thecore_backend_commons 3.9.0 → 3.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ab4135c3f942d5333ade592af3ae92b194dd0aa6c32b8ee26d6992b8fa30e51
-  data.tar.gz: 317b0d39134b558ffa1cabfe7f2a6b137269e95438dc736c230ed557608554db
+  metadata.gz: 3aa559045828d8dc8ca4981fad05e6ff9ef2f80a7191f2e16db4f45ddcaf1c24
+  data.tar.gz: cd8fe33d14e2373a1b01ccd7290ceba1cb75048df57b6591a35c9cb135e077d5
 SHA512:
-  metadata.gz: 70d5413c5d89753ed3c1b011d2e76b216a016df55db0dbf90d7162949912a9b4f3e7f363f5a6d9ae257468dd62de6a67358086bf1d0dfe85226a40691459fa8b
-  data.tar.gz: c88ad248c63439a693e8d6f726cc5066a8765d628774b46ef6a5a9150ed016a6981d96040c0cb7f2f52b844e4e33a47acb3c2fef4a1771202f3bdbbcbf09e653
+  metadata.gz: 2a94d02e27478addb9660b69f693d4c8760e92dd11c5698130a7dc38601e1a745d3ca041ee6103204e4aeb070d138ef64877537debba042153ad5d2125650414
+  data.tar.gz: 15fc51c68e34e67042f8a02699639d5fb953e8710fce8e5923c225fa414e6c7c52c6ca5e22d3d618b817b88df09597dff65d31b35935bcbbc884b3678029ae2c

data/config/initializers/application_config.rb

@@ -13,5 +13,5 @@ Rails.application.config.action_cable.allowed_request_origins = [/http:\/\/*/, /
 # and mounts Sidekiq::Web unconditionally (thecore_background_jobs), so ActiveJob should actually
 # route through it rather than defaulting to Rails' in-process :async, which silently drops any
 # job in flight when its process restarts. Production only: :async remains the default in
-# development/test so neither requires a reachable Redis. See docs/adr/0001, CONTEXT.md.
+# development/test so neither requires a reachable Redis. See docs/adr/0001, GLOSSARY.md.
 Rails.application.config.active_job.queue_adapter = :sidekiq if Rails.env.production?

data/config/initializers/concern_cable_connection.rb

@@ -11,22 +11,51 @@ module CableConnectionConcern
 
     protected
 
-    def find_verified_user 
-      # this checks whether a user is authenticated with devise
-      # It looks for a token in the query parameters, or in the headers
-      m = request.query_parameters["token"].presence || request.headers["Authorization"].split(" ").second.strip rescue nil
-
-      # check for m2m token
-      user = User.where.not(encrypted_access_token: nil).find { |u| BCrypt::Password.new(u.encrypted_access_token) == m } rescue false
-      return user if user
-
-      # check for JWT token
-      body = (::HashWithIndifferentAccess.new(::JWT.decode(m, ::Rails.application.credentials.dig(:secret_key_base).presence||ENV["SECRET_KEY_BASE"], false)[0]) rescue nil)
-      verified_user = env['warden'].user.presence || User.find_by(id: body[:user_id]) rescue false
-      return verified_user if verified_user
-
-      # The Token is not m2m nor JWT, fail
-      return reject_unauthorized_connection
+    def find_verified_user
+      # An already-authenticated Devise/Warden session (e.g. RailsAdmin in the browser) is
+      # trusted as-is, before looking at any token.
+      warden_user = env["warden"]&.user
+      return warden_user if warden_user
+
+      # Looks for a token in the query parameters, or in the "Authorization" header.
+      m = request.query_parameters["token"].presence ||
+          request.headers["Authorization"].to_s.split(" ").second&.strip
+      return reject_unauthorized_connection if m.blank?
+
+      # Machine-to-machine token (bcrypt-compared against each user's stored token). Guarded by a
+      # column check so this generic gem also works in a host without m2m tokens (and so its own
+      # dummy app, whose users table has no such column, doesn't abort the transaction).
+      if User.column_names.include?("encrypted_access_token")
+        m2m_user = User.where.not(encrypted_access_token: nil)
+                       .find { |u| BCrypt::Password.new(u.encrypted_access_token) == m } rescue nil
+        return m2m_user if m2m_user
+      end
+
+      # JWT: the signature MUST be verified, exactly like every REST request. Decoding with the
+      # verification disabled (the previous behaviour) let a forged token carrying an arbitrary
+      # user_id authenticate as any user over the WebSocket — and ActivityLogChannel streams every
+      # record change, so that was a full read bypass. See docs/adr and the issue tracker.
+      body = decode_verified_jwt(m)
+      jwt_user = User.find_by(id: body[:user_id]) if body && body[:user_id]
+      return jwt_user if jwt_user
+
+      # Neither a valid m2m nor a valid JWT token: refuse the connection.
+      reject_unauthorized_connection
+    end
+
+    # Decodes and VERIFIES a JWT. Reuses model_driven_api's JsonWebToken when present, so the
+    # WebSocket shares the REST API's signing key, key-rotation and single-session handling;
+    # falls back to a signature-verifying decode so this gem still works on its own. Returns nil
+    # on any invalid, forged or expired token.
+    def decode_verified_jwt(token)
+      if defined?(::JsonWebToken)
+        ::JsonWebToken.decode(token)
+      else
+        secret = ::Rails.application.credentials.dig(:secret_key_base).presence || ENV["SECRET_KEY_BASE"]
+        ::HashWithIndifferentAccess.new(::JWT.decode(token, secret, true, algorithm: "HS256")[0])
+      end
+    rescue StandardError
+      nil
     end
   end
 end

data/lib/thecore_backend_commons/version.rb

@@ -1,3 +1,3 @@
 module ThecoreBackendCommons
-  VERSION = "3.9.0".freeze
+  VERSION = "3.9.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: thecore_backend_commons
 version: !ruby/object:Gem::Version
-  version: 3.9.0
+  version: 3.9.1
 platform: ruby
 authors:
 - Gabriele Tassoni