sidekiq 6.2.2 → 8.1.5

data/lib/sidekiq/web/router.rb

@@ -3,101 +3,88 @@
 require "rack"
 
 module Sidekiq
-  module WebRouter
-    GET = "GET"
-    DELETE = "DELETE"
-    POST = "POST"
-    PUT = "PUT"
-    PATCH = "PATCH"
-    HEAD = "HEAD"
-
-    ROUTE_PARAMS = "rack.route_params"
-    REQUEST_METHOD = "REQUEST_METHOD"
-    PATH_INFO = "PATH_INFO"
-
-    def head(path, &block)
-      route(HEAD, path, &block)
-    end
+  class Web
+    # Provides an API to declare endpoints, along with a match
+    # API to dynamically route a request to an endpoint.
+    module Router
+      def head(path, &) = route(:head, path, &)
 
-    def get(path, &block)
-      route(GET, path, &block)
-    end
+      def get(path, &) = route(:get, path, &)
 
-    def post(path, &block)
-      route(POST, path, &block)
-    end
+      def post(path, &) = route(:post, path, &)
 
-    def put(path, &block)
-      route(PUT, path, &block)
-    end
+      def put(path, &) = route(:put, path, &)
 
-    def patch(path, &block)
-      route(PATCH, path, &block)
-    end
+      def patch(path, &) = route(:patch, path, &)
 
-    def delete(path, &block)
-      route(DELETE, path, &block)
-    end
+      def delete(path, &) = route(:delete, path, &)
 
-    def route(method, path, &block)
-      @routes ||= {GET => [], POST => [], PUT => [], PATCH => [], DELETE => [], HEAD => []}
-
-      @routes[method] << WebRoute.new(method, path, block)
-    end
-
-    def match(env)
-      request_method = env[REQUEST_METHOD]
-      path_info = ::Rack::Utils.unescape env[PATH_INFO]
+      def route(*methods, path, &block)
+        methods.each do |method|
+          raise ArgumentError, "Invalid method #{method}. Must be one of #{@routes.keys.join(",")}" unless route_cache.has_key?(method)
+          route_cache[method] << Route.new(method, path, block)
+        end
+      end
 
-      # There are servers which send an empty string when requesting the root.
-      # These servers should be ashamed of themselves.
-      path_info = "/" if path_info == ""
+      def match(env)
+        request_method = env["REQUEST_METHOD"].downcase.to_sym
+        path_info = ::Rack::Utils.unescape_path env["PATH_INFO"]
 
-      @routes[request_method].each do |route|
-        params = route.match(request_method, path_info)
-        if params
-          env[ROUTE_PARAMS] = params
+        # There are servers which send an empty string when requesting the root.
+        # These servers should be ashamed of themselves.
+        path_info = "/" if path_info == ""
 
-          return WebAction.new(env, route.block)
+        route_cache[request_method].each do |route|
+          params = route.match(request_method, path_info)
+          if params
+            env["rack.route_params"] = params
+            return Action.new(env, route.block)
+          end
         end
+
+        nil
       end
 
-      nil
+      def route_cache
+        @@routes ||= {get: [], post: [], put: [], patch: [], delete: [], head: []}
+      end
     end
-  end
 
-  class WebRoute
-    attr_accessor :request_method, :pattern, :block, :name
+    class Route
+      attr_accessor :request_method, :pattern, :block, :name
 
-    NAMED_SEGMENTS_PATTERN = /\/([^\/]*):([^.:$\/]+)/
+      NAMED_SEGMENTS_PATTERN = /\/([^\/]*):([^.:$\/]+)/
 
-    def initialize(request_method, pattern, block)
-      @request_method = request_method
-      @pattern = pattern
-      @block = block
-    end
+      def initialize(request_method, pattern, block)
+        @request_method = request_method
+        @pattern = pattern
+        @block = block
+      end
 
-    def matcher
-      @matcher ||= compile
-    end
+      def matcher
+        @matcher ||= compile
+      end
 
-    def compile
-      if pattern.match?(NAMED_SEGMENTS_PATTERN)
-        p = pattern.gsub(NAMED_SEGMENTS_PATTERN, '/\1(?<\2>[^$/]+)')
+      def compile
+        if pattern.match?(NAMED_SEGMENTS_PATTERN)
+          p = pattern.gsub(NAMED_SEGMENTS_PATTERN, '/\1(?<\2>[^$/]+)')
 
-        Regexp.new("\\A#{p}\\Z")
-      else
-        pattern
+          Regexp.new("\\A#{p}\\Z")
+        else
+          pattern
+        end
       end
-    end
 
-    def match(request_method, path)
-      case matcher
-      when String
-        {} if path == matcher
-      else
-        path_match = path.match(matcher)
-        path_match&.named_captures&.transform_keys(&:to_sym)
+      EMPTY = {}.freeze
+
+      def match(request_method, path)
+        case matcher
+        when String
+          EMPTY if path == matcher
+        else
+          path_match = path.match(matcher)
+          path_match&.named_captures&.transform_keys(&:to_sym)
+        end
       end
     end
   end

data/lib/sidekiq/web.rb

@@ -1,27 +1,19 @@
 # frozen_string_literal: true
 
 require "erb"
-
-require "sidekiq"
-require "sidekiq/api"
-require "sidekiq/paginator"
-require "sidekiq/web/helpers"
-
-require "sidekiq/web/router"
-require "sidekiq/web/action"
-require "sidekiq/web/application"
-require "sidekiq/web/csrf_protection"
-
-require "rack/content_length"
+require "securerandom"
 require "rack/builder"
 require "rack/static"
+require "sidekiq"
+require "sidekiq/api"
+require "sidekiq/web/config"
 
 module Sidekiq
   class Web
     ROOT = File.expand_path("#{File.dirname(__FILE__)}/../../web")
     VIEWS = "#{ROOT}/views"
     LOCALES = ["#{ROOT}/locales"]
-    LAYOUT = "#{VIEWS}/layout.erb"
+    LAYOUT = "#{VIEWS}/layout.html.erb"
     ASSETS = "#{ROOT}/assets"
 
     DEFAULT_TABS = {
@@ -30,140 +22,119 @@ module Sidekiq
       "Queues" => "queues",
       "Retries" => "retries",
       "Scheduled" => "scheduled",
-      "Dead" => "morgue"
+      "Dead" => "morgue",
+      "Metrics" => "metrics",
+      "Profiles" => "profiles"
     }
 
+    @@config = Sidekiq::Web::Config.new
+
     class << self
-      def settings
-        self
+      def configure
+        if block_given?
+          yield @@config
+        else
+          @@config
+        end
       end
 
-      def default_tabs
-        DEFAULT_TABS
+      def app_url=(url)
+        @@config.app_url = url
       end
 
-      def custom_tabs
-        @custom_tabs ||= {}
+      def assets_path=(path)
+        @@config.assets_path = path
       end
-      alias_method :tabs, :custom_tabs
 
-      def locales
-        @locales ||= LOCALES
-      end
+      def assets_path = @@config.assets_path
 
-      def views
-        @views ||= VIEWS
-      end
+      def tabs = @@config.tabs
 
-      def enable(*opts)
-        opts.each { |key| set(key, true) }
-      end
+      def locales = @@config.locales
 
-      def disable(*opts)
-        opts.each { |key| set(key, false) }
-      end
-
-      def middlewares
-        @middlewares ||= []
-      end
-
-      def use(*args, &block)
-        middlewares << [args, block]
-      end
+      def views = @@config.views
 
-      def set(attribute, value)
-        send(:"#{attribute}=", value)
-      end
+      def custom_job_info_rows = @@config.custom_job_info_rows
 
-      def sessions=(val)
-        puts "WARNING: Sidekiq::Web.sessions= is no longer relevant and will be removed in Sidekiq 7.0. #{caller(1..1).first}"
+      def redis_pool
+        @pool || Sidekiq.default_configuration.redis_pool
       end
 
-      def session_secret=(val)
-        puts "WARNING: Sidekiq::Web.session_secret= is no longer relevant and will be removed in Sidekiq 7.0. #{caller(1..1).first}"
+      def redis_pool=(pool)
+        @pool = pool
       end
 
-      attr_accessor :app_url, :redis_pool
-      attr_writer :locales, :views
-    end
+      def middlewares = @@config.middlewares
 
-    def self.inherited(child)
-      child.app_url = app_url
-      child.redis_pool = redis_pool
-    end
+      def use(*args, &block) = @@config.middlewares << [args, block]
 
-    def settings
-      self.class.settings
+      def register(*args, **kw, &block)
+        Sidekiq.logger.warn { "`Sidekiq::Web.register` is deprecated, use `Sidekiq::Web.configure {|cfg| cfg.register(...) }`" }
+        @@config.register(*args, **kw, &block)
+      end
     end
 
-    def middlewares
-      @middlewares ||= self.class.middlewares
+    # Allow user to say
+    #   run Sidekiq::Web
+    # rather than:
+    #   run Sidekiq::Web.new
+    def self.call(env)
+      @inst ||= new
+      @inst.call(env)
     end
 
-    def use(*args, &block)
-      middlewares << [args, block]
+    # testing, internal use only
+    def self.reset!
+      @@config.reset!
+      @inst = nil
     end
 
     def call(env)
-      app.call(env)
-    end
-
-    def self.call(env)
-      @app ||= new
-      @app.call(env)
+      env[:web_config] = Sidekiq::Web.configure
+      env[:csp_nonce] = SecureRandom.hex(8)
+      env[:redis_pool] = self.class.redis_pool
+      safe_request?(env) ? app.call(env) : deny(env)
     end
 
     def app
-      @app ||= build
-    end
-
-    def enable(*opts)
-      opts.each { |key| set(key, true) }
+      @app ||= build(@@config)
     end
 
-    def disable(*opts)
-      opts.each { |key| set(key, false) }
+    def safe_methods?(env)
+      %w[GET HEAD OPTIONS TRACE].include? env["REQUEST_METHOD"]
     end
 
-    def set(attribute, value)
-      send(:"#{attribute}=", value)
+    def safe_request?(env)
+      return true if safe_methods?(env)
+      env["HTTP_SEC_FETCH_SITE"] == "same-origin"
     end
 
-    def sessions=(val)
-      puts "Sidekiq::Web#sessions= is no longer relevant and will be removed in Sidekiq 7.0. #{caller[2..2].first}"
-    end
-
-    def self.register(extension)
-      extension.registered(WebApplication)
+    def deny(env)
+      Sidekiq.logger.warn "attack prevented by #{self.class}"
+      [403, {Rack::CONTENT_TYPE => "text/plain"}, ["Forbidden"]]
     end
 
     private
 
-    def build
-      klass = self.class
-      m = middlewares
+    def build(cfg)
+      cfg.freeze
+      m = cfg.middlewares
 
       rules = []
-      rules = [[:all, {"Cache-Control" => "public, max-age=86400"}]] unless ENV["SIDEKIQ_WEB_TESTING"]
+      rules = [[:all, {"cache-control" => "private, max-age=86400"}]] unless ENV["SIDEKIQ_WEB_TESTING"]
 
       ::Rack::Builder.new do
         use Rack::Static, urls: ["/stylesheets", "/images", "/javascripts"],
-                          root: ASSETS,
-                          cascade: true,
-                          header_rules: rules
+          root: cfg.assets_path,
+          cascade: true,
+          header_rules: rules
         m.each { |middleware, block| use(*middleware, &block) }
-        use Sidekiq::Web::CsrfProtection unless $TESTING
-        run WebApplication.new(klass)
+        run Sidekiq::Web::Application.new(self.class)
       end
     end
   end
-
-  Sidekiq::WebApplication.helpers WebHelpers
-  Sidekiq::WebApplication.helpers Sidekiq::Paginator
-
-  Sidekiq::WebAction.class_eval <<-RUBY, __FILE__, __LINE__ + 1
-    def _render
-      #{ERB.new(File.read(Web::LAYOUT)).src}
-    end
-  RUBY
 end
+
+require "sidekiq/web/router"
+require "sidekiq/web/action"
+require "sidekiq/web/application"

data/lib/sidekiq/worker_compatibility_alias.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  # Sidekiq::Job is a new alias for Sidekiq::Worker as of Sidekiq 6.3.0.
+  # Use `include Sidekiq::Job` rather than `include Sidekiq::Worker`.
+  #
+  # The term "worker" is too generic and overly confusing, used in several
+  # different contexts meaning different things. Many people call a Sidekiq
+  # process a "worker". Some people call the thread that executes jobs a
+  # "worker". This change brings Sidekiq closer to ActiveJob where your job
+  # classes extend ApplicationJob.
+  Worker = Job
+end