Class: RobotLab::Web::App

Inherits:
Sinatra::Base
  • Object
show all
Defined in:
lib/robot_lab/web/app.rb

Overview

Sinatra console for driving robot_lab robots from the browser and streaming each run over Server-Sent Events.

This is a DEVELOPER TOOL, unauthenticated by default — run it on localhost or a trusted network. The security touches below (CSRF with constant-time compare, hashed session secret, cookie flags, production boot guard) harden the surface but do not make it safe to expose publicly.

Constant Summary collapse

CSRF_SAFE_METHODS = 
%w[GET HEAD OPTIONS].freeze

Class Method Summary collapse

Class Method Details

.persisted_dev_secret ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/robot_lab/web/app.rb', line 39

def self.persisted_dev_secret
  path     = File.join(Dir.home, '.config', 'robot_lab', 'web_session_secret')
  existing = File.read(path).strip if File.exist?(path)
  return existing if existing && !existing.empty?

  require 'fileutils'
  FileUtils.mkdir_p(File.dirname(path))
  SecureRandom.hex(64).tap do |secret|
    File.write(path, secret)
    File.chmod(0o600, path)
  end
end

.session_secret_source ⇒ Object

Stable session secret. Uses SESSION_SECRET when set; otherwise persists a per-user random secret so it survives restarts. A fresh random secret on every boot would invalidate existing session cookies ("HMAC is invalid").



35
36
37
 
# File 'lib/robot_lab/web/app.rb', line 35

def self.session_secret_source
  ENV['SESSION_SECRET'] || persisted_dev_secret
end