first version

Author: MiguelSavignano

LICENSE.txt

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2026 Your Name
+Copyright (c) 2026 Miguel Savignano
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -63,19 +63,6 @@ as the given `AdminUser` — no username/password required.
 
 ---
 
-## Route constraint (optional)
-
-If you prefer to block at the routing layer instead of the controller layer:
-
-```ruby
-# config/routes.rb
-constraints(ActiveAdminVpn::VpnConstraint) do
-  ActiveAdmin.routes(self)
-end
-```
-
----
-
 ## Trusted proxies
 
 If your app runs behind a load balancer or reverse proxy, make sure Rails trusts

active_admin_vpn.gemspec

@@ -1,9 +1,25 @@
 # frozen_string_literal: true
 
-require_relative "vpn_auto_login/version"
+require "active_admin/vpn_auto_login/version"
+require "active_admin/vpn_auto_login/configuration"
+require "active_admin/vpn_auto_login/vpn_constraint"
+require "active_admin/vpn_auto_login/controller_helpers"
+require "active_admin/vpn_auto_login/railtie" if defined?(Rails)
 
 module ActiveAdmin
   module VpnAutoLogin
-    # Your gem's code goes here.
+    class << self
+      def configuration
+        @configuration ||= Configuration.new
+      end
+
+      def configure
+        yield(configuration)
+      end
+
+      def reset!
+        @configuration = Configuration.new
+      end
+    end
   end
 end

lib/active_admin/vpn_auto_login.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module VpnAutoLogin
+    class Configuration
+      attr_writer :ip_ranges
+      attr_accessor :auto_login
+      attr_accessor :auto_login_email
+      attr_accessor :forbidden_status
+      attr_accessor :forbidden_message
+
+      def initialize
+        @auto_login       = false
+        @auto_login_email = nil
+        @forbidden_status = :forbidden
+        @forbidden_message = "Access denied. Connect to the VPN to access this area."
+      end
+
+      def ip_ranges
+        raw = @ip_ranges || ENV["VPN_IP_RANGE"] || ""
+        raw.split(",").map(&:strip).reject(&:empty?)
+      end
+
+      def parsed_ranges
+        ip_ranges.map { |cidr| IPAddr.new(cidr) }
+      rescue IPAddr::InvalidAddressError => e
+        raise ArgumentError, "[ActiveAdmin::VpnAutoLogin] Invalid IP range in configuration: #{e.message}"
+      end
+
+      def vpn_ip?(ip)
+        return false if ip.blank?
+        parsed_ranges.any? { |range| range.include?(IPAddr.new(ip)) }
+      rescue IPAddr::InvalidAddressError
+        false
+      end
+    end
+  end
+end

lib/active_admin/vpn_auto_login/configuration.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module VpnAutoLogin
+    module ControllerHelpers
+      extend ActiveSupport::Concern
+
+      included do
+        before_action :enforce_vpn_access
+        before_action :auto_login_from_vpn, if: -> { ActiveAdmin::VpnAutoLogin.configuration.auto_login }
+      end
+
+      private
+
+      def on_vpn?
+        ActiveAdmin::VpnAutoLogin.configuration.vpn_ip?(request.remote_ip)
+      end
+
+      def enforce_vpn_access
+        return if on_vpn?
+
+        config = ActiveAdmin::VpnAutoLogin.configuration
+        render plain: config.forbidden_message, status: config.forbidden_status
+      end
+
+      def auto_login_from_vpn
+        return unless on_vpn?
+        return if respond_to?(:current_admin_user) && current_admin_user
+
+        email = ActiveAdmin::VpnAutoLogin.configuration.auto_login_email
+        if email.blank?
+          Rails.logger.warn "[ActiveAdmin::VpnAutoLogin] auto_login is enabled but auto_login_email is not set."
+          return
+        end
+
+        user = AdminUser.find_by(email: email)
+        if user
+          sign_in(user)
+        else
+          Rails.logger.warn "[ActiveAdmin::VpnAutoLogin] auto_login_email '#{email}' not found in AdminUser."
+        end
+      end
+    end
+  end
+end

lib/active_admin/vpn_auto_login/controller_helpers.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module VpnAutoLogin
+    class Railtie < Rails::Railtie
+      initializer "active_admin_vpn_auto_login.setup" do
+        ActiveSupport.on_load(:active_admin) do
+          ActiveAdmin.application.on_load do
+            ActiveAdmin::BaseController.include(ActiveAdmin::VpnAutoLogin::ControllerHelpers)
+          end
+        end
+      end
+    end
+  end
+end

lib/active_admin/vpn_auto_login/railtie.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module VpnAutoLogin
+    class VpnConstraint
+      def self.matches?(request)
+        ActiveAdmin::VpnAutoLogin.configuration.vpn_ip?(request.remote_ip)
+      end
+    end
+  end
+end