clowk 0.9.1 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 28abd896caa982a35fa6efd1f1412ce35c65e16c097ae6bca4106f7947eb235b
-  data.tar.gz: 6f34617088b87ac8c7e7a1b9792e772a62134e78726ee750ec4dc878e87f5cf7
+  metadata.gz: 6bd80a8d0998a7b4779bb719e51a1d31c394cd53a5ea3a46b56cd2206213a949
+  data.tar.gz: 71846822f9bdf17b29357e55266480d5a352f970cd3aa0b256ffc89599277a73
 SHA512:
-  metadata.gz: 9b35e25266da57b3c408ef66b3386d2fd85cc1c5aa6f0aafe9df0cac2b52e365b68dc79219f6f6857845043725e35b3e1c1939a37ee57d38206bc63fca7629d2
-  data.tar.gz: afc0e6ed3b78bcc9f7caed60cbda3131ad3869e141ed999a8588e95525ea52f8f5bea32624c2982e2d76a40206618d707978a8830f235b1a906bdc85271aa93e
+  metadata.gz: d5b8fcb5938dc7cb1034a7dae4a2aec1e9dbd36cdc4ad2972f43ec99a22cf66e76779e3de3ce826a38bfd24b5add840732b5e05ae34c9b198f1fe1f506640503
+  data.tar.gz: d7adc93a749be711889b792d20c0c9f7e0d280768a40104d149be7ad71902c90052d562704018bde2ac119b9529e82da3d5aac80813387a50d56550fa96f8441

data/README.md

@@ -274,30 +274,30 @@ Both ends — the broker said inactive, the ceiling passed — go through
 
 ### Where the token is kept
 
-Clowk writes the token to its own cookie, and — by default, as every version
-before 0.9 did — mirrors a copy into the app's Rails session.
-
-Both are cookies, so the setting names the owner rather than the mechanism:
+Clowk writes the token to its own cookie. The setting decides one thing: whether
+a copy is **also** mirrored into the host app's Rails session.
 
 ```ruby
-config.token_store = :clowk  # Clowk's own cookie, and nowhere else
-config.token_store = :app    # also mirrored into the Rails session (the default)
+config.token_store = nil   # Clowk's own cookie, and nowhere else (the default)
+config.token_store = :app  # also mirrored into the app's Rails session
 ```
 
-The copy is not free. A Rails session lives in **one** cookie with about 4096
-bytes to its name, and in production, where tokens are RS256, the token is most
-of what a session weighs. Hand a browser more than it will hold and it discards
-the whole cookie in silence — no error server-side, none in the console, the
-previous cookie simply stays. Everything written on that request goes with it: a
-flash message, a selected tenant, a CSRF rotation. What a person sees is a button
-that does nothing.
+The copy is not free, which is why `nil` is the default. A Rails session lives in
+**one** cookie with about 4096 bytes to its name, and in production, where tokens
+are RS256, the token is most of what a session weighs. Hand a browser more than
+it will hold and it discards the whole cookie in silence — no error server-side,
+none in the console, the previous cookie simply stays. Everything written on that
+request goes with it: a flash message, a selected tenant, a CSRF rotation. What a
+person sees is a button that does nothing. An app pays that risk on every request
+to keep a copy of a token it already has.
 
-Under `:clowk` the session keeps the claims and the sign-in time, nothing else.
+Under `nil` the session keeps the claims and the sign-in time, nothing else.
 `current_token` reads Clowk's cookie instead, which is where an API-only app has
-always read it from. Sessions written before the switch are pruned on their next
+always read it from. Sessions written before the upgrade are pruned on their next
 request, so an app does not have to wait for everyone to sign out.
 
-The default stays `:app` so an upgrade changes nothing until you ask.
+Ask for `:app` if the app reads the token out of `session[...]` itself rather
+than through `current_token`.
 
 ### Token verification
 

data/lib/clowk/authenticable.rb

@@ -98,8 +98,8 @@ module Clowk
     end
 
     # The session first, which holds a copy only under token_store :app —
-    # and, for one request after an app switches to :clowk, in a session
-    # written before the switch. drop_mirrored_token! clears those. Clowk's own
+    # and, for one request after an app drops that setting, in a session
+    # written before the change. drop_mirrored_token! clears those. Clowk's own
     # cookie is the source either way.
     def current_token
       stored_session&.dig("token") || extracted_token
@@ -321,7 +321,7 @@ module Clowk
       claims = {user: payload, signed_in_at: Time.now.to_i}
 
       store[Clowk.config.session_key] =
-        (Clowk.config.token_store == :clowk) ? claims : claims.merge(token:)
+        (Clowk.config.token_store == :app) ? claims.merge(token:) : claims
 
       clowk_cookie_jar&.[]=(Clowk.config.cookie_key, {
         value: token,
@@ -333,11 +333,11 @@ module Clowk
 
     # A session written under :app still carries the token, and
     # persist_clowk_session does not run again while that session stands — so
-    # without this, switching an app to :clowk would shrink nothing until every
+    # without this, an app that drops :app would shrink nothing until every
     # person signed out and back in. Drops the copy once, on the first request
-    # after the switch.
+    # after the change.
     def drop_mirrored_token!
-      return unless Clowk.config.token_store == :clowk
+      return if Clowk.config.token_store == :app
 
       store = clowk_session_store
       held = stored_session

data/lib/clowk/configuration.rb

@@ -66,29 +66,26 @@ module Clowk
       # the next request; max_session_age is what bounds that.
       @fail_open_on_broker_error = true
 
-      # Whose cookie keeps the token for the next request: :app or :clowk.
-      #
-      # Both are cookies — that is why the setting names the OWNER rather than
-      # the mechanism. :clowk is this gem's own cookie; :app is the Rails
-      # session, which is itself one cookie carrying everything the app puts in
-      # `session[...]`.
+      # Whether the token is ALSO mirrored into the host app's Rails session:
+      # nil for no, :app for yes.
       #
       # Clowk's own cookie is written either way — it is what `current_token`
       # reads when the session has none, and the only place an API-only app has
-      # ever had. The setting decides whether a COPY is also mirrored into the
-      # app's Rails session, as every version before 0.9 did.
+      # ever had. That is why nil is not "nowhere": it is Clowk's cookie alone.
       #
-      # That copy is not free. A Rails session lives in ONE cookie with about
-      # 4096 bytes to its name, and in production, where tokens are RS256, the
-      # token is most of what a session weighs. Hand a browser more than it will
-      # hold and it discards the whole cookie in silence: no error server-side,
-      # none in the console, the previous cookie simply stays. Everything written
-      # on that request goes with it — a flash message, a selected tenant — which
-      # reads as a button that does nothing.
+      # The copy is not free, which is why nil is the default. A Rails session
+      # lives in ONE cookie with about 4096 bytes to its name, and in
+      # production, where tokens are RS256, the token is most of what a session
+      # weighs. Hand a browser more than it will hold and it discards the whole
+      # cookie in silence: no error server-side, none in the console, the
+      # previous cookie simply stays. Everything written on that request goes
+      # with it — a flash message, a selected tenant — which reads as a button
+      # that does nothing. An app pays that risk on every request to keep a copy
+      # of a token it already has.
       #
-      # :session stays the default so an upgrade changes nothing until an app
-      # asks for :cookie.
-      @token_store = :app
+      # :app is there for an app that reads the token out of `session[...]`
+      # itself, rather than through `current_token`.
+      @token_store = nil
     end
 
     # Where API-only apps cache session status, since they have no Rails session

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.9.1"
+  VERSION = "0.10.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.10.0
 platform: ruby
 authors:
 - Clowk