clowk 0.9.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1fa17ef38ffc2cce253e598ab2c2478ba05f5f7c638601ec833bafa00377ebc
-  data.tar.gz: 396b0e5c36dcaa01a10397f6227af24dcdf5274a06145222da54855aba71a076
+  metadata.gz: 28abd896caa982a35fa6efd1f1412ce35c65e16c097ae6bca4106f7947eb235b
+  data.tar.gz: 6f34617088b87ac8c7e7a1b9792e772a62134e78726ee750ec4dc878e87f5cf7
 SHA512:
-  metadata.gz: 1fd3f7de008dd50644494e85e0771113ae98be1efdc1abcae7d97888b6af84f7aa2f5fd086aa711d3be4b2984b0a626c9bdddc5d66c6c8bc41955b21325c3717
-  data.tar.gz: 36067b774a1d57d833909bcee4316d29a25ee5a907b03063f8ee52545adbf36b09a9857b4b374065a60956f2a5a386044138592b9643e0cf5a7b2f48dec50da8
+  metadata.gz: 9b35e25266da57b3c408ef66b3386d2fd85cc1c5aa6f0aafe9df0cac2b52e365b68dc79219f6f6857845043725e35b3e1c1939a37ee57d38206bc63fca7629d2
+  data.tar.gz: afc0e6ed3b78bcc9f7caed60cbda3131ad3869e141ed999a8588e95525ea52f8f5bea32624c2982e2d76a40206618d707978a8830f235b1a906bdc85271aa93e

data/README.md

@@ -277,9 +277,11 @@ Both ends — the broker said inactive, the ceiling passed — go through
 Clowk writes the token to its own cookie, and — by default, as every version
 before 0.9 did — mirrors a copy into the app's Rails session.
 
+Both are cookies, so the setting names the owner rather than the mechanism:
+
 ```ruby
-config.token_store = :cookie   # Clowk's cookie only
-config.token_store = :session  # also mirrored into the session (the default)
+config.token_store = :clowk  # Clowk's own cookie, and nowhere else
+config.token_store = :app    # also mirrored into the Rails session (the default)
 ```
 
 The copy is not free. A Rails session lives in **one** cookie with about 4096
@@ -290,12 +292,12 @@ previous cookie simply stays. Everything written on that request goes with it: a
 flash message, a selected tenant, a CSRF rotation. What a person sees is a button
 that does nothing.
 
-Under `:cookie` the session keeps the claims and the sign-in time, nothing else.
+Under `:clowk` the session keeps the claims and the sign-in time, nothing else.
 `current_token` reads Clowk's cookie instead, which is where an API-only app has
 always read it from. Sessions written before the switch are pruned on their next
 request, so an app does not have to wait for everyone to sign out.
 
-The default stays `:session` so an upgrade changes nothing until you ask.
+The default stays `:app` so an upgrade changes nothing until you ask.
 
 ### Token verification
 

data/lib/clowk/authenticable.rb

@@ -97,8 +97,8 @@ module Clowk
       end
     end
 
-    # The session first, which holds a copy only under token_store :session —
-    # and, for one request after an app switches to :cookie, in a session
+    # The session first, which holds a copy only under token_store :app —
+    # and, for one request after an app switches to :clowk, in a session
     # written before the switch. drop_mirrored_token! clears those. Clowk's own
     # cookie is the source either way.
     def current_token
@@ -321,7 +321,7 @@ module Clowk
       claims = {user: payload, signed_in_at: Time.now.to_i}
 
       store[Clowk.config.session_key] =
-        (Clowk.config.token_store == :cookie) ? claims : claims.merge(token:)
+        (Clowk.config.token_store == :clowk) ? claims : claims.merge(token:)
 
       clowk_cookie_jar&.[]=(Clowk.config.cookie_key, {
         value: token,
@@ -331,13 +331,13 @@ module Clowk
       })
     end
 
-    # A session written under :session still carries the token, and
+    # A session written under :app still carries the token, and
     # persist_clowk_session does not run again while that session stands — so
-    # without this, switching an app to :cookie would shrink nothing until every
+    # without this, switching an app to :clowk would shrink nothing until every
     # person signed out and back in. Drops the copy once, on the first request
     # after the switch.
     def drop_mirrored_token!
-      return unless Clowk.config.token_store == :cookie
+      return unless Clowk.config.token_store == :clowk
 
       store = clowk_session_store
       held = stored_session

data/lib/clowk/configuration.rb

@@ -66,7 +66,12 @@ module Clowk
       # the next request; max_session_age is what bounds that.
       @fail_open_on_broker_error = true
 
-      # Where the token is kept for the next request: :session or :cookie.
+      # Whose cookie keeps the token for the next request: :app or :clowk.
+      #
+      # Both are cookies — that is why the setting names the OWNER rather than
+      # the mechanism. :clowk is this gem's own cookie; :app is the Rails
+      # session, which is itself one cookie carrying everything the app puts in
+      # `session[...]`.
       #
       # Clowk's own cookie is written either way — it is what `current_token`
       # reads when the session has none, and the only place an API-only app has
@@ -83,7 +88,7 @@ module Clowk
       #
       # :session stays the default so an upgrade changes nothing until an app
       # asks for :cookie.
-      @token_store = :session
+      @token_store = :app
     end
 
     # Where API-only apps cache session status, since they have no Rails session

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.9.0"
+  VERSION = "0.9.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Clowk