yes-read-api 2.4.5 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d39b9ae08398487d3eff34bf24f91e25ad03921f74df6ec0a55d06195256282a
-  data.tar.gz: e20a9c3cb5149a6e45940eb18f91d26fac6600dbd9c001a3355b846ee5e5fce9
+  metadata.gz: ffccff57e5b684bd457f73ee8812236bdfff0adef1179e040600a8f60ae9e477
+  data.tar.gz: '09c52031f2424362d6437a0f0e3fbb7697a78389990c0da1436f6ac84aa2daf5'
 SHA512:
-  metadata.gz: a238fe0e409db52025aa776c4395fe1afc8ed09f246c1a368bd4ab92a26b9c719b29639d01941836f5f24996ea8ee6a3203026bba599fc61eec551898815160b
-  data.tar.gz: ea069356f20ace8d83696c76539e7752843ab173da85b69b4cc437cfe6bdeb0a62e7998f8c85122d950a38e26e95cbdffcbfe066708e3faad939701a44d9df35
+  metadata.gz: da42b024bd288d04c96b97e06806008d9365adfc77f5d9d1488951a0988730ce529cf8a0198fa15e6c3d84cdb102677b6d5b6dbd91f7526ce4e07cf2329f902f
+  data.tar.gz: 78e070d987e4c42bee1f905d364380e4446aa26e6cb879bc1ddec1a989f4ab80e41fee3f02adfeba210c9537ce9399631db87bd5e46fdf5b1f7f58565221407e

data/app/controllers/yes/read/api/queries_controller.rb

@@ -10,6 +10,10 @@ module Yes
         before_action :validate_advanced_payload, only: :advanced
         before_action :process_own_filter, only: :call
 
+        IGNORED_FILTER_PARAM = { basic: :filter_definition, advanced: :filters }.freeze
+
+        # Covers AuthenticationError raised outside #authenticate_with_token, e.g. by consumer
+        # request authorizers, filters or serializers.
         rescue_from(Yes::Core::AuthenticationError, with: :auth_error_response)
 
         rescue_from(
@@ -43,7 +47,7 @@ module Yes
         end
 
         def response_json(filter_type: :basic, persisted_filter: nil)
-          filter_options = persisted_filter&.body&.deep_symbolize_keys&.merge(model: params[:model]) || params
+          filter_options = applied_filter_options(persisted_filter:, filter_type:)
 
           request_authorizer.call(filter_options, auth_data)
 
@@ -56,6 +60,19 @@ module Yes
           serialize(paginated_records, filter_options)
         end
 
+        # The options the query is built from. They are what the request authorizer is handed too, so
+        # it never authorizes a parameter the query does not apply: a basic query applies `filters` and
+        # an advanced one `filter_definition`.
+        #
+        # @param persisted_filter [#body, nil] stored filter whose body replaces the request params
+        # @param filter_type [Symbol] `:basic` or `:advanced`
+        # @return [Hash] the params without the key the filter type ignores
+        def applied_filter_options(persisted_filter:, filter_type:)
+          options = persisted_filter&.body&.deep_symbolize_keys&.merge(model: params[:model]) || params
+
+          options.except(IGNORED_FILTER_PARAM.fetch(filter_type))
+        end
+
         def request_authorizer
           authorizer_class = "ReadModels::#{read_model_name.classify}::RequestAuthorizer"
           Kernel.const_get(authorizer_class)
@@ -93,15 +110,26 @@ module Yes
           @params ||= request.parameters.deep_symbolize_keys
         end
 
+        # Authenticates the request using the configured auth adapter and stores the returned auth data.
+        # Rescues at call time (not via rescue_from) because the adapter, and with it its error
+        # classes, is configured in an initializer that may run after this controller loads.
+        #
+        # @return [void]
         def authenticate_with_token
           adapter = Yes::Core.configuration.auth_adapter
           raise Yes::Core::AuthenticationError, 'No auth adapter configured' if adapter.nil?
 
           @auth_data = adapter.authenticate(request)
+        rescue *Yes::Core.configuration.auth_error_classes => e
+          auth_error_response(e)
         end
 
         attr_reader :auth_data
 
+        # Renders a 401 for an authentication failure.
+        #
+        # @param error [StandardError] the error raised by the auth adapter
+        # @return [void]
         def auth_error_response(error)
           render(
             json: { title: 'Auth Token Invalid', detail: error.message }.to_json,

data/config/routes.rb

@@ -50,7 +50,7 @@ module Yes
           request.body.rewind # restore the cursor to the beginning able read again body
 
           auth_token = env['HTTP_AUTHORIZATION'] || ''
-          auth_data =  auth_token.present? ? JWT.decode(auth_token.gsub('Bearer ', ''), nil, false) : {}
+          auth_data = unverified_auth_data(auth_token)
           {
             auth_token:,
             auth_data: auth_data.to_json,
@@ -58,9 +58,23 @@ module Yes
           }.stringify_keys
         end
 
+        # Decodes the bearer token without verifying it, only to enrich the span. A missing or
+        # undecodable token yields an empty result: span enrichment must never decide the outcome
+        # of the request, the controller answers with 401 for such tokens.
+        #
+        # @param auth_token [String] the raw Authorization header value (may be empty)
+        # @return [Array<Hash>, Hash] the decoded JWT payload and header, or an empty hash
+        def unverified_auth_data(auth_token)
+          return {} if auth_token.blank?
+
+          JWT.decode(auth_token.gsub('Bearer ', ''), nil, false)
+        rescue JWT::DecodeError
+          {}
+        end
+
         def get_otl_auth_data(request, env)
           auth_token = env['HTTP_AUTHORIZATION'] || ''
-          auth_data =  auth_token.present? ? JWT.decode(auth_token.gsub('Bearer ', ''), nil, false) : {}
+          auth_data = unverified_auth_data(auth_token)
           {
             auth_token:,
             auth_data: auth_data.to_json,

data/lib/yes/read/api/version.rb

@@ -3,7 +3,7 @@
 module Yes
   module Read
     module Api
-      VERSION = '2.4.5'
+      VERSION = '2.5.0'
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yes-read-api
 version: !ruby/object:Gem::Version
-  version: 2.4.5
+  version: 2.5.0
 platform: ruby
 authors:
 - Nico Ritsche