clowk 0.7.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33d1a92eb50a3515f9c312ccd3ba71dbc9bedfd11935797f70497aa076dbb55b
-  data.tar.gz: 38aa689ff1303246487acaad73cf02c34955bafa9a44bc44544b6ce289e758a3
+  metadata.gz: a1fa17ef38ffc2cce253e598ab2c2478ba05f5f7c638601ec833bafa00377ebc
+  data.tar.gz: 396b0e5c36dcaa01a10397f6227af24dcdf5274a06145222da54855aba71a076
 SHA512:
-  metadata.gz: b334fda452268ee1ae58a897ddbd07dfe6c0f715f4a2693ddadffbeb882af3d906bf4e76ce655160eb5c204c2de6d175c596ecc182b4261ef9edfc21c31f6b51
-  data.tar.gz: 4516f8fdc4dd79291fa895c2a203d7920b3d44ee69bf89f1a8c3f11877f65e36d1e8dd70b67b5a99c49462e15c07d33f25b42d85466fd87f44e2a3244745248e
+  metadata.gz: 1fd3f7de008dd50644494e85e0771113ae98be1efdc1abcae7d97888b6af84f7aa2f5fd086aa711d3be4b2984b0a626c9bdddc5d66c6c8bc41955b21325c3717
+  data.tar.gz: 36067b774a1d57d833909bcee4316d29a25ee5a907b03063f8ee52545adbf36b09a9857b4b374065a60956f2a5a386044138592b9643e0cf5a7b2f48dec50da8

data/README.md

@@ -239,15 +239,18 @@ those actions and they get a live one:
 
 ```ruby
 class ApiKeysController < ApplicationController
-  clowk_require_fresh_session only: [:create, :update, :destroy]
+  before_action :clowk_enforce_fresh_session!, only: [:create, :update, :destroy]
 end
 ```
 
-It takes the same options as `before_action`. Everything not named keeps the
-cached check, so an app pays for the round trip on the few actions it cannot
-undo and nowhere else. `clowk_enforce_fresh_session!` is the same thing as a
-method, and `clowk_session_active?(force: true)` returns the answer instead of
-enforcing it.
+An ordinary `before_action`, so the filter options you already know all work.
+Everything not named keeps the cached check, so an app pays for the round trip on
+the few actions it cannot undo and nowhere else.
+
+Under a configured `prefix_by` the method is named for the scope, like every
+other one here — `clowk_user_enforce_fresh_session!` beside
+`clowk_user_enforce_session!`. And `clowk_session_active?(force: true)` returns
+the answer instead of enforcing it.
 
 Two settings decide what happens when Clowk itself cannot be reached:
 
@@ -269,6 +272,31 @@ with no round trip at all.
 Both ends — the broker said inactive, the ceiling passed — go through
 `config.on_session_expired` when you set one.
 
+### Where the token is kept
+
+Clowk writes the token to its own cookie, and — by default, as every version
+before 0.9 did — mirrors a copy into the app's Rails session.
+
+```ruby
+config.token_store = :cookie   # Clowk's cookie only
+config.token_store = :session  # also mirrored into the session (the default)
+```
+
+The copy is not free. A Rails session lives in **one** cookie with about 4096
+bytes to its name, and in production, where tokens are RS256, the token is most
+of what a session weighs. Hand a browser more than it will hold and it discards
+the whole cookie in silence — no error server-side, none in the console, the
+previous cookie simply stays. Everything written on that request goes with it: a
+flash message, a selected tenant, a CSRF rotation. What a person sees is a button
+that does nothing.
+
+Under `:cookie` the session keeps the claims and the sign-in time, nothing else.
+`current_token` reads Clowk's cookie instead, which is where an API-only app has
+always read it from. Sessions written before the switch are pruned on their next
+request, so an app does not have to wait for everyone to sign out.
+
+The default stays `:session` so an upgrade changes nothing until you ask.
+
 ### Token verification
 
 Tokens signed with `RS256` are verified against Clowk's public key set, fetched

data/lib/clowk/authenticable.rb

@@ -67,22 +67,6 @@ module Clowk
       Clowk::Authenticable.install_dynamic_methods(self)
     end
 
-    class_methods do
-      # Demand a live answer from Clowk before these actions, whatever a cached
-      # status says.
-      #
-      #   class ApiKeysController < ApplicationController
-      #     clowk_require_fresh_session only: [:create, :update, :destroy]
-      #   end
-      #
-      # Takes the same options as before_action. Everything NOT listed keeps the
-      # cached check, which is the point: an app pays for a round trip on the few
-      # actions that cannot be undone, and nowhere else.
-      def clowk_require_fresh_session(**options)
-        before_action(**options) { clowk_enforce_fresh_session! }
-      end
-    end
-
     # Per-request credentials — for apps whose keys are not a boot constant:
     # an operator pastes a publishable key into a settings screen, or one
     # process serves several tenants.
@@ -106,10 +90,17 @@ module Clowk
     def clowk_current_resource
       @clowk_current_resource ||= begin
         payload = stored_user_payload || verified_request_payload
+
+        drop_mirrored_token!
+
         payload ? Current.new(payload) : nil
       end
     end
 
+    # The session first, which holds a copy only under token_store :session —
+    # and, for one request after an app switches to :cookie, in a session
+    # written before the switch. drop_mirrored_token! clears those. Clowk's own
+    # cookie is the source either way.
     def current_token
       stored_session&.dig("token") || extracted_token
     end
@@ -143,7 +134,10 @@ module Clowk
     # rotating a secret, deleting an account, removing a member. Everything else
     # should take the cached check — this is a round trip, on purpose.
     #
-    #   clowk_require_fresh_session only: [:destroy, :rotate_secret]
+    #   before_action :clowk_enforce_fresh_session!, only: [:destroy]
+    #
+    # Under a configured prefix_by it is named for the scope, like every other
+    # method here: `clowk_user_enforce_fresh_session!`.
     #
     # Before 0.7 the only way to get this was `session_status_ttl = 0`, which
     # bought freshness here by paying a round trip on every page instead.
@@ -324,11 +318,10 @@ module Clowk
       store = clowk_session_store
       return if store.nil?
 
-      store[Clowk.config.session_key] = {
-        token:,
-        user: payload,
-        signed_in_at: Time.now.to_i
-      }
+      claims = {user: payload, signed_in_at: Time.now.to_i}
+
+      store[Clowk.config.session_key] =
+        (Clowk.config.token_store == :cookie) ? claims : claims.merge(token:)
 
       clowk_cookie_jar&.[]=(Clowk.config.cookie_key, {
         value: token,
@@ -338,6 +331,23 @@ module Clowk
       })
     end
 
+    # A session written under :session still carries the token, and
+    # persist_clowk_session does not run again while that session stands — so
+    # without this, switching an app to :cookie would shrink nothing until every
+    # person signed out and back in. Drops the copy once, on the first request
+    # after the switch.
+    def drop_mirrored_token!
+      return unless Clowk.config.token_store == :cookie
+
+      store = clowk_session_store
+      held = stored_session
+
+      return if store.nil? || held.nil?
+      return unless held.key?("token") || held.key?(:token)
+
+      store[Clowk.config.session_key] = held.except("token", :token)
+    end
+
     def resolve_session_status(force: false)
       @clowk_session_check_unavailable = false
       cached = force ? nil : clowk_read_cached_session_status

data/lib/clowk/configuration.rb

@@ -27,6 +27,7 @@ module Clowk
     attr_accessor :session_status_ttl
     attr_accessor :max_session_age
     attr_accessor :fail_open_on_broker_error
+    attr_accessor :token_store
     attr_writer :session_status_cache
 
     def initialize
@@ -64,6 +65,25 @@ module Clowk
       # cannot be made at all, the session is left standing and checked again on
       # the next request; max_session_age is what bounds that.
       @fail_open_on_broker_error = true
+
+      # Where the token is kept for the next request: :session or :cookie.
+      #
+      # Clowk's own cookie is written either way — it is what `current_token`
+      # reads when the session has none, and the only place an API-only app has
+      # ever had. The setting decides whether a COPY is also mirrored into the
+      # app's Rails session, as every version before 0.9 did.
+      #
+      # That copy is not free. A Rails session lives in ONE cookie with about
+      # 4096 bytes to its name, and in production, where tokens are RS256, the
+      # token is most of what a session weighs. Hand a browser more than it will
+      # hold and it discards the whole cookie in silence: no error server-side,
+      # none in the console, the previous cookie simply stays. Everything written
+      # on that request goes with it — a flash message, a selected tenant — which
+      # reads as a button that does nothing.
+      #
+      # :session stays the default so an upgrade changes nothing until an app
+      # asks for :cookie.
+      @token_store = :session
     end
 
     # Where API-only apps cache session status, since they have no Rails session

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.7.1"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.9.0
 platform: ruby
 authors:
 - Clowk