activerecord-session_store 2.1.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6bb05b1423773abedfd835936febc52ab7db2ac6e501d12ef04caeafebc8f803
-  data.tar.gz: 021ef3c3a9dbb1d778ebfbd6afc71f2b1826f5d3589571afadf6936dd5e8ed5b
+  metadata.gz: 4d410be8bc8f2608aab6f3362f842ffe56498e018ca813afb080096af80ed3c1
+  data.tar.gz: 4e520360edec22efb0647ce4aea99f4dd3996483e0ea8d8d95b59c3b8c49e8c6
 SHA512:
-  metadata.gz: ed3984c27305ead605fd3e4a9fd3855fb3005efca57035c80f208df06ce2180da4bc241a76d4821e8a80702e085795f0821988648b1d0065aa449d59a5a98d1e
-  data.tar.gz: d55b4b6ff073360a3770fb4097e6a4c009a0ed186364cff2de69ba61af4dc9f7c57009fa7ca149af7cda5802a5e924ca962d6af185d5f64ef391ed68414fe576
+  metadata.gz: c0a67cf16741647e87c32630beef7b5d51c978037eecb54157eb721d154a5081dbe2b340591b1c1f6b9597ec63aee1dbe6d865cfa82a3a375b2fe37cd249e8cb
+  data.tar.gz: 17b50e63572cebaf5bec61db9d1400908f947ef112cd386505022c1386914ca6520176979b64d16532747854ff273baf9dbb060c8e7c571769f54743ba8678ae

data/CHANGELOG.md

@@ -0,0 +1 @@
+See https://github.com/rails/activerecord-session_store/releases for more information on the releases.

data/README.md

@@ -38,6 +38,13 @@ been updated in the last 30 days. The 30 days cutoff can be changed using the
 Configuration
 --------------
 
+Disable fallback to use insecure session by providing the option
+`secure_session_only` when setting up the session store.
+
+```ruby
+Rails.application.config.session_store :active_record_store, key: '_my_app_session', secure_session_only: true
+```
+
 The default assumes a `sessions` table with columns:
 
 *  `id` (numeric primary key),
@@ -136,6 +143,10 @@ $ rake db:sessions:upgrade
 This rake task is idempotent and can be run multiple times, and session data of
 users will remain intact.
 
+If you are using a custom class for storing your sessions (as described earlier
+in `Configuration`), you need to copy and adapt this task or add a migration
+containing equivalent code.
+
 Please see [#151] for more details.
 
 [#151]: https://github.com/rails/activerecord-session_store/pull/151

data/lib/action_dispatch/session/active_record_store.rb

@@ -1,5 +1,5 @@
 require "active_support/core_ext/module/attribute_accessors"
-require 'action_dispatch/middleware/session/abstract_store'
+require "action_dispatch/middleware/session/abstract_store"
 
 module ActionDispatch
   module Session
@@ -57,8 +57,16 @@ module ActionDispatch
       # ActiveRecord::SessionStore::Session
       class_attribute :session_class
 
-      SESSION_RECORD_KEY = 'rack.session.record'
+      DEFAULT_SAME_SITE = proc { |request| request.cookies_same_site_protection } # :nodoc:
       ENV_SESSION_OPTIONS_KEY = Rack::RACK_SESSION_OPTIONS
+      SESSION_RECORD_KEY = "rack.session.record"
+      SESSION_RECORD_CREATED_KEY = "rack.session.record.created"
+
+      def initialize(app, options = {})
+        @secure_session_only = options.delete(:secure_session_only) { false }
+        options[:same_site] = DEFAULT_SAME_SITE unless options.key?(:same_site)
+        super
+      end
 
     private
       def get_session(request, sid)
@@ -78,6 +86,7 @@ module ActionDispatch
         logger.silence do
           record, sid = get_session_model(request, sid)
           record.data = session_data
+          return sid unless record.changed? || record.new_record?
           return false unless record.save
 
           session_data = record.data
@@ -117,26 +126,47 @@ module ActionDispatch
 
       def get_session_model(request, id)
         logger.silence do
-          model = get_session_with_fallback(id)
-          unless model
-            id = generate_sid
-            model = session_class.new(:session_id => id.private_id, :data => {})
-            model.save
-          end
-          if request.env[ENV_SESSION_OPTIONS_KEY][:id].nil?
-            request.env[SESSION_RECORD_KEY] = model
+          if can_reuse_session_record?(request, id)
+            model = request.env[SESSION_RECORD_KEY]
           else
-            request.env[SESSION_RECORD_KEY] ||= model
+            model = get_session_with_fallback(id)
+
+            new_record = false
+
+            unless model
+              id = generate_sid
+              model = session_class.new(:session_id => id.private_id, :data => {})
+              model.save
+              new_record = true
+            end
+
+            if request.env[ENV_SESSION_OPTIONS_KEY][:id].nil?
+              request.env[SESSION_RECORD_KEY] = model
+              request.env[SESSION_RECORD_CREATED_KEY] = new_record
+            else
+              unless request.env[SESSION_RECORD_KEY]
+                request.env[SESSION_RECORD_KEY] = model
+                request.env[SESSION_RECORD_CREATED_KEY] = new_record
+              end
+            end
           end
+
           [model, id]
         end
       end
 
+      def can_reuse_session_record?(request, id)
+        id &&
+          !request.env[SESSION_RECORD_CREATED_KEY] &&
+          (model = request.env[SESSION_RECORD_KEY]) &&
+          model.session_id == id.private_id
+      end
+
       def get_session_with_fallback(sid)
-        if sid && !self.class.private_session_id?(sid.public_id)
+        if sid && sid.public_id.valid_encoding? && !self.class.private_session_id?(sid.public_id)
           if (secure_session = session_class.find_by_session_id(sid.private_id))
             secure_session
-          elsif (insecure_session = session_class.find_by_session_id(sid.public_id))
+          elsif !@secure_session_only && (insecure_session = session_class.find_by_session_id(sid.public_id))
             insecure_session.session_id = sid.private_id # this causes the session to be secured
             insecure_session
           end
@@ -162,7 +192,6 @@ module ActionDispatch
         # user tried to retrieve a session by a private key?
         session_id =~ /\A\d+::/
       end
-
     end
   end
 end

data/lib/active_record/session_store/railtie.rb

@@ -4,6 +4,10 @@ module ActiveRecord
   module SessionStore
     class Railtie < Rails::Railtie
       rake_tasks { load File.expand_path("../../../tasks/database.rake", __FILE__) }
+
+      initializer "activerecord-session_store.deprecator" do |app|
+        app.deprecators[:"activerecord-session_store"] = SessionStore.deprecator
+      end
     end
   end
 end

data/lib/active_record/session_store/session.rb

@@ -38,6 +38,10 @@ module ActiveRecord
             # Reset column info since it may be stale.
             reset_column_information
             if columns_hash['sessid']
+              SessionStore.deprecator.warn <<~MSG
+                Using a session ID column other than `session_id` is deprecated without replacement. You should migrate your session table to use `session_id`.
+              MSG
+
               def self.find_by_session_id(session_id)
                 find_by_sessid(session_id)
               end
@@ -64,7 +68,10 @@ module ActiveRecord
         @data ||= self.class.deserialize(read_attribute(@@data_column_name)) || {}
       end
 
-      attr_writer :data
+      def data=(data)
+        attribute_will_change!(@@data_column_name) if data != self.data
+        @data = data
+      end
 
       # Has the session been loaded yet?
       def loaded?

data/lib/active_record/session_store/sql_bypass.rb

@@ -72,8 +72,6 @@ module ActiveRecord
       attr_accessor :session_id
       alias :new_record? :new_record
 
-      attr_writer :data
-
       # Look for normal and serialized data, self.find_by_session_id's way of
       # telling us to postpone deserializing until the data is requested.
       # We need to handle a normal data attribute in case of a new record.
@@ -83,6 +81,7 @@ module ActiveRecord
         @data           = attributes[:data]
         @serialized_data = attributes[:serialized_data]
         @new_record     = @serialized_data.nil?
+        @data_changed    = false
       end
 
       # Returns true if the record is persisted, i.e. it's not a new record
@@ -106,6 +105,15 @@ module ActiveRecord
         @data
       end
 
+      def data=(data)
+        @data_changed = true if data != self.data
+        @data = data
+      end
+
+      def changed?
+        persisted? && (@retrieved_by != session_id || @data_changed)
+      end
+
       def save
         return false unless loaded?
         serialized_data = self.class.serialize(data)
@@ -113,7 +121,7 @@ module ActiveRecord
 
         if @new_record
           @new_record = false
-          connect.update <<-end_sql, 'Create session'
+          result = connect.update <<-end_sql, 'Create session'
             INSERT INTO #{table_name} (
               #{connect.quote_column_name(session_id_column)},
               #{connect.quote_column_name(data_column)} )
@@ -122,7 +130,7 @@ module ActiveRecord
               #{connect.quote(serialized_data)} )
           end_sql
         else
-          connect.update <<-end_sql, 'Update session'
+          result = connect.update <<-end_sql, 'Update session'
             UPDATE #{table_name}
             SET
               #{connect.quote_column_name(data_column)}=#{connect.quote(serialized_data)},
@@ -130,6 +138,10 @@ module ActiveRecord
             WHERE #{connect.quote_column_name(session_id_column)}=#{connect.quote(@retrieved_by)}
           end_sql
         end
+
+        @retrieved_by = @session_id
+        @data_changed = false
+        result
       end
 
       def destroy

data/lib/active_record/session_store/version.rb

@@ -1,5 +1,5 @@
 module ActiveRecord
   module SessionStore
-    VERSION = "2.1.0".freeze
+    VERSION = "2.3.0".freeze
   end
 end

data/lib/active_record/session_store.rb

@@ -1,13 +1,20 @@
 require 'active_record'
 require 'active_record/session_store/version'
 require 'action_dispatch/session/active_record_store'
+require 'active_support'
 require 'active_support/core_ext/hash/keys'
-require 'multi_json'
+require 'json'
 
 module ActiveRecord
   module SessionStore
     autoload :Session, 'active_record/session_store/session'
 
+    class << self
+      def deprecator
+        @deprecator ||= ActiveSupport::Deprecation.new("3.0", "ActiveRecord::SessionStore")
+      end
+    end
+
     module ClassMethods # :nodoc:
       mattr_accessor :serializer
 
@@ -62,12 +69,12 @@ module ActiveRecord
       # Uses built-in JSON library to encode/decode session
       class JsonSerializer
         def self.load(value)
-          hash = MultiJson.load(value)
+          hash = JSON.parse(value)
           hash.is_a?(Hash) ? hash.with_indifferent_access[:value] : hash
         end
 
         def self.dump(value)
-          MultiJson.dump(value: value)
+          JSON.dump(value: value)
         end
       end
 

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: activerecord-session_store
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.3.0
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-08-31 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -16,42 +15,42 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '7.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '7.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: railties
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '7.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -72,26 +71,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '4'
-- !ruby/object:Gem::Dependency
-  name: multi_json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.11'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.11.2
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.11'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.11.2
 - !ruby/object:Gem::Dependency
   name: cgi
   requirement: !ruby/object:Gem::Requirement
@@ -106,27 +85,13 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.3.6
-- !ruby/object:Gem::Dependency
-  name: sqlite3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-description:
 email: david@loudthinking.com
 executables: []
 extensions: []
 extra_rdoc_files:
 - README.md
 files:
+- CHANGELOG.md
 - MIT-LICENSE
 - README.md
 - lib/action_dispatch/session/active_record_store.rb
@@ -142,8 +107,10 @@ files:
 homepage: https://github.com/rails/activerecord-session_store
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  homepage_uri: https://github.com/rails/activerecord-session_store
+  source_code_uri: https://github.com/rails/activerecord-session_store
+  changelog_uri: https://github.com/rails/activerecord-session_store/blob/master/CHANGELOG.md
 rdoc_options:
 - "--main"
 - README.md
@@ -153,15 +120,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
-signing_key:
+rubygems_version: 3.6.7
 specification_version: 4
 summary: An Action Dispatch session store backed by an Active Record class.
 test_files: []