usps-support 0.2.37 → 0.2.39

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d61c4a69572f5f429e1695b6cf279d2307736b0b17aa0a7b2712a00ae995903c
-  data.tar.gz: 363f61ca6ada0f8d0420eedeb7f489c71b5b61a121638e1363b19fed6265f5fa
+  metadata.gz: 4b5af1f3316c237eb45e235fd0d096456f088d85726a708687ad201fb3e3a8aa
+  data.tar.gz: d51a0b3a79f5251b535c054c2bc27a8c43c8dd223e7dd43c93d476d56b0e211e
 SHA512:
-  metadata.gz: 62156ff57b04bc404b5233e4027e4384da1b13ad0f72e9b46d64a64dde59cf76dac87ba0ea188f6339dc8337f0feacf0f54bbb05984ef38d128afcc71ecef83f
-  data.tar.gz: 22d8b7c9f23afafd350f06a06ff90f3a84f905a96d6570967a77f83b743cd8627d242622145e120f9d98123c3abd275f48b8877164c4747ccb3eeaeaf2c26d3e
+  metadata.gz: 87eff25ec01929faa12ac277766518a0a22d7596ab5f34b1a94ace66f30765308ef9fb3865bed937c07abe17305f2cdf2974c883a49534d4bf70dbe8c6029744
+  data.tar.gz: d7b743c078fbb4fa6d2306467fa16e7b384b1dc25821e23b89bd19ffa76129c615df863f6b3c7f1ab8aed3b82e87bfcc1aaf3670763695849e41c572f714a28f

data/config/routes.rb

@@ -1,4 +1,11 @@
 Usps::Support::Engine.routes.draw do
+  if defined?(Sidekiq::Web)
+    unless Sidekiq::Web.middlewares.any? { it.first == Usps::Support::SidekiqAuth }
+      Sidekiq::Web.use(Usps::Support::SidekiqAuth)
+    end
+    mount Sidekiq::Web => '/sidekiq'
+  end
+
   resource :admin, only: [], controller: 'usps/support/admins' do
     collection do
       post :impersonate

data/lib/usps/support/engine.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rails/engine'
+require 'usps/support/sidekiq_auth'
 
 module Usps
   module Support

data/lib/usps/support/models/toast.rb

@@ -71,7 +71,7 @@ module Usps::Support::Models
           title: 'SERVER WILL RESTART SOON',
           body: "Please do not attempt to make any changes for a moment.\n" \
                 "We'll let you know when the server's back up.",
-          timeout: 0,
+          timeout: 60_000,
           id: IDS[:restarting]
         )
       end

data/lib/usps/support/sidekiq_auth.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'cgi'
+
+module Usps::Support
+  # Rack middleware that gates Sidekiq::Web (or any inner Rack app) behind the
+  # same JWT/admin authentication used by the host app's controllers.
+  #
+  # Routes-level constraints can only return true/false, so an expired session
+  # at /sidekiq used to silently 404 — the controller refresh flow never ran.
+  # Running this as middleware lets us issue a 302 to the login refresh URL the
+  # same way `Usps::JwtAuth::Concern#redirect_to_login` does.
+  #
+  # Usage in an engine route file:
+  #
+  #   if defined?(::Sidekiq::Web)
+  #     ::Sidekiq::Web.use(Usps::Support::SidekiqAuth)
+  #     mount ::Sidekiq::Web => '/sidekiq'
+  #   end
+  #
+  class SidekiqAuth
+    LOGIN_URL = 'https://www.usps.org/jwt/'
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      request = ActionDispatch::Request.new(env)
+      member = decode_member(request)
+      return forbidden unless member && Usps::JwtAuth.config.is_admin.call(member)
+
+      @app.call(env)
+    rescue JWT::DecodeError
+      clear_jwt(request)
+      redirect_to_login(request)
+    end
+
+  private
+
+    def decode_member(request)
+      data = Usps::JwtAuth.decode(
+        fetch_jwt(request),
+        audience: [Usps::JwtAuth.config.audience],
+        issuer: Regexp.union(Usps::JwtAuth.config.issuers)
+      )
+      Usps::JwtAuth.config.find_member.call(data['certificate'])
+    rescue ActiveRecord::RecordNotFound
+      nil
+    end
+
+    def fetch_jwt(request)
+      request.session[:jwt] || request.cookie_jar[:jwt]
+    end
+
+    def clear_jwt(request)
+      request.session[:jwt] = nil
+      request.cookie_jar.delete(:jwt, domain: cookie_domain)
+    end
+
+    def cookie_domain
+      Usps::JwtAuth.config.environment.production? ? '.aws.usps.org' : 'localhost'
+    end
+
+    def redirect_to_login(request)
+      url = login_url_base
+      url = "#{url}&path=#{CGI.escape(request.fullpath)}"
+      [302, { 'Location' => url, 'Content-Type' => 'text/html' }, []]
+    end
+
+    def login_url_base
+      if Usps::JwtAuth.config.environment.development?
+        "#{LOGIN_URL}?local&port=#{ENV.fetch('PORT', '3000')}"
+      else
+        "#{LOGIN_URL}?application=#{Usps::JwtAuth.config.audience}"
+      end
+    end
+
+    def forbidden
+      [403, { 'Content-Type' => 'text/plain' }, ['Forbidden']]
+    end
+  end
+end

data/lib/usps/support/version.rb

@@ -2,6 +2,6 @@
 
 module Usps
   module Support
-    VERSION = '0.2.37'
+    VERSION = '0.2.39'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: usps-support
 version: !ruby/object:Gem::Version
-  version: 0.2.37
+  version: 0.2.39
 platform: ruby
 authors:
 - Julian Fiander
@@ -121,6 +121,7 @@ files:
 - lib/usps/support/models/hq/squadrons/website.rb
 - lib/usps/support/models/toast.rb
 - lib/usps/support/railtie.rb
+- lib/usps/support/sidekiq_auth.rb
 - lib/usps/support/version.rb
 homepage: https://github.com/unitedstatespowersquadrons/usps-support
 licenses: []