global_session 3.2.0 → 3.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c515a5dcc7b904111d8d920ec99e0ccdce58121f
-  data.tar.gz: 5d64ca49728e08bd110fc597ff5321a951983041
+  metadata.gz: fe9830dded408fa5a939935b137d93c43e6b3dde
+  data.tar.gz: 50eacb0893c75b8344aa48c43cea959a33755b1b
 SHA512:
-  metadata.gz: ba37377a8a6489d088ca0f835dc61be4bacba59472249802358a686b6500315f438e846a3e73142923fce67cc7b7646de9948577cb73ff22b5aa3d8dba604142
-  data.tar.gz: a43759e7a9d51b6322c04c41f19821229b35bce347dcf76d1ea3a5f65ccfa60a9cab1112f13a448cd20c390a84cff339cff2a4d9c0c7e940479d0411246bc878
+  metadata.gz: d5d6e4ad5700e5b7a3ff95a23f256305f3ca09f9b7e3c664ad64f9ac6138aed97a627f07d19fd04e98040b6ca6e1cab9717aefb8ce7ed91e790f7f7efaf9ded3
+  data.tar.gz: dcc7dcb1e4ac1e2f197819ebd0e666f0219dc96abe7cfa32f440a453f95d74db63113ee6fecf82edc07ca86645f9fa9b62b28cfea73dc4763806dae030a3ad1c

data/CHANGELOG.md

@@ -0,0 +1,94 @@
+3.2.1 (pending)
+---------------
+
+Fixed a bug with automatic cookie renewal; cookies were not being renewed unless
+the `authority` directive was present in the configuration.
+
+3.2.0 (2015-07-08)
+------------------
+
+If cookie domain is omitted from configuration, the Rack middleware will 
+guess a suitable domain by looking at the HTTP Host header (or `X-Forwarded-Host` 
+if it is present, i.e. the request has passed through a load balancer). The
+heuristic for HTTP-host-to-cookie-domain is:
+
+* Numeric IPv4: `127.0.0.1` -> _no_ domain
+* 1-component: `localhost` -> _no_ domain
+* 2-component: `example.com` -> `example.com` 
+* N-component: `foo.test.example.com` -> `test.example.com`
+
+This doesn't handle country-code TLDs (`.co.uk`) so you'll still need to specify
+the cookie domain for Web sites under a ccTLD.
+
+The Rack middleware will guess whether to add the `secure` flag to cookies
+based on `rack.url_scheme` (or `X-Forwarded-Proto` if it is present).
+
+3.1 (2015-01-27)
+----------------
+
+Split Directory class into Directory & Keystore, retaining some backward-compatibility shims
+inside Directory. In v4, these shims will be removed and all key management concerns will be
+handled by Keystore; the Directory class will be limited to session creation, renewal, and
+validity checking.
+
+The `trust` and `authority` configuration elements have been deprecated, as ha
+the ability to pass a keystore directory to `Directory.new`. Instead, the
+configuration should contain a `keystore` that tells the gem where to find its
+public and private keys; every public key is implicitly trusted, and if some
+private key is found, the app is an authority (otherwise it's not an authority
+and sessions are read-only). Example new configuration:
+
+    keystore:
+      public:
+        - config/authorities
+        - config/other_dir_with_keys_i_should_trust
+      private: /etc/my_private.key
+      
+As with any other Global Session configuration, this stanza can appear under
+`common` or under an enivronment-specific section (`staging`, `production`, etc).
+
+Finally, you can pass a private key location in the environment variable named
+`GLOBAL_SESSION_PRIVATE_KEY` instead of including that information in the
+configuration.
+
+3.0 (2013-10-03)
+----------------
+
+The format of the global session cookie has been reinvented again! It once again uses JSON
+(because msgpack was not widely supported in other languages/OSes) but retains the compact
+array encoding introduced in v2.
+
+The cryptographic signature scheme has been changed for better compatibility; we now use
+PKCS1 v1.5 sign and verify operations instead of "raw" RSA. v2 and v1 sessions are fully
+supported for read/write, but any session created with the v3 gem will use the v3 crypto
+scheme.
+
+2.0 (2012-11-06)
+----------------
+
+The format of the global session cookie has been reinvented; it now uses msgpack and delegates
+all crypto to RightSupport::Crypto::SignedHash. Together with a few other optimizations, the
+size of the cookie has shrunk by about 30%.
+
+The gem remains capable of reading and writing V1 format cookies, but all new cookies are created
+with the V2 format.
+
+The "integrated" feature is no longer supported for the Rails integration layer; global session
+attributes must always be accessed separately from local session attributes, through the
+#global_session reader method that is mixed into ActionController::Base.
+
+1.0 (2011-01-01)
+----------------
+
+General Availability release. Mostly interface-compatible with 0.9.
+
+0.9 (2010-12-07)
+----------------
+
+Rack middleware implementation is feature-complete and has major spec coverage. Rails integration
+is untested and may contain bugs.
+
+0.9.0 (2010-12-22)
+----------------
+
+Initial commit ported from 'rack' branch of old has_global_session project

data/VERSION

@@ -1 +1 @@
-3.2.0
+3.2.1

data/global_session.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: global_session 3.2.0 ruby lib
+# stub: global_session 3.2.1 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "global_session"
-  s.version = "3.2.0"
+  s.version = "3.2.1"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Tony Spataro"]
-  s.date = "2015-07-08"
+  s.date = "2015-07-10"
   s.description = "This Rack middleware allows several web apps in an authentication domain to share session state, facilitating single sign-on in a distributed web app. It only provides session sharing and does not concern itself with authentication or replication of the user database."
   s.email = "support@rightscale.com"
   s.extra_rdoc_files = [
@@ -19,6 +19,7 @@ Gem::Specification.new do |s|
     "README.rdoc"
   ]
   s.files = [
+    ".ruby-version",
     ".travis.yml",
     "CHANGELOG.rdoc",
     "LICENSE",

data/lib/global_session/directory.rb

@@ -168,7 +168,7 @@ module GlobalSession
     # @deprecated will be removed in GlobalSession v4; please use Keystore instead
     # @see GlobalSession::Keystore
     def local_authority_name
-      @keystore.private_key_name || @private_key_name
+      @keystore.private_key_name
     end
     
     # Determine whether this system trusts a particular named authority based on

data/lib/global_session/rack.rb

@@ -37,6 +37,9 @@ module GlobalSession
       # @return [GlobalSession::Directory]
       attr_accessor :directory
 
+      # @return [GlobalSession::Keystore]
+      attr_accessor :keystore
+
       # Make a new global session middleware.
       #
       # The optional block here controls an alternate ticket retrieval
@@ -98,9 +101,6 @@ module GlobalSession
                 "Cannot determine directory class/instance; method parameter is a #{directory.class.name} and configuration parameter is #{klass.class.name}"
         end
 
-        # Initialize the keystore
-        @keystore = Keystore.new(@configuration)
-
         @cookie_retrieval = block
         @cookie_name      = @configuration['cookie']['name']
       end
@@ -202,8 +202,8 @@ module GlobalSession
       # @return [true] always returns true
       # @param [Hash] env Rack request environment
       def renew_cookie(env)
-        return unless @configuration['authority']
-        return if env['global_session.req.renew'] == false
+        return true unless @directory.local_authority_name
+        return true if env['global_session.req.renew'] == false
 
         if (renew = @configuration['renew']) && env['global_session'] &&
           env['global_session'].expired_at < Time.at(Time.now.utc + 60 * renew.to_i)
@@ -218,7 +218,7 @@ module GlobalSession
       # @return [true] always returns true
       # @param [Hash] env Rack request environment
       def update_cookie(env)
-        return true unless @directory.keystore.private_key_name
+        return true unless @directory.local_authority_name
         return true if env['global_session.req.update'] == false
 
         session = env['global_session']
@@ -261,8 +261,8 @@ module GlobalSession
       # @return [true] always returns true
       # @param [Hash] env Rack request environment
       def wipe_cookie(env)
-        return unless @directory.keystore.private_key_name
-        return if env['global_session.req.update'] == false
+        return true unless @directory.local_authority_name
+        return true if env['global_session.req.update'] == false
 
         env['rack.cookies'][@cookie_name] = {:value   => nil,
                                              :domain  => cookie_domain(env),

data/lib/global_session/session/abstract.rb

@@ -44,7 +44,7 @@ module GlobalSession::Session
 
     # @return a Hash representation of the session with three subkeys: :metadata, :signed and :insecure
     # @raise nothing -- does not raise; returns empty hash if there is a failure
-    def to_hash
+    def to_h
       hash = {}
 
       md = {}
@@ -67,6 +67,9 @@ module GlobalSession::Session
       {}
     end
 
+    # @deprecated will be removed in GlobalSession v4; please use to_h instead
+    alias to_hash to_h
+
     # @return [true,false] true if this session was created in-process, false if it was initialized from a cookie
     def new_record?
       @cookie.nil?
@@ -81,6 +84,13 @@ module GlobalSession::Session
       @directory.valid_session?(@id, @expired_at)
     end
 
+    # Determine whether any state has changed since the session was loaded.
+    #
+    # @return [Boolean] true if something has changed
+    def dirty?
+      !!(new_record? || @dirty_timestamps)
+    end
+
     # Determine whether the global session schema allows a given key to be placed
     # in the global session.
     #
@@ -104,7 +114,7 @@ module GlobalSession::Session
       @signed.has_key?(key) || @insecure.has_key?(key)
     end
 
-    alias :key? :has_key?
+    alias key? has_key?
 
     # Invalidate this session by reporting its UUID to the Directory.
     #
@@ -125,6 +135,7 @@ module GlobalSession::Session
       expired_at ||= Time.at(Time.now.utc + 60 * minutes)
       @expired_at = expired_at
       @created_at = Time.now.utc
+      @dirty_timestamps = true
     end
 
     private

data/lib/global_session/session/v1.rb

@@ -57,7 +57,7 @@ module GlobalSession::Session
     # === Return
     # cookie(String):: Base64Cookie-encoded, Zlib-compressed JSON-serialized global session
     def to_s
-      if @cookie && !@dirty_insecure && !@dirty_secure
+      if @cookie && !dirty?
         #use cached cookie if nothing has changed
         return @cookie
       end
@@ -86,6 +86,13 @@ module GlobalSession::Session
       return GlobalSession::Encoding::Base64Cookie.dump(zbin)
     end
 
+    # Determine whether any state has changed since the session was loaded.
+    #
+    # @return [Boolean] true if something has changed
+    def dirty?
+      !!(super || @dirty_secure || @dirty_insecure)
+    end
+
     # Return the keys that are currently present in the global session.
     #
     # === Return

data/lib/global_session/session/v2.rb

@@ -58,7 +58,7 @@ module GlobalSession::Session
     # === Return
     # cookie(String):: Base64Cookie-encoded, Msgpack-serialized global session
     def to_s
-      if @cookie && !@dirty_insecure && !@dirty_secure
+      if @cookie && !dirty?
         #use cached cookie if nothing has changed
         return @cookie
       end
@@ -90,6 +90,13 @@ module GlobalSession::Session
       return GlobalSession::Encoding::Base64Cookie.dump(msgpack)
     end
 
+    # Determine whether any state has changed since the session was loaded.
+    #
+    # @return [Boolean] true if something has changed
+    def dirty?
+      !!(super || @dirty_secure || @dirty_insecure)
+    end
+
     # Return the keys that are currently present in the global session.
     #
     # === Return

data/lib/global_session/session/v3.rb

@@ -115,7 +115,7 @@ module GlobalSession::Session
     # @return [String] a B64cookie-encoded JSON-serialized global session
     # @raise [GlobalSession::UnserializableType] if the attributes hash contains
     def to_s
-      if @cookie && !@dirty_insecure && !@dirty_secure
+      if @cookie && !dirty?
         #use cached cookie if nothing has changed
         return @cookie
       end
@@ -154,6 +154,13 @@ module GlobalSession::Session
       return GlobalSession::Encoding::Base64Cookie.dump(bin)
     end
 
+    # Determine whether any state has changed since the session was loaded.
+    #
+    # @return [Boolean] true if something has changed
+    def dirty?
+      !!(super || @dirty_secure || @dirty_insecure)
+    end
+
     # Return the keys that are currently present in the global session.
     #
     # === Return

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: global_session
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.2.1
 platform: ruby
 authors:
 - Tony Spataro
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-08 00:00:00.000000000 Z
+date: 2015-07-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -141,7 +141,7 @@ extra_rdoc_files:
 files:
 - ".ruby-version"
 - ".travis.yml"
-- CHANGELOG.rdoc
+- CHANGELOG.md
 - LICENSE
 - README.rdoc
 - Rakefile

data/CHANGELOG.rdoc

@@ -1,43 +0,0 @@
-== 3.1 (2015-01-27)
-
-Split Directory class into Directory & Keystore, retaining some backward-compatibility shims
-inside Directory. In v4, these shims will be removed and all key management concerns will be
-handled by Keystore; the Directory class will be limited to session creation, renewal, and
-validity checking.
-
-== 3.0 (2013-10-03)
-
-The format of the global session cookie has been reinvented again! It once again uses JSON
-(because msgpack was not widely supported in other languages/OSes) but retains the compact
-array encoding introduced in v2.
-
-The cryptographic signature scheme has been changed for better compatibility; we now use
-PKCS1 v1.5 sign and verify operations instead of "raw" RSA. v2 and v1 sessions are fully
-supported for read/write, but any session created with the v3 gem will use the v3 crypto
-scheme.
-
-== 2.0 (2012-11-06)
-
-The format of the global session cookie has been reinvented; it now uses msgpack and delegates
-all crypto to RightSupport::Crypto::SignedHash. Together with a few other optimizations, the
-size of the cookie has shrunk by about 30%.
-
-The gem remains capable of reading and writing V1 format cookies, but all new cookies are created
-with the V2 format.
-
-The "integrated" feature is no longer supported for the Rails integration layer; global session
-attributes must always be accessed separately from local session attributes, through the
-#global_session reader method that is mixed into ActionController::Base.
-
-== 1.0 (2011-01-01)
-
-General Availability release. Mostly interface-compatible with 0.9.
-
-== 0.9 (2010-12-07)
-
-Rack middleware implementation is feature-complete and has major spec coverage. Rails integration
-is untested and may contain bugs.
-
-=== 0.9.0 (2010-12-22)
-
-Initial commit ported from 'rack' branch of old has_global_session project