From 05b242579646c53b0bae4efe66536fd2aeca262f Mon Sep 17 00:00:00 2001 From: Manabu Niseki Date: Tue, 24 Oct 2023 20:41:24 +0900 Subject: [PATCH 1/7] Remove Rack::Auth::Digest --- lib/grape.rb | 1 - lib/grape/middleware/auth/strategies.rb | 3 +- spec/grape/middleware/auth/strategies_spec.rb | 88 ------------------- 3 files changed, 1 insertion(+), 91 deletions(-) diff --git a/lib/grape.rb b/lib/grape.rb index 680bea819f..7b9ad1a80b 100644 --- a/lib/grape.rb +++ b/lib/grape.rb @@ -5,7 +5,6 @@ require 'rack/builder' require 'rack/accept' require 'rack/auth/basic' -require 'rack/auth/digest/md5' require 'set' require 'bigdecimal' require 'date' diff --git a/lib/grape/middleware/auth/strategies.rb b/lib/grape/middleware/auth/strategies.rb index dc36eea48a..56855263e4 100644 --- a/lib/grape/middleware/auth/strategies.rb +++ b/lib/grape/middleware/auth/strategies.rb @@ -12,8 +12,7 @@ def add(label, strategy, option_fetcher = ->(_) { [] }) def auth_strategies @auth_strategies ||= { - http_basic: StrategyInfo.new(Rack::Auth::Basic, ->(settings) { [settings[:realm]] }), - http_digest: StrategyInfo.new(Rack::Auth::Digest::MD5, ->(settings) { [settings[:realm], settings[:opaque]] }) + http_basic: StrategyInfo.new(Rack::Auth::Basic, ->(settings) { [settings[:realm]] }) } end diff --git a/spec/grape/middleware/auth/strategies_spec.rb b/spec/grape/middleware/auth/strategies_spec.rb index 29749c5518..f6996695b8 100644 --- a/spec/grape/middleware/auth/strategies_spec.rb +++ b/spec/grape/middleware/auth/strategies_spec.rb @@ -29,92 +29,4 @@ def app expect(last_response.status).to eq(401) end end - - context 'Digest MD5 Auth' do - RSpec::Matchers.define :be_challenge do - match do |actual_response| - actual_response.status == 401 && - actual_response['WWW-Authenticate'].start_with?('Digest ') && - actual_response.body.empty? - end - end - - module StrategiesSpec - class PasswordHashed < Grape::API - http_digest(realm: { realm: 'Test Api', opaque: 'secret', passwords_hashed: true }) do |username| - { 'foo' => Digest::MD5.hexdigest(['foo', 'Test Api', 'bar'].join(':')) }[username] - end - - get '/test' do - [{ hey: 'you' }, { there: 'bar' }, { foo: 'baz' }] - end - end - - class PasswordIsNotHashed < Grape::API - http_digest(realm: 'Test Api', opaque: 'secret') do |username| - { 'foo' => 'bar' }[username] - end - - get '/test' do - [{ hey: 'you' }, { there: 'bar' }, { foo: 'baz' }] - end - end - end - - context 'when password is hashed' do - def app - StrategiesSpec::PasswordHashed - end - - it 'is a digest authentication challenge' do - get '/test' - expect(last_response).to be_challenge - end - - it 'throws a 401 if no auth is given' do - get '/test' - expect(last_response.status).to eq(401) - end - - it 'authenticates if given valid creds' do - digest_authorize 'foo', 'bar' - get '/test' - expect(last_response.status).to eq(200) - end - - it 'throws a 401 if given invalid creds' do - digest_authorize 'bar', 'foo' - get '/test' - expect(last_response.status).to eq(401) - end - end - - context 'when password is not hashed' do - def app - StrategiesSpec::PasswordIsNotHashed - end - - it 'is a digest authentication challenge' do - get '/test' - expect(last_response).to be_challenge - end - - it 'throws a 401 if no auth is given' do - get '/test' - expect(last_response.status).to eq(401) - end - - it 'authenticates if given valid creds' do - digest_authorize 'foo', 'bar' - get '/test' - expect(last_response.status).to eq(200) - end - - it 'throws a 401 if given invalid creds' do - digest_authorize 'bar', 'foo' - get '/test' - expect(last_response.status).to eq(401) - end - end - end end From 5e8ca377688983354098847d10d9f30f278c8e8d Mon Sep 17 00:00:00 2001 From: Manabu Niseki Date: Tue, 24 Oct 2023 22:59:49 +0900 Subject: [PATCH 2/7] Update README.md to remove digest auth --- README.md | 20 +++----------------- 1 file changed, 3 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 0e28d24c1f..bad8038dee 100644 --- a/README.md +++ b/README.md @@ -115,7 +115,7 @@ - [Active Model Serializers](#active-model-serializers) - [Sending Raw or No Data](#sending-raw-or-no-data) - [Authentication](#authentication) - - [Basic and Digest Auth](#basic-and-digest-auth) + - [Basic Auth](#basic-auth) - [Register custom middleware for authentication](#register-custom-middleware-for-authentication) - [Describing and Inspecting an API](#describing-and-inspecting-an-api) - [Current Route and Endpoint](#current-route-and-endpoint) @@ -3422,9 +3422,9 @@ end ## Authentication -### Basic and Digest Auth +### Basic Auth -Grape has built-in Basic and Digest authentication (the given `block` +Grape has built-in Basic authentication (the given `block` is executed in the context of the current `Endpoint`). Authentication applies to the current namespace and any children, but not parents. @@ -3435,20 +3435,6 @@ http_basic do |username, password| end ``` -Digest auth supports clear-text passwords and password hashes. - -```ruby -http_digest({ realm: 'Test Api', opaque: 'app secret' }) do |username| - # lookup the user's password here -end -``` - -```ruby -http_digest(realm: { realm: 'Test Api', opaque: 'app secret', passwords_hashed: true }) do |username| - # lookup the user's password hash here -end -``` - ### Register custom middleware for authentication Grape can use custom Middleware for authentication. How to implement these From 6616695b3fd18f775cd73ff0a6894bc9512bcbc1 Mon Sep 17 00:00:00 2001 From: Manabu Niseki Date: Tue, 24 Oct 2023 23:03:41 +0900 Subject: [PATCH 3/7] Update UPGRADING and CHANGELOG --- CHANGELOG.md | 3 ++- UPGRADING.md | 10 ++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 54906d7d12..0140bbfd2b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,11 @@ -### 1.9.0 (Next) +### 2.0.0 (Next) #### Features * [#2353](https://github.com/ruby-grape/grape/pull/2353): Added Rails 7.1 support - [@ericproulx](https://github.com/ericproulx). * [#2355](https://github.com/ruby-grape/grape/pull/2355): Set response headers based on Rack version - [@schinery](https://github.com/schinery). * [#2360](https://github.com/ruby-grape/grape/pull/2360): Reduce gem size by removing specs - [@ericproulx](https://github.com/ericproulx). +* [#2361](https://github.com/ruby-grape/grape/pull/2361): Remove rack::auth::digest - [@ninoseki](https://github.com/ninoseki). * Your contribution here. #### Fixes diff --git a/UPGRADING.md b/UPGRADING.md index c2f856c8f9..be4fd9b536 100644 --- a/UPGRADING.md +++ b/UPGRADING.md @@ -1,11 +1,11 @@ Upgrading Grape =============== -### Upgrading to >= 1.9.0 +### Upgrading to >= 2.0.0 #### Headers -As per [rack/rack#1592](https://github.com/rack/rack/issues/1592) Rack 3.0 is enforcing the HTTP/2 semantics, and thus treats all headers as lowercase. Starting with Grape 1.9.0, headers will be cased based on what version of Rack you are using. +As per [rack/rack#1592](https://github.com/rack/rack/issues/1592) Rack 3.0 is enforcing the HTTP/2 semantics, and thus treats all headers as lowercase. Starting with Grape 2.0.0, headers will be cased based on what version of Rack you are using. Given this request: @@ -30,6 +30,12 @@ end See [#2355](https://github.com/ruby-grape/grape/pull/2355) for more information. +#### Digest auth deprecation + +Digest auth has been removed along with the deprecation of `Rack::Auth::Digest` in Rack 3. + +See [#2294](https://github.com/ruby-grape/grape/issues/2294) for more information. + ### Upgrading to >= 1.7.0 #### Exceptions renaming From 1310747db21ae53d4ace475d2fde5ca97e617edd Mon Sep 17 00:00:00 2001 From: Manabu Niseki Date: Wed, 25 Oct 2023 21:39:55 +0900 Subject: [PATCH 4/7] Fix typo --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0140bbfd2b..3eaf192f6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ * [#2353](https://github.com/ruby-grape/grape/pull/2353): Added Rails 7.1 support - [@ericproulx](https://github.com/ericproulx). * [#2355](https://github.com/ruby-grape/grape/pull/2355): Set response headers based on Rack version - [@schinery](https://github.com/schinery). * [#2360](https://github.com/ruby-grape/grape/pull/2360): Reduce gem size by removing specs - [@ericproulx](https://github.com/ericproulx). -* [#2361](https://github.com/ruby-grape/grape/pull/2361): Remove rack::auth::digest - [@ninoseki](https://github.com/ninoseki). +* [#2361](https://github.com/ruby-grape/grape/pull/2361): Remove Rack::Auth::Digest - [@ninoseki](https://github.com/ninoseki). * Your contribution here. #### Fixes From 9d7526342a1cc7ef327f90b7fcdacc8126dcc574 Mon Sep 17 00:00:00 2001 From: Manabu Niseki Date: Wed, 25 Oct 2023 21:40:47 +0900 Subject: [PATCH 5/7] Bump the version up to 2.0.0 --- lib/grape/version.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/grape/version.rb b/lib/grape/version.rb index 9b8501a1ed..c6660d510f 100644 --- a/lib/grape/version.rb +++ b/lib/grape/version.rb @@ -2,5 +2,5 @@ module Grape # The current version of Grape. - VERSION = '1.9.0' + VERSION = '2.0.0' end From 31254606d51508c44809361a98a955988620c1f9 Mon Sep 17 00:00:00 2001 From: Manabu Niseki Date: Wed, 25 Oct 2023 21:43:57 +0900 Subject: [PATCH 6/7] Quote the class name --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3eaf192f6a..aabf664f24 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ * [#2353](https://github.com/ruby-grape/grape/pull/2353): Added Rails 7.1 support - [@ericproulx](https://github.com/ericproulx). * [#2355](https://github.com/ruby-grape/grape/pull/2355): Set response headers based on Rack version - [@schinery](https://github.com/schinery). * [#2360](https://github.com/ruby-grape/grape/pull/2360): Reduce gem size by removing specs - [@ericproulx](https://github.com/ericproulx). -* [#2361](https://github.com/ruby-grape/grape/pull/2361): Remove Rack::Auth::Digest - [@ninoseki](https://github.com/ninoseki). +* [#2361](https://github.com/ruby-grape/grape/pull/2361): Remove `Rack::Auth::Digest` - [@ninoseki](https://github.com/ninoseki). * Your contribution here. #### Fixes From 4905cc6bb538bf770fb085247a573ed276c422f0 Mon Sep 17 00:00:00 2001 From: Manabu Niseki Date: Thu, 26 Oct 2023 01:42:39 +0900 Subject: [PATCH 7/7] Update Stable Release version --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index bad8038dee..f0d66f8094 100644 --- a/README.md +++ b/README.md @@ -160,7 +160,7 @@ content negotiation, versioning and much more. ## Stable Release -You're reading the documentation for the next release of Grape, which should be **1.9.0**. +You're reading the documentation for the next release of Grape, which should be **2.0.0**. Please read [UPGRADING](UPGRADING.md) when upgrading from a previous version. The current stable release is [1.8.0](https://github.com/ruby-grape/grape/blob/v1.8.0/README.md).