thecore_backend_commons 3.8.0 → 3.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87cd88199c064c66426aa326171b69d52fb1833e3e9cabf5cfb8856f9193a151
-  data.tar.gz: 9564c73bdf8b9167d6a6116a9c86290dbdf9a032af5f770d2f14a5800b213ba0
+  metadata.gz: 3aa559045828d8dc8ca4981fad05e6ff9ef2f80a7191f2e16db4f45ddcaf1c24
+  data.tar.gz: cd8fe33d14e2373a1b01ccd7290ceba1cb75048df57b6591a35c9cb135e077d5
 SHA512:
-  metadata.gz: adde92df4fa407e41ce14f125eb1a97392cd73c4509f221f2a68064a9078fb72b07bd3e1c0676d9404d6727500b41002c76320de9a3ea900065cb0377ed88537
-  data.tar.gz: 92d69794ef610e4e9dc402bb87c331e82400812d51660f7f2c60c604422c54fec0ccb881bc20e3547ff58fac5643a6282809b896baf1159531a3b9f0e178ae62
+  metadata.gz: 2a94d02e27478addb9660b69f693d4c8760e92dd11c5698130a7dc38601e1a745d3ca041ee6103204e4aeb070d138ef64877537debba042153ad5d2125650414
+  data.tar.gz: 15fc51c68e34e67042f8a02699639d5fb953e8710fce8e5923c225fa414e6c7c52c6ca5e22d3d618b817b88df09597dff65d31b35935bcbbc884b3678029ae2c

data/config/initializers/application_config.rb

@@ -13,5 +13,5 @@ Rails.application.config.action_cable.allowed_request_origins = [/http:\/\/*/, /
 # and mounts Sidekiq::Web unconditionally (thecore_background_jobs), so ActiveJob should actually
 # route through it rather than defaulting to Rails' in-process :async, which silently drops any
 # job in flight when its process restarts. Production only: :async remains the default in
-# development/test so neither requires a reachable Redis. See docs/adr/0001, CONTEXT.md.
+# development/test so neither requires a reachable Redis. See docs/adr/0001, GLOSSARY.md.
 Rails.application.config.active_job.queue_adapter = :sidekiq if Rails.env.production?

data/config/initializers/concern_cable_connection.rb

@@ -11,22 +11,51 @@ module CableConnectionConcern
 
     protected
 
-    def find_verified_user 
-      # this checks whether a user is authenticated with devise
-      # It looks for a token in the query parameters, or in the headers
-      m = request.query_parameters["token"].presence || request.headers["Authorization"].split(" ").second.strip rescue nil
-
-      # check for m2m token
-      user = User.where.not(encrypted_access_token: nil).find { |u| BCrypt::Password.new(u.encrypted_access_token) == m } rescue false
-      return user if user
-
-      # check for JWT token
-      body = (::HashWithIndifferentAccess.new(::JWT.decode(m, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"], false)[0]) rescue nil)
-      verified_user = env['warden'].user.presence || User.find_by(id: body[:user_id]) rescue false
-      return verified_user if verified_user
-
-      # The Token is not m2m nor JWT, fail
-      return reject_unauthorized_connection
+    def find_verified_user
+      # An already-authenticated Devise/Warden session (e.g. RailsAdmin in the browser) is
+      # trusted as-is, before looking at any token.
+      warden_user = env["warden"]&.user
+      return warden_user if warden_user
+
+      # Looks for a token in the query parameters, or in the "Authorization" header.
+      m = request.query_parameters["token"].presence ||
+          request.headers["Authorization"].to_s.split(" ").second&.strip
+      return reject_unauthorized_connection if m.blank?
+
+      # Machine-to-machine token (bcrypt-compared against each user's stored token). Guarded by a
+      # column check so this generic gem also works in a host without m2m tokens (and so its own
+      # dummy app, whose users table has no such column, doesn't abort the transaction).
+      if User.column_names.include?("encrypted_access_token")
+        m2m_user = User.where.not(encrypted_access_token: nil)
+                       .find { |u| BCrypt::Password.new(u.encrypted_access_token) == m } rescue nil
+        return m2m_user if m2m_user
+      end
+
+      # JWT: the signature MUST be verified, exactly like every REST request. Decoding with the
+      # verification disabled (the previous behaviour) let a forged token carrying an arbitrary
+      # user_id authenticate as any user over the WebSocket — and ActivityLogChannel streams every
+      # record change, so that was a full read bypass. See docs/adr and the issue tracker.
+      body = decode_verified_jwt(m)
+      jwt_user = User.find_by(id: body[:user_id]) if body && body[:user_id]
+      return jwt_user if jwt_user
+
+      # Neither a valid m2m nor a valid JWT token: refuse the connection.
+      reject_unauthorized_connection
+    end
+
+    # Decodes and VERIFIES a JWT. Reuses model_driven_api's JsonWebToken when present, so the
+    # WebSocket shares the REST API's signing key, key-rotation and single-session handling;
+    # falls back to a signature-verifying decode so this gem still works on its own. Returns nil
+    # on any invalid, forged or expired token.
+    def decode_verified_jwt(token)
+      if defined?(::JsonWebToken)
+        ::JsonWebToken.decode(token)
+      else
+        secret = ::Rails.application.credentials.dig(:secret_key_base).presence || ENV["SECRET_KEY_BASE"]
+        ::HashWithIndifferentAccess.new(::JWT.decode(token, secret, true, algorithm: "HS256")[0])
+      end
+    rescue StandardError
+      nil
     end
   end
 end

data/lib/thecore_backend_commons/version.rb

@@ -1,3 +1,3 @@
 module ThecoreBackendCommons
-  VERSION = "3.8.0".freeze
+  VERSION = "3.9.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: thecore_backend_commons
 version: !ruby/object:Gem::Version
-  version: 3.8.0
+  version: 3.9.1
 platform: ruby
 authors:
 - Gabriele Tassoni
@@ -113,28 +113,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.9'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.9'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: roo-xls
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: active_storage_validations
   requirement: !ruby/object:Gem::Requirement