* This change allows access to api/health_checks if you are coming from localhost
or 127.0.0.1. Pretty sweet huh?
The reason for this change is because I want to easily get to these healthcheck
end points from localhost without having to get the health-check-token beforehand.
Buttttt.... this addition has some issues. You can spoof the host header pretty
easily:
https://daniel.haxx.se/blog/2018/04/05/curl-another-host/
I thought about doing `return if !request.ssl? && request.local?`
to check of the request was over https or not. Any localhost healthcheck we do
directly to puma will be over http. Checking for TLS seemed like a logical next
check, but since we force https on the edge and not necessarily from the edge to
Puma the Host header can still be spoofed to get at these end points.
More info on host header attacks and what Rails 6 is doing about it:
https://github.com/rails/rails/issues/29893
While I do think it is a good idea to protect these healthcheck end points from
the outside world, I do want to be able to get to them easily locally. WWYD?
* Fix Health Check spec by stubbing request
Co-authored-by: mstruve <mollylbs@gmail.com>
* Change models and related files
* Update controllers and specs
* More renaming
* Seek and destroy, I mean search and replace
* Round up the stragglers
* Ground control to Major Travis...
* More fixes
* PR feedback
* Various fixes
* Rename view
* Fix list query builder
* Unify request specs
* Fix some API spec errors
* Fix remaining API specs
* Make spec conform to API
* Fix leftover problems
* Fix JS tests
* Fix column name in select
* Fix API specs
* Fix search specs
* Paging Mr. Travis
* Rename positive_reactions_count to public_reactions_count
* Add positive reactions count back in so we can remove it
* Use public_category method for reactions
* Add positive_reactions_count in case any old caches rely on it
* Add positive_rxn_count to account for API endpoints
* Remove unused method
* One more spot...
* Add method back in because of caches
* Update specs to match new functionality
* Fix typo
* Remove unused methods
* Add correct rate limit exception to Articles::Updater
* Send Retry-After with HTTP 429 back to the client
* Update API specs for error 429
* Test build
* Fix spec
* Add retry after to ImageUploadsController and fix specs
* Generalize a bit
* Modernize index test
* Hide comments body_html and user info if the comment is either deleted or hidden
* Shorten lines a bit
* Freeze repeated strings
* Document all /comments
* Document /comments/{id}
* Access only unpublished listings if they belong to the user when authenticated
* Make sure we never send unpublished listings in the index
* Update API docs
* oops
* Remove unused preloading as this loads a single item
* Fix articles index state param values
* Update Articles API docs
* Fix ClassifiedListing.cost_by_category with invalid category
* Add docs for GET|POST /listings and fix bugs
* Document PUT /api/listings/:id
* Add docs for /listings/category/{category}
* One variable down
* Improve listings update error handling
* Convert SponsorshipDecorator to Rails decorator
* Remove empty ReactionDecorator
* Rename SponsorshipDecorator#level_color_hex to level_background_color
* Convert CommentDecorator to Rails decorator
* Add specs and fix bugs for NotificationDecorator
* Convert NotificationDecorator to Rails decorator
* Add specs and fix bugs for OrganizationDecorator
* Convert OrganizationDecorator to Rails decorator
* Add specs to PodcastEpisodeDecorator and fix bugs
* Convert PodcastEpisodeDecorator to a Rails decorator
* Add missing specs for ArticleDecorator and fix bugs
* Convert ArticleDecorator to Rails decorator
* Add missing specs to UserDecorator and fix issues
* Convert UserDecorator to Rails decorator
* Add .decorate_collection method
* Add decorator for AR relations and remove Draper
* Rename BaseDecorator back to ApplicationDecorator
* Rename .decorate_ back to .decorate
* Restore decorate_collection (WTH)
* Add decorated?
* Fix bugs and failing specs
* Decoration should always be explicit
* TagsController inherits from ApiController
* Let ApiController inherit from ActionController::Base to have its own lifecycle
* Remove unused method
* Use only one respond_to :json for the entire API
* ApiController inherits from ActionController::Base
* Use Pundit only where needed
* Add check for article param being a Hash & spec
* Remove unnecessary blank line
* Move logic to private method and before_action call
* Change check_if to validate
* Use is_a? to type check
* Fix type check for specs
* Add specs
* Check the object, not the ID
* Use permitted params and delete cache only after create
* Inherit from ApiController, bail if the reaction user does not exist, fix naming
* Remove superflous test
* Add tests and improve pagination and caching
* Add two more specs
* Add .with_video scope
* Get rid of N+1
* Only select needed columns
* Improve efficiency of the video page as well
* Add missing set_cache_control_headers to API videos#index
Surrogate keys are about setting expectations on cache purging.
Presently we use a combination of all parameters to set changing surrogate keys depending on the result of the `ArticleApiIndexService`. This approach has two limitations:
- if two set of params lead to the same exact set of articles, we still create two different caches
- deleted articles will remain for 24 hours in the cache because the cache key doesn't take the record keys into account
By simply using record keys we make sure that different params leading to the same result set will share the same cache and that deleted keys won't appear anymore in the cache.
* Create new CreateWorker
* Create new spec for CreateWorker
* Change CreateJob to CreateWorker and move to sidekiq
* Update worker
* Update priority of Reactions Create Worker
* Remove leading spaces from spec
* Add article's record key to Fastly Surrogate-Key to separate caches
After #4744 we successfully setup an auto purging system based on Fastly's surrogate key based cache and purging API.
Unfortunately this worked only in the `:show` action as comments are their own tree-based resource.
The `:index` though, is related to a single article, so without the article's record key in the `Surrogate-Key` header the first time we hit the API the result would become the value stored in Fastly's API, for all articles.
* Fix commentable mock for job spec
* Add comment.commentable.purge to the worker as well
* Add more thorough tests for commentable
* Use ancestry in the index and add test
* Add tests for show action
* Return complete comments trees for index, kill n+1 and use correct edge cache key
* Return complete comments tree for show, kill n+1 and use correct edge cache key
* Refactor tests and add surrogate keys tests
* Preload users for the whole subtree
* Clarify explanation of the edge cache keys construction
* Refactor partials
* Remove action caching
* Replace .map.flatten with .flat_map
* Fix surrogate key prefix according to Fastly docs
* Add comment.purge to Comments::BustCacheJob to use Fastly-Rails
* Fix surrogate key spec
