clowk 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66d644459bae62c4a73b869fadc50402bfbe6fb060c0c6fc5ee521361a852be7
-  data.tar.gz: 1e81f740b072795cb9a84c2013f406ee5ea34a9bf5c1c92797cea9efd1c22d4e
+  metadata.gz: b8925255001baaeae3fb7507651c4fa65ba8ccb24358a593c191f5e3a0070b2a
+  data.tar.gz: f6acd810ff58c1410c67c8b78c4db705966fa8643d39fef2673da25816c006c8
 SHA512:
-  metadata.gz: 824a01a8708d3b4f1805c83acc20d2161c9e72f3be7c47ae9e1c2d9d80bbff624292d20e65cf03b53ca5384874caef3f1d038482cd4d4593cc688537b63a2d31
-  data.tar.gz: d4703e671a924025452c08686d6134f85563108d0edeb18bb049f9f9e4d119228d404ba3eccddae21840b2b63267c416aebac1b4a7f925689a9e37cd642cbf95
+  metadata.gz: d61ceac58f3444d2cf6cf0af582d595a115c0971048ad7a2e979611cc45a4020bbc1a3689fccf33144ccc3d28bbc7cfbc32cb1bd870de94f43cede1289cd9aea
+  data.tar.gz: 538f167b4d02d928f9cd231fadbbb8e8a7639b2648903e5f46da1414b058b376e5dd9ce926ab47cbb1fbc1aeacbdce748d5ef8bb6d24ea8c6ec00fd90f941685

data/README.md

@@ -239,15 +239,18 @@ those actions and they get a live one:
 
 ```ruby
 class ApiKeysController < ApplicationController
-  clowk_require_fresh_session only: [:create, :update, :destroy]
+  before_action :clowk_enforce_fresh_session!, only: [:create, :update, :destroy]
 end
 ```
 
-It takes the same options as `before_action`. Everything not named keeps the
-cached check, so an app pays for the round trip on the few actions it cannot
-undo and nowhere else. `clowk_enforce_fresh_session!` is the same thing as a
-method, and `clowk_session_active?(force: true)` returns the answer instead of
-enforcing it.
+An ordinary `before_action`, so the filter options you already know all work.
+Everything not named keeps the cached check, so an app pays for the round trip on
+the few actions it cannot undo and nowhere else.
+
+Under a configured `prefix_by` the method is named for the scope, like every
+other one here — `clowk_user_enforce_fresh_session!` beside
+`clowk_user_enforce_session!`. And `clowk_session_active?(force: true)` returns
+the answer instead of enforcing it.
 
 Two settings decide what happens when Clowk itself cannot be reached:
 

data/lib/clowk/authenticable.rb

@@ -67,22 +67,6 @@ module Clowk
       Clowk::Authenticable.install_dynamic_methods(self)
     end
 
-    class_methods do
-      # Demand a live answer from Clowk before these actions, whatever a cached
-      # status says.
-      #
-      #   class ApiKeysController < ApplicationController
-      #     clowk_require_fresh_session only: [:create, :update, :destroy]
-      #   end
-      #
-      # Takes the same options as before_action. Everything NOT listed keeps the
-      # cached check, which is the point: an app pays for a round trip on the few
-      # actions that cannot be undone, and nowhere else.
-      def clowk_require_fresh_session(**options)
-        before_action(**options) { clowk_enforce_fresh_session! }
-      end
-    end
-
     # Per-request credentials — for apps whose keys are not a boot constant:
     # an operator pastes a publishable key into a settings screen, or one
     # process serves several tenants.
@@ -143,7 +127,10 @@ module Clowk
     # rotating a secret, deleting an account, removing a member. Everything else
     # should take the cached check — this is a round trip, on purpose.
     #
-    #   clowk_require_fresh_session only: [:destroy, :rotate_secret]
+    #   before_action :clowk_enforce_fresh_session!, only: [:destroy]
+    #
+    # Under a configured prefix_by it is named for the scope, like every other
+    # method here: `clowk_user_enforce_fresh_session!`.
     #
     # Before 0.7 the only way to get this was `session_status_ttl = 0`, which
     # bought freshness here by paying a round trip on every page instead.
@@ -153,6 +140,14 @@ module Clowk
 
     # @param force [Boolean] see {#clowk_session_status}
     def clowk_enforce_session!(force: false)
+      # Nothing to enforce against a request that carries no session. Reached
+      # through clowk_authenticate! this is already true, but the method is also
+      # a before_action in its own right — and called that way with no session it
+      # read "not active" and ended one that never existed. On a page that skips
+      # the identity gate on purpose (an invite link, a public page that shows
+      # more when signed in) that threw away whatever the redirect was carrying.
+      return unless clowk_signed_in?
+
       return clowk_expire_session!(nil) if clowk_session_beyond_max_age?
       return if clowk_session_active?(force: force)
 

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.7.0"
+  VERSION = "0.8.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: ruby
 authors:
 - Clowk