usps-support 0.2.37 → 0.2.38

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d61c4a69572f5f429e1695b6cf279d2307736b0b17aa0a7b2712a00ae995903c
-  data.tar.gz: 363f61ca6ada0f8d0420eedeb7f489c71b5b61a121638e1363b19fed6265f5fa
+  metadata.gz: 6deaa8a3f89d025d0ae50d5d2d04b9167c352cfc01bab8bd10e31ede841bfc70
+  data.tar.gz: 8778454efe042569391298d76e752fce21f957754d367e284439634a74e2fce4
 SHA512:
-  metadata.gz: 62156ff57b04bc404b5233e4027e4384da1b13ad0f72e9b46d64a64dde59cf76dac87ba0ea188f6339dc8337f0feacf0f54bbb05984ef38d128afcc71ecef83f
-  data.tar.gz: 22d8b7c9f23afafd350f06a06ff90f3a84f905a96d6570967a77f83b743cd8627d242622145e120f9d98123c3abd275f48b8877164c4747ccb3eeaeaf2c26d3e
+  metadata.gz: fb518162fa4730a79a96d9ad517f6a923d444db44a29f1ab834644c91937abc68070dd51bb86e93214d3684b7342c29aa09e6e52c82a314723a9b2ff44e0a170
+  data.tar.gz: 327b03a16b1738f6a70cc86c9dc35f10b730b9bf3a6ee89661ac1f84ff81f93117025ef5a842b5c1f7839660da20c4b85c7a143d76b1e6afe272ed65c90b5bcc

data/config/routes.rb

@@ -1,4 +1,11 @@
 Usps::Support::Engine.routes.draw do
+  if defined?(Sidekiq::Web)
+    unless Sidekiq::Web.middlewares.any? { it.first == Usps::Support::SidekiqAuth }
+      Sidekiq::Web.use(Usps::Support::SidekiqAuth)
+    end
+    mount Sidekiq::Web => '/sidekiq'
+  end
+
   resource :admin, only: [], controller: 'usps/support/admins' do
     collection do
       post :impersonate

data/lib/usps/support/engine.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rails/engine'
+require 'usps/support/sidekiq_auth'
 
 module Usps
   module Support

data/lib/usps/support/sidekiq_auth.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'cgi'
+
+module Usps::Support
+  # Rack middleware that gates Sidekiq::Web (or any inner Rack app) behind the
+  # same JWT/admin authentication used by the host app's controllers.
+  #
+  # Routes-level constraints can only return true/false, so an expired session
+  # at /sidekiq used to silently 404 — the controller refresh flow never ran.
+  # Running this as middleware lets us issue a 302 to the login refresh URL the
+  # same way `Usps::JwtAuth::Concern#redirect_to_login` does.
+  #
+  # Usage in an engine route file:
+  #
+  #   if defined?(::Sidekiq::Web)
+  #     ::Sidekiq::Web.use(Usps::Support::SidekiqAuth)
+  #     mount ::Sidekiq::Web => '/sidekiq'
+  #   end
+  #
+  class SidekiqAuth
+    LOGIN_URL = 'https://www.usps.org/jwt/'
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      request = ActionDispatch::Request.new(env)
+      member = decode_member(request)
+      return forbidden unless member && Usps::JwtAuth.config.is_admin.call(member)
+
+      @app.call(env)
+    rescue JWT::DecodeError
+      clear_jwt(request)
+      redirect_to_login(request)
+    end
+
+  private
+
+    def decode_member(request)
+      data = Usps::JwtAuth.decode(
+        fetch_jwt(request),
+        audience: [Usps::JwtAuth.config.audience],
+        issuer: Regexp.union(Usps::JwtAuth.config.issuers)
+      )
+      Usps::JwtAuth.config.find_member.call(data['certificate'])
+    rescue ActiveRecord::RecordNotFound
+      nil
+    end
+
+    def fetch_jwt(request)
+      request.session[:jwt] || request.cookie_jar[:jwt]
+    end
+
+    def clear_jwt(request)
+      request.session[:jwt] = nil
+      request.cookie_jar.delete(:jwt, domain: cookie_domain)
+    end
+
+    def cookie_domain
+      Usps::JwtAuth.config.environment.production? ? '.aws.usps.org' : 'localhost'
+    end
+
+    def redirect_to_login(request)
+      url = login_url_base
+      url = "#{url}&path=#{CGI.escape(request.fullpath)}"
+      [302, { 'Location' => url, 'Content-Type' => 'text/html' }, []]
+    end
+
+    def login_url_base
+      if Usps::JwtAuth.config.environment.development?
+        "#{LOGIN_URL}?local&port=#{ENV.fetch('PORT', '3000')}"
+      else
+        "#{LOGIN_URL}?application=#{Usps::JwtAuth.config.audience}"
+      end
+    end
+
+    def forbidden
+      [403, { 'Content-Type' => 'text/plain' }, ['Forbidden']]
+    end
+  end
+end

data/lib/usps/support/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module Support
-    VERSION = '0.2.37'
+    VERSION = '0.2.38'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-support
 version: !ruby/object:Gem::Version
-  version: 0.2.37
+  version: 0.2.38
 platform: ruby
 authors:
 - Julian Fiander
@@ -121,6 +121,7 @@ files:
 - lib/usps/support/models/hq/squadrons/website.rb
 - lib/usps/support/models/toast.rb
 - lib/usps/support/railtie.rb
+- lib/usps/support/sidekiq_auth.rb
 - lib/usps/support/version.rb
 homepage: https://github.com/unitedstatespowersquadrons/usps-support
 licenses: []