studio-engine 0.4.2 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c2cff93b3aa059d4b0542abe34622157f0d0928f758b4f656878cfab6e4e25a2
-  data.tar.gz: fb784e5e6ace872de9d92d3a035e85caaa2085b6b72e18b1f380459f997221c5
+  metadata.gz: 9666cf8a5b997901079ee936e2ff49cf5b6b653b67e13de85a6588f6bddd93f7
+  data.tar.gz: 62a8338512f0cdf2f01f37bccaff8e2f41bad93233a4f3c62fe1f0eafda61d37
 SHA512:
-  metadata.gz: 7862911114e91fde7662c540229703184be955af01116c8ced37160751b8d1b09093ebba1fe410602d03b6f562e261e995884e78041fea02b720fafbfd027bf1
-  data.tar.gz: e7424e7e280e8ba717807d3b690fad5929d150e6c3c298a8ace724a4e1ebdec8fd261f8bf9f40b8abff2f299d223a8954cc3a7abd5a0493f0cc0def677fc7649
+  metadata.gz: 873809f43ebcaacb718b8ecec8d45ab933b38f88c706786fa0aa03e89d78c6e41b079579acca0f920d754448d23d1f7a2d899b21483808d20b445077e6b576d7
+  data.tar.gz: 17b0fb9f7997e3b4d5ba8b87188576360b23bfdb5657d29088fab2d0f805fd91b52c38c6472a6892f5225aefdf559a1f73b7484c902f6867bdb93919705d4138

data/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — `MAJOR.MINOR.PATCH`. Both consumer Rails apps pin to a tag in their `Gemfile`; bumping the tag is a release.
 
+## v0.4.3 (2026-05-19)
+
+Tier-3 fix from the turf-monster pre-prod opsec audit (OPSEC-016).
+
+### Fixed (security)
+- **`GET /sso_login` no longer mutates the session (OPSEC-016).** The action previously called `authenticate_sso_user!` directly — starting a session on a GET. GETs are not CSRF-covered and are prefetchable (`<img>`, `<link rel=prefetch>`, browser prefetch), so an XSS on any `*.mcritchie.studio` subdomain that wrote `session[:sso_email]` could have a forged `/sso_login` hit silently start a session as that user. `sso_login` now only redirects to the login page; the session mutation happens exclusively through the CSRF-protected `POST /sso_continue` ("Continue as …" button).
+
+### Changed
+- The hub's one-click SSO link to a satellite's `/sso_login` now lands the user on the satellite login page with the "Continue as …" button instead of logging them in directly — one extra click, and the GET endpoint is no longer a session-mutation vector.
+
 ## v0.4.2 (2026-05-19)
 
 Security follow-up to v0.4.1 — closes a cross-app session-fixation surface.

data/app/controllers/sessions_controller.rb

@@ -15,15 +15,20 @@ class SessionsController < ApplicationController
     end
   end
 
-  # GET /sso_login — one-click SSO entry point (linked from hub app nav)
+  # GET /sso_login — one-click SSO entry point (linked from hub app nav).
+  #
+  # OPSEC-016: this previously called authenticate_sso_user! directly, mutating
+  # the session on a GET. GETs are not CSRF-covered and are prefetchable
+  # (browser prefetch, <img>, <link rel=prefetch>), so an XSS on any
+  # *.mcritchie.studio subdomain could write session[:sso_email] and a forged
+  # GET /sso_login would silently start a session as that user. It now only
+  # redirects to the login page — the session mutation happens exclusively via
+  # the CSRF-protected POST /sso_continue ("Continue as …" button rendered
+  # there when sso_user_available?).
   def sso_login
     return redirect_to root_path if logged_in?
-    return redirect_to login_path unless sso_user_available?
 
-    authenticate_sso_user!
-  rescue StandardError => e
-    create_error_log(e)
-    redirect_to login_path, alert: "Could not continue session. Please log in."
+    redirect_to login_path
   end
 
   # POST /sso_continue — form-based SSO from login page button

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.4.2"
+  VERSION = "0.4.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
 platform: ruby
 authors:
 - Alex McRitchie
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-19 00:00:00.000000000 Z
+date: 2026-05-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails