bible270 1.1.6 → 1.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 323ea67db4332521a07129d64ca3b1e4f6405ba0d87352f14db5dcbcbbe675c7
-  data.tar.gz: b60e969effcc93b68b95c29e8054aae754a41210641146ce526eefd6d28e0229
+  metadata.gz: b7014361816b071aaacc54d569f247ff116cc2c5c0f49ea4490e46a2e62375f4
+  data.tar.gz: d61942b56c9409563d03e8b76e2f3dea0ba6a73d0119e4d0dade38bdcb177ec2
 SHA512:
-  metadata.gz: 799b578048236367edd22c1b75e3c62d9c2b24a8dce6d28174695954a465d97ddffb75164d790b207d7aaca3d225a2a8f1f00e6e2d932cfd90b9824277c53f7d
-  data.tar.gz: 6c7c718e5e2c3b434090eb38481371ec0a63399769d0d54ded50fbee47de914bcbd5fe49605169b7a81b012f979826333d28b2aa349e8392955bd9567187a49c
+  metadata.gz: ee0357bfb87e84ab59b359ba11a274c380834587008263b7229e3d8f3edd04c02a1211045ebabec90545c4384c0404d872913c1caa2461609ec09aa4339bce88
+  data.tar.gz: 2e413b639bdccfbc194a44a7e30051d5c304ed2205625c3b3c79749da20f463178c538b6b9db43233843d783e2bfb91fce2e43121f55b7ff798a55798564a1a7

data/CHANGELOG.md

@@ -6,7 +6,7 @@ All notable changes to bible270. Format follows [Keep a Changelog](https://keepa
 
 ### Changed
 
-- show administrators a quiet, linked completed-day count on Community reader rows while keeping progress hidden—and its aggregate query skipped—for ordinary readers and visitors
+- show administrators a quiet, linked completed-day count on Community reader rows while keeping progress hidden—and its aggregate query skipped—for ordinary readers and visitors; the link stays unadorned at rest and uses the site’s gold hover and keyboard-focus treatment
 
 **[Full Changelog](https://github.com/avonderluft/bible270/compare/v1.1.5...main)**
 
@@ -552,6 +552,7 @@ This is the initial public release.
 
 * Email sign-in requires working Action Mailer delivery in the host application. Set `config.mailer_from`; delivery is inline by default, or set `email_sign_in_deliver_later` when a queue backend is available.
 
+[1.1.6]: https://github.com/avonderluft/bible270/releases/tag/v1.1.6
 [1.1.5]: https://github.com/avonderluft/bible270/releases/tag/v1.1.5
 [1.1.4]: https://github.com/avonderluft/bible270/releases/tag/v1.1.4
 [1.1.3]: https://github.com/avonderluft/bible270/releases/tag/v1.1.3

data/README.md

@@ -6,6 +6,8 @@ A mountable **Rails engine** that drops a 270-day (9 month) interactive Bible re
 
 Initially created for use by students and faculty of [Kingdom Movement School of Ministry](https://www.kmsm.life/), to read through all of Scripture together during the school year. Thus it is potentially useful for any Bible School, Seminary, or Discipleship school working on a 9 month schedule.
 
+For a guided tour of the implementation, see the [architecture walkthrough](docs/architecture.md).
+
 ## The plan
 
 Three readings a day, sized by **verse count** so each day takes roughly the same time.

data/app/controllers/bible270/application_controller.rb

@@ -26,6 +26,8 @@ module Bible270
 
     layout :bible270_layout
 
+    rescue_from ActionController::InvalidAuthenticityToken, with: :recover_from_stale_page
+
     helper_method :current_reader, :signed_in?, :b270_config, :enrollment_closed?
 
   private
@@ -101,6 +103,17 @@ module Bible270
       current_reader.present?
     end
 
+    # A suspended mobile tab can outlive its Rails session cookie. The page still
+    # contains the old session's CSRF token, so Rails rejects its next form before
+    # current_reader has a chance to restore the session from the remember cookie.
+    # Never execute that unverified request; return to a fresh page for a safe retry.
+    def recover_from_stale_page(error)
+      Rails.logger.info("[bible270] refreshing a page after #{error.class}")
+      redirect_back fallback_location: root_path, allow_other_host: false,
+                    alert: 'This page had been open for a while, so it was refreshed. Please try again.',
+                    status: :see_other
+    end
+
     # Guard participation (checking off / commenting). Viewing is always open.
     def require_reader!
       return true if signed_in?

data/app/controllers/bible270/sessions_controller.rb

@@ -17,6 +17,16 @@ module Bible270
       @origin = safe_origin(params[:origin])
     end
 
+    # Refresh a resumed page's session and CSRF token without reloading its content.
+    # Calling current_reader first lets the long-lived remember cookie rebuild a
+    # browser session that the phone may have discarded while the tab was asleep.
+    def refresh
+      current_reader
+      response.headers['X-CSRF-Token'] = form_authenticity_token
+      response.headers['Cache-Control'] = 'no-store'
+      head :no_content
+    end
+
     def create
       auth = request.env['omniauth.auth']
       redirect_to(sign_in_path, alert: "Sign in didn't complete. Please try again.") and return unless auth

data/app/views/bible270/shared/_interaction_ui.html.erb

@@ -1,5 +1,6 @@
-<script nonce="<%= content_security_policy_nonce %>">
+<script nonce="<%= content_security_policy_nonce %>" data-refresh-path="<%= refresh_session_path %>">
   (() => {
+    const refreshSessionPath = document.currentScript.dataset.refreshPath;
     if (window.Bible270InteractionUI) {
       window.Bible270InteractionUI.reset();
       return;
@@ -30,6 +31,42 @@
       document.querySelectorAll("form[data-b270-submit='true']").forEach(resetForm);
     }
 
+    const SESSION_REFRESH_AFTER = 5 * 60 * 1000;
+    let sessionRefreshedAt = Date.now();
+    let sessionRefresh = null;
+    let hiddenAt = null;
+
+    function updateAuthenticityToken(token) {
+      const meta = document.querySelector("meta[name='csrf-token']");
+      if (meta) meta.content = token;
+      document.querySelectorAll("input[name='authenticity_token']").forEach((input) => {
+        input.value = token;
+      });
+    }
+
+    function refreshSession() {
+      if (sessionRefresh) return sessionRefresh;
+
+      sessionRefresh = fetch(refreshSessionPath, {
+        credentials: "same-origin",
+        cache: "no-store",
+        headers: { Accept: "text/plain" }
+      }).then((response) => {
+        const token = response.headers.get("X-CSRF-Token");
+        if (!response.ok || !token) throw new Error("Could not refresh the session");
+
+        updateAuthenticityToken(token);
+        sessionRefreshedAt = Date.now();
+      }).finally(() => {
+        sessionRefresh = null;
+      });
+      return sessionRefresh;
+    }
+
+    function sessionRefreshNeeded() {
+      return Date.now() - sessionRefreshedAt >= SESSION_REFRESH_AFTER;
+    }
+
     let scriptureWindow = null;
     const replacesBackgroundTabs = /iPad|iPhone|iPod/.test(navigator.userAgent) ||
       (navigator.platform === "MacIntel" && navigator.maxTouchPoints > 1);
@@ -62,6 +99,24 @@
     document.addEventListener("submit", (event) => {
       const form = event.target.closest("form[data-b270-submit='true']");
       if (!form) return;
+
+      if (sessionRefresh || sessionRefreshNeeded()) {
+        event.preventDefault();
+        if (form.dataset.b270AwaitingSession === "true") return;
+
+        form.dataset.b270AwaitingSession = "true";
+        const submitter = event.submitter;
+        refreshSession().then(() => {
+          delete form.dataset.b270AwaitingSession;
+          form.requestSubmit(submitter || undefined);
+        }).catch(() => {
+          delete form.dataset.b270AwaitingSession;
+          sessionRefreshedAt = Date.now();
+          form.requestSubmit(submitter || undefined);
+        });
+        return;
+      }
+
       if (form.dataset.b270Submitting === "true") {
         event.preventDefault();
         return;
@@ -89,7 +144,18 @@
       }
     });
 
-    window.addEventListener("pageshow", reset);
+    window.addEventListener("pageshow", (event) => {
+      reset();
+      if (event.persisted) refreshSession().catch(() => {});
+    });
+    document.addEventListener("visibilitychange", () => {
+      if (document.visibilityState === "hidden") {
+        hiddenAt = Date.now();
+      } else if (hiddenAt && Date.now() - hiddenAt >= SESSION_REFRESH_AFTER) {
+        refreshSession().catch(() => {});
+        hiddenAt = null;
+      }
+    });
     document.addEventListener("turbo:load", reset);
 
     window.Bible270InteractionUI = { reset };

data/config/routes.rb

@@ -50,6 +50,7 @@ Bible270::Engine.routes.draw do
   # Built-in OmniAuth sign-in. The request phase (POST <mount>/auth/:provider)
   # is handled by the OmniAuth middleware in the host app, not by these routes.
   get    'sign_in',                 to: 'sessions#new', as: :sign_in
+  get    'session/refresh',         to: 'sessions#refresh', as: :refresh_session
 
   # Email (magic link) sign-in, for readers without a social account.
   post   'sign_in/email',           to: 'sessions#email_link',     as: :email_sign_in_link

data/lib/bible270/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bible270
-  VERSION = '1.1.6'
+  VERSION = '1.1.7'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bible270
 version: !ruby/object:Gem::Version
-  version: 1.1.6
+  version: 1.1.7
 platform: ruby
 authors:
 - Andrew vonderLuft