bible270 1.3.1 → 1.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e581a537cf6100f7d0012cd3de3de1d24b53d908fadb928ae38f09b4fcd4ef65
-  data.tar.gz: '025209163a4d12210d243596129b2c440f7ed2096acb8b3d64a88486f960c07d'
+  metadata.gz: 1045882b2a544c39d4f9c4b6282c4dd67861f1af380d4af7ad1cd226b57dcaee
+  data.tar.gz: 03c9162733bfaf96cc08fcd101231174efbf97378cdefe47e55d91d603c0b6bd
 SHA512:
-  metadata.gz: bf4564bfb9c6edfca1bb7b1dbff2bcb93505ae26c04b8a07cfdfe441394e1d5ef757746acc81244c82f70ec5b9ef6498f191c57be537b814d4245492730ec8f3
-  data.tar.gz: 6e95808d78d6c9224989be8664fcf2ae0e82cc61ae4a0d91ced27c830eebd77daa81596e3741aa63797001c62d50563c3751db12deeb54a36a61860beb5b744f
+  metadata.gz: 8bc8c454821233d8c899af8c6224b08d5c48b615ac2c6bbf5dc03140cce041c60c7f1208c78a631576875b3eb3507ca82ae61e2c57a19b5c4fe0e6aab3d30c1d
+  data.tar.gz: 735cf1ba5f33e2f56bd87cbd2720eeb6b685822b148b7b2a13fd8e7537dcd63cf73e6253e050445be136087bcacc4802dcda36c939f1080994c2a8733a1f4b78

data/CHANGELOG.md

@@ -7,6 +7,7 @@ All notable changes to bible270. Format follows [Keep a Changelog](https://keepa
 ### Fixed
 
 - correct Day 27's New Testament reading to include Matthew 26:75
+- silently recover all Turbo interactions from stale sessions, retry once with a fresh CSRF token, and reload rather than submit with a known-stale token if refreshing fails
 
 **[Full Changelog](https://github.com/avonderluft/bible270/compare/v1.3.0...main)**
 

data/app/controllers/bible270/application_controller.rb

@@ -116,18 +116,15 @@ module Bible270
       reason = error ? error.class : 'an unverified request'
       Rails.logger.info("[bible270] silently refreshing a page after #{reason}")
 
-      if stale_turbo_checkoff?
+      if request.format.turbo_stream?
         response.set_header('X-Bible270-Refresh-Session', 'true')
+        response.set_header('Cache-Control', 'no-store')
         head :conflict
       else
         redirect_back fallback_location: root_path, allow_other_host: false, status: :see_other
       end
     end
 
-    def stale_turbo_checkoff?
-      controller_name == 'checkoffs' && action_name == 'toggle' && request.format.turbo_stream?
-    end
-
     # Guard participation (checking off / commenting). Viewing is always open.
     def require_reader!
       return true if signed_in?

data/app/views/bible270/shared/_interaction_ui.html.erb

@@ -35,6 +35,7 @@
     let sessionRefreshedAt = Date.now();
     let sessionRefresh = null;
     let hiddenAt = null;
+    const submitters = new WeakMap();
 
     function updateAuthenticityToken(token) {
       const meta = document.querySelector("meta[name='csrf-token']");
@@ -97,6 +98,9 @@
     });
 
     document.addEventListener("submit", (event) => {
+      const submittedForm = event.target.closest("form");
+      if (submittedForm && event.submitter) submitters.set(submittedForm, event.submitter);
+
       const form = event.target.closest("form[data-b270-submit='true']");
       if (!form) return;
 
@@ -111,8 +115,7 @@
           form.requestSubmit(submitter || undefined);
         }).catch(() => {
           delete form.dataset.b270AwaitingSession;
-          sessionRefreshedAt = Date.now();
-          form.requestSubmit(submitter || undefined);
+          window.location.reload();
         });
         return;
       }
@@ -134,17 +137,22 @@
 
     function staleSessionResponse(fetchResponse) {
       if (!fetchResponse) return false;
-      if (fetchResponse.statusCode === 422) return true;
 
-      return fetchResponse.statusCode === 409 &&
-        fetchResponse.response.headers.get("X-Bible270-Refresh-Session") === "true";
+      const response = fetchResponse.response;
+      if (fetchResponse.statusCode === 409 &&
+          response.headers.get("X-Bible270-Refresh-Session") === "true") return true;
+
+      // Older deployments can still return Rails' HTML 422 page. Do not confuse
+      // an intentional Turbo Stream validation response with an expired session.
+      const contentType = response.headers.get("Content-Type") || "";
+      return fetchResponse.statusCode === 422 && contentType.includes("text/html");
     }
 
     document.addEventListener("turbo:before-fetch-response", (event) => {
       const target = event.target;
-      const form = target.closest && target.closest("form[data-b270-checkoff='true']");
+      const form = target.closest && target.closest("form");
       const response = event.detail.fetchResponse;
-      if (!form || !staleSessionResponse(response)) return;
+      if (!form || form.method.toLowerCase() === "get" || !staleSessionResponse(response)) return;
 
       event.preventDefault();
       if (form.dataset.b270RetriedAfterStaleSession === "true") {
@@ -152,9 +160,12 @@
         return;
       }
 
+      const submitter = submitters.get(form);
       form.dataset.b270RetriedAfterStaleSession = "true";
       resetForm(form);
-      refreshSession().then(() => form.requestSubmit()).catch(() => window.location.reload());
+      refreshSession()
+        .then(() => form.requestSubmit(submitter || undefined))
+        .catch(() => window.location.reload());
     });
 
     document.addEventListener("turbo:submit-end", (event) => {
@@ -165,6 +176,7 @@
       if (form.dataset.b270RetriedAfterStaleSession === "true" &&
           staleSessionResponse(event.detail.fetchResponse)) return;
 
+      delete form.dataset.b270RetriedAfterStaleSession;
       if (event.detail.success) {
         announce(form.dataset.b270Success || "Saved.", "success");
       } else {

data/lib/bible270/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bible270
-  VERSION = '1.3.1'
+  VERSION = '1.3.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bible270
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.2
 platform: ruby
 authors:
 - Andrew vonderLuft