signed_params 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8c20a32fb7717fdc82f737a65b377486beffbc9faa4852d36563c9c4828a9f3c
+  data.tar.gz: d64e43dde0ed9bc8294dc1b4d44b3157fba803ca1a83c2576c1172a0c4f30bbe
+SHA512:
+  metadata.gz: 830bc743e8226ae34d62686bb305274c35a0a4abe4f399de5076cfc55e563a5df889efae64d924694a853e8cad94e6a4370c429c41ba2e6c660bc00a558160b1
+  data.tar.gz: 3a026ec3ee4eb1103e0a29eed1989a4e7f2637e39599ae3d675ef2965b59a2b7db36c6cd15980fa9096046d91de0cc1ce5f1b347a030624ae758a8e3077b7b16

data/LICENCE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Elvinas Predkelis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,75 @@
+# Signed Params
+
+A small Rails controller concern that allows encoding and decoding parameters. Such parameters are protected against tampering and safe to share with the internet.
+
+`signed_params` are great for generating sharable links and/or mitigating web scrapers.
+
+Battle tested at [Hansa](https://hansahq.com). Developed at [Primevise](https://primevise.com).
+
+---
+
+## Installation
+
+#### Add gem
+
+Simply add the gem to your Gemfile by running the following command
+
+```bash
+$ bundle add signed_params
+```
+
+---
+
+#### Add it to your application
+
+After you have the gem installed, you include the functionality in `app/controllers/application_controller.rb`:
+
+```ruby
+class ApplicationController < ActionController::Base
+  include SignedParams::Concern
+end
+```
+
+> [!TIP]
+> You can also include the concern only in the controllers you seem fit. Adding the concern to the `ApplicationController` is a "forget about it" approach.
+
+---
+
+## Usage
+
+You can encode your parameters with a `sign_param` helper method. Specify which params you want to decode by specifying them in the `has_signed_params` class method.
+
+#### Example
+
+```ruby
+class RecordsController < ApplicationController
+  has_signed_params :record_ids, only: :index
+
+  def index
+    # The record_ids param is automatically decoded
+    @records = Record.find(params[:record_ids])
+  end
+
+  def new_public_link
+    record_ids = Record.last(8).pluck(:id)
+    encoded_record_ids = sign_params(record_ids)
+    # Your controller action logic that generates shareable public links
+  end
+end
+```
+
+---
+
+## Configuration
+
+`signed_params` uses Rails' [ActiveSupport::MessageVerifier](https://api.rubyonrails.org/classes/ActiveSupport/MessageVerifier.html) under the hood to encode the params. You can adjust the secret used for encoding by adding an initializer.
+
+```ruby
+SignedParams.configure do |config|
+  config.verifier_secret = ENV["SIGNED_PARAMS_ENCODING_SECRET"] || "my-strong-and-private-signing-secret"
+end
+```
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/lib/signed_params/concern.rb

@@ -0,0 +1,38 @@
+module SignedParams
+  module Concern
+    extend ActiveSupport::Concern
+
+    included do
+      class_attribute :signed_param_keys, default: []
+      helper_method :sign_param
+    end
+
+    class_methods do
+      def has_signed_params(*keys, **attributes)
+        self.signed_param_keys = keys
+        before_action :decode_signed_params
+      end
+    end
+
+    def sign_param(value)
+      signed_params_verifier.generate(value)
+    end
+
+    private
+
+    def decode_signed_params
+      return unless signed_param_keys.length
+      signed_param_keys.each do |key|
+        begin
+          params[key] = signed_params_verifier.verify(params[key])
+        rescue ActiveSupport::MessageVerifier::InvalidSignature
+          params[key] = nil
+        end
+      end
+    end
+
+    def signed_params_verifier
+      @signed_params_verifier ||= Rails.application.message_verifier(SignedParams.configuration.verifier_secret)
+    end
+  end
+end

data/lib/signed_params/configuration.rb

@@ -0,0 +1,21 @@
+module SignedParams
+  class Configuration
+    attr_accessor :verifier_secret
+
+    def initialize
+      @verifier_secret = :signed_params
+    end
+  end
+
+  class << self
+    attr_accessor :configuration
+  end
+
+  def self.configuration
+    @configuration ||= Configuration.new
+  end
+
+  def self.configure
+    yield(configuration)
+  end
+end

data/lib/signed_params/version.rb

@@ -0,0 +1,3 @@
+module SignedParams
+  VERSION = "0.0.1"
+end

data/lib/signed_params.rb

@@ -0,0 +1,15 @@
+require "signed_params/concern"
+require "signed_params/configuration"
+require "signed_params/version"
+
+module SignedParams
+  class << self
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield configuration
+    end
+  end
+end

metadata

@@ -0,0 +1,51 @@
+--- !ruby/object:Gem::Specification
+name: signed_params
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Elvinas Predkelis
+bindir: bin
+cert_chain: []
+date: 2025-05-26 00:00:00.000000000 Z
+dependencies: []
+description: A Rails concern that provides automatic encoding/decoding of signed parameters
+  to prevent tampering
+email:
+- elvinas@primevise.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENCE
+- README.md
+- lib/signed_params.rb
+- lib/signed_params/concern.rb
+- lib/signed_params/configuration.rb
+- lib/signed_params/version.rb
+homepage: https://github.com/elvinaspredkelis/signed_params
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/elvinaspredkelis/signed_params
+  source_code_uri: https://github.com/elvinaspredkelis/signed_params
+  changelog_uri: https://github.com/elvinaspredkelis/signed_params/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.2
+specification_version: 4
+summary: A Rails concern that provides automatic encoding/decoding of signed parameters
+  to prevent tampering
+test_files: []