clowk 0.3.3 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b02c176f355917aa070a2b183a5844911e769b49ff7906cc40c13bbcd68cbf6
-  data.tar.gz: 7ba591ce54755e2ff3d6a586ef7942ae96442efa6ae93caff5c64e0ac313cbd1
+  metadata.gz: 724e8bb8826e85a7ca8a5ab0a35252a173ae351914318fdf1e7337b28d0acf24
+  data.tar.gz: '0649d40341028b61fa6bc6c5ec48f11d4426db5a3919e231b043b512df5d8676'
 SHA512:
-  metadata.gz: f33e323f94c88fc064d12d0caa0cbc87bf9fad301ba0e29fc89d51ec0f40e81658e7dc67f485e437281705b0cdd10c6157b927500d0afd255f151d48485188ad
-  data.tar.gz: 9c6e02049ac043a85e293ad4ac8ec060d4f90e2b1231931cb593a6287a73b1400bdb6c4c01e18cf20fe090cf5be43336eeade52bb495c8d24074878b0a4c688f
+  metadata.gz: 9d641c9a88626dbadcd07e71aa433c34526c4e5de64e4727c593ceff50d227ca29ab8cee2352f0f69912e98b10dc4e341e81aa2382be49db192937a7b7fc7a3c
+  data.tar.gz: 6d896475327369927e31eb9ea02c40d635739b945cd01389a2431d2717030364d99fff4eac03b6f10a084a00c80dc0381b5b3d9cf55ce9f5337960b364a19152

data/lib/clowk/authenticable.rb

@@ -13,6 +13,7 @@ module Clowk
       signed_in_method = :"#{scope}_signed_in?"
 
       enforce_session_method = :"#{scope}_enforce_session!"
+      sign_out_method = :"#{scope}_sign_out!"
 
       base.class_eval do
         unless current_method == :clowk_current_resource
@@ -39,6 +40,12 @@ module Clowk
           end
         end
 
+        unless sign_out_method == :clowk_sign_out!
+          define_method(sign_out_method) do
+            clowk_sign_out!
+          end
+        end
+
         helper_method current_method, authenticate_method, signed_in_method, :current_token if respond_to?(:helper_method)
       end
     end
@@ -86,9 +93,17 @@ module Clowk
     end
 
     def clowk_authenticate!
-      return clowk_current_resource if clowk_signed_in?
+      return clowk_handle_unauthenticated unless clowk_signed_in?
+
+      # A valid token proves who signed in, not that the session still stands —
+      # revocation lives server-side. Opt in with config.enforce_active_session
+      # to pay a lookup (cached for session_status_ttl) on every authentication.
+      if Clowk.config.enforce_active_session
+        clowk_enforce_session!
+        return if respond_to?(:performed?) && performed?
+      end
 
-      clowk_handle_unauthenticated
+      clowk_current_resource
     end
 
     def clowk_sign_out!
@@ -127,8 +142,13 @@ module Clowk
       nil
     end
 
+    # Bearer header or cookie only — never the query string. A valid token in a
+    # URL would otherwise sign the visitor in on ANY path, bypassing the state
+    # check that makes the OAuth callback safe, and would stay replayable for the
+    # token's full lifetime anywhere the URL was logged. CallbacksController
+    # reads params directly, after validating state.
     def extracted_token
-      @extracted_token ||= Clowk::Middleware::TokenExtractor.new(request).call
+      @extracted_token ||= Clowk::Middleware::TokenExtractor.new(request, token_param: nil).call
     end
 
     def stored_session
@@ -161,7 +181,7 @@ module Clowk
     def resolve_session_status
       cached = stored_session&.dig("session_status") || stored_session&.dig(:session_status)
 
-      return cached&.deep_symbolize_keys if cached
+      return cached&.deep_symbolize_keys if cached && clowk_session_status_fresh?
 
       resource = clowk_current_resource
 
@@ -172,11 +192,29 @@ module Clowk
       result = client.tokens.verify_with_session(token: current_token)
       status = result&.dig(:session)
 
-      session[Clowk.config.session_key] = stored_session.merge("session_status" => status) if status && stored_session
+      if status && stored_session
+        session[Clowk.config.session_key] = stored_session.merge(
+          "session_status" => status,
+          "session_status_checked_at" => Time.now.to_i
+        )
+      end
 
       status
     rescue Clowk::InvalidTokenError
       nil
     end
+
+    # Whether the cached status may still be trusted. Timestamped alongside the
+    # payload rather than inside it, so what we hand back stays exactly what the
+    # API returned.
+    def clowk_session_status_fresh?
+      ttl = Clowk.config.session_status_ttl.to_i
+      return false unless ttl.positive?
+
+      checked_at = (stored_session&.dig("session_status_checked_at") ||
+                    stored_session&.dig(:session_status_checked_at)).to_i
+
+      checked_at.positive? && (Time.now.to_i - checked_at) < ttl
+    end
   end
 end

data/lib/clowk/configuration.rb

@@ -22,6 +22,7 @@ module Clowk
     attr_accessor :token_param
     attr_accessor :enforce_active_session
     attr_accessor :on_session_expired
+    attr_accessor :session_status_ttl
 
     def initialize
       @api_base_url = "https://api.clowk.dev/api/v1"
@@ -43,6 +44,11 @@ module Clowk
       @token_param = :token
       @enforce_active_session = false
       @on_session_expired = nil
+      # How long a fetched session status stays trusted, in seconds. Without a
+      # TTL the first lookup would be cached for the life of the Rails session,
+      # which silently turns every later enforcement call into a no-op. Set 0 to
+      # check on every call.
+      @session_status_ttl = 300
     end
 
     def after_sign_in_path
@@ -64,6 +70,7 @@ module Clowk
       errors << "http_read_timeout must be Numeric" unless @http_read_timeout.is_a?(Numeric)
       errors << "http_write_timeout must be Numeric" unless @http_write_timeout.is_a?(Numeric)
       errors << "http_retry_attempts must be a non-negative Integer" unless @http_retry_attempts.is_a?(Integer) && @http_retry_attempts >= 0
+      errors << "session_status_ttl must be a non-negative Integer" unless @session_status_ttl.is_a?(Integer) && @session_status_ttl >= 0
 
       raise ConfigurationError, errors.join(", ") if errors.any?
 

data/lib/clowk/http/client.rb

@@ -137,12 +137,22 @@ module Clowk
 
     def build_uri(path)
       base_uri = URI(base_url)
-      base_uri.path = join_paths(base_uri.path, normalize_path(path))
-      base_uri.query = nil
+      request_path, request_query = split_query(path)
+      base_uri.path = join_paths(base_uri.path, normalize_path(request_path))
+      base_uri.query = request_query
       base_uri.fragment = nil
       base_uri
     end
 
+    # A request path may arrive with its query already attached (the SDK's
+    # `search` builds "resource/search?query=..."). URI#path= rejects a value
+    # containing "?", so split the query off and set it as its own component
+    # instead of smuggling it through the path.
+    def split_query(path)
+      path_part, _separator, query_part = path.to_s.partition("?")
+      [path_part, query_part.empty? ? nil : query_part]
+    end
+
     def normalize_path(path)
       path.to_s.start_with?("/") ? path : "/#{path}"
     end

data/lib/clowk/middleware/token_extractor.rb

@@ -17,7 +17,13 @@ module Clowk
 
       attr_reader :request, :token_param, :cookie_key
 
+      # Opt-in only. Reading a token from the query string on every request lets
+      # a link like /anything?token=<jwt> establish a session without ever
+      # passing the callback's `state` check, so callers that establish sessions
+      # pass token_param: nil. The callback reads params itself, after state.
       def token_from_params
+        return if token_param.nil?
+
         params = (request.respond_to?(:params) && request.params) ? request.params : {}
         params[token_param.to_s].presence
       end

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.3.3"
+  VERSION = "0.4.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.1
 platform: ruby
 authors:
 - Clowk