yiffspace-auth 0.0.4 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dad90f17a6b3bfc0a2a459d13e29709018c1f342190403c8fabba52908ecfb21
-  data.tar.gz: 7e7f5c43f3bb224d80e496d1b93d7873e89bcd53ba8a383c4fdd6b4e1f2d2f19
+  metadata.gz: 797ac14850c6fb1331452f93c0f751e9096ea74aa16d9ed488f1e32acfb17da1
+  data.tar.gz: 0c2cbc7304003f8ff54cfe0ccf236e89fb16ff89fa801e7537a931bca70cf2d9
 SHA512:
-  metadata.gz: 6c7f74d61e15c0aa03222153dccc65e9d6c9cd61fee05f5bb33b06cddb3eff0e7628e12ff6419b1948767892bd9bf3c0b5c7703f2df7d7f5e0a4441eb9bfb012
-  data.tar.gz: f8b2aeea3b6f655bf4a3d89ad859edfa62958147a550b8cb1a40d9b83481a8e686780afbc8ef7dfe3975f459c619c5d8a9d07b6cb89b1eaa325cd665882b4aca
+  metadata.gz: e81232dbb0d624cf5982b96d80ad454fef794f5fd3b7157bb056807265890e97c27bc9f63ecb2ef2cae784fbb9af1b62c752d6f02c8ad393438340b82acf3aa8
+  data.tar.gz: c97f9aca4937066941ddd271041afa13725854cd605b938bb070c748189d360645aa863c7f7ea13d9b4ae059239b117408694f64234efb5cac5e853d5dcfbf04

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.0.5
+
+- Add auth spoofing: `YiffSpace::Auth.enable_spoof_auth!`/`disable_spoof_auth!`
+  toggle a global switch, and setting `spoof_user_id` (plus optional
+  `spoof_permissions`/`spoof_roles`) on a `Client` makes every request through
+  that client log in as that user via `Helper#auth`/`#user`, without touching
+  the real session. Intended for local development - the gem doesn't gate this
+  by environment itself, so only call `enable_spoof_auth!` from somewhere the
+  host app already restricts to development (see `enable_debug_action!`).
+  Controllers can override this per-request: the `disable_spoof_auth`/
+  `override_spoof_auth` class macros (and the underlying `spoof_override=`
+  setter, for values only known at request time) let a controller opt out of
+  spoofing entirely, or swap in its own `spoof_user_id`/`spoof_permissions`/
+  `spoof_roles` independent of the client's configured defaults.
+
 ## 0.0.1
 
 - Initial release, extracted from the `yiffspace` gem's `YiffSpace::Auth::*`

data/app/controllers/yiff_space/auth/webhook_controller.rb

@@ -66,7 +66,7 @@ module YiffSpace
       end
 
       def mark_dirty(user_id)
-        Rails.cache.write(format(Helper::DIRTY_FLAG_KEY, user_id), true, expires_in: DIRTY_FLAG_TTL)
+        Rails.cache.write(format(DIRTY_FLAG_KEY, user_id), true, expires_in: DIRTY_FLAG_TTL)
       end
     end
   end

data/lib/yiffspace/auth/client.rb

@@ -8,7 +8,8 @@ module YiffSpace
     class Client
       attr_accessor(:client_id, :client_secret, :scopes, :resource,
                     :redirect_uri, :server_url, :auth_session_key, :user_session_key,
-                    :update_discord_images, :permissions_separator, :logto_webhook_secret)
+                    :update_discord_images, :permissions_separator, :logto_webhook_secret,
+                    :spoof_user_id, :spoof_permissions, :spoof_roles)
 
       attr_reader(:name)
 
@@ -22,6 +23,10 @@ module YiffSpace
         @update_discord_images   = true
         @permissions_separator   = ":"
         @logto_webhook_secret    = nil
+        # See YiffSpace::Auth.enable_spoof_auth! - spoofing is off for this client until spoof_user_id is set.
+        @spoof_user_id           = nil
+        @spoof_permissions       = []
+        @spoof_roles             = []
       end
 
       def logto(controller)

data/lib/yiffspace/auth/helper.rb

@@ -8,17 +8,10 @@ module YiffSpace
     module Helper
       extend(ActiveSupport::Concern)
 
-      # auth/user session values (raw Discord profile + OIDC token claims) can easily exceed a
-      # cookie's ~4KB limit, so the session cookie itself only holds an opaque pointer - the real
-      # payload lives in Rails.cache (already a hard dependency of this module, see
-      # #sync_auth_if_dirty! below), keyed off that pointer.
-      SESSION_CACHE_KEY = "yiffspace:auth:session:%s"
-      SESSION_CACHE_TTL = 30.days
-
       module ClassMethods
         def set_client_name(name) # rubocop:disable Naming/AccessorMethodName
           before_action do |controller|
-            controller.request.env["yiffspace.auth.client_name"] = name
+            controller.request.env[CLIENT_NAME_ENV] = name
             if controller.respond_to?(:yiffspace_client_name=)
               controller.yiffspace_client_name = name
             elsif controller.respond_to?(:client_name=)
@@ -32,6 +25,24 @@ module YiffSpace
             end
           end
         end
+
+        # Disables spoof auth for this controller (or just the actions matched by the given
+        # before_action options, e.g. `only:`/`except:`), regardless of the global switch or the
+        # client's spoof_user_id. Useful for controllers that must always see the real session
+        # (e.g. the auth engine's own login/callback controllers).
+        def disable_spoof_auth(**before_action_options)
+          before_action(**before_action_options) { |controller| controller.request.env[SPOOF_OVERRIDE_ENV] = false }
+        end
+
+        # Overrides the user/permissions/roles spoofed for this controller (or just the actions
+        # matched by the given before_action options), independent of the client's configured
+        # spoof_user_id/spoof_permissions/spoof_roles. Still requires the global switch
+        # (YiffSpace::Auth.enable_spoof_auth!) to be on - this only changes *who* gets spoofed in,
+        # not whether spoofing happens at all.
+        def override_spoof_auth(spoof_user_id: nil, spoof_permissions: nil, spoof_roles: nil, **before_action_options)
+          overrides = { spoof_user_id: spoof_user_id, spoof_permissions: spoof_permissions, spoof_roles: spoof_roles }.compact
+          before_action(**before_action_options) { |controller| controller.request.env[SPOOF_OVERRIDE_ENV] = overrides }
+        end
       end
 
       def auth_raw
@@ -39,13 +50,14 @@ module YiffSpace
       end
 
       def auth
+        return spoofed_auth if spoofing?
         return AuthInfo::Anonymous.instance if auth_raw.blank?
 
         AuthInfo.from_session(auth_raw)
       end
 
       def auth?
-        auth_raw.present? && !auth.anonymous?
+        spoofing? || (auth_raw.present? && !auth.anonymous?)
       end
 
       def auth=(value)
@@ -62,13 +74,14 @@ module YiffSpace
       end
 
       def user
+        return spoofed_user if spoofing?
         return UserInfo::Anonymous.instance if user_raw.blank?
 
         UserInfo.from_session(user_raw)
       end
 
       def user?
-        user_raw.present? && !user.anonymous?
+        spoofing? || (user_raw.present? && !user.anonymous?)
       end
 
       def user=(value)
@@ -99,13 +112,12 @@ module YiffSpace
         auth.permissions.has?(name)
       end
 
-      DIRTY_FLAG_KEY = "yiffspace:auth:dirty:%s"
-
       # Checks the dirty flag written by the Logto webhook handler. If set, re-fetches
       # the user's current roles and permissions from the Logto Management API and
       # rewrites the session — without waiting for the access token to expire.
       # Call this as a before_action in any controller that needs instant revocation.
       def sync_auth_if_dirty!
+        return if spoofing?
         return unless auth?
 
         flag_key = format(DIRTY_FLAG_KEY, auth.id)
@@ -156,8 +168,62 @@ module YiffSpace
         request.env[CLIENT_NAME_ENV] = value.to_sym
       end
 
+      # Per-request override set via the disable_spoof_auth/override_spoof_auth class macros, or
+      # by calling this setter directly (e.g. from a custom before_action, for values that can
+      # only be computed per-request). `false` disables spoofing; a Hash overrides individual
+      # :spoof_user_id/:spoof_permissions/:spoof_roles values; nil (the default) defers entirely
+      # to the client's configuration.
+      def spoof_override
+        respond_to?(:request, true) && request.env[SPOOF_OVERRIDE_ENV]
+      end
+
+      def spoof_override=(value)
+        request.env[SPOOF_OVERRIDE_ENV] = value
+      end
+
       private
 
+      # True when YiffSpace::Auth.enable_spoof_auth! has been called and a spoof user id resolves
+      # (from the client's spoof_user_id or a controller override). Clients without one keep
+      # behaving normally even with the global switch on, so spoofing is always opt-in.
+      def spoofing?
+        YiffSpace::Auth.spoof_auth? && resolved_spoof_user_id.present?
+      end
+
+      def resolved_spoof_user_id
+        return nil if spoof_override == false
+
+        (spoof_override.is_a?(Hash) && spoof_override[:spoof_user_id]) || auth_client_config.spoof_user_id
+      end
+
+      def resolved_spoof_permissions
+        (spoof_override.is_a?(Hash) && spoof_override[:spoof_permissions]) || auth_client_config.spoof_permissions
+      end
+
+      def resolved_spoof_roles
+        (spoof_override.is_a?(Hash) && spoof_override[:spoof_roles]) || auth_client_config.spoof_roles
+      end
+
+      # Memoized per-request so repeated calls (controller + views) don't refetch the
+      # spoofed user from the Logto Management API on every access.
+      def spoofed_user
+        @spoofed_user ||= begin
+          config    = auth_client_config
+          api_user  = config.logto_management.get_or_create_user(resolved_spoof_user_id)
+          UserInfo.new(id: api_user.discord_id, user: api_user, discord: api_user.discord.serializable_hash)
+        end
+      end
+
+      def spoofed_auth
+        @spoofed_auth ||= AuthInfo.new(
+          id:          spoofed_user.id,
+          token:       "spoofed",
+          roles:       resolved_spoof_roles,
+          permissions: resolved_spoof_permissions,
+          client_id:   auth_client_config.client_id,
+        )
+      end
+
       def read_session_cache(session_key)
         token = session[session_key]
         return nil if token.blank?

data/lib/yiffspace/auth/version.rb

@@ -2,6 +2,6 @@
 
 module YiffSpace
   module Auth
-    VERSION = "0.0.4"
+    VERSION = "0.0.5"
   end
 end

data/lib/yiffspace/auth.rb

@@ -19,8 +19,23 @@ module YiffSpace
     CLIENT_NAME_ENV     = "yiffspace.auth.client_name"
     DEFAULT_CLIENT_NAME = :default
 
+    # Per-request override of spoof auth, keyed off the request env like CLIENT_NAME_ENV is - see
+    # Helper#spoof_override/#spoof_override= below. `false` disables spoofing outright; a Hash
+    # overrides individual :spoof_user_id/:spoof_permissions/:spoof_roles values.
+    SPOOF_OVERRIDE_ENV = "yiffspace.auth.spoof_override"
+
+    # auth/user session values (raw Discord profile + OIDC token claims) can easily exceed a
+    # cookie's ~4KB limit, so the session cookie itself only holds an opaque pointer - the real
+    # payload lives in Rails.cache (already a hard dependency of Helper, see
+    # Helper#sync_auth_if_dirty! below), keyed off that pointer.
+    SESSION_CACHE_KEY = "yiffspace:auth:session:%s"
+    SESSION_CACHE_TTL = 30.days
+
+    DIRTY_FLAG_KEY = "yiffspace:auth:dirty:%s"
+
     @clients             = {}
     @enable_debug_action = false
+    @spoof_auth          = false
 
     module_function
 
@@ -54,6 +69,23 @@ module YiffSpace
     def disable_debug_action!
       @enable_debug_action = false
     end
+
+    # Global kill switch for auth spoofing. When enabled, any client with a
+    # `spoof_user_id` configured logs every request in as that user instead of
+    # reading the real session - see Helper#auth/#user. There's no environment
+    # check here (mirrors enable_debug_action!) - it's on the host app to only
+    # ever call this from somewhere gated to development.
+    def spoof_auth?
+      @spoof_auth
+    end
+
+    def enable_spoof_auth!
+      @spoof_auth = true
+    end
+
+    def disable_spoof_auth!
+      @spoof_auth = false
+    end
   end
 
   class Configuration

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: yiffspace-auth
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
 platform: ruby
 authors:
 - Donovan_DMC
 bindir: bin
 cert_chain: []
-date: 2026-08-14 00:00:00.000000000 Z
+date: 2026-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty