solid_queue_monitor 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92ff7e193202f9653de1b877d2e5d8b2f841c1e50e6c86a9ba4c556782e1fe8b
-  data.tar.gz: 2d180ede70f06618f676d167674238e4e7940e02f0b5af56b2667f543ab833f0
+  metadata.gz: 4f1ef08bb05ef11d7b29d511beea231cab0d1a8e1b16fc88d6c0d1fd540660b1
+  data.tar.gz: 310ff85731b0aa63432b03f909b39eb942a0eeccf59fc4956673c50561f70582
 SHA512:
-  metadata.gz: 203a85cfcb427b2d21faf15c0203bea8c06ee8a01296ad94d318aae018ad83cd8a7c86b9ac633a300588df9a7dc012a1ba42c2a0bcc91e1b97829816e527bba2
-  data.tar.gz: 4a3904c1f727a72d47d960cfc0e20c70ffd0f0f5c62463c652d31123653956e73874661d67b15a7cdbd14b6d36aed322b946548f2906d73860f6ef12d79c4ce2
+  metadata.gz: a7df976149fe809482b5a7a2299a431957174582d5134b7080942420595a469a645fae5541082a326e035b3b05fbc355f001d31eb06377b7a1275101139f735a
+  data.tar.gz: 4e32adbbba30b69d0eea3eb106d68172d8d35ae00a3ae111eb1f560337bee25708b63d5654466cd1c47e49a1d37e3e51979e2a51ac6e5412f975ad00be1a798e

data/README.md

@@ -123,6 +123,9 @@ SolidQueueMonitor.setup do |config|
 
   # Disable the chart on the overview page to skip chart queries entirely
   # config.show_chart = true
+
+  # Enable CSRF protection for the dashboard's destructive actions (opt-in)
+  # config.csrf_protection_enabled = false
 end
 
 # Optional: inherit from a host-app controller to plug into your existing auth.
@@ -140,6 +143,27 @@ If you don't need the job activity chart, disable it to skip chart queries entir
 config.show_chart = false
 ```
 
+### CSRF Protection
+
+The dashboard's destructive actions (retry, discard, pause, resume, execute, reject, remove/prune workers) are all `POST` requests. By default CSRF protection is **disabled**, because the gem does not assume the host application has a session store (it works in API-only apps without one).
+
+If your host app has a session store and the dashboard is mounted on the same origin, you should enable CSRF protection:
+
+```ruby
+config.csrf_protection_enabled = true
+```
+
+When enabled:
+
+- All dashboard forms embed an `authenticity_token`, and `csrf_meta_tags` are added to the layout for JS/`fetch`-driven requests.
+- Unverified `POST` requests are rejected by Rails' standard `verify_authenticity_token` (returns `422 Unprocessable Entity`). Safe methods (`GET`/`HEAD`) pass through.
+
+Requirements:
+
+- The host app has a session store configured (e.g. `config.session_store :cookie_store`).
+- `config.api_only` is not enabled (or session middleware is otherwise present).
+- The dashboard is mounted on the same origin as the host app, so `form_authenticity_token` works.
+
 ### Authentication
 
 By default, Solid Queue Monitor does not require authentication to access the dashboard. This makes it easy to get started in development environments.

data/app/assets/javascripts/solid_queue_monitor/application.js

@@ -322,7 +322,9 @@
     function bulkSubmit(action, promptMsg) {
       var ids = checkedBoxes().map(function (checkbox) { return checkbox.value; });
       if (ids.length === 0 || !window.confirm(promptMsg)) return;
-      Array.prototype.slice.call(form.querySelectorAll('input[type="hidden"]')).forEach(function (input) { input.remove(); });
+      // Only clear previously-appended job id inputs. Other hidden inputs
+      // (e.g. the CSRF authenticity_token) must be preserved.
+      Array.prototype.slice.call(form.querySelectorAll('input[type="hidden"][name="job_ids[]"]')).forEach(function (input) { input.remove(); });
       form.action = action;
       ids.forEach(function (id) { appendHidden('job_ids[]', id); });
       form.submit();

data/app/controllers/solid_queue_monitor/application_controller.rb

@@ -13,7 +13,12 @@ module SolidQueueMonitor
 
     before_action :authenticate, if: -> { SolidQueueMonitor::AuthenticationService.authentication_required? }
     layout 'solid_queue_monitor/application'
-    skip_before_action :verify_authenticity_token
+
+    # CSRF protection is opt-in (config.csrf_protection_enabled). By default the
+    # token check is skipped so the dashboard works in hosts without a session
+    # store. When the host enables it, the standard verify_authenticity_token
+    # before_action runs and unverified POSTs are rejected.
+    skip_before_action :verify_authenticity_token, unless: -> { SolidQueueMonitor.csrf_protection_enabled }
 
     def set_flash_message(message, type)
       # Store in instance variable for access in views

data/app/controllers/solid_queue_monitor/assets_controller.rb

@@ -4,6 +4,10 @@ module SolidQueueMonitor
   class AssetsController < ApplicationController
     skip_before_action :authenticate, raise: false
 
+    # Public read-only assets: exempt from CSRF so the cross-origin JavaScript
+    # guard doesn't reject GETs for the JS asset when csrf_protection_enabled.
+    skip_forgery_protection
+
     MIME_TYPES = { '.css' => 'text/css', '.js' => 'application/javascript' }.freeze
     FINGERPRINT_PATTERN = /\A(?<base>[A-Za-z0-9_]+)-(?<hash>[a-f0-9]+)(?<ext>\.css|\.js)\z/
 

data/app/helpers/solid_queue_monitor/application_helper.rb

@@ -25,6 +25,23 @@ module SolidQueueMonitor
       type.to_s == 'success' ? 'message-success' : 'message-error'
     end
 
+    # Hidden authenticity_token field for raw HTML POST forms.
+    # Renders nothing unless CSRF protection is enabled, so hosts without a
+    # session store are unaffected (form_authenticity_token needs a session).
+    def csrf_token_field_if_enabled
+      return ''.html_safe unless SolidQueueMonitor.csrf_protection_enabled
+
+      hidden_field_tag(:authenticity_token, form_authenticity_token)
+    end
+
+    # CSRF meta tags for JS/fetch-driven POSTs (defense in depth).
+    # Only emitted when CSRF protection is enabled, for the same reason.
+    def csrf_meta_tags_if_enabled
+      return ''.html_safe unless SolidQueueMonitor.csrf_protection_enabled
+
+      csrf_meta_tags
+    end
+
     def queue_link(queue_name, css_class: nil)
       return '-' if queue_name.blank?
 

data/app/views/layouts/solid_queue_monitor/application.html.erb

@@ -4,6 +4,7 @@
     <title>Solid Queue Monitor - <%= content_for?(:title) ? yield(:title) : 'Dashboard' %></title>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <%= csrf_meta_tags_if_enabled %>
     <%= stylesheet_link_tag asset_url_for('application.css'), nonce: content_security_policy_nonce %>
   </head>
   <body class="solid_queue_monitor"

data/app/views/solid_queue_monitor/failed_jobs/_row.html.erb

@@ -13,12 +13,14 @@
   <td class="actions-cell">
     <div class="job-actions">
       <form method="post" action="<%= retry_failed_job_path(id: job.id) %>" class="inline-form">
+        <%= csrf_token_field_if_enabled %>
         <button type="submit" class="action-button retry-button">Retry</button>
       </form>
       <form method="post"
             action="<%= discard_failed_job_path(id: job.id) %>"
             class="inline-form"
             data-confirm="Are you sure you want to discard this job?">
+        <%= csrf_token_field_if_enabled %>
         <button type="submit" class="action-button discard-button">Discard</button>
       </form>
     </div>

data/app/views/solid_queue_monitor/failed_jobs/index.html.erb

@@ -15,6 +15,7 @@
 </div>
 
 <form method="post" id="failed-jobs-form">
+  <%= csrf_token_field_if_enabled %>
   <% columns = [
     { sort_key: nil, label: tag.input(type: 'checkbox', id: 'select-all', class: 'select-all-checkbox') },
     { sort_key: :class_name, label: 'Job' },

data/app/views/solid_queue_monitor/jobs/_header.html.erb

@@ -15,6 +15,7 @@
     <div class="job-actions">
       <% if @failed_execution %>
         <form action="<%= retry_failed_job_path(id: @failed_execution.id) %>" method="post" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= job_path(@job) %>">
           <button type="submit" class="action-button retry-button">Retry</button>
         </form>
@@ -22,12 +23,14 @@
               method="post"
               class="inline-form"
               data-confirm="Are you sure you want to discard this job?">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= failed_jobs_path %>">
           <button type="submit" class="action-button discard-button">Discard</button>
         </form>
       <% end %>
       <% if @scheduled_execution %>
         <form action="<%= execute_scheduled_job_path(id: @scheduled_execution.id) %>" method="post" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= scheduled_jobs_path %>">
           <button type="submit" class="action-button retry-button">Execute Now</button>
         </form>

data/app/views/solid_queue_monitor/overview/_recent_job_row.html.erb

@@ -10,6 +10,7 @@
     <% if failed_execution %>
       <div class="job-actions">
         <form method="post" action="<%= retry_failed_job_path(id: failed_execution.id) %>" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= root_path %>">
           <button type="submit" class="action-button retry-button">Retry</button>
         </form>
@@ -17,6 +18,7 @@
               action="<%= discard_failed_job_path(id: failed_execution.id) %>"
               class="inline-form"
               data-confirm="Are you sure you want to discard this job?">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= root_path %>">
           <button type="submit" class="action-button discard-button">Discard</button>
         </form>

data/app/views/solid_queue_monitor/queues/_job_row.html.erb

@@ -10,6 +10,7 @@
     <% if failed_execution %>
       <div class="job-actions">
         <form method="post" action="<%= retry_failed_job_path(id: failed_execution.id) %>" class="inline-form">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
           <button type="submit" class="action-button retry-button">Retry</button>
         </form>
@@ -17,6 +18,7 @@
               action="<%= discard_failed_job_path(id: failed_execution.id) %>"
               class="inline-form"
               data-confirm="Are you sure you want to discard this job?">
+          <%= csrf_token_field_if_enabled %>
           <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
           <button type="submit" class="action-button discard-button">Discard</button>
         </form>

data/app/views/solid_queue_monitor/queues/_row.html.erb

@@ -17,6 +17,7 @@
   <td class="actions-cell">
     <% if paused %>
       <form action="<%= resume_queue_path %>" method="post" class="inline-form">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= queue_name %>">
         <button type="submit" class="action-button resume-button" title="Resume queue processing">Resume</button>
       </form>
@@ -25,6 +26,7 @@
             method="post"
             class="inline-form"
             data-confirm="Are you sure you want to pause the <%= queue_name %> queue? Workers will stop processing jobs from this queue.">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= queue_name %>">
         <button type="submit" class="action-button pause-button" title="Pause queue processing">Pause</button>
       </form>

data/app/views/solid_queue_monitor/queues/show.html.erb

@@ -11,12 +11,14 @@
   <div class="section-header-right">
     <% if @paused %>
       <form action="<%= resume_queue_path %>" method="post" class="inline-form">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= @queue_name %>">
         <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
         <button type="submit" class="action-button resume-button">Resume Queue</button>
       </form>
     <% else %>
       <form action="<%= pause_queue_path %>" method="post" class="inline-form" data-confirm="Are you sure you want to pause this queue?">
+        <%= csrf_token_field_if_enabled %>
         <input type="hidden" name="queue_name" value="<%= @queue_name %>">
         <input type="hidden" name="redirect_to" value="<%= queue_details_path(queue_name: @queue_name) %>">
         <button type="submit" class="action-button pause-button">Pause Queue</button>

data/app/views/solid_queue_monitor/scheduled_jobs/index.html.erb

@@ -15,6 +15,7 @@
 </div>
 
 <form id="scheduled-jobs-form" method="post">
+  <%= csrf_token_field_if_enabled %>
   <% columns = [
     { sort_key: nil, label: tag.input(type: 'checkbox', id: 'scheduled-jobs-select-all') },
     { sort_key: :class_name, label: 'Job' },

data/app/views/solid_queue_monitor/workers/_row.html.erb

@@ -13,6 +13,7 @@
             method="post"
             class="inline-form"
             data-confirm="Remove this dead process from the registry?">
+        <%= csrf_token_field_if_enabled %>
         <button type="submit" class="action-button discard-button" title="Remove dead process">Remove</button>
       </form>
     <% else %>

data/app/views/solid_queue_monitor/workers/index.html.erb

@@ -24,7 +24,7 @@
          data-confirm="Remove all <%= @summary[:dead] %> dead process<%= suffix %>? This will clean up processes that have stopped sending heartbeats.">
         Prune all
       </a>
-      <form id="prune-all-form" action="<%= prune_workers_path %>" method="post" class="is-hidden"></form>
+      <form id="prune-all-form" action="<%= prune_workers_path %>" method="post" class="is-hidden"><%= csrf_token_field_if_enabled %></form>
     <% end %>
   </div>
 </div>

data/lib/generators/solid_queue_monitor/templates/initializer.rb

@@ -27,4 +27,11 @@ SolidQueueMonitor.setup do |config|
 
   # Disable the chart on the overview page to skip chart queries entirely.
   # config.show_chart = true
+
+  # Enable CSRF protection for the dashboard's destructive POST actions.
+  # Disabled by default for backward compatibility. Requires the host app to
+  # have a session store (e.g. cookie_store) and the dashboard mounted on the
+  # same origin. When enabled, all dashboard forms embed an authenticity token
+  # and unverified POSTs are rejected.
+  # config.csrf_protection_enabled = false
 end

data/lib/solid_queue_monitor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SolidQueueMonitor
-  VERSION = '2.1.0'
+  VERSION = '2.2.0'
 end

data/lib/solid_queue_monitor.rb

@@ -11,7 +11,8 @@ module SolidQueueMonitor
   class << self
     attr_writer :username, :password, :base_controller_class
     attr_accessor :jobs_per_page, :authentication_enabled,
-                  :auto_refresh_enabled, :auto_refresh_interval, :show_chart
+                  :auto_refresh_enabled, :auto_refresh_interval, :show_chart,
+                  :csrf_protection_enabled
 
     def username
       resolve_value(@username)
@@ -39,6 +40,9 @@ module SolidQueueMonitor
   @auto_refresh_enabled = true
   @auto_refresh_interval = 30 # seconds
   @show_chart = true
+  # Disabled by default for backward compatibility: enabling CSRF protection
+  # requires a session-backed host app, which the gem does not assume.
+  @csrf_protection_enabled = false
 
   def self.setup
     yield self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solid_queue_monitor
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Vishal Sadriya