verikloak-pundit 0.2.4 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a29b74665fc8bf023f1b6aeea48575b55227a5a4c0d8deae339b02651885814
-  data.tar.gz: fda84a30fa38d00819b5b00c4d72a2a8858355c4faaba2dcef8ec1a956df7753
+  metadata.gz: 8a9cbde30c7f580f43089a171707034fc1d476bdc63cf358ee00a7e2ceffe48c
+  data.tar.gz: 4bda6971e321a4a46045523f1dd01a610cb6a95b28e47a01c665d24a38bdaaf8
 SHA512:
-  metadata.gz: 928b8e33c892000b074a6c8fe12aece68a14140d5994b9f13640d074b39130f560a49e3fabc1a07917e0678d89e6f8a1b797a73dcb3f579b5ffeef622398050d
-  data.tar.gz: 7c418267c589a0a13a0aafdbb2cc48c4fa4cefb87a61d8051a3257e3250790b7be48ac79b7e3fc96421c4ad1a966d0ba511277d67e872d7e7c6f5e6fced09412
+  metadata.gz: 26364d453900ef0bd915eedda4567343b65d8e9adfd7c61e02e926c954ad8bcc778042c7432ea4878a8fa1173a7f7eedccd5cea009f384b042044a65fadd53ca
+  data.tar.gz: 57494f3d1b8de679d2fb81b3a3ba7eff5d8635cadf0f4ef19110f8bd9d6bc70010629ed7c64b6584524c580e8968041d3c0581cc7d0468f067c13f45e4bdc254

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [0.3.0] - 2026-01-01
+
+### Fixed
+- **ENV fallback preservation**: `Configuration#dup` now correctly preserves the `nil` state of `resource_client`, allowing ENV fallback to remain dynamic after duplication. Previously, duplicating a config would freeze the resolved ENV value.
+- **Non-hash resource_access entries**: `resource_roles_all_clients` now guards against malformed `resource_access` entries that are not hashes, preventing potential `NoMethodError`.
+
+### Changed
+- **role_map key normalization**: `role_map` keys are now automatically normalized to symbols when set. This allows users to configure with string keys (e.g., from YAML) while maintaining consistent symbol-based lookup in `RoleMapper`.
+- **pundit_user memoization**: `Controller#pundit_user` is now memoized with `@pundit_user ||=` to avoid creating multiple `UserContext` instances per request.
+
+---
+
 ## [0.2.4] - 2026-01-01
 
 ### Added

data/lib/verikloak/pundit/configuration.rb

@@ -22,13 +22,22 @@ module Verikloak
     # @!attribute expose_helper_method
     #   @return [Boolean] whether to register `verikloak_claims` as a Rails helper method
     class Configuration
-      attr_accessor :role_map, :env_claims_key,
+      attr_accessor :env_claims_key,
                     :realm_roles_path, :resource_roles_path,
                     :permission_role_scope, :permission_resource_clients,
                     :expose_helper_method
 
+      attr_reader :role_map
       attr_writer :resource_client
 
+      # Set the role map, normalizing keys to symbols for consistent lookup.
+      #
+      # @param value [Hash]
+      # @return [void]
+      def role_map=(value)
+        @role_map = normalize_role_map(value)
+      end
+
       # Returns the resource client, falling back to ENV['KEYCLOAK_RESOURCE_CLIENT'] if not set.
       #
       # @return [String]
@@ -99,12 +108,23 @@ module Verikloak
         @expose_helper_method = true
       end
 
+      # Normalize role_map keys to symbols for consistent lookup.
+      #
+      # @param map [Hash, nil]
+      # @return [Hash]
+      def normalize_role_map(map)
+        return {} unless map.is_a?(Hash)
+
+        map.transform_keys(&:to_sym)
+      end
+
       # Copy configuration fields from another instance, duplicating mutable
       # structures so future writes do not leak across instances.
       #
       # @param other [Configuration]
       def initialize_from(other)
-        @resource_client = dup_string(other.resource_client)
+        # Copy the raw instance variable, not the getter, to preserve ENV fallback behavior
+        @resource_client = dup_string(other.instance_variable_get(:@resource_client))
         @role_map = dup_hash(other.role_map)
         @env_claims_key = dup_string(other.env_claims_key)
         @realm_roles_path = dup_array(other.realm_roles_path)

data/lib/verikloak/pundit/controller.rb

@@ -14,9 +14,10 @@ module Verikloak
       end
 
       # Pundit hook returning the UserContext built from Rack env claims.
+      # Memoized to avoid creating multiple instances per request.
       # @return [UserContext]
       def pundit_user
-        Verikloak::Pundit::UserContext.from_env(request.env)
+        @pundit_user ||= Verikloak::Pundit::UserContext.from_env(request.env)
       end
 
       # Access raw Verikloak claims from Rack env.

data/lib/verikloak/pundit/railtie.rb

@@ -16,7 +16,7 @@ module Verikloak
       # Synchronize configuration with verikloak-rails when available.
       # Runs after verikloak-rails configuration is applied.
       initializer 'verikloak_pundit.sync_configuration', after: 'verikloak.configure' do
-        sync_with_verikloak_rails if defined?(Verikloak::Rails)
+        Verikloak::Pundit::Railtie.sync_with_verikloak_rails if defined?(Verikloak::Rails)
       end
 
       class << self

data/lib/verikloak/pundit/user_context.rb

@@ -43,7 +43,7 @@ module Verikloak
       def realm_roles
         @realm_roles ||= begin
           path = resolve_path(config.realm_roles_path)
-          Array(claims.dig(*path)).map(&:to_s).uniq.freeze
+          extract_roles(path)
         end
       end
 
@@ -55,7 +55,7 @@ module Verikloak
         client = client.to_s
         (@resource_roles_cache ||= {})[client] ||= begin
           path = resolve_path(config.resource_roles_path, client: client)
-          Array(claims.dig(*path)).map(&:to_s).uniq.freeze
+          extract_roles(path)
         end
       end
 
@@ -107,6 +107,14 @@ module Verikloak
 
       private
 
+      # Extract roles from claims at the given path.
+      #
+      # @param path [Array<String>]
+      # @return [Array<String>]
+      def extract_roles(path)
+        Array(claims.dig(*path)).map(&:to_s).uniq.freeze
+      end
+
       # Resolve a configured path into concrete dig segments.
       #
       # @param path_config [Array<String, Proc>]
@@ -146,6 +154,7 @@ module Verikloak
           access = claims[CLAIM_RESOURCE_ACCESS]
           if access.is_a?(Hash)
             roles = access.each_with_object([]) do |(client_id, entry), acc|
+              next unless entry.is_a?(Hash)
               next unless permission_client_allowed?(client_id)
 
               acc.concat(Array(entry[CLAIM_ROLES]))

data/lib/verikloak/pundit/version.rb

@@ -5,6 +5,6 @@ module Verikloak
     # Gem version for verikloak-pundit.
     #
     # @return [String]
-    VERSION = '0.2.4'
+    VERSION = '0.3.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: verikloak-pundit
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.3.0
 platform: ruby
 authors:
 - taiyaky
@@ -94,7 +94,7 @@ metadata:
   source_code_uri: https://github.com/taiyaky/verikloak-pundit
   changelog_uri: https://github.com/taiyaky/verikloak-pundit/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/taiyaky/verikloak-pundit/issues
-  documentation_uri: https://rubydoc.info/gems/verikloak-pundit/0.2.4
+  documentation_uri: https://rubydoc.info/gems/verikloak-pundit/0.3.0
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: