Class: Wurk::Web::Authorization

Inherits:
Object
  • Object
show all
Defined in:
lib/wurk/web/config.rb

Overview

Rack middleware inserted into the engine. Resolves PATH_INFO + REQUEST_METHOD from env and delegates to Wurk::Web.config. The engine's mount path is stripped via SCRIPT_NAME so the callback sees engine-relative paths.

Constant Summary collapse

FORBIDDEN_BODY = 
'Forbidden'
READ_ONLY_BODY = 
'Read-only mode'
FORBIDDEN_HEADERS = 
{ 'Content-Type' => 'text/plain' }.freeze
SAFE_METHODS =

Methods allowed while read-only. Anything else is a mutation and 403s.

%w[GET HEAD OPTIONS].freeze

Instance Method Summary collapse

Constructor Details

#initialize(app, api_handoff: true) ⇒ Authorization

api_handoff: false for a mount that never routes to Wurk::API (the standalone Sidekiq::Web.call), where a /api/v1 path is just an extension path and read-only must refuse it here like any other.



475
476
477
478
 
# File 'lib/wurk/web/config.rb', line 475

def initialize(app, api_handoff: true)
  @app = app
  @api_handoff = api_handoff
end

Instance Method Details

#call(env) ⇒ Object 



480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
 
# File 'lib/wurk/web/config.rb', line 480

def call(env)
  method = env['REQUEST_METHOD']
  path = env['PATH_INFO'].to_s
  config = Wurk::Web.config
  return forbidden(FORBIDDEN_BODY) unless config.authorized?(env, method, path)

  # The machine API's own read-only refusal is an RFC-9457 problem
  # document with a slug a client can branch on; this one is the string
  # "Read-only mode" in text/plain. Same verdict either way, so hand the
  # decision down rather than answering here — stamping the env is what
  # makes mount mode 1 (and nothing else) inherit `WURK_WEB_READ_ONLY`.
  # The host's `authorized?` block above still applies: it gates the
  # mount, and a machine client reaching this path chose that mount.
  if @api_handoff && ::Wurk::API.engine_serves?(path)
    env[::Wurk::API::READ_ONLY_ENV] = true if config.read_only?
    return @app.call(env)
  end

  return forbidden(READ_ONLY_BODY) if config.read_only? && !SAFE_METHODS.include?(method)

  @app.call(env)
end