clowk 0.8.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b8925255001baaeae3fb7507651c4fa65ba8ccb24358a593c191f5e3a0070b2a
-  data.tar.gz: f6acd810ff58c1410c67c8b78c4db705966fa8643d39fef2673da25816c006c8
+  metadata.gz: 28abd896caa982a35fa6efd1f1412ce35c65e16c097ae6bca4106f7947eb235b
+  data.tar.gz: 6f34617088b87ac8c7e7a1b9792e772a62134e78726ee750ec4dc878e87f5cf7
 SHA512:
-  metadata.gz: d61ceac58f3444d2cf6cf0af582d595a115c0971048ad7a2e979611cc45a4020bbc1a3689fccf33144ccc3d28bbc7cfbc32cb1bd870de94f43cede1289cd9aea
-  data.tar.gz: 538f167b4d02d928f9cd231fadbbb8e8a7639b2648903e5f46da1414b058b376e5dd9ce926ab47cbb1fbc1aeacbdce748d5ef8bb6d24ea8c6ec00fd90f941685
+  metadata.gz: 9b35e25266da57b3c408ef66b3386d2fd85cc1c5aa6f0aafe9df0cac2b52e365b68dc79219f6f6857845043725e35b3e1c1939a37ee57d38206bc63fca7629d2
+  data.tar.gz: afc0e6ed3b78bcc9f7caed60cbda3131ad3869e141ed999a8588e95525ea52f8f5bea32624c2982e2d76a40206618d707978a8830f235b1a906bdc85271aa93e

data/README.md

@@ -272,6 +272,33 @@ with no round trip at all.
 Both ends — the broker said inactive, the ceiling passed — go through
 `config.on_session_expired` when you set one.
 
+### Where the token is kept
+
+Clowk writes the token to its own cookie, and — by default, as every version
+before 0.9 did — mirrors a copy into the app's Rails session.
+
+Both are cookies, so the setting names the owner rather than the mechanism:
+
+```ruby
+config.token_store = :clowk  # Clowk's own cookie, and nowhere else
+config.token_store = :app    # also mirrored into the Rails session (the default)
+```
+
+The copy is not free. A Rails session lives in **one** cookie with about 4096
+bytes to its name, and in production, where tokens are RS256, the token is most
+of what a session weighs. Hand a browser more than it will hold and it discards
+the whole cookie in silence — no error server-side, none in the console, the
+previous cookie simply stays. Everything written on that request goes with it: a
+flash message, a selected tenant, a CSRF rotation. What a person sees is a button
+that does nothing.
+
+Under `:clowk` the session keeps the claims and the sign-in time, nothing else.
+`current_token` reads Clowk's cookie instead, which is where an API-only app has
+always read it from. Sessions written before the switch are pruned on their next
+request, so an app does not have to wait for everyone to sign out.
+
+The default stays `:app` so an upgrade changes nothing until you ask.
+
 ### Token verification
 
 Tokens signed with `RS256` are verified against Clowk's public key set, fetched

data/lib/clowk/authenticable.rb

@@ -90,10 +90,17 @@ module Clowk
     def clowk_current_resource
       @clowk_current_resource ||= begin
         payload = stored_user_payload || verified_request_payload
+
+        drop_mirrored_token!
+
         payload ? Current.new(payload) : nil
       end
     end
 
+    # The session first, which holds a copy only under token_store :app —
+    # and, for one request after an app switches to :clowk, in a session
+    # written before the switch. drop_mirrored_token! clears those. Clowk's own
+    # cookie is the source either way.
     def current_token
       stored_session&.dig("token") || extracted_token
     end
@@ -311,11 +318,10 @@ module Clowk
       store = clowk_session_store
       return if store.nil?
 
-      store[Clowk.config.session_key] = {
-        token:,
-        user: payload,
-        signed_in_at: Time.now.to_i
-      }
+      claims = {user: payload, signed_in_at: Time.now.to_i}
+
+      store[Clowk.config.session_key] =
+        (Clowk.config.token_store == :clowk) ? claims : claims.merge(token:)
 
       clowk_cookie_jar&.[]=(Clowk.config.cookie_key, {
         value: token,
@@ -325,6 +331,23 @@ module Clowk
       })
     end
 
+    # A session written under :app still carries the token, and
+    # persist_clowk_session does not run again while that session stands — so
+    # without this, switching an app to :clowk would shrink nothing until every
+    # person signed out and back in. Drops the copy once, on the first request
+    # after the switch.
+    def drop_mirrored_token!
+      return unless Clowk.config.token_store == :clowk
+
+      store = clowk_session_store
+      held = stored_session
+
+      return if store.nil? || held.nil?
+      return unless held.key?("token") || held.key?(:token)
+
+      store[Clowk.config.session_key] = held.except("token", :token)
+    end
+
     def resolve_session_status(force: false)
       @clowk_session_check_unavailable = false
       cached = force ? nil : clowk_read_cached_session_status

data/lib/clowk/configuration.rb

@@ -27,6 +27,7 @@ module Clowk
     attr_accessor :session_status_ttl
     attr_accessor :max_session_age
     attr_accessor :fail_open_on_broker_error
+    attr_accessor :token_store
     attr_writer :session_status_cache
 
     def initialize
@@ -64,6 +65,30 @@ module Clowk
       # cannot be made at all, the session is left standing and checked again on
       # the next request; max_session_age is what bounds that.
       @fail_open_on_broker_error = true
+
+      # Whose cookie keeps the token for the next request: :app or :clowk.
+      #
+      # Both are cookies — that is why the setting names the OWNER rather than
+      # the mechanism. :clowk is this gem's own cookie; :app is the Rails
+      # session, which is itself one cookie carrying everything the app puts in
+      # `session[...]`.
+      #
+      # Clowk's own cookie is written either way — it is what `current_token`
+      # reads when the session has none, and the only place an API-only app has
+      # ever had. The setting decides whether a COPY is also mirrored into the
+      # app's Rails session, as every version before 0.9 did.
+      #
+      # That copy is not free. A Rails session lives in ONE cookie with about
+      # 4096 bytes to its name, and in production, where tokens are RS256, the
+      # token is most of what a session weighs. Hand a browser more than it will
+      # hold and it discards the whole cookie in silence: no error server-side,
+      # none in the console, the previous cookie simply stays. Everything written
+      # on that request goes with it — a flash message, a selected tenant — which
+      # reads as a button that does nothing.
+      #
+      # :session stays the default so an upgrade changes nothing until an app
+      # asks for :cookie.
+      @token_store = :app
     end
 
     # Where API-only apps cache session status, since they have no Rails session

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.8.0"
+  VERSION = "0.9.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Clowk