clowk 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b01072bf359496a3554b9f8d71aa01574ac36e0a3af9d3f8f1b3f70f403d9518
-  data.tar.gz: f50d5b860acb97711bebaed47f0ba5ab7a3cd9e22e154db84cf2d89a94e207ad
+  metadata.gz: 5027a092ba122ab807f5c0340bc30399f7ab85f9ef41bc99c5610b68df6f47f7
+  data.tar.gz: 1f0dd44bf7696a1e3cffed45cb4c48edc92db3025007db39c6ea721f119619a8
 SHA512:
-  metadata.gz: 286be44c6c4062b813f88d52c2d47c4a60210a847485a00ebad88e3c73fd4e08092704173446ba3ada396f07d46583d1d3ed5062909dae559f032cd119365d79
-  data.tar.gz: c8cff8c774890c14b70a8e90b16828bbf36184d00979cead290381c314f3e52d10e4d5357ff4841aa635caaf17ae843901b6bb8f449cd4947e22b746e79d8f87
+  metadata.gz: 20a10b0715b1695694c51b915490ad852ba43004e9f1ec1b0fbc7af1d192737250234d4342ea1cac3db7ef6a94dc992b17795ee5ab2f0e0fcc6b23e7237a7c27
+  data.tar.gz: 124f14e7d6e53e7c904faa98befc85d18e7f1644f02d654a01c037555d589f4085069945435c7c81aaad36db4158b019b8f61faaeb359ac61839b09edf65d7a0

data/lib/clowk/authenticable.rb

@@ -116,11 +116,18 @@ module Clowk
 
     private
 
-    # An API-only app has no session middleware, so there is nowhere to redirect
-    # a browser to and no way to come back. Redirecting there would answer a
-    # failed API call with a 302 to a sign-in page the caller cannot use.
+    # ActionController::API is the reliable signal, and it has to be checked
+    # directly. Probing `session` does not work: with no session middleware
+    # loaded, `request.session` still returns a Session object that responds to
+    # `[]` and reads as nil — writes vanish, but nothing raises. Inferring
+    # "there is a session, so this is a browser" from that answered every API
+    # call with a 302 to a sign-in page the caller cannot follow.
+    def clowk_api_only?
+      defined?(ActionController::API) && is_a?(ActionController::API)
+    end
+
     def clowk_api_request?
-      clowk_session_store.nil? || request.format.json?
+      clowk_api_only? || clowk_session_store.nil? || request.format.json?
     end
 
     def clowk_handle_unauthenticated
@@ -139,18 +146,24 @@ module Clowk
       end
     end
 
-    # Probed rather than assumed: accessing `session` without the middleware
-    # raises, and `respond_to?` is true either way because the method is
-    # delegated to the request.
+    # nil in API-only controllers. Not because `session` raises there — it does
+    # not, see clowk_api_only? — but because whatever it hands back writes to
+    # nowhere, and callers branch on this to decide whether persisting is worth
+    # doing at all.
     def clowk_session_store
       return @clowk_session_store if defined?(@clowk_session_store)
 
-      @clowk_session_store = begin
-        store = session
-        store.respond_to?(:[]) ? store : nil
-      rescue
-        nil
-      end
+      @clowk_session_store =
+        if clowk_api_only?
+          nil
+        else
+          begin
+            store = session
+            store.respond_to?(:[]) ? store : nil
+          rescue
+            nil
+          end
+        end
     end
 
     def clowk_cookie_jar

data/lib/clowk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Clowk
-  VERSION = "0.5.0"
+  VERSION = "0.5.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clowk
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Clowk