verikloak-rails 0.2.5 → 0.2.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 59774b369340238296ec1189c9512e674738abfcb26546103ebe56fd090b1c98
-  data.tar.gz: 0dcea3b1e940545a5213dadb253bc0152168eefad534d9ef8fc6c547491f783b
+  metadata.gz: d96aa5ed90bc1dbc922ec263fecbccdb8dd122e51accced8776a969211e4f549
+  data.tar.gz: d7cc87f1b7cf857fbc707962860a596f35efa32f167c76e1bf50362090f6d5b6
 SHA512:
-  metadata.gz: b4e0710f56702485f068937a9a3d0cfabe53694fbf1cf408de1be80d56dbdb5fd1b45ed2c280f0e3627b050f5d34c35c696ab885821757b082f6033b2b2a4608
-  data.tar.gz: 465c2f918d008ca326f67a5247c7da85655cb7544c18b3b787d6fde9ab47be661b455b5a7cbbccd98c18f1b4482707bd06e9e9a381ca2f94ed08d7d0e6448c32
+  metadata.gz: 518cf212cede738ce3e392a93f413b654ba138d4768afbe20811274129f93139aef1afbe5c24cbf3309cf7d99c978cf9a4ff6d8443b01cc7dae543da97f04c7c
+  data.tar.gz: 412639b3aa790ffae71cf53dc427e213ba5b9ae426270cbc6af3e1e0ce26c028abc98db14b0bce58153601f10a7b86c566b4ffdbfd7dcd954175008a6d146025

data/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [0.2.7] - 2025-09-23
+
+### Fixed
+- Handle `RuntimeError` exceptions from `ActionDispatch::MiddlewareStack#insert_after` in Rails 8+
+- Add `inserted` flag to prevent duplicate middleware insertion when fallback is used
+- Enhance error handling to gracefully handle all middleware insertion failures
+
+### Changed
+- Update middleware insertion candidates logic for better Rails version compatibility
+  - Rails 8+ now raises `RuntimeError` instead of the deprecated `ActionDispatch::MiddlewareStack::MiddlewareNotFound`
+  - Broaden exception handling to catch `StandardError` for robustness across Rails versions
+  - Improve logging and debugging information for middleware insertion failures
+
+## [0.2.6] - 2025-09-23
+
+### Fixed
+- Leave `config.verikloak.rescue_pundit` commented in the installer initializer so `verikloak-pundit` can automatically disable the built-in rescue.
+
+### Documentation
+- Align README compatibility with the current `verikloak` dependency range.
+- Clarify how the Pundit rescue interacts with the optional `verikloak-pundit` gem and adjust examples accordingly.
+
 ## [0.2.5] - 2025-09-23
 
 ### Added

data/README.md

@@ -21,7 +21,7 @@ Provide drop-in, token-based authentication for Rails APIs via Verikloak (OIDC d
 ## Compatibility
 - Ruby: >= 3.1
 - Rails: 6.1 – 8.x
-- verikloak: >= 0.1.2, < 0.2
+- verikloak: >= 0.2.0, < 1.0.0
 
 ## Quick Start
 ```bash
@@ -114,7 +114,7 @@ Keys under `config.verikloak`:
 | `error_renderer` | Object responding to `render(controller, error)` | Override error rendering | built-in JSON renderer |
 | `auto_include_controller` | Boolean | Auto-include controller concern | `true` |
 | `render_500_json` | Boolean | Rescue `StandardError`, log the exception, and render JSON 500 | `false` |
-| `rescue_pundit` | Boolean | Rescue `Pundit::NotAuthorizedError` to 403 JSON when Pundit is present (auto-disabled when `verikloak-pundit` is loaded) | `true` |
+| `rescue_pundit` | Boolean | Rescue `Pundit::NotAuthorizedError` to 403 JSON when Pundit is present<br/>(auto-disabled when `verikloak-pundit` is loaded and the initializer leaves it unset) | `true` |
 | `middleware_insert_before` | Object/String/Symbol | Insert `Verikloak::Middleware` before this Rack middleware | `nil` |
 | `middleware_insert_after` | Object/String/Symbol | Insert `Verikloak::Middleware` after this Rack middleware (`Rails::Rack::Logger` when `nil`) | `nil` |
 | `auto_insert_bff_header_guard` | Boolean | Auto insert `Verikloak::Bff::HeaderGuard` when the gem is present | `true` |
@@ -157,8 +157,9 @@ Rails.application.configure do
   config.verikloak.logger_tags = %i[request_id sub]
   config.verikloak.render_500_json = ENV.fetch('VERIKLOAK_RENDER_500', 'false') == 'true'
 
-  # Optional Pundit rescue (403 JSON)
-  config.verikloak.rescue_pundit = ENV.fetch('VERIKLOAK_RESCUE_PUNDIT', 'true') == 'true'
+  # Optional Pundit rescue (403 JSON). Leave commented if you use
+  # verikloak-pundit so it can disable the built-in handler automatically.
+  # config.verikloak.rescue_pundit = ENV.fetch('VERIKLOAK_RESCUE_PUNDIT', 'true') == 'true'
 end
 ```
 
@@ -232,10 +233,10 @@ end
 ## Optional Pundit Rescue
 If the `pundit` gem is present, `Pundit::NotAuthorizedError` is rescued to a standardized 403 JSON. This is a lightweight convenience only; deeper Pundit integration (policies, helpers) is out of scope and can live in a separate plugin.
 
-When the optional [`verikloak-pundit`](https://github.com/taiyaky/verikloak-pundit) gem is loaded, the built-in rescue is automatically disabled to avoid double-handling errors. Explicitly set `config.verikloak.rescue_pundit` if you prefer different behavior.
+When the optional [`verikloak-pundit`](https://github.com/taiyaky/verikloak-pundit) gem is loaded, the built-in rescue is automatically disabled to avoid double-handling errors—as long as the initializer leaves `config.verikloak.rescue_pundit` unset. Uncomment the initializer line (or set the value elsewhere) if you prefer different behavior.
 
 ### Toggle
-Toggle with `config.verikloak.rescue_pundit` (default: true unless overridden by `verikloak-pundit`). Environment example:
+Toggle with `config.verikloak.rescue_pundit` (default: true; leave unset to allow `verikloak-pundit` to disable it). Environment example:
 
 ```ruby
 # config/initializers/verikloak.rb

data/lib/generators/verikloak/install/install_generator.rb

@@ -26,7 +26,7 @@ module Verikloak
           ✅ verikloak: initializer created.
 
           Next steps:
-          1) Ensure the base gem is installed:   gem 'verikloak', '>= 0.1.2', '< 0.2'
+          1) Ensure the base gem is installed:   gem 'verikloak', '>= 0.2.0', '< 1.0.0'
           2) Set discovery_url / audience in config/initializers/verikloak.rb
           3) (Optional) If you disable auto-include, add this line to ApplicationController:
                include Verikloak::Rails::Controller

data/lib/generators/verikloak/install/templates/initializer.rb.erb

@@ -10,5 +10,8 @@ Rails.application.configure do
   config.verikloak.logger_tags = %i[request_id sub]
   config.verikloak.auto_include_controller = true
   config.verikloak.render_500_json = ENV.fetch('VERIKLOAK_RENDER_500', 'false') == 'true'
-  config.verikloak.rescue_pundit = ENV.fetch('VERIKLOAK_RESCUE_PUNDIT', 'true') == 'true'
+
+  # Optional Pundit rescue (403 JSON). Leave commented so `verikloak-pundit`
+  # can auto-disable the built-in handler when it is on the load path.
+  # config.verikloak.rescue_pundit = ENV.fetch('VERIKLOAK_RESCUE_PUNDIT', 'true') == 'true'
 end

data/lib/verikloak/rails/railtie.rb

@@ -136,13 +136,59 @@ module Verikloak
         # @param base_options [Hash] options to pass to the middleware
         # @return [void]
         def insert_middleware_after(stack, base_options)
-          after = Verikloak::Rails.config.middleware_insert_after || ::Rails::Rack::Logger
-          if after
-            stack.insert_after after,
-                               ::Verikloak::Middleware,
-                               **base_options
+          candidates = middleware_insert_after_candidates
+          inserted = false
+
+          candidates.each do |candidate|
+            next unless candidate
+
+            begin
+              stack.insert_after candidate,
+                                 ::Verikloak::Middleware,
+                                 **base_options
+              inserted = true
+              break
+            rescue StandardError => e
+              # Handle middleware insertion failures:
+              # - Rails 8+: RuntimeError for missing middleware
+              # - Earlier versions: ActionDispatch::MiddlewareStack::MiddlewareNotFound
+              log_middleware_insertion_warning(candidate, e)
+            end
+          end
+
+          # Only use as fallback if insertion after a specific middleware failed
+          stack.use ::Verikloak::Middleware, **base_options unless inserted
+        end
+
+        # Build list of middleware to try as insertion points.
+        # Starts with the configured value (if any) and falls back to defaults
+        # that exist across supported Rails versions.
+        #
+        # @return [Array<Object>] ordered list of potential middleware targets
+        def middleware_insert_after_candidates
+          configured = Verikloak::Rails.config.middleware_insert_after
+
+          defaults = []
+          defaults << ::Rails::Rack::Logger if defined?(::Rails::Rack::Logger)
+          defaults << ::ActionDispatch::Executor if defined?(::ActionDispatch::Executor)
+          defaults << ::Rack::Head if defined?(::Rack::Head)
+          defaults << ::Rack::Runtime if defined?(::Rack::Runtime)
+
+          ([configured] + defaults).compact.uniq
+        end
+
+        # Log when a middleware insertion target cannot be found.
+        #
+        # @param candidate [Object] middleware we attempted to insert after
+        # @param error [StandardError] the exception raised during insertion
+        # @return [void]
+        def log_middleware_insertion_warning(candidate, error)
+          candidate_name = candidate.is_a?(Class) ? candidate.name : candidate.class.name
+          message = "[verikloak] Unable to insert after #{candidate_name}: #{error.message}"
+          if defined?(::Rails) && ::Rails.respond_to?(:logger) && ::Rails.logger
+            ::Rails.logger.warn(message)
           else
-            stack.use ::Verikloak::Middleware, **base_options
+            warn(message)
           end
         end
       end

data/lib/verikloak/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Verikloak
   module Rails
-    VERSION = '0.2.5'
+    VERSION = '0.2.7'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: verikloak-rails
 version: !ruby/object:Gem::Version
-  version: 0.2.5
+  version: 0.2.7
 platform: ruby
 authors:
 - taiyaky
@@ -94,7 +94,7 @@ metadata:
   source_code_uri: https://github.com/taiyaky/verikloak-rails
   changelog_uri: https://github.com/taiyaky/verikloak-rails/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/taiyaky/verikloak-rails/issues
-  documentation_uri: https://rubydoc.info/gems/verikloak-rails/0.2.5
+  documentation_uri: https://rubydoc.info/gems/verikloak-rails/0.2.7
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: