clowk 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1593747e0040a0056565a40b2bf1699d8242af1d253751ce3ea5c86949ff1f7a
-  data.tar.gz: 33147a1e6f88c7970d52bf33403566c09309315c53b8e080416aaece4f1ecc2a
+  metadata.gz: 1aad1a920ab61f2ff4a89d52ceede9e30edf63a92f2fa5cb60e99eb3032f5a39
+  data.tar.gz: a701bfc46f4c2ae7c2bc57d731ab9a9ff4dde4dc454fc0634e8b1d6a08603b80
 SHA512:
-  metadata.gz: 0cf89e539def821193dd451c8902e581423f103acd8881ce67d7eadb9cfd9e2e69302a265769679eb5a906593a89253f4781cf625546ee3bbd3d8d012d15584a
-  data.tar.gz: f4993722c5349f80a7a10f39cff94d3b76b4909b700272f23458bca7d227fa263258c78b01cf511e2cb5d30640dae84a991fd686939fc4fbfcd2cee7b2e5e757
+  metadata.gz: bd7bb4bc6f95eb20c9cdabbb5f7e1dd1664f5d2566b895bd0e7466c46821ee7262b25bea0ced1aaf21e4ae8fa858ada4b28161d5517d7241f8ec31607ef5cae8
+  data.tar.gz: e0d6c2d830d16cc85c003c114240e0b2270f7de8288d85f1eb4b5d564613d8681c1d484a37fcf36a76908f44f6e9d3b9579d2890d4e3abf4cc84917375c2d03e

data/lib/clowk/authenticable.rb

@@ -291,7 +291,22 @@ module Clowk
       store.read(clowk_status_cache_key)&.deep_symbolize_keys
     end
 
+    # A TTL of zero means "never trust a cached status", so there is nothing to
+    # write anywhere — the read side already discards whatever is there
+    # (clowk_session_status_fresh? is false without a positive TTL).
+    #
+    # The guard used to sit below the session branch and cover only the external
+    # cache, so an app that set the TTL to zero — to guarantee a genuinely fresh
+    # check before a destructive action — still had the full status payload
+    # written into its session on every single request, and never read back.
+    # That is write-only weight in a cookie with 4096 bytes to live in, and it
+    # ends as ActionDispatch::Cookies::CookieOverflow on whichever request
+    # happens to add a flash message.
     def clowk_write_cached_session_status(status)
+      ttl = Clowk.config.session_status_ttl.to_i
+
+      return unless ttl.positive?
+
       if clowk_session_store
         clowk_session_store[Clowk.config.session_key] = stored_session.merge(
           "session_status" => status,
@@ -301,10 +316,9 @@ module Clowk
         return
       end
 
-      ttl = Clowk.config.session_status_ttl.to_i
       store = clowk_status_cache
 
-      return unless store && ttl.positive?
+      return unless store
 
       store.write(clowk_status_cache_key, status, expires_in: ttl)
     end

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.6.0"
+  VERSION = "0.6.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Clowk