stitches 5.1.1 → 5.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8bd97055675ab8ddc5fead5ed4a01b73df4ecd2c8b48f6069dfaf4702077f409
-  data.tar.gz: b6834f800f55e68dee2b361cb129aa2bad5aa730c412c0815411f64ecfd4b664
+  metadata.gz: 36996c8616e83953bdfe5c10a8b83ad99a0b4bc71d1778aace6149ea0860deac
+  data.tar.gz: 9d2db9ddabbdbbc3d5f97cf477b5a8635dfb4713426e1fb11b181b6a3fa129a2
 SHA512:
-  metadata.gz: a6f998361c6a0ad89def9c863b6ac1e801cf1c7194b8345f37e180a66bb3e806f0d835163de541976e853c6f33c3abf3ae2c03d480dde1d5b5789b8d3218e28f
-  data.tar.gz: 3003d37d1e6560bfe8aace38c91af4d64c3b26d065b9e0f895dd9601e908ee0bbf9a591a681e1ad56cdabfa692953dcf37191541801217f4e58e952b325a1b62
+  metadata.gz: a00a09939651a50e4dde80dfeb943a2840d6c5cfe39753a29df12e78f23e5ac51a18eedc0c9c9a69fc2c22495a7c168ddf6a5a3346075e725438f65e400c86c1
+  data.tar.gz: eb3a8f860a7a11852057f58e3f9e60c7c3be9c15823d408e9053b7b6f4dee21e0a59b868bb3f4f73056a3d774122898a204ba6401fd033abf1a886d2252036df

data/.ruby-version

@@ -1 +1 @@
-ruby-3.4.9
+ruby-3.4.10

data/README.md

@@ -42,6 +42,21 @@ Stitches.configure do |config|
 end
 ```
 
+You can also pass a callable (lambda, proc, or any object responding to `#call`) to make
+per-request auth decisions. The callable receives the Rack `env` hash and should return a
+truthy value to skip auth:
+
+```ruby
+Stitches.configure do |config|
+  config.disable_api_key_support = ->(env) {
+    env['HTTP_HOST'].to_s.include?('.int.example.com')
+  }
+end
+```
+
+This is useful for services that serve both internal (no auth needed) and external (auth
+required) traffic on different hostnames without requiring a separate deployment.
+
 ### Caller Identification
 
 When API key auth is disabled, services lose the ability to identify which

data/lib/stitches/api_key.rb

@@ -23,7 +23,9 @@ module Stitches
   protected
 
     def do_call(env)
-      return @app.call(env) if Stitches.configuration.disable_api_key_support
+      disable = Stitches.configuration.disable_api_key_support
+      disable = disable.call(env) if disable.respond_to?(:call)
+      return @app.call(env) if disable
 
       authorization = env["HTTP_AUTHORIZATION"]
       if authorization

data/lib/stitches/spec/test_headers.rb

@@ -6,7 +6,7 @@ class TestHeaders
       "Accept"       => full_mimetype,
       "Content-Type" => full_mimetype,
     }.tap { |headers|
-      set_authorization_header(headers,options) unless Stitches.configuration.disable_api_key_support
+      set_authorization_header(headers,options) unless Stitches.configuration.disable_api_key_support == true
     }
   end
 

data/lib/stitches/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Stitches
-  VERSION = '5.1.1'
+  VERSION = '5.2.0'
 end

data/spec/api_key_middleware_spec.rb

@@ -56,6 +56,73 @@ RSpec.describe "/api/hellos", type: :request do
     end
   end
 
+  context "disable_api_key_support is a callable" do
+    before do
+      Stitches.configuration.reset_to_defaults!
+      Stitches.configuration.custom_http_auth_scheme = 'MyAwesomeInternalScheme'
+      Stitches::ApiClientAccessWrapper.clear_api_cache
+    end
+
+    context "when the callable always returns true" do
+      before do
+        Stitches.configuration.disable_api_key_support = ->(_env) { true }
+      end
+
+      it "skips auth and reaches the controller" do
+        execute_call(auth: nil)
+
+        expect(response.body).to include "Hello"
+        expect(response.status).to eq 200
+      end
+
+      it "does not populate api client env vars" do
+        execute_call(auth: nil)
+
+        expect(response.body).to include "Hello ,"
+        expect(response.body).to include "IdNotFound"
+      end
+    end
+
+    context "when the callable always returns false" do
+      before do
+        Stitches.configuration.disable_api_key_support = ->(_env) { false }
+      end
+
+      it "enforces auth and returns 401" do
+        execute_call(auth: nil)
+
+        expect_unauthorized
+      end
+    end
+
+    context "when the callable inspects the request hostname" do
+      before do
+        Stitches.configuration.disable_api_key_support = ->(env) {
+          env['HTTP_HOST'].to_s.include?(".int.")
+        }
+      end
+
+      context "request arrives on the internal hostname" do
+        it "skips auth" do
+          host! "myapp.staging.int.example.com"
+          execute_call(auth: nil)
+
+          expect(response.body).to include "Hello"
+          expect(response.status).to eq 200
+        end
+      end
+
+      context "request arrives on the public hostname" do
+        it "enforces auth" do
+          host! "myapp.staging.example.com"
+          execute_call(auth: nil)
+
+          expect_unauthorized
+        end
+      end
+    end
+  end
+
   context "enabled api key support" do
     before do
       Stitches.configuration.reset_to_defaults!

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: stitches
 version: !ruby/object:Gem::Version
-  version: 5.1.1
+  version: 5.2.0
 platform: ruby
 authors:
 - Stitch Fix Engineering