Bingbot/i, /Slurp/i, /DuckDuckBot/i, /YandexBot/i, /Applebot/i,
+    /facebookexternalhit/i, /Twitterbot/i, /LinkedInBot/i, /Discordbot/i, /Slackbot/i,
+    /WhatsApp/i, /TelegramBot/i
+  ].freeze
+end

data/lib/shugoi/core.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Évaluation d'une requête : pre-flight PoW challenge, /__sg_challenge, blocage headless.
+  # Parité avec core.ts (module Node).
+  class Core
+    # Résultat de blocage renvoyé au middleware.
+    Decision = Struct.new(:status, :content_type, :body, :headers, keyword_init: true)
+
+    def initialize(config, pow, api_client)
+      @config = config
+      @pow = pow
+      @api_client = api_client
+      @validation_valid = false
+      @validation_failed = false
+      @validation_warned_at = 0
+    end
+
+    # @param ctx [Hash] { path:, ua:, ip:, host:, accept_language:, sec_fetch_dest:, sec_fetch_mode:, sg_proof:, forwarded_prefix: }
+    # @return [Decision, nil] nil = laisser passer
+    def evaluate(ctx)
+      path = ctx[:path].to_s
+      return nil if @config.is_allowlisted?(path)
+
+      # Route du challenge JS (le navigateur arrive ici après le 307).
+      if path == "/__sg_challenge"
+        return challenge_page
+      end
+
+      # Pre-flight PoW challenge (anti-curl/view-source).
+      return nil if path.include?("/__shugoi/") || path.start_with?("/api/")
+      ua = ctx[:ua].to_s
+
+      if ua.match?(/Mozilla/i) && !@config.signing_secret.to_s.empty?
+        proof = ctx[:sg_proof].to_s
+        unless @pow.valid?(proof)
+          return pow_challenge_307(ctx)
+        end
+      end
+
+      # Blocage headless (UA).
+      if ua.match?(/Mozilla/i) == false && @config.is_headless?(ua)
+        @api_client.post_event(@config.site_key, "headless", "")
+        return Decision.new(status: @config.block_status, content_type: "text/plain", body: BLOCK_PAGE, headers: {})
+      end
+
+      nil
+    end
+
+    # Page challenge (tableau en commentaire + JS PoW inline).
+    def challenge_page
+      js = <<~JS
+        (function(){
+        var P=new URLSearchParams(location.search);
+        var salt=P.get('salt')||'', ts=P.get('ts')||'', diff=parseInt(P.get('diff')||'10',10), path=P.get('path')||'/';
+        var enc=new TextEncoder();
+        function bits(d){var l=0;for(var i=0;i<d.length;i++){var b=parseInt(d[i],16);if(b===0){l+=4;continue}var s=b.toString(2),z=0;while(z<s.length&&s[z]==='0')z++;l+=z;break}return l}
+        var n=0;
+        function step(){
+          crypto.subtle.digest('SHA-256',enc.encode(salt+':'+n.toString(16))).then(function(buf){
+            var h=Array.from(new Uint8Array(buf)).map(function(v){return v.toString(16).padStart(2,'0')}).join('');
+            if(bits(h)>=diff){var base=path;var q=(base.indexOf('?')>=0?'&':'?')+'sg_proof='+ts+':'+n.toString(16);location.replace(base+q)}
+            else{n++;if(n<300000)step()}
+          }).catch(function(){location.reload()});
+        }
+        step();
+        })();
+      JS
+      html = "<!--\n#{BLOCK_PAGE}-->\n<script>#{js}</script>"
+      Decision.new(status: 200, content_type: "text/html", body: html, headers: {})
+    end
+
+    private
+
+    # 307 vers le challenge : body = tableau ASCII seul (curl le voit tel quel).
+    def pow_challenge_307(ctx)
+      ts = Utils.now_sec
+      salt = Utils.hmac_hex(@config.signing_secret, ts.to_s)
+      prefix = ctx[:forwarded_prefix].to_s
+      prefix = "" if prefix == "/"
+      prefix = prefix.sub(%r{/\z}, "") unless prefix.empty?
+      path = ctx[:path].to_s
+      path = "/#{path}" unless path.start_with?("/")
+      chal_url = "#{prefix}/__sg_challenge?ts=#{ts}&salt=#{salt}&diff=#{@config.pow_difficulty}&path=#{URI.encode_www_form_component(prefix + path)}"
+      Decision.new(status: 307, content_type: "text/plain", body: BLOCK_PAGE, headers: { "location" => chal_url })
+    end
+  end
+end

data/lib/shugoi/errors.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Shugoi
+  class Error < StandardError; end
+  class ConfigError < Error; end
+  class InvalidSignature < Error; end
+end

data/lib/shugoi/guard_cache.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "monitor"
+
+module Shugoi
+  # Cache mémoire des guards (guard-detect) fetchés depuis l'API.
+  # Parité avec _guardCaches (render.ts).
+  class GuardCache
+    TTL_MS = 300_000
+
+    def initialize(api_client)
+      @api_client = api_client
+      @detect = nil
+      @fetched_at = 0
+      @mutex = Mutex.new
+    end
+
+    def detect
+      @detect
+    end
+
+    def ensure_ready(site_key, secret = nil)
+      return if @detect && Utils.now_ms - @fetched_at < TTL_MS
+
+      @mutex.synchronize do
+        return if @detect && Utils.now_ms - @fetched_at < TTL_MS
+        code = @api_client.fetch_guard_detect(site_key, secret)
+        @detect = code && !code.empty? ? code : 'console.error("Shugoi guard-detect unavailable")'
+        @fetched_at = Utils.now_ms
+      end
+    end
+  end
+end

data/lib/shugoi/html_store.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Stockage mémoire (et disque optionnel) du HTML rendu, lié au token.
+  # Parité avec _memoryStore/_siteCache (render.ts).
+  class HtmlStore
+    TOKEN_TTL_MS = 120_000
+    MAX_ENTRIES = 5000
+    MAX_TOTAL_BYTES = 64 * 1024 * 1024
+    MAX_TOKEN_READS = 1
+
+    Entry = Struct.new(:html, :expires_at, :reads)
+
+    def initialize(disk_path: nil)
+      @entries = {}
+      @site_cache = {}
+      @total_bytes = 0
+      @disk_path = disk_path
+      @mutex = Mutex.new
+    end
+
+    def store(token, html, site_key)
+      @mutex.synchronize do
+        evict_expired
+        size = html.bytesize
+        while (@entries.size >= MAX_ENTRIES || @total_bytes + size > MAX_TOTAL_BYTES) && !@entries.empty?
+          drop(@entries.keys.first)
+        end
+        @entries[token] = Entry.new(html, Utils.now_ms + TOKEN_TTL_MS, 0)
+        @site_cache[site_key] = html
+        @total_bytes += size
+        write_disk(token, html)
+      end
+    end
+
+    # @return [String, nil] html si présent et lisible
+    def read(token)
+      @mutex.synchronize do
+        entry = @entries[token]
+        return nil if entry.nil?
+        return drop_and_nil(token) if Utils.now_ms > entry.expires_at
+
+        entry.reads += 1
+        entry.html
+      end
+    end
+
+    def site_html(site_key)
+      @site_cache[site_key]
+    end
+
+    def drop(token)
+      @mutex.synchronize do
+        entry = @entries.delete(token)
+        @total_bytes -= entry.html.bytesize if entry
+      end
+    end
+
+    private
+
+    def evict_expired
+      @entries.each_key do |token|
+        entry = @entries[token]
+        drop(token) if Utils.now_ms > entry.expires_at
+      end
+    end
+
+    def drop_and_nil(token)
+      drop(token)
+      nil
+    end
+
+    def write_disk(token, html)
+      return unless @disk_path
+      path = File.join(@disk_path, Utils.sha256_hex(token))
+      File.write(path, html, mode: "w")
+    rescue StandardError
+      nil
+    end
+  end
+end

data/lib/shugoi/pow.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Proof-of-work anti-curl.
+  # Parité avec core.ts (module Node) :
+  #   salt = HMAC(secret, ts)
+  #   proof = "ts:nonce" où SHA256(salt:nonce) a >= POW_DIFFICULTY bits à zéro en tête.
+  class Pow
+    def initialize(signing_secret, difficulty = 10, ttl_ms = 120_000)
+      @secret = signing_secret.to_s
+      @difficulty = difficulty
+      @ttl_ms = ttl_ms
+    end
+
+    # Génère le challenge à injecter (window.__sg_pow).
+    def challenge
+      ts = Utils.now_sec
+      { ts: ts, salt: salt(ts), difficulty: @difficulty }
+    end
+
+    # Vérifie un proof "ts:nonce".
+    def valid?(proof)
+      return false if proof.to_s.empty? || @secret.empty?
+      ts_str, solution = proof.to_s.split(":", 2)
+      return false if ts_str.nil? || solution.nil?
+
+      ts = ts_str.to_i
+      return false if ts.zero?
+      return false if (Utils.now_ms - ts * 1000).abs > @ttl_ms
+
+      digest = Utils.sha256_hex("#{salt(ts_str)}:#{solution}")
+      Utils.leading_zero_bits(digest) >= @difficulty
+    end
+
+    private
+
+    def salt(ts)
+      Utils.hmac_hex(@secret, ts.to_s)
+    end
+  end
+end

data/lib/shugoi/rack/middleware.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require "rack"
+require "json"
+
+module Shugoi
+  module Rack
+    # Middleware Rack principal — parité avec createShugoiMiddleware (module Node).
+    #
+    #   use Shugoi::Rack::Middleware, site_key: "sg_sk_live_…", secret: "…"
+    #
+    # Ou via la gem :
+    #   use Shugoi, site_key: "…"
+    class Middleware
+      def initialize(app, options = {})
+        @app = app
+        @config = Config.new(options)
+        @api_client = ApiClient.new(@config.base_url, debug: @config.debug)
+        @guard_cache = GuardCache.new(@api_client)
+        @config_cache = ConfigCache.new(@api_client)
+        @token_signer = TokenSigner.new(@config.signing_secret)
+        @html_store = HtmlStore.new(disk_path: options[:disk_path])
+        @pow = Pow.new(@config.signing_secret, @config.pow_difficulty, @config.pow_ttl_ms)
+        @skeleton = SkeletonGenerator.new(@config, @guard_cache, @config_cache, @token_signer)
+        @render = RenderHandler.new(@config, @token_signer, @html_store, @config_cache)
+        @core = Core.new(@config, @pow, @api_client)
+      end
+
+      def call(env)
+        path = env["PATH_INFO"].to_s
+        query = parse_query(env["QUERY_STRING"].to_s)
+
+        # Render endpoint.
+        if path.end_with?("/__shugoi/render")
+          return handle_render(env, query)
+        end
+
+        # CSP.
+        headers = {}
+        headers["content-security-policy"] = csp_header if @config.csp_enabled
+
+        ctx = build_ctx(env, query)
+        decision = @core.evaluate(ctx)
+
+        if decision
+          h = headers.merge(decision.headers || {})
+          h["content-type"] = decision.content_type
+          return [decision.status, h, [decision.body]]
+        end
+
+        # SkipPaths (SSR direct) : on laisse l'app servir la page sans challenge ni skeleton.
+        if @config.auto_inject && @config.site_key
+          cfg = @config_cache.fetch(@config.site_key)
+          if cfg[:skip_paths].include?(path)
+            return @app.call(env)
+          end
+        end
+
+        status, resp_headers, body = @app.call(env)
+
+        # Rack 3 exige des noms de headers en minuscules → on normalise.
+        resp_headers = resp_headers.each_with_object({}) { |(k, v), acc| acc[k.to_s.downcase] = v }
+
+        # L'allowlist skip le split-render aussi (parité Node : `!core.isAllowlisted(path)`).
+        return [status, resp_headers, body] unless @config.auto_inject && @config.split_render && !@config.is_allowlisted?(path)
+
+        html = body.respond_to?(:each) ? body.each.to_a.join : body.to_s
+        ct = resp_headers["content-type"].to_s
+        if html.include?("<html") && (ct.include?("text/html") || ct.empty?)
+          begin
+            skeleton = inject_guards(html, ctx)
+            body = [skeleton]
+          rescue StandardError => e
+            warn("[shugoi] inject error: #{e.message}") if @config.debug
+          end
+        end
+
+        [status, resp_headers, body]
+      end
+
+      private
+
+      def build_ctx(env, query)
+        ua = env["HTTP_USER_AGENT"].to_s
+        ip = (env["HTTP_X_FORWARDED_FOR"].to_s.split(",")[0] || "").strip
+        ip = env["REMOTE_ADDR"].to_s if ip.empty?
+        {
+          path: env["PATH_INFO"].to_s,
+          ua: ua,
+          ip: ip,
+          host: env["HTTP_HOST"].to_s,
+          accept_language: env["HTTP_ACCEPT_LANGUAGE"],
+          sec_fetch_dest: env["HTTP_SEC_FETCH_DEST"],
+          sec_fetch_mode: env["HTTP_SEC_FETCH_MODE"],
+          sg_proof: query["sg_proof"],
+          forwarded_prefix: env["HTTP_X_FORWARDED_PREFIX"]
+        }
+      end
+
+      def handle_render(env, query)
+        token = query["token"].to_s
+        mid = query["mid"].to_s
+        grant = query["grant"].to_s
+        ip = (env["HTTP_X_FORWARDED_FOR"].to_s.split(",")[0] || "").strip
+        ip = env["REMOTE_ADDR"].to_s if ip.empty?
+        data = @render.render_data(token, mid, grant, ip)
+        body = JSON.generate(data)
+        [200, { "content-type" => "application/json", "cache-control" => "no-store" }, [body]]
+      end
+
+      def inject_guards(html, ctx)
+        ts = Utils.now_ms
+        signed = @token_signer.sign(@config.site_key, ts)
+        render_url = "./__shugoi/render"
+
+        # Injecte window.__sg_disableRestrictedAccess si nécessaire.
+        config_script = ""
+        unless @config.restricted_access
+          config_script = "<script>window.__sg_disableRestrictedAccess=true</script>"
+        end
+
+        injected = html
+        if (i = injected.index("</head>"))
+          injected = injected[0...i] + config_script + injected[i..]
+        elsif (m = injected.match(/<body[^>]*>/))
+          at = injected.index(m[0]) + m[0].length
+          injected = injected[0...at] + config_script + injected[at..]
+        else
+          injected = config_script + injected
+        end
+
+        @html_store.store(signed, injected, @config.site_key)
+        @skeleton.generate(@config.site_key, signed, @config.base_url, render_url)
+      end
+
+      def csp_header
+        base = "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://shugoi.com; " \
+               "connect-src 'self' https://shugoi.com; style-src 'self' 'unsafe-inline' https://shugoi.com; " \
+               "font-src 'self' https://shugoi.com data:; img-src 'self' https://shugoi.com data: blob:; " \
+               "frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'"
+        base
+      end
+
+      def parse_query(qs)
+        ::Rack::Utils.parse_nested_query(qs)
+      end
+    end
+  end
+end

data/lib/shugoi/rails/configuration.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Shugoi
+  module Rails
+    # Configuration globale pour Rails (équivalent de ShugoiCoreOptions).
+    class Configuration
+      attr_accessor :site_key, :secret, :signing_secret, :allowlist,
+                    :headless_patterns, :bot_whitelist, :base_url, :internal_url,
+                    :debug, :auto_inject, :restricted_access, :extra_directives,
+                    :csp, :block_status, :locale, :block_page, :split_render,
+                    :multi_process, :verify_bots, :pow_difficulty, :pow_ttl_ms
+
+      def initialize
+        @site_key = ENV["SHUGOI_SITE_KEY"]
+        @secret = ENV["SHUGOI_SECRET"]
+        @signing_secret = ENV["SHUGOI_SIGNING_SECRET"] || ENV["SHUGOKI_SIGNING_SECRET"]
+        @allowlist = ["/api", "/legal"]
+        @headless_patterns = Shugoi::DEFAULT_HEADLESS_PATTERNS
+        @bot_whitelist = Shugoi::DEFAULT_BOT_WHITELIST
+        @base_url = ENV["SHUGOI_BASE_URL"] || "https://shugoi.com/api/v1"
+        @internal_url = nil
+        @debug = false
+        @auto_inject = true
+        @restricted_access = false
+        @extra_directives = {}
+        @csp = true
+        @block_status = 403
+        @locale = nil
+        @block_page = nil
+        @split_render = true
+        @multi_process = false
+        @verify_bots = true
+        @pow_difficulty = 10
+        @pow_ttl_ms = 120_000
+      end
+
+      def to_options
+        {
+          site_key: @site_key,
+          secret: @secret,
+          signing_secret: @signing_secret,
+          allowlist: @allowlist,
+          headless_patterns: @headless_patterns,
+          bot_whitelist: @bot_whitelist,
+          base_url: @base_url,
+          internal_url: @internal_url,
+          debug: @debug,
+          auto_inject: @auto_inject,
+          restricted_access: @restricted_access,
+          extra_directives: @extra_directives,
+          csp: @csp,
+          block_status: @block_status,
+          locale: @locale,
+          block_page: @block_page,
+          split_render: @split_render,
+          multi_process: @multi_process,
+          verify_bots: @verify_bots,
+          pow_difficulty: @pow_difficulty,
+          pow_ttl_ms: @pow_ttl_ms
+        }.reject { |_, v| v.nil? }
+      end
+    end
+  end
+end

data/lib/shugoi/rails/railtie.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Shugoi
+  module Rails
+    # Intégration Rails : monte le middleware et expose la configuration.
+    #
+    #   # config/initializers/shugoi.rb
+    #   Shugoi.configure do |config|
+    #     config.site_key = "sg_sk_live_…"
+    #     config.secret = "…"
+    #     config.debug = Rails.env.development?
+    #   end
+    class Railtie < ::Rails::Railtie
+      initializer "shugoi.middleware" do |app|
+        app.middleware.use Shugoi::Rack::Middleware, Shugoi.config.to_options
+      end
+    end
+  end
+end

data/lib/shugoi/render_handler.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Traite la requête /__shugoi/render : vérifie token + grant, sert le HTML stocké.
+  # Parité avec renderResponseData + handleRender (render.ts).
+  class RenderHandler
+    def initialize(config, token_signer, html_store, config_cache)
+      @config = config
+      @token_signer = token_signer
+      @html_store = html_store
+      @config_cache = config_cache
+    end
+
+    # @param token [String] token render
+    # @param mid [String] machineId
+    # @param grant [String] render-grant
+    # @param ip [String]
+    # @return [Hash] { html: … } ou { error: "not_found" }
+    def render_data(token, mid, grant, ip)
+      return { error: "not_found" } if token.to_s.empty? || token.length < 16 || token.length > 300
+
+      # Le token doit appartenir à CE siteKey (CRITIQUE 1 §7bis).
+      tok_site_key = token.split(":")[0]
+      return { error: "not_found" } if tok_site_key != @config.site_key
+
+      # Expiration du token.
+      tok_ts = token.split(":")[1].to_i
+      return { error: "not_found" } if !tok_ts.zero? && Utils.now_ms - tok_ts > HtmlStore::TOKEN_TTL_MS
+
+      # Anti-bypass token-only : grant valide requis.
+      return { error: "not_found" } unless @token_signer.verify_render_grant(mid, grant, token, ip, @config.site_key)
+
+      content_replace_on = content_replace_flag?(token)
+      html = @html_store.read(token)
+      return { html: html } if html
+
+      # Fallback content-replace OFF : renvoie le HTML du site.
+      unless content_replace_on
+        site_html = @html_store.site_html(tok_site_key)
+        return { html: site_html } if site_html
+      end
+
+      return { error: "not_found" } unless @token_signer.verify_token(token)
+
+      { error: "not_found" }
+    end
+
+    private
+
+    def content_replace_flag?(token)
+      site_key = token.split(":")[0]
+      flags = @config_cache.fetch(site_key)[:flags]
+      flags["enableContentReplacementCheck"] == true
+    end
+  end
+end

data/lib/shugoi/skeleton_generator.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Génère le skeleton HTML (bootcode unicode) injecté dans la page.
+  # Parité avec generateSkeleton (render.ts) — mêmes fragments JS, même encodage unicode.
+  class SkeletonGenerator
+    def initialize(config, guard_cache, config_cache, token_signer)
+      @config = config
+      @guard_cache = guard_cache
+      @config_cache = config_cache
+      @token_signer = token_signer
+    end
+
+    # @return [String] HTML du skeleton (<script>…eval([...])…</script>)
+    def generate(site_key, token, base_url, render_url = "./__shugoi/render", locale = "en")
+      @guard_cache.ensure_ready(site_key, @config.signing_secret)
+      cfg_data = @config_cache.fetch(site_key)
+      flags = cfg_data[:flags]
+      detect = @guard_cache.detect
+
+      fragments = []
+      fragments << "window.__sg_siteKey=#{json(site_key)}"
+      fragments << "window.__sg_baseUrl=#{json(base_url)}"
+      fragments << "window.__sg_config=#{json(flags)}"
+      fragments << "try{if((location.search||'').indexOf('sg_proof=')>=0){var _qs=location.search.replace(/[?&]sg_proof=[^&]*/,'');var _cu=location.pathname+(_qs?_qs:'')+location.hash;history.replaceState(null,'',_cu)}}catch(e){}"
+
+      pow = Pow.new(@config.signing_secret, @config.pow_difficulty, @config.pow_ttl_ms).challenge
+      fragments << "window.__sg_pow=#{json(pow)}"
+      fragments << "window.__sg_serverTime=#{Utils.now_ms}"
+      fragments << "window.__sg_clockts=#{Utils.now_ms}"
+      fragments << "window.__sg_disableRestrictedAccess=true" unless @config.restricted_access
+      fragments << "try{#{detect}}catch(e){window.__sg_blocked=true}" if detect
+
+      # __sg_showBlock (page de blocage néobrutaliste)
+      fragments << show_block_fragment
+
+      fragments << "var t=\"#{token}\""
+      fragments << "window.__sg_token=\"#{token}\""
+      fragments << "var k=\"#{site_key}\""
+      fragments << "var b=\"#{base_url}\""
+      fragments << "var r=\"#{render_url}\""
+
+      # rd(p,n) : remplacement du document par le contenu rendu.
+      fragments << rd_fragment
+
+      fragments << "_gw(function(){rd(r+\"?token=\"+t,0);setTimeout(_sgCl,1500)})"
+      fragments << cleanup_fragment
+
+      combined = fragments.join(";")
+      enc = Utils.unicode_encode(combined)
+      decoded_call = "[...'#{enc}'].map(x=>String.fromCodePoint(x.codePointAt(0)-917504)).join('')"
+      "<script>eval(#{decoded_call})</script>"
+    end
+
+    private
+
+    def json(obj)
+      JSON.generate(obj)
+    end
+
+    def show_block_fragment
+      css = "body{font-family:system-ui,-apple-system,'Segoe UI',Roboto,sans-serif;display:flex;align-items:center;justify-content:center;padding:1.2rem}#c{max-width:460px;width:100%;background:#fff;border:4px solid #000;border-radius:28px 6px 32px 10px;box-shadow:12px 12px 0 #000;padding:3rem 2.4rem 2.8rem;text-align:center}#c .bdg{display:inline-block;border:2px solid #000;border-radius:10px 2px 14px 4px;padding:.3rem .9rem;font-size:.6rem;font-weight:700;text-transform:uppercase;letter-spacing:.1em;color:#E87090;margin-bottom:1.4rem}#c h2{font-family:'Alex Brush',Georgia,'Times New Roman',serif;font-size:2.2rem;color:#E87090;font-weight:400;margin:0 auto .6rem}#c p.desc{font-size:.9rem;color:#555;line-height:1.8;max-width:380px;margin:0 auto}#c p.ft{font-size:.55rem;color:#E87090;margin-top:1.8rem}"
+      "window.__sg_showBlock=function(msg,title,badge){var h=\"<head><meta charset=UTF-8><meta name=viewport content=width=device-width,initial-scale=1><style>#{css}</style></head><body><div id=c><img src=https://shugoi.com/favicon-block.png class=l><img src=https://shugoi.com/brand-block.png class=b><div class=bdg>\"+(badge||\"\")+\"</div><h2>\"+(title||\"\")+\"</h2><p class=desc>\"+(msg||\"\")+\"</p><p class=ft>\"+location.hostname+\" \\u00b7 Shugoi</p></div></body>\";document.documentElement.innerHTML=h}"
+    end
+
+    def rd_fragment
+      "var _gw=function(cb){if(window.__sg_guardsReady||window.__sg_blocked)cb();else setTimeout(function(){_gw(cb)},100)};" \
+        "function rd(p,n){if(window.__sg_blocked)return;if(!document.body)return setTimeout(function(){rd(p,n)},50);" \
+        "if(n>6){if((window.__sg_config||{}).enableContentReplacementCheck===true)window.__sg_showBlock&&window.__sg_showBlock(\"\",\"\",\"\");return}" \
+        "var _g=(window.__sg_grant||\"\");if(_g){p=p+(\"&grant=\"+encodeURIComponent(_g))}" \
+        "var _m=(window.__sg_detectMid||window.__sg_mid||\"\");if(_m){p=p+(\"&mid=\"+encodeURIComponent(_m))}" \
+        "fetch(p).then(function(x){return x.json()}).then(function(d){if(window.__sg_blocked)return;" \
+        "if(!document.body)return setTimeout(function(){rd(p,n+1)},50);" \
+        "if(d.html){document.open(\"text/html\");document.write(d.html);document.close();window.scrollTo(0,0)}" \
+        "if(d.blocked){window.__sg_showBlock&&window.__sg_showBlock(d.message,d.title)}" \
+        "if(d.error){if((window.__sg_config||{}).enableContentReplacementCheck===true)window.__sg_showBlock&&window.__sg_showBlock(\"\",\"\",\"\")}" \
+        "else if(!d.html&&!d.blocked){setTimeout(function(){rd(p,n+1)},300)}})" \
+        ".catch(function(){setTimeout(function(){rd(p,n+1)},300)})}"
+    end
+
+    def cleanup_fragment
+      "function _sgCl(){try{for(var _i in window){if(_i.indexOf(\"__sg\")===0){window[_i]=null;delete window[_i]}}" \
+        "window._sgLogCP=function(){};window.midHex=function(){};window.rd=function(){};window._gw=function(){};" \
+        "window.applyDecision=function(){};window._D=function(){};window.z=function(f){return f()}}catch(_e){}}"
+    end
+  end
+end

data/lib/shugoi/token_signer.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Shugoi
+  # Signature des tokens render + vérification des render-grants.
+  # Parité exacte avec le module Node :
+  #   token :  siteKey:timestamp:nonce:sig        (sig = HMAC(secret, "siteKey:ts:nonce"))
+  #   grant :  base36(ts):HMAC(secret, "render-grant:siteKey:mid:token:ip:ts")
+  class TokenSigner
+    GRANT_TTL_MS = 120_000
+
+    def initialize(secret)
+      @secret = secret.to_s
+    end
+
+    # @return [String] token signé, ou "" si pas de secret
+    def sign(site_key, timestamp = Utils.now_ms)
+      return "" if @secret.empty?
+      nonce = SecureRandom.hex(8)
+      payload = [site_key, timestamp.to_i, nonce].join(":")
+      sig = Utils.hmac_hex(@secret, payload)
+      "#{payload}:#{sig}"
+    end
+
+    # Vérifie un render-grant émis par le wlc serveur.
+    # @param mid [String] machineId (64 hex)
+    # @param grant [String] grant brut "base36ts:sig"
+    # @param token [String] token render lié
+    # @param ip [String] IP du client
+    # @param expected_site_key [String] siteKey attendu (celui du middleware)
+    def verify_render_grant(mid, grant, token, ip, expected_site_key)
+      return true if @secret.empty? # fail-safe : pas de secret → pas de vérification
+      return false if grant.to_s.empty? || mid.to_s.empty?
+      return false unless mid.to_s.match?(/\A[a-f0-9]{64}\z/)
+
+      ts_str, sig = grant.to_s.split(":", 2)
+      return false if ts_str.nil? || sig.nil?
+
+      ts = Utils.base36_decode(ts_str)
+      return false if ts.zero? && ts_str != "0"
+      return false if Utils.now_ms - (ts * 1000) > GRANT_TTL_MS
+      return false if expected_site_key.to_s.empty?
+
+      payload = "render-grant:#{[expected_site_key, mid, token.to_s, ip.to_s, ts_str].join(':')}"
+      expected = Utils.hmac_hex(@secret, payload)
+      Utils.secure_equals(sig, expected)
+    end
+
+    # Vérifie un token render complet (siteKey:ts:nonce:sig).
+    def verify_token(token)
+      parts = token.to_s.split(":")
+      return false unless parts.length == 4 && parts[3].length == 64
+      return false if @secret.empty?
+
+      site_key, timestamp, nonce, sig = parts
+      ts = timestamp.to_i
+      return false if ts.zero?
+      return false if Utils.now_ms - ts > 120_000 # TOKEN_TTL
+
+      payload = [site_key, timestamp, nonce].join(":")
+      expected = Utils.hmac_hex(@secret, payload)
+      Utils.secure_equals(sig, expected)
+    end
+  end
+end

data/lib/shugoi/utils.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "securerandom"
+require "json"
+
+module Shugoi
+  module Utils
+    module_function
+
+    # Comparaison constant-time de deux hex strings.
+    def secure_equals(a, b)
+      return false unless a.is_a?(String) && b.is_a?(String)
+      return false unless a.bytesize == b.bytesize
+      OpenSSL.fixed_length_secure_compare(a, b)
+    end
+
+    def hmac_hex(secret, payload)
+      OpenSSL::HMAC.hexdigest("SHA256", secret.to_s, payload.to_s)
+    end
+
+    def sha256_hex(str)
+      OpenSSL::Digest::SHA256.hexdigest(str.to_s)
+    end
+
+    def base36_encode(num)
+      return "0" if num.zero?
+      alphabet = "0123456789abcdefghijklmnopqrstuvwxyz"
+      out = +""
+      n = num
+      while n.positive?
+        n, r = n.divmod(36)
+        out.prepend(alphabet[r])
+      end
+      out
+    end
+
+    def base36_decode(str)
+      str.to_s.to_i(36)
+    end
+
+    # Nombre de bits à zéro en tête du digest hex (parité avec la fonction JS `bits`).
+    def leading_zero_bits(hex_digest)
+      leading = 0
+      hex_digest.each_char do |c|
+        nib = c.to_i(16)
+        if nib.zero?
+          leading += 4
+          next
+        end
+        leading += nib.to_s(2).match(/^0*/)[0].length
+        break
+      end
+      leading
+    end
+
+    def now_ms
+      (Time.now.to_f * 1000).to_i
+    end
+
+    def now_sec
+      Time.now.to_i
+    end
+
+    # Encodage unicode (parité Node : chaque caractère décalé de +917504).
+    def unicode_encode(code)
+      code.each_codepoint.map { |cp| (917504 + cp).chr(Encoding::UTF_8) }.join
+    end
+
+    def escape_json_string(s)
+      JSON.generate(s.to_s)[1..-2]
+    end
+  end
+end

data/lib/shugoi/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Shugoi
+  VERSION = "0.1.0"
+end

data/lib/shugoi.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require_relative "shugoi/version"
+require_relative "shugoi/errors"
+require_relative "shugoi/constants"
+require_relative "shugoi/config"
+require_relative "shugoi/utils"
+require_relative "shugoi/token_signer"
+require_relative "shugoi/pow"
+require_relative "shugoi/api_client"
+require_relative "shugoi/guard_cache"
+require_relative "shugoi/config_cache"
+require_relative "shugoi/html_store"
+require_relative "shugoi/skeleton_generator"
+require_relative "shugoi/render_handler"
+require_relative "shugoi/core"
+require_relative "shugoi/rack/middleware"
+require_relative "shugoi/rails/configuration"
+require_relative "shugoi/rails/railtie" if defined?(::Rails::Railtie)
+
+module Shugoi
+  def self.new(app, options = {})
+    Shugoi::Rack::Middleware.new(app, options)
+  end
+
+  class << self
+    def config
+      @config ||= Shugoi::Rails::Configuration.new
+    end
+
+    def configure
+      yield(config)
+    end
+  end
+end

metadata

@@ -0,0 +1,104 @@
+--- !ruby/object:Gem::Specification
+name: shugoi
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Shugoi
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '6.0'
+- !ruby/object:Gem::Dependency
+  name: concurrent-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
+description: Rack middleware + Rails integration for Shugoi. Blocks bots, scrapers
+  and headless clients with a proof-of-work challenge, machine fingerprinting and
+  split-render, mirroring the Node.js module.
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/shugoi.rb
+- lib/shugoi/api_client.rb
+- lib/shugoi/config.rb
+- lib/shugoi/config_cache.rb
+- lib/shugoi/constants.rb
+- lib/shugoi/core.rb
+- lib/shugoi/errors.rb
+- lib/shugoi/guard_cache.rb
+- lib/shugoi/html_store.rb
+- lib/shugoi/pow.rb
+- lib/shugoi/rack/middleware.rb
+- lib/shugoi/rails/configuration.rb
+- lib/shugoi/rails/railtie.rb
+- lib/shugoi/render_handler.rb
+- lib/shugoi/skeleton_generator.rb
+- lib/shugoi/token_signer.rb
+- lib/shugoi/utils.rb
+- lib/shugoi/version.rb
+homepage: https://shugoi.com
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://shugoi.com
+  source_code_uri: https://github.com/RoxasYTB/shugoi-npm
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: Shugoi anti-abuse protection for Ruby on Rails
+test_files: []