where_is_waldo 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9caee3a6cb5747d9ce5ab460315fdaca5a9f05f7521dbe07f36a6d9fe5de48d9
-  data.tar.gz: f7e293f87b04039c7a2dbc21e6a80ef574a773438800588a9f87255b9336497a
+  metadata.gz: 33656f9699b2331d830131c39118af0a671b32f3f7f173faec64bde7a522b27b
+  data.tar.gz: 374c04bea26515d249cf4720694699e73ae43f5e9b63601a11d871f16eabe01c
 SHA512:
-  metadata.gz: 95e63474cdbfff6c224b4bc4882bba3fb96cb157bf73a7769a1755f8b6326cba60e19aee6b06fc8fb58fc483496a68f8aa3e6bd03513a1782802ca123f8b9cb7
-  data.tar.gz: 9abb3e965ddf1a13722e5700c2c3c8927c9b6b43593801e592670ec4ab09483ce2a3cf2da6a764dfbfb204e238a0107cbd9628067c5e06b0d7920a24412a0726
+  metadata.gz: d16fdffe075e626fef57fceb95c20b39833c67db2c799ad9099d3873093054152bf68d989958ae432b2ae613b6cb7805a4ebf49a5838ef18b26e6256508a8ac4
+  data.tar.gz: 46024ca78a424b725eace01ad965006691e1c4081ee77ab14c22b6aed26356d11542cd8188abbdc35e588adbc7a7ed04d156bc378e6e7e8d42f8659027a72b21

data/CHANGELOG.md

@@ -3,6 +3,28 @@
 Notable changes to where_is_waldo. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/).
 
+## 0.1.6
+
+### Security
+
+- **The built-in connection no longer authenticates from client-supplied
+  `subject_id` in production.** `WhereIsWaldo::ApplicationCable::Connection`
+  previously fell back to `request.params[:subject_id]` whenever no
+  `authenticate_proc` was configured — so a client could connect with
+  `?subject_id=<anyone>` and be authenticated as that subject (cross-account
+  impersonation). The params path is now permitted **only in local dev/test**;
+  production **fails closed** (rejects the connection) unless `authenticate_proc`
+  (or a self-identified connection such as `JwtConnection`) establishes the
+  subject. Apps that mount the built-in connection in production without an
+  `authenticate_proc` will now be rejected — configure one.
+
+### Tests
+
+- Added a two-account roster isolation spec (a viewer streams only their own
+  org's stream, sees only their own members, and receives none of another
+  account's deltas) and a connection spec proving the params-fallback path
+  fails closed in production.
+
 ## 0.1.5
 
 ### Security / correctness

data/VERSION

@@ -1 +1 @@
-0.1.5
+0.1.6

data/app/channels/where_is_waldo/application_cable/connection.rb

@@ -29,9 +29,16 @@ module WhereIsWaldo
             reject_unauthorized_connection
           end
         else
-          # Default: try to get subject_id from params
-          self.waldo_subject_id = request.params[:subject_id]
-          self.waldo_session_id = request.params[:session_id] || generate_session_id
+          # No authenticate_proc configured. The only remaining identity source
+          # is client-controlled params, which must NEVER authenticate a real
+          # connection (a client could pass ?subject_id=<anyone> and impersonate
+          # them). Permit it ONLY in local dev/test as a convenience; fail closed
+          # everywhere else. Production apps must configure `authenticate_proc`
+          # (or identify the connection themselves, e.g. via JwtConnection).
+          if Rails.env.local?
+            self.waldo_subject_id = request.params[:subject_id]
+            self.waldo_session_id = request.params[:session_id] || generate_session_id
+          end
 
           reject_unauthorized_connection unless waldo_subject_id
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: where_is_waldo
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Scott Gibson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-24 00:00:00.000000000 Z
+date: 2026-07-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails