clowk 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b8925255001baaeae3fb7507651c4fa65ba8ccb24358a593c191f5e3a0070b2a
-  data.tar.gz: f6acd810ff58c1410c67c8b78c4db705966fa8643d39fef2673da25816c006c8
+  metadata.gz: a1fa17ef38ffc2cce253e598ab2c2478ba05f5f7c638601ec833bafa00377ebc
+  data.tar.gz: 396b0e5c36dcaa01a10397f6227af24dcdf5274a06145222da54855aba71a076
 SHA512:
-  metadata.gz: d61ceac58f3444d2cf6cf0af582d595a115c0971048ad7a2e979611cc45a4020bbc1a3689fccf33144ccc3d28bbc7cfbc32cb1bd870de94f43cede1289cd9aea
-  data.tar.gz: 538f167b4d02d928f9cd231fadbbb8e8a7639b2648903e5f46da1414b058b376e5dd9ce926ab47cbb1fbc1aeacbdce748d5ef8bb6d24ea8c6ec00fd90f941685
+  metadata.gz: 1fd3f7de008dd50644494e85e0771113ae98be1efdc1abcae7d97888b6af84f7aa2f5fd086aa711d3be4b2984b0a626c9bdddc5d66c6c8bc41955b21325c3717
+  data.tar.gz: 36067b774a1d57d833909bcee4316d29a25ee5a907b03063f8ee52545adbf36b09a9857b4b374065a60956f2a5a386044138592b9643e0cf5a7b2f48dec50da8

data/README.md

@@ -272,6 +272,31 @@ with no round trip at all.
 Both ends — the broker said inactive, the ceiling passed — go through
 `config.on_session_expired` when you set one.
 
+### Where the token is kept
+
+Clowk writes the token to its own cookie, and — by default, as every version
+before 0.9 did — mirrors a copy into the app's Rails session.
+
+```ruby
+config.token_store = :cookie   # Clowk's cookie only
+config.token_store = :session  # also mirrored into the session (the default)
+```
+
+The copy is not free. A Rails session lives in **one** cookie with about 4096
+bytes to its name, and in production, where tokens are RS256, the token is most
+of what a session weighs. Hand a browser more than it will hold and it discards
+the whole cookie in silence — no error server-side, none in the console, the
+previous cookie simply stays. Everything written on that request goes with it: a
+flash message, a selected tenant, a CSRF rotation. What a person sees is a button
+that does nothing.
+
+Under `:cookie` the session keeps the claims and the sign-in time, nothing else.
+`current_token` reads Clowk's cookie instead, which is where an API-only app has
+always read it from. Sessions written before the switch are pruned on their next
+request, so an app does not have to wait for everyone to sign out.
+
+The default stays `:session` so an upgrade changes nothing until you ask.
+
 ### Token verification
 
 Tokens signed with `RS256` are verified against Clowk's public key set, fetched

data/lib/clowk/authenticable.rb

@@ -90,10 +90,17 @@ module Clowk
     def clowk_current_resource
       @clowk_current_resource ||= begin
         payload = stored_user_payload || verified_request_payload
+
+        drop_mirrored_token!
+
         payload ? Current.new(payload) : nil
       end
     end
 
+    # The session first, which holds a copy only under token_store :session —
+    # and, for one request after an app switches to :cookie, in a session
+    # written before the switch. drop_mirrored_token! clears those. Clowk's own
+    # cookie is the source either way.
     def current_token
       stored_session&.dig("token") || extracted_token
     end
@@ -311,11 +318,10 @@ module Clowk
       store = clowk_session_store
       return if store.nil?
 
-      store[Clowk.config.session_key] = {
-        token:,
-        user: payload,
-        signed_in_at: Time.now.to_i
-      }
+      claims = {user: payload, signed_in_at: Time.now.to_i}
+
+      store[Clowk.config.session_key] =
+        (Clowk.config.token_store == :cookie) ? claims : claims.merge(token:)
 
       clowk_cookie_jar&.[]=(Clowk.config.cookie_key, {
         value: token,
@@ -325,6 +331,23 @@ module Clowk
       })
     end
 
+    # A session written under :session still carries the token, and
+    # persist_clowk_session does not run again while that session stands — so
+    # without this, switching an app to :cookie would shrink nothing until every
+    # person signed out and back in. Drops the copy once, on the first request
+    # after the switch.
+    def drop_mirrored_token!
+      return unless Clowk.config.token_store == :cookie
+
+      store = clowk_session_store
+      held = stored_session
+
+      return if store.nil? || held.nil?
+      return unless held.key?("token") || held.key?(:token)
+
+      store[Clowk.config.session_key] = held.except("token", :token)
+    end
+
     def resolve_session_status(force: false)
       @clowk_session_check_unavailable = false
       cached = force ? nil : clowk_read_cached_session_status

data/lib/clowk/configuration.rb

@@ -27,6 +27,7 @@ module Clowk
     attr_accessor :session_status_ttl
     attr_accessor :max_session_age
     attr_accessor :fail_open_on_broker_error
+    attr_accessor :token_store
     attr_writer :session_status_cache
 
     def initialize
@@ -64,6 +65,25 @@ module Clowk
       # cannot be made at all, the session is left standing and checked again on
       # the next request; max_session_age is what bounds that.
       @fail_open_on_broker_error = true
+
+      # Where the token is kept for the next request: :session or :cookie.
+      #
+      # Clowk's own cookie is written either way — it is what `current_token`
+      # reads when the session has none, and the only place an API-only app has
+      # ever had. The setting decides whether a COPY is also mirrored into the
+      # app's Rails session, as every version before 0.9 did.
+      #
+      # That copy is not free. A Rails session lives in ONE cookie with about
+      # 4096 bytes to its name, and in production, where tokens are RS256, the
+      # token is most of what a session weighs. Hand a browser more than it will
+      # hold and it discards the whole cookie in silence: no error server-side,
+      # none in the console, the previous cookie simply stays. Everything written
+      # on that request goes with it — a flash message, a selected tenant — which
+      # reads as a button that does nothing.
+      #
+      # :session stays the default so an upgrade changes nothing until an app
+      # asks for :cookie.
+      @token_store = :session
     end
 
     # Where API-only apps cache session status, since they have no Rails session

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.8.0"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Clowk