solid_queue_monitor 2.0.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83ef4d9fb6a37088b8af586bdbc8af9a46018984918e58b912857a0df0ef910b
-  data.tar.gz: b0ceea99892250d40b763725fbc0dc0428f2a19123d34476f06cc86f22418ea0
+  metadata.gz: 4f1ef08bb05ef11d7b29d511beea231cab0d1a8e1b16fc88d6c0d1fd540660b1
+  data.tar.gz: 310ff85731b0aa63432b03f909b39eb942a0eeccf59fc4956673c50561f70582
 SHA512:
-  metadata.gz: f704b7eadd79058dc24f384bd2051e6ee0ceac7ae0a4315395122f9b381d2765ebaba2671e71560ec37cc49a1c6d0250a15bc6b61fc09599a4a58be1518c0881
-  data.tar.gz: 2bf9b9351dbc680180e31ce5f347cb480022159a1f4a2d4bfbd2e3b7f9fc6fab91cbfd044964b28ef426e59baa7c03da4079ad80e5440c219492a4aa89de5f8e
+  metadata.gz: a7df976149fe809482b5a7a2299a431957174582d5134b7080942420595a469a645fae5541082a326e035b3b05fbc355f001d31eb06377b7a1275101139f735a
+  data.tar.gz: 4e32adbbba30b69d0eea3eb106d68172d8d35ae00a3ae111eb1f560337bee25708b63d5654466cd1c47e49a1d37e3e51979e2a51ac6e5412f975ad00be1a798e

data/README.md

@@ -123,7 +123,14 @@ SolidQueueMonitor.setup do |config|
 
   # Disable the chart on the overview page to skip chart queries entirely
   # config.show_chart = true
+
+  # Enable CSRF protection for the dashboard's destructive actions (opt-in)
+  # config.csrf_protection_enabled = false
 end
+
+# Optional: inherit from a host-app controller to plug into your existing auth.
+# See "Custom Authentication" below. Defaults to "ActionController::Base".
+# SolidQueueMonitor.base_controller_class = 'AdminController'
 ```
 
 ### Performance at Scale
@@ -136,6 +143,27 @@ If you don't need the job activity chart, disable it to skip chart queries entir
 config.show_chart = false
 ```
 
+### CSRF Protection
+
+The dashboard's destructive actions (retry, discard, pause, resume, execute, reject, remove/prune workers) are all `POST` requests. By default CSRF protection is **disabled**, because the gem does not assume the host application has a session store (it works in API-only apps without one).
+
+If your host app has a session store and the dashboard is mounted on the same origin, you should enable CSRF protection:
+
+```ruby
+config.csrf_protection_enabled = true
+```
+
+When enabled:
+
+- All dashboard forms embed an `authenticity_token`, and `csrf_meta_tags` are added to the layout for JS/`fetch`-driven requests.
+- Unverified `POST` requests are rejected by Rails' standard `verify_authenticity_token` (returns `422 Unprocessable Entity`). Safe methods (`GET`/`HEAD`) pass through.
+
+Requirements:
+
+- The host app has a session store configured (e.g. `config.session_store :cookie_store`).
+- `config.api_only` is not enabled (or session middleware is otherwise present).
+- The dashboard is mounted on the same origin as the host app, so `form_authenticity_token` works.
+
 ### Authentication
 
 By default, Solid Queue Monitor does not require authentication to access the dashboard. This makes it easy to get started in development environments.
@@ -159,6 +187,48 @@ config.username = -> { Rails.application.credentials.dig(:solid_queue_monitor, :
 config.password = -> { Rails.application.credentials.dig(:solid_queue_monitor, :password) }
 ```
 
+### Custom Authentication
+
+By default, Solid Queue Monitor uses HTTP Basic auth with the username/password from `SolidQueueMonitor.setup`. To integrate with your app's existing auth (Devise, Pundit, OmniAuth, custom sessions, etc.), point the engine at a base controller from your host app:
+
+```ruby
+# config/initializers/solid_queue_monitor.rb
+SolidQueueMonitor.setup do |config|
+  config.authentication_enabled = false # disable HTTP Basic
+end
+
+# Inherit from your own controller so its before_actions, rescue_froms,
+# layout, and current_user helper cascade into the engine.
+SolidQueueMonitor.base_controller_class = 'AdminController'
+```
+
+**Minimal example — just authenticate:**
+
+```ruby
+class AdminController < ApplicationController
+  before_action :authenticate_user!   # Devise (or your equivalent)
+end
+```
+
+**Richer example — require an admin role:**
+
+```ruby
+class AdminController < ApplicationController
+  before_action :authenticate_user!
+  before_action :require_admin
+
+  private
+
+  def require_admin
+    redirect_to root_path, alert: 'Not authorized' unless current_user&.admin?
+  end
+end
+```
+
+Leave `authentication_enabled = true` if you want HTTP Basic to run *on top of* your host auth (host runs first, HTTP Basic second). Most adopters disable it.
+
+Restart your server after changing this config — the class hierarchy is set at load time, so config changes won't take effect on a live process.
+
 ## Usage
 
 After installation, visit `/solid_queue` in your browser to access the dashboard.

data/app/assets/javascripts/solid_queue_monitor/application.js

@@ -322,7 +322,9 @@
     function bulkSubmit(action, promptMsg) {
       var ids = checkedBoxes().map(function (checkbox) { return checkbox.value; });
       if (ids.length === 0 || !window.confirm(promptMsg)) return;
-      Array.prototype.slice.call(form.querySelectorAll('input[type="hidden"]')).forEach(function (input) { input.remove(); });
+      // Only clear previously-appended job id inputs. Other hidden inputs
+      // (e.g. the CSRF authenticity_token) must be preserved.
+      Array.prototype.slice.call(form.querySelectorAll('input[type="hidden"][name="job_ids[]"]')).forEach(function (input) { input.remove(); });
       form.action = action;
       ids.forEach(function (id) { appendHidden('job_ids[]', id); });
       form.submit();

data/app/controllers/solid_queue_monitor/application_controller.rb

@@ -1,13 +1,24 @@
 # frozen_string_literal: true
 
 module SolidQueueMonitor
-  class ApplicationController < ActionController::Base
+  class ApplicationController < SolidQueueMonitor.base_controller_class.safe_constantize || ActionController::Base
     include ActionController::HttpAuthentication::Basic::ControllerMethods
     include ActionController::Flash
 
+    # Explicitly include the engine's helpers so they remain available when the
+    # host configures a custom base_controller_class. Rails auto-includes engine
+    # helpers only when the parent is ActionController::Base; inheriting from a
+    # host controller short-circuits that, breaking view methods like render_chart.
+    helper SolidQueueMonitor::Engine.helpers
+
     before_action :authenticate, if: -> { SolidQueueMonitor::AuthenticationService.authentication_required? }
     layout 'solid_queue_monitor/application'
-    skip_before_action :verify_authenticity_token
+
+    # CSRF protection is opt-in (config.csrf_protection_enabled). By default the
+    # token check is skipped so the dashboard works in hosts without a session
+    # store. When the host enables it, the standard verify_authenticity_token
+    # before_action runs and unverified POSTs are rejected.
+    skip_before_action :verify_authenticity_token, unless: -> { SolidQueueMonitor.csrf_protection_enabled }
 
     def set_flash_message(message, type)
       # Store in instance variable for access in views

data/app/controllers/solid_queue_monitor/assets_controller.rb

@@ -4,6 +4,10 @@ module SolidQueueMonitor
   class AssetsController < ApplicationController
     skip_before_action :authenticate, raise: false
 
+    # Public read-only assets: exempt from CSRF so the cross-origin JavaScript
+    # guard doesn't reject GETs for the JS asset when csrf_protection_enabled.
+    skip_forgery_protection
+
     MIME_TYPES = { '.css' => 'text/css', '.js' => 'application/javascript' }.freeze
     FINGERPRINT_PATTERN = /\A(?<base>[A-Za-z0-9_]+)-(?<hash>[a-f0-9]+)(?<ext>\.css|\.js)\z/
 

data/app/helpers/solid_queue_monitor/application_helper.rb

@@ -25,6 +25,23 @@ module SolidQueueMonitor
       type.to_s == 'success' ? 'message-success' : 'message-error'
     end
 
+    # Hidden authenticity_token field for raw HTML POST forms.
+    # Renders nothing unless CSRF protection is enabled, so hosts without a
+    # session store are unaffected (form_authenticity_token needs a session).
+    def csrf_token_field_if_enabled
+      return ''.html_safe unless SolidQueueMonitor.csrf_protection_enabled
+
+      hidden_field_tag(:authenticity_token, form_authenticity_token)
+    end
+
+    # CSRF meta tags for JS/fetch-driven POSTs (defense in depth).
+    # Only emitted when CSRF protection is enabled, for the same reason.
+    def csrf_meta_tags_if_enabled
+      return ''.html_safe unless SolidQueueMonitor.csrf_protection_enabled
+
+      csrf_meta_tags
+    end
+
     def queue_link(queue_name, css_class: nil)
       return '-' if queue_name.blank?
 

data/app/views/layouts/solid_queue_monitor/application.html.erb

@@ -4,6 +4,7 @@
     <title>Solid Queue Monitor - <%= content_for?(:title) ? yield(:title) : 'Dashboard' %></title>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <%= csrf_meta_tags_if_enabled %>
     <%= stylesheet_link_tag asset_url_for('application.css'), nonce: content_security_policy_nonce %>
   </head>
   <body class="solid_queue_monitor"

data/app/views/solid_queue_monitor/failed_jobs/_row.html.erb

@@ -13,12 +13,14 @@
   <td class="actions-cell">
     <div class="job-actions">
       <form method="post" action="<%= retry_failed_job_path(id: job.id) %>" class="inline-form">
+        <%= csrf_token_field_if_enabled %>
         <button type="submit" class="action-button retry-button">Retry</button>
       </form>
       <form method="post"
             action="<%= discard_failed_job_path(id: job.id) %>"
             class="inline-form"
             data-confirm="Are you sure you want to discard this job?">
+        <%= csrf_token_field_if_enabled %>
         <button type="submit" class="action-button discard-button">Discard</button>
       </form>
     </div>

data/app/views/solid_queue_monitor/failed_jobs/index.html.erb

@@ -15,6 +15,7 @@
 </div>
 
 <form method="post" id="failed-jobs-form">
+  <%= csrf_token_field_if_enabled %>
   <% columns = [
     { sort_key: nil, label: tag.input(type: 'checkbox', id: 'select-all', class: 'select-all-checkbox') },
     { sort_key: :class_name, label: 'Job' },

data/app/views/solid_queue_monitor/jobs/_header.html.erb

@@ -15,6 +15,7 @@
     <div class="job-actions">
       <% if @failed_execution %>
         <form action="<%= retry_failed_job_path(id: @failed_execution.id) %>" method="post" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= job_path(@job) %>">
           <button type="submit" class="action-button retry-button">Retry</button>
         </form>
@@ -22,12 +23,14 @@
               method="post"
               class="inline-form"
               data-confirm="Are you sure you want to discard this job?">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= failed_jobs_path %>">
           <button type="submit" class="action-button discard-button">Discard</button>
         </form>
       <% end %>
       <% if @scheduled_execution %>
         <form action="<%= execute_scheduled_job_path(id: @scheduled_execution.id) %>" method="post" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= scheduled_jobs_path %>">
           <button type="submit" class="action-button retry-button">Execute Now</button>
         </form>

data/app/views/solid_queue_monitor/overview/_recent_job_row.html.erb

@@ -10,6 +10,7 @@
     <% if failed_execution %>
       <div class="job-actions">
         <form method="post" action="<%= retry_failed_job_path(id: failed_execution.id) %>" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= root_path %>">
           <button type="submit" class="action-button retry-button">Retry</button>
         </form>
@@ -17,6 +18,7 @@
               action="<%= discard_failed_job_path(id: failed_execution.id) %>"
               class="inline-form"
               data-confirm="Are you sure you want to discard this job?">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= root_path %>">
           <button type="submit" class="action-button discard-button">Discard</button>
         </form>

data/app/views/solid_queue_monitor/queues/_job_row.html.erb

@@ -10,6 +10,7 @@
     <% if failed_execution %>
       <div class="job-actions">
         <form method="post" action="<%= retry_failed_job_path(id: failed_execution.id) %>" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
           <button type="submit" class="action-button retry-button">Retry</button>
         </form>
@@ -17,6 +18,7 @@
               action="<%= discard_failed_job_path(id: failed_execution.id) %>"
               class="inline-form"
               data-confirm="Are you sure you want to discard this job?">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
           <button type="submit" class="action-button discard-button">Discard</button>
         </form>

data/app/views/solid_queue_monitor/queues/_row.html.erb

@@ -17,6 +17,7 @@
   <td class="actions-cell">
     <% if paused %>
       <form action="<%= resume_queue_path %>" method="post" class="inline-form">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= queue_name %>">
         <button type="submit" class="action-button resume-button" title="Resume queue processing">Resume</button>
       </form>
@@ -25,6 +26,7 @@
             method="post"
             class="inline-form"
             data-confirm="Are you sure you want to pause the <%= queue_name %> queue? Workers will stop processing jobs from this queue.">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= queue_name %>">
         <button type="submit" class="action-button pause-button" title="Pause queue processing">Pause</button>
       </form>

data/app/views/solid_queue_monitor/queues/show.html.erb

@@ -11,12 +11,14 @@
   <div class="section-header-right">
     <% if @paused %>
       <form action="<%= resume_queue_path %>" method="post" class="inline-form">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= @queue_name %>">
         <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
         <button type="submit" class="action-button resume-button">Resume Queue</button>
       </form>
     <% else %>
       <form action="<%= pause_queue_path %>" method="post" class="inline-form" data-confirm="Are you sure you want to pause this queue?">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= @queue_name %>">
         <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
         <button type="submit" class="action-button pause-button">Pause Queue</button>

data/app/views/solid_queue_monitor/scheduled_jobs/index.html.erb

@@ -15,6 +15,7 @@
 </div>
 
 <form id="scheduled-jobs-form" method="post">
+  <%= csrf_token_field_if_enabled %>
   <% columns = [
     { sort_key: nil, label: tag.input(type: 'checkbox', id: 'scheduled-jobs-select-all') },
     { sort_key: :class_name, label: 'Job' },

data/app/views/solid_queue_monitor/workers/_row.html.erb

@@ -13,6 +13,7 @@
             method="post"
             class="inline-form"
             data-confirm="Remove this dead process from the registry?">
+        <%= csrf_token_field_if_enabled %>
         <button type="submit" class="action-button discard-button" title="Remove dead process">Remove</button>
       </form>
     <% else %>

data/app/views/solid_queue_monitor/workers/index.html.erb

@@ -24,7 +24,7 @@
          data-confirm="Remove all <%= @summary[:dead] %> dead process<%= suffix %>? This will clean up processes that have stopped sending heartbeats.">
         Prune all
       </a>
-      <form id="prune-all-form" action="<%= prune_workers_path %>" method="post" class="is-hidden"></form>
+      <form id="prune-all-form" action="<%= prune_workers_path %>" method="post" class="is-hidden"><%= csrf_token_field_if_enabled %></form>
     <% end %>
   </div>
 </div>

data/lib/generators/solid_queue_monitor/templates/initializer.rb

@@ -27,4 +27,11 @@ SolidQueueMonitor.setup do |config|
 
   # Disable the chart on the overview page to skip chart queries entirely.
   # config.show_chart = true
+
+  # Enable CSRF protection for the dashboard's destructive POST actions.
+  # Disabled by default for backward compatibility. Requires the host app to
+  # have a session store (e.g. cookie_store) and the dashboard mounted on the
+  # same origin. When enabled, all dashboard forms embed an authenticity token
+  # and unverified POSTs are rejected.
+  # config.csrf_protection_enabled = false
 end

data/lib/solid_queue_monitor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SolidQueueMonitor
-  VERSION = '2.0.0'
+  VERSION = '2.2.0'
 end

data/lib/solid_queue_monitor.rb

@@ -5,10 +5,14 @@ require_relative 'solid_queue_monitor/engine'
 
 module SolidQueueMonitor
   class Error < StandardError; end
+
+  DEFAULT_BASE_CONTROLLER_CLASS = 'ActionController::Base'
+
   class << self
-    attr_writer :username, :password
+    attr_writer :username, :password, :base_controller_class
     attr_accessor :jobs_per_page, :authentication_enabled,
-                  :auto_refresh_enabled, :auto_refresh_interval, :show_chart
+                  :auto_refresh_enabled, :auto_refresh_interval, :show_chart,
+                  :csrf_protection_enabled
 
     def username
       resolve_value(@username)
@@ -18,6 +22,10 @@ module SolidQueueMonitor
       resolve_value(@password)
     end
 
+    def base_controller_class
+      @base_controller_class || DEFAULT_BASE_CONTROLLER_CLASS
+    end
+
     private
 
     def resolve_value(value)
@@ -32,6 +40,9 @@ module SolidQueueMonitor
   @auto_refresh_enabled = true
   @auto_refresh_interval = 30 # seconds
   @show_chart = true
+  # Disabled by default for backward compatibility: enabling CSRF protection
+  # requires a session-backed host app, which the gem does not assume.
+  @csrf_protection_enabled = false
 
   def self.setup
     yield self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solid_queue_monitor
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Vishal Sadriya