Module: ActiveJob::Temporal::TLSFile

Defined in:
lib/activejob/temporal/tls_file.rb

Defined Under Namespace

Classes: Error

Constant Summary collapse

OPEN_FLAGS =

Symlinks are resolved before opening, so NOFOLLOW only trips when the resolved path is swapped for a symlink between resolution and open.

File::RDONLY | (File.const_defined?(:NOFOLLOW) ? File::NOFOLLOW : 0)

Class Method Summary collapse

Class Method Details

.read(path) ⇒ String?

Reads a TLS file, resolving symlinks first so Kubernetes secret mounts (path -> ..data/path -> timestamped directory) work.

Parameters:

  • path (String, nil) —

    path to a TLS file

Returns:

  • (String, nil) —

    file contents, or nil when path is blank

Raises:

  • (Error) —

    when the path does not resolve to a readable regular file



29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/activejob/temporal/tls_file.rb', line 29

def read(path)
  return nil if path.nil? || path.to_s.empty?

  resolved_path = File.realpath(File.expand_path(path))
  File.open(resolved_path, OPEN_FLAGS) do |file|
    raise Error, "TLS file path must point to a regular file: #{path}" unless file.stat.file?

    file.read
  end
rescue Errno::ELOOP
  raise Error, "TLS file path could not be resolved: #{path}"
rescue Errno::ENOENT, Errno::ENOTDIR, Errno::EACCES
  raise Error, "TLS file path is not readable: #{path}"
end

.readable_regular_file?(path) ⇒ Boolean

Returns true when the path resolves to a readable regular file.

Parameters:

  • path (String, nil) —

    path to a TLS file, symlinks allowed

Returns:

  • (Boolean) —

    true when the path resolves to a readable regular file



15
16
17
18
19
20
21
 
# File 'lib/activejob/temporal/tls_file.rb', line 15

def readable_regular_file?(path)
  resolved_path = File.realpath(File.expand_path(path))

  File.stat(resolved_path).file? && File.readable?(resolved_path)
rescue Errno::ENOENT, Errno::ENOTDIR, Errno::EACCES, Errno::ELOOP
  false
end