add ip validation to AuthSchServicesController

.env.example

@@ -10,4 +10,8 @@ UNSPLASH_SECRET=
 SECRET_KEY_BASE=
 
 # previously DATABASE_PASSWORD, this variable is used by both the Postgres database and the Rails app
-POSTGRES_PASSWORD=
+POSTGRES_PASSWORD=
+
+# ip addresses that can call actions on the AuthSchServicesController
+# example=54.163.76.76,35.182.98.197
+VALID_AUTHSCH_IPS=

README.md

@@ -133,6 +133,16 @@ docker-compose run web bash -c "bundle exec rake db:migrate"
 docker-compose run web bash -c "bundle exec rake assets:precompile"
 ```
 
+### In Production
+
+Add the following Nginx configuration setting for the server block.
+This enables the rails server to see the clients original ip, not just the reverse proxy's ip.
+The client's ip is required to authenticate users for the AuthSchServicesController.
+
+```shell
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+```
+
 ## Maintenance tasks
 
 Be sure to make regular backups in prod.

app/controllers/auth_sch_services_controller.rb

@@ -1,5 +1,6 @@
 class AuthSchServicesController < ApplicationController
   skip_before_action :require_login
+  before_action :validate_authsc_ip
 
   def sync
     user = get_user(params[:id], [])
@@ -18,6 +19,11 @@ def entrants
 
   private
 
+  def validate_authsc_ip
+    valid_authsc_ips = ENV["VALID_AUTHSCH_IPS"].split(',')
+    render status: :forbidden, plain: 'Forbidden' unless valid_authsc_ips.include?(request.remote_ip)
+  end
+
   def entrants_json(user, semester)
     entrants = user.entry_requests.select do |er|
       er.evaluation.accepted && er.evaluation.semester == semester