slash_console 0.1.6 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00dad9f1dd2b860398d627127e7bd3df9b5596b0e9fc8c8e915de93c7229ceed
-  data.tar.gz: 2f451ca16d04c7e89a008b1533b9ffcc355326689c3664fedeb8054fd37bfa85
+  metadata.gz: fe6fc75ab8103bf062f9a10eefdcc0385749f4c1889b04fb1c6ba0f1a99a939d
+  data.tar.gz: 6186eb67c87e30ebb7c0e09dca9cd4d38212d5186fd32571a0ee89aedaaea780
 SHA512:
-  metadata.gz: af3ca9a32035629be4bcdc38b7e8808bc2a4b7f92635359a7781a4e622a566b09d68a4963855ac614f18590d124e0fb953e731c92cc8d5670357f6a20804ebdb
-  data.tar.gz: 824164461e81532a821fdda656ff611e8ff6d662dc2fb8451fc030e7d1f79ee3adcf5f33230a475ab937318037e489937f48853cb40ab595150c8af567b237e9
+  metadata.gz: 611af64c4b066ec322875c66d9eac0a50ff0cc0102344240b24f1dd501ec60cd2241f3d19cd3f45fd593c0c63205685483bcdf79df23b18081e91e141618432d
+  data.tar.gz: 9f7f467142f12e16668899c9cb150e7b7165be1f2df1b099d93d2809bc2d5fb0ffb36f32d2befdd752be3c83cb2850331ad91bae944510704b76379c8400d6d1

data/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.7] - 2026-07-10
+
+### Security
+- Authentication is now required in every environment except `development`
+  and `test`, instead of only `production`. The engine force-enables
+  web-console and allows all IPs everywhere, so a `staging`/`preview`
+  deployment previously served an unauthenticated console.
+- Require web-console >= 4.2.1: versions before 4.1.0 do not put CSP
+  nonces on injected assets (silently breaking under a strict CSP), and
+  versions before 4.2.1 lack Rack 3 / Rails 7.1 support.
+- Enabled `rubygems_mfa_required`, so future gem pushes and yanks require
+  a multi-factor-authenticated RubyGems session.
+
+### Fixed
+- A malformed Basic Authorization header (credentials without a colon)
+  now gets a 401 on Rack 2 instead of raising.
+- Stored console sessions are capped at 50 per process. web-console's
+  session store is never evicted otherwise, so each console page load
+  pinned a binding in memory until process restart.
+
+### Removed
+- Deleted the engine's unused application layout, which referenced a
+  stylesheet that does not ship with the gem, and a no-op CSRF skip in
+  the console controller (the console page is GET-only).
+
 ## [0.1.6] - 2026-07-10
 
 ### Security
@@ -78,6 +103,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Development mode with no authentication required
 - Standard Ruby style guide compliance
 
-[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.6...HEAD
+[Unreleased]: https://github.com/firstdraft/slash_console/compare/v0.1.7...HEAD
+[0.1.7]: https://github.com/firstdraft/slash_console/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/firstdraft/slash_console/compare/v0.1.0...v0.1.6
 [0.1.0]: https://github.com/firstdraft/slash_console/releases/tag/v0.1.0

data/README.md

@@ -6,7 +6,7 @@ A Rails engine that provides a web-based console interface at `/rails/console`,
 
 - Only use this gem in applications where the security trade-offs are acceptable. Basically, only for toy apps/proofs-of-concept/portfolio projects that contain only sample data. Never use this gem when real user data is at risk.
 - For serious apps, SSH into the server and run `rails console` at the command-line. This may require upgrading your hosting from free to paid, but you should be doing that anyway if you have real users.
-- Make up a strong, unique `ADMIN_PASSWORD` for each app.
+- Make up a strong, unique `ADMIN_PASSWORD` for each app. There is no rate limiting on the password prompt, so a short or guessable password can be brute-forced.
 
 ## Installation
 
@@ -30,9 +30,9 @@ That's it! Navigate to `/rails/console` in your browser.
 
 In development, no authentication is required. Simply visit `/rails/console`.
 
-### Production
+### Deployed environments
 
-For production use, authentication is required. Set these environment variables:
+In every environment other than `development` and `test` — production, staging, previews, anything — authentication is required. Set these environment variables:
 
 ```bash
 ADMIN_USERNAME="choose_your_own_username"
@@ -41,15 +41,19 @@ ADMIN_PASSWORD="choose_your_own_strong_password"
 
 Without these environment variables, you'll see an error message explaining what needs to be configured.
 
+If your server runs multiple processes (e.g. Puma workers), console sessions live in the memory of whichever process rendered the page, so evaluating code may intermittently report that your session is no longer available. Run a single process (e.g. `WEB_CONCURRENCY=1`) for a reliable console.
+
 ## How It Works
 
 SlashConsole is a lightweight wrapper around [the excellent `web-console` gem](https://github.com/rails/web-console). It:
 
 1. Provides a dedicated route for console access (instead of only on error pages).
 2. Renders a full-page console interface, including in apps that enforce a strict nonce-based Content Security Policy.
-3. In production, requires basic authentication via a Rack middleware that protects both the console page and web-console's code-evaluation endpoints (`/__web_console/repl_sessions/:id`).
+3. In every environment except development and test, requires basic authentication via a Rack middleware that protects both the console page and web-console's code-evaluation endpoints (`/__web_console/repl_sessions/:id`).
 4. Evaluates console input at the top level, so constants resolve the same way as in `bin/rails console`.
 
+Note that SlashConsole configures web-console itself: it activates it in all environments and clears its IP allowlist (authentication replaces it). Any `config.web_console` settings in your app will be overridden.
+
 ## Development
 
 After checking out the repo, run `bundle install` to install dependencies.

data/app/controllers/slash_console/console_controller.rb

@@ -2,17 +2,23 @@ module SlashConsole
   class ConsoleController < ApplicationController
     layout false
 
-    skip_before_action :verify_authenticity_token, if: -> { defined?(verify_authenticity_token) }
+    # web-console stores every console session (and the binding it holds)
+    # in an in-memory hash that is never evicted, so each page load would
+    # otherwise pin memory until the process restarts. Old sessions are
+    # dropped once this many accumulate; an evicted session's tab shows
+    # web-console's normal "session is no longer available" message.
+    MAX_STORED_SESSIONS = 50
 
     # BasicAuthMiddleware is the primary guard: it protects both this page
     # and web-console's evaluator endpoints, but only at the engine's
     # standard /rails mount point. These filters remain as a second layer
     # so the page stays protected if an application mounts the engine at a
     # custom path.
-    before_action :ensure_credentials_configured, if: -> { Rails.env.production? }
-    before_action :authenticate_user, if: -> { Rails.env.production? }
+    before_action :ensure_credentials_configured, if: -> { BasicAuthMiddleware.authentication_required? }
+    before_action :authenticate_user, if: -> { BasicAuthMiddleware.authentication_required? }
 
     def index
+      prune_console_sessions
       console(SlashConsole.console_binding)
       render :index
     end
@@ -30,5 +36,10 @@ module SlashConsole
         BasicAuthMiddleware.authorized?(username, password)
       end
     end
+
+    def prune_console_sessions
+      storage = WebConsole::Session.inmemory_storage
+      storage.shift while storage.size >= MAX_STORED_SESSIONS
+    end
   end
 end

data/lib/slash_console/basic_auth_middleware.rb

@@ -1,5 +1,5 @@
 module SlashConsole
-  # Basic authentication for the console in production.
+  # Basic authentication for the console in deployed environments.
   #
   # Authentication must happen in the middleware stack, not in
   # ConsoleController: web-console's evaluator endpoints (PUT/POST
@@ -20,6 +20,14 @@ module SlashConsole
     CONSOLE_PATHS = %r{\A/rails(?:/(?:console)?(?:\.[^/]*)?/?)?\z}
 
     class << self
+      # Development and test are the only environments that get an open
+      # console. Any deployed environment -- production, staging, preview,
+      # or anything else -- must present credentials, because the engine
+      # force-enables web-console everywhere and allows all IPs.
+      def authentication_required?
+        !(Rails.env.development? || Rails.env.test?)
+      end
+
       def credentials_configured?
         ENV["ADMIN_USERNAME"].present? && ENV["ADMIN_PASSWORD"].present?
       end
@@ -35,14 +43,13 @@ module SlashConsole
     end
 
     def call(env)
-      return @app.call(env) unless Rails.env.production? && protects?(env[Rack::PATH_INFO].to_s)
+      return @app.call(env) unless self.class.authentication_required? && protects?(env[Rack::PATH_INFO].to_s)
 
       unless self.class.credentials_configured?
         return [503, {"content-type" => "text/plain"}, [CREDENTIALS_MESSAGE]]
       end
 
-      auth = Rack::Auth::Basic::Request.new(env)
-      if auth.provided? && auth.basic? && self.class.authorized?(*auth.credentials)
+      if valid_credentials?(env)
         @app.call(env)
       else
         unauthorized
@@ -51,6 +58,17 @@ module SlashConsole
 
     private
 
+    # Destructures rather than splatting: Rack 2 (Rails 7.0 apps) does not
+    # validate credential arity in Request#basic?, so a header whose
+    # decoded value lacks a colon would otherwise raise instead of 401ing.
+    def valid_credentials?(env)
+      auth = Rack::Auth::Basic::Request.new(env)
+      return false unless auth.provided? && auth.basic?
+
+      username, password = auth.credentials
+      self.class.authorized?(username, password)
+    end
+
     def protects?(path)
       CONSOLE_PATHS.match?(path) || evaluator_path?(path)
     end

data/lib/slash_console/version.rb

@@ -1,3 +1,3 @@
 module SlashConsole
-  VERSION = "0.1.6"
+  VERSION = "0.1.7"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: slash_console
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.7
 platform: ruby
 authors:
 - Raghu Betina
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 4.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 4.2.1
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement
@@ -66,7 +66,6 @@ files:
 - app/assets/stylesheets/slash_console/application.css
 - app/controllers/slash_console/application_controller.rb
 - app/controllers/slash_console/console_controller.rb
-- app/views/layouts/slash_console/application.html.erb
 - app/views/slash_console/console/index.html.erb
 - config/routes.rb
 - lib/slash_console.rb
@@ -78,6 +77,7 @@ homepage: https://github.com/firstdraft/slash_console
 licenses:
 - MIT
 metadata:
+  rubygems_mfa_required: 'true'
   homepage_uri: https://github.com/firstdraft/slash_console
   source_code_uri: https://github.com/firstdraft/slash_console
   changelog_uri: https://github.com/firstdraft/slash_console/blob/main/CHANGELOG.md

data/app/views/layouts/slash_console/application.html.erb

@@ -1,17 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Slash console</title>
-  <%= csrf_meta_tags %>
-  <%= csp_meta_tag %>
-
-  <%= yield :head %>
-
-  <%= stylesheet_link_tag    "slash_console/application", media: "all" %>
-</head>
-<body>
-
-<%= yield %>
-
-</body>
-</html>