auto-session-timeout 0.9.5 → 0.9.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 3561cc313c2dc97c96fb2a2a5931c01c8a442706
-  data.tar.gz: d5c805a2efeb3af57dad7d2b23aa4aa55b1df902
+SHA256:
+  metadata.gz: dee94e3d3dc455152461cede0c60297d6aa1b0374ebf4ad1a907b5dc22624248
+  data.tar.gz: 99a6fba023bdd08410c8f2f7e95bd45c66c73327c4cb1b77ff6012b36d3f4fcd
 SHA512:
-  metadata.gz: 3dff428123f23f12a7cd5f9cba6a25a8d8576db3519ab01c1a70586e6ec84cf52377910207339adcc4a0360106bdd69b35dcb8bad73f68b452d005223ac0452f
-  data.tar.gz: 022ed3b160ee413a4e703bd097acdec9b865994c2d42cf57276b1087591e220f2859b69edae1c293815741ea6daa01b4bc69a4c11fdf920dba5e9ad76cbb8ba0
+  metadata.gz: 9d9e346cd1a79e8528ec4bf22bead52d999a1b4961aa92f1cd5b11a6d1b54131e3201b442447e85df1c6ef2abdc3254390a8ce86c4f6a6c8d523041250a1d7ef
+  data.tar.gz: 9c5fbfd43a32d7596afdb02622bd51c35a9d94219d52c4885dc25dfcbeea75e4613437f53e87aa1a8a694bd51df9aebcdd3cd967ca110185cfe3568997a5a637

data/.github/workflows/minitest.yml

@@ -0,0 +1,69 @@
+name: Minitest
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  test:
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rails-version: ['3.2', '4.0', '4.1', '4.2', '5.0', '5.1', '5.2', '6.0', '6.1', '7.0']
+        ruby-version: ['2.4', '2.5', '2.6', '2.7', '3.0']
+        exclude:
+          - rails-version: '3.2'
+            ruby-version: '2.7'
+          - rails-version: '3.2'
+            ruby-version: '3.0'
+
+          - rails-version: '4.0'
+            ruby-version: '2.7'
+          - rails-version: '4.0'
+            ruby-version: '3.0'
+
+          - rails-version: '4.1'
+            ruby-version: '2.7'
+          - rails-version: '4.1'
+            ruby-version: '3.0'
+
+          - rails-version: '4.2'
+            ruby-version: '2.7'
+          - rails-version: '4.2'
+            ruby-version: '3.0'
+
+          - rails-version: '5.0'
+            ruby-version: '3.0'
+
+          - rails-version: '5.1'
+            ruby-version: '3.0'
+
+          - rails-version: '5.2'
+            ruby-version: '3.0'
+
+          - rails-version: '6.0'
+            ruby-version: '2.4'
+
+          - rails-version: '6.1'
+            ruby-version: '2.4'
+
+          - rails-version: '7.0'
+            ruby-version: '2.4'
+          - rails-version: '7.0'
+            ruby-version: '2.5'
+          - rails-version: '7.0'
+            ruby-version: '2.6'
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      env:
+        RAILS_VERSION: ${{ matrix.rails-version }}
+      with:
+        ruby-version: ${{ matrix.ruby-version }}
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+    - name: Run tests
+      run: bundle exec rake

data/.gitignore

@@ -5,6 +5,7 @@
 .yardoc
 *.sublime-project
 *.sublime-workspace
+.idea
 Gemfile.lock
 InstalledFiles
 _yardoc

data/CHANGELOG

@@ -1,5 +1,63 @@
+2022-01-04 - v0.9.9
+
+2022-01-04 - Rails 7 compatibility [pelargir]
+
+2021-10-11 - v0.9.8
+
+2021-10-10 - Custom session timeout method [JunaidUK]
+
+2021-02-02 - v0.9.7
+
+2021-02-02 - Rails 6 compatibility [jasonheecs]
+
+2019-10-15 - v0.9.6
+
+2019-10-15 - Use routes in JS helper [pelargir]
+
+2019-03-03 - Update README [cprodhomme]
+
+2018-12-21 - Support Rails protect_from_forgery [davegudge]
+
+2017-06-13 - v0.9.5
+
+2017-06-12 - Exclude controller actions from CSRF verification [pelargir]
+
+2017-06-12 - Make updater use vanilla JS [emilos]
+
+2017-05-16 - v0.9.4
+
+2017-05-08 - Rails 5 compatibility [quainjn]
+
+2016-10-14 - Allow defining verbosity [zaimramlan]
+
+2013-08-29 - v0.9.3
+
+2013-08-28 - Add jQuery support [krishnasrihari]
+
+2013-07-24 - v0.9.2
+
+2013-07-24 - Add tests and use Ruby 1.9 hash syntax [pelargir]
+
+2013-07-24 - v0.9.1
+
+2013-07-24 - Timeout can be set in controller or user model [pelargir]
+
+2013-07-22 - v0.9
+
+2013-07-21 - Support for jQuery periodical updater plugin [pelargir]
+
+2013-07-17 - v0.8
+
 2014-07-14 - Added jQuery support [krishnasrihari]
 
+2013-06-23 - v0.7
+
 2013-06-22 - Switched to Bundler for generating the gemspec [pelargir]
 
-2009-04-22 - Initial import [pelargir]
+2009-08-22 - v0.5
+
+2009-06-03 - Move controller actions into plugin [pelargir]
+
+2009-04-22 - Add JS helper [pelargir]
+
+2009-04-22 - Initial import [pelargir]

data/Gemfile

@@ -1,4 +1,7 @@
 source 'https://rubygems.org'
 
+rails_version = ENV['RAILS_VERSION']
+gem 'actionpack', rails_version
+
 # Specify your gem's dependencies in auto-session-timeout.gemspec
 gemspec

data/README.md

@@ -1,100 +1,166 @@
-# auto-session-timeout
+[![Build Status](https://travis-ci.com/pelargir/auto-session-timeout.svg?branch=master)](https://travis-ci.com/pelargir/auto-session-timeout)
+
+# Auto::Session::Timeout
 
 Provides automatic session timeout in a Rails application. Very easy
 to install and configure. Have you ever wanted to force your users
 off your app if they go idle for a certain period of time? Many
 online banking sites use this technique. If your app is used on any
-kind of public computer system, this plugin is a necessity.
+kind of public computer system, this gem is a necessity.
 
 ## Installation
 
 Add this line to your application's Gemfile:
 
-    gem 'auto-session-timeout'
+```ruby
+gem 'auto-session-timeout'
+```
 
 And then execute:
 
-    $ bundle
+```
+$ bundle
+```
 
 Or install it yourself as:
 
-    $ gem install auto-session-timeout
+```
+$ gem install auto-session-timeout
+```
 
 ## Usage
 
 After installing, tell your application controller to use auto timeout:
 
-    class ApplicationController < ActionController::Base
-      auto_session_timeout 1.hour
-      ...
-    end
-
-You will also need to insert this line inside the body tags in your
-views. The easiest way to do this is to insert it once inside your
-default or application-wide layout. Make sure you are only rendering
-it if the user is logged in, otherwise the plugin will attempt to force
-non-existent sessions to timeout, wreaking havoc:
-
-    <body>
-      <% if current_user %>
-        <%= auto_session_timeout_js %>
-      <% end %>
-    </body>
+```ruby
+class ApplicationController < ActionController::Base
+  auto_session_timeout 1.hour
+end
+```
+
+This will use a global timeout of 1 hour. The gem assumes your authentication
+provider has a `#current_user` method that returns the currently logged in user.
+
+If you want to specify a  custom timeout value per user, don't pass a value to
+the controller as shown above. Instead,  override `#auto_timeout` in your
+`#current_user` model. This is  typically the `User` class:
+
+```ruby
+class ApplicationController < ActionController::Base
+  auto_session_timeout
+end
+
+class User < ActiveRecord::Base
+  def auto_timeout
+    15.minutes
+  end
+end
+```
+
+You will also need to insert a call to the `#auto_session_timeout_js`
+helper method inside the body tags in your views. The easiest way to
+do this is to insert it once inside your default or application-wide
+layout. Make sure you are only rendering if the user is logged in,
+otherwise the gem will attempt to force non-existent sessions to
+timeout, wreaking havoc:
+
+```erb
+<body>
+  <% if current_user %>
+    <%= auto_session_timeout_js %>
+  <% end %>
+</body>
+```
 
 You need to setup two actions: one to return the session status and
 another that runs when the session times out. You can use the default
-actions included with the plugin by inserting this line in your target
+actions included with the gem by inserting this line in your target
 controller (most likely your user or session controller):
 
-    class SessionsController < ApplicationController
-      auto_session_timeout_actions
-    end
+```ruby
+class SessionsController < ApplicationController
+  auto_session_timeout_actions
+end
+```
 
 To customize the default actions, simply override them. You can call
-the render_session_status and render_session_timeout methods to use
-the default implementation from the plugin, or you can define the
+the `#render_session_status` and `#render_session_timeout` methods to
+use the default implementation from the gem, or you can define the
 actions entirely with your own custom code:
 
-    class SessionsController < ApplicationController
-      def active
-       render_session_status
-      end
-      
-      def timeout
-        render_session_timeout
-      end
-    end
+```ruby
+class SessionsController < ApplicationController
+  def active
+    render_session_status
+  end
+
+  def timeout
+    render_session_timeout
+  end
+end
+```
 
-In any of these cases, make sure to properly map the actions in
-your routes.rb file:
+In any of these cases, make sure to properly map the actions in your
+routes.rb file:
 
-    match 'active'  => 'sessions#active',  via: :get
-    match 'timeout' => 'sessions#timeout', via: :get
+```ruby
+get "active",  to: "sessions#active"
+get "timeout", to: "sessions#timeout"
+```
 
 You're done! Enjoy watching your sessions automatically timeout.
 
-## Additional Configuration
+## Using with Devise
+
+When using Devise for authentication you will need to add a scoped
+sessions controller and call the timeout actions helper there.
+For example:
+
+```ruby
+class Users::SessionsController < Devise::SessionsController
+  auto_session_timeout_actions
+end
+```
+
+In your routes.rb file you will need to declare your scoped controller
+and declare the timeout actions inside the same Devise scope:
+
+```ruby
+Rails.application.routes.draw do
+  devise_for :users, controllers: { sessions: "users/sessions" }
+  
+  devise_scope :user do
+    get "active", to: "users/sessions#active"
+    get "timeout", to: "users/sessions#timeout"
+  end
+end
+```
+
+You can use Devise's `#user_signed_in?` method when you call the JS helper
+method in your view:
+
+```erb
+<body>
+  <% if user_signed_in? %>
+    <%= auto_session_timeout_js %>
+  <% end %>
+</body>
+```
+
+## Optional Configuration
 
 By default, the JavaScript code checks the server every 60 seconds for
 active sessions. If you prefer that it check more frequently, pass a
 frequency attribute to the helper method. The frequency is given in
 seconds. The following example checks the server every 15 seconds:
 
-    <html>
-      <head>...</head>
-      <body>
-        <% if current_user %>
-          <%= auto_session_timeout_js frequency: 15 %>
-        <% end %>
-        ...
-      </body>
-    </html>
-
-## TODO
-
-* current_user must be defined
-* using Prototype vs. jQuery
-* setting timeout in controller vs. user
+```erb
+<body>
+  <% if current_user %>
+    <%= auto_session_timeout_js frequency: 15 %>
+  <% end %>
+</body>
+```
 
 ## Contributing
 

data/auto-session-timeout.gemspec

@@ -8,7 +8,7 @@ Gem::Specification.new do |spec|
   spec.version       = Auto::Session::Timeout::VERSION
   spec.authors       = ["Matthew Bass"]
   spec.email         = ["pelargir@gmail.com"]
-  spec.description   = %q{Provides automatic session timeout in a Rails application.}
+  spec.description   = %q{Automatic session timeout in Rails}
   spec.summary       = %q{Provides automatic session timeout in a Rails application.}
   spec.homepage      = "http://github.com/pelargir/auto-session-timeout"
   spec.license       = "MIT"
@@ -18,8 +18,8 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 1.3"
-  spec.add_development_dependency "rake", "~> 0"
-  spec.add_development_dependency "minitest", "~> 4.2"
-  spec.add_development_dependency "actionpack", "~> 3.2"
+  spec.add_dependency "actionpack", [">= 3.2", "< 7.1"]
+  spec.add_development_dependency "bundler", "~> 2.0"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "minitest", [">= 4.2", "< 6"]
 end

data/lib/auto/session/timeout/version.rb

@@ -1,7 +1,7 @@
 module Auto
   module Session
     module Timeout
-      VERSION = "0.9.5"
+      VERSION = "0.9.9"
     end
   end
 end

data/lib/auto_session_timeout.rb

@@ -8,8 +8,8 @@ module AutoSessionTimeout
     def auto_session_timeout(seconds=nil)
       protect_from_forgery except: [:active, :timeout]
       prepend_before_action do |c|
-        if c.session[:auto_session_expires_at] && c.session[:auto_session_expires_at] < Time.now
-          c.send :reset_session
+        if session_expired?(c) && !signing_in?(c)
+          handle_session_reset(c)
         else
           unless c.request.original_url.start_with?(c.send(:active_url))
             offset = seconds || (current_user.respond_to?(:auto_timeout) ? current_user.auto_timeout : nil)
@@ -31,8 +31,28 @@ module AutoSessionTimeout
   end
   
   def render_session_timeout
-    flash[:notice] = "Your session has timed out."
-    redirect_to "/login"
+    flash[:notice] = t("devise.failure.timeout", default: "Your session has timed out.")
+    redirect_to sign_in_path
+  end
+
+  private
+
+  def handle_session_reset(c)
+    c.send :reset_session
+  end
+
+  def signing_in?(c)
+    c.request.env["PATH_INFO"] == sign_in_path && c.request.env["REQUEST_METHOD"] == "POST"
+  end
+
+  def session_expired?(c)
+    c.session[:auto_session_expires_at].try(:<, Time.now)
+  end
+
+  def sign_in_path
+    user_session_path
+  rescue
+    "/login"
   end
   
 end

data/lib/auto_session_timeout_helper.rb

@@ -1,7 +1,6 @@
 module AutoSessionTimeoutHelper
   def auto_session_timeout_js(options={})
     frequency = options[:frequency] || 60
-    verbosity = options[:verbosity] || 2
     attributes = options[:attributes] || {}
     code = <<JS
 function PeriodicalQuery() {
@@ -9,11 +8,11 @@ function PeriodicalQuery() {
   request.onload = function (event) {
     var status = event.target.status;
     var response = event.target.response;
-    if (status === 200 && (response === false || response === 'false')) {
-      window.location.href = '/timeout';
+    if (status === 200 && (response === false || response === 'false' || response === null)) {
+      window.location.href = '#{timeout_path}';
     }
   };
-  request.open('GET', '/active', true);
+  request.open('GET', '#{active_path}', true);
   request.responseType = 'json';
   request.send();
   setTimeout(PeriodicalQuery, (#{frequency} * 1000));

data/test/auto_session_timeout_helper_test.rb

@@ -2,42 +2,40 @@ require File.dirname(__FILE__) + '/test_helper'
 
 describe AutoSessionTimeoutHelper do
 
-  subject { Class.new(ActionView::Base).new }
+  class StubView
+    include AutoSessionTimeoutHelper
+    include ActionView::Helpers::JavaScriptHelper
+    include ActionView::Helpers::TagHelper
+
+    def timeout_path
+      "/timeout"
+    end
+
+    def active_path
+      "/active"
+    end
+  end
+
+  subject { StubView.new }
 
   describe "#auto_session_timeout_js" do
     it "returns correct JS" do
-      assert_equal "<script type=\"text/javascript\">
-//<![CDATA[
-function PeriodicalQuery() {
-  var request = new XMLHttpRequest();
-  request.onload = function (event) {
-    var status = event.target.status;
-    var response = event.target.response;
-    if (status === 200 && (response === false || response === 'false')) {
-      window.location.href = '/timeout';
-    }
-  };
-  request.open('GET', '/active', true);
-  request.responseType = 'json';
-  request.send();
-  setTimeout(PeriodicalQuery, (60 * 1000));
-}
-setTimeout(PeriodicalQuery, (60 * 1000));
-
-//]]>
-</script>", subject.auto_session_timeout_js
+      js = subject.auto_session_timeout_js
+      assert js.include?("window.location.href = '/timeout'")
+      assert js.include?("request.open('GET', '/active', true)")
+      assert js.include?("setTimeout(PeriodicalQuery, (60 * 1000))")
     end
 
     it "uses custom frequency when given" do
-      assert_match /120/, subject.auto_session_timeout_js(frequency: 120)
+      assert_match %r{120}, subject.auto_session_timeout_js(frequency: 120)
     end
 
     it "uses 60 when custom frequency is nil" do
-      assert_match /60/, subject.auto_session_timeout_js(frequency: nil)
+      assert_match %r{60}, subject.auto_session_timeout_js(frequency: nil)
     end
 
     it "accepts attributes" do
-      assert_match /data-turbolinks-eval="false"/, subject.auto_session_timeout_js(attributes: { 'data-turbolinks-eval': 'false' })
+      assert_match %r{data-turbolinks-eval="false"}, subject.auto_session_timeout_js(attributes: { 'data-turbolinks-eval': 'false' })
     end
   end
 

metadata

@@ -1,78 +1,91 @@
 --- !ruby/object:Gem::Specification
 name: auto-session-timeout
 version: !ruby/object:Gem::Version
-  version: 0.9.5
+  version: 0.9.9
 platform: ruby
 authors:
 - Matthew Bass
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-06-13 00:00:00.000000000 Z
+date: 2022-01-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.3'
-  type: :development
+        version: '3.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '3.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '7.1'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.2'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.2'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
-  name: actionpack
+  name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.2'
+        version: '4.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.2'
-description: Provides automatic session timeout in a Rails application.
+        version: '4.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
+description: Automatic session timeout in Rails
 email:
 - pelargir@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/minitest.yml"
 - ".gitignore"
 - CHANGELOG
 - Gemfile
@@ -92,7 +105,7 @@ homepage: http://github.com/pelargir/auto-session-timeout
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -107,9 +120,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.10
-signing_key: 
+rubygems_version: 3.1.6
+signing_key:
 specification_version: 4
 summary: Provides automatic session timeout in a Rails application.
 test_files: