katalyst-koi 5.6.0 → 5.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: beb8b89b9542bb29583d8908cbc41746eaa2eaac7540ebd0c1ba0f7818e2a524
-  data.tar.gz: 0f80f33a3561c9913540115cff337c5df17ca50789435973ad1b1df11438cbf8
+  metadata.gz: eebb6eb78b256d385d6ac52f7868d61ccf877177c69d18095eee36e69d7ce710
+  data.tar.gz: 450a8d50dd9f5139690f10d394eb3bc7e7228ae5890070620ff8e7535d2c1c72
 SHA512:
-  metadata.gz: dbcc40de9887a60357c6e03280c51e1172bebdbd72f34ef549a57b9ea31566cf7b79353e802a4678bf7d7580dc7a10e9a3095aabc6c44b08983b88027e1d59f4
-  data.tar.gz: 35debfa95facb9a6419d462352a42e08d8dfe6810ff0432b6b41d653ce1decf5373e27e25fc4c0ff17457c9949258228abe022c4b5e89e2ac5c642a8012ba4f5
+  metadata.gz: ee7575375983c5b232c063560741ad608aadbc22705f1158942944c8dcdc16638ad72adc2e193f6a2e6ebead9386e020ead1eb7d5d392a3f4b816857011545fe
+  data.tar.gz: 21994dd6bd359b5064f3f07dd923adfd74cf5e1822a5be93bda786c3dd2f550f7410548dbd939120f8910aaba0435c537d4b6f139add00ca19254e0879268626

data/app/components/koi/header/edit_component.rb

@@ -11,7 +11,7 @@ module Koi
         super()
 
         @resource = resource
-        @title = title
+        @title    = title
 
         @header = HeaderComponent.new(title: self.title)
       end

data/app/components/koi/tables/cells/link_component.rb

@@ -26,8 +26,8 @@ module Koi
           def initialize(cell:, url:, default_url:, **)
             super(**)
 
-            @cell = cell
-            @url = url
+            @cell        = cell
+            @url         = url
             @default_url = default_url
           end
 

data/app/controllers/admin/admin_users_controller.rb

@@ -80,7 +80,7 @@ module Admin
     private
 
     def set_admin_user
-      @admin_user = Admin::User.with_archived.find(params[:id])
+      @admin_user = Admin::User.with_archived.find(params.expect(:id))
     end
 
     def admin_user_params
@@ -95,6 +95,7 @@ module Admin
       attribute :email, :string
       attribute :last_sign_in_at, :date
       attribute :last_sign_out_at, :date
+      attribute :sessions_count, :integer
       attribute :sign_in_count, :integer
       attribute :password_login, :enum, scope: :has_password_login, multiple: false
       attribute :passkey, :boolean, scope: :has_passkey

data/app/controllers/admin/credentials_controller.rb

@@ -55,7 +55,7 @@ module Admin
     end
 
     def set_credential
-      @credential = Credential.find(params[:id])
+      @credential = Credential.find(params.expect(:id))
       @admin_user = @credential.admin
     end
 

data/app/controllers/admin/device_authorizations_controller.rb

@@ -3,7 +3,7 @@
 module Admin
   class DeviceAuthorizationsController < ApplicationController
     EXPIRES_IN = 10.minutes
-    INTERVAL = 5
+    INTERVAL   = 5
 
     rate_limit to: 3, within: 1.minute, only: :create
     skip_before_action :verify_authenticity_token, only: :create
@@ -52,7 +52,7 @@ module Admin
     private
 
     def set_device_authorization
-      @device_authorization = Admin::DeviceAuthorization.find_by!(user_code: params[:user_code])
+      @device_authorization = Admin::DeviceAuthorization.find_by!(user_code: params.expect(:user_code))
     end
   end
 end

data/app/controllers/admin/sessions_controller.rb

@@ -6,8 +6,13 @@ module Admin
     include Koi::Controller::RecordsAuthentication
 
     before_action :redirect_authenticated, only: %i[new], if: :admin_signed_in?
+    before_action :requires_session_authentication!, only: %i[destroy]
     before_action :authenticate_local_admin, only: %i[new], if: -> { Koi.config.authenticate_local_admins }
 
+    rate_limit to: 10, within: 3.minutes, only: :create, with: -> do
+      redirect_to(new_admin_session_path, status: :too_many_requests, alert: t("koi.auth.too_many_requests"))
+    end
+
     attr_reader :admin_user
 
     def new
@@ -29,19 +34,19 @@ module Admin
         create_session_with_password
       elsif session_params[:email].present?
         # conversational flow, ask for password regardless of email
-        admin_user = Admin::User.new(session_params.slice(:email))
+        @admin_user = Admin::User.new(session_params.slice(:email))
 
         render(:password, status: :unprocessable_content, locals: { admin_user: })
       else
         # invalid request, re-render new
-        admin_user = Admin::User.new
+        @admin_user = Admin::User.new
 
         render(:new, status: :unprocessable_content, locals: { admin_user: })
       end
     end
 
     def destroy
-      destroy_admin_session!
+      destroy_admin_sessions!(Koi::Current.admin_user)
 
       redirect_to new_admin_session_path
     end
@@ -50,7 +55,7 @@ module Admin
 
     def create_session_with_password
       # constant time lookup for user with password verification
-      admin_user = Admin::User.authenticate_by(session_params.slice(:email, :password))
+      @admin_user = Admin::User.authenticate_by(session_params.slice(:email, :password))
 
       if admin_user.present? && admin_user.requires_otp?
         session[:pending_admin_user_id] = admin_user.id
@@ -59,7 +64,7 @@ module Admin
       elsif admin_user.present?
         admin_sign_in(admin_user)
       else
-        admin_user = Admin::User.new(session_params.slice(:email, :password))
+        @admin_user = Admin::User.new(session_params.slice(:email, :password))
         admin_user.errors.add(:email, :invalid)
 
         render(:new, status: :unprocessable_content, locals: { admin_user: })
@@ -68,15 +73,15 @@ module Admin
 
     def create_session_with_token
       # assume that the previous step injected the user's ID into the session and remove it regardless of outcome
-      admin_user = Admin::User.find_by(id: session.delete(:pending_admin_user_id))
+      @admin_user = Admin::User.find_by(id: session.delete(:pending_admin_user_id))
 
       if admin_user&.otp&.verify(session_params[:token],
                                  drift_ahead:  15,
                                  drift_behind: 15,
-                                 after:        admin_user.current_sign_in_at)
+                                 after:        admin_user.last_sign_in_at)
         admin_sign_in(admin_user)
       else
-        admin_user = Admin::User.new
+        @admin_user = Admin::User.new
         admin_user.errors.add(:email, :invalid)
 
         render(:new, status: :unprocessable_content, locals: { admin_user: })
@@ -84,10 +89,10 @@ module Admin
     end
 
     def create_session_with_webauthn
-      if (admin_user = webauthn_authenticate!(session_params[:response]))
+      if (@admin_user = webauthn_authenticate!(session_params[:response]))
         admin_sign_in(admin_user)
       else
-        admin_user = Admin::User.new
+        @admin_user = Admin::User.new
         admin_user.errors.add(:email, :invalid)
 
         render(:new, status: :unprocessable_content, locals: { admin_user: })
@@ -101,14 +106,14 @@ module Admin
     def authenticate_local_admin
       return if admin_signed_in? || !Rails.env.development?
 
-      Koi::Current.admin_user = Admin::User.find_by(email: [
+      @admin_user = Admin::User.find_by(email: [
         ENV.fetch("EMAIL", nil),
         "#{ENV.fetch('USER', nil)}@katalyst.com.au",
       ].compact)
 
-      return unless admin_signed_in?
+      return if admin_user.nil?
 
-      create_admin_session!
+      create_admin_session!(admin_user)
 
       flash.delete(:redirect) if (redirect = flash[:redirect])
 
@@ -116,9 +121,7 @@ module Admin
     end
 
     def admin_sign_in(admin_user)
-      Koi::Current.admin_user = admin_user
-
-      create_admin_session!
+      create_admin_session!(admin_user)
 
       redirect_to(url_from(params[:redirect].presence) || admin_dashboard_path, status: :see_other)
     end

data/app/controllers/admin/tokens_controller.rb

@@ -37,7 +37,7 @@ module Admin
     private
 
     def set_admin_user
-      @admin_user = Admin::User.find(params[:admin_user_id])
+      @admin_user = Admin::User.find(params.expect(:admin_user_id))
     end
   end
 end

data/app/controllers/admin/url_rewrites_controller.rb

@@ -53,7 +53,7 @@ module Admin
     private
 
     def set_url_rewrite
-      @url_rewrite = ::UrlRewrite.find(params[:id])
+      @url_rewrite = ::UrlRewrite.find(params.expect(:id))
     end
 
     def url_rewrite_params

data/app/controllers/admin/well_knowns_controller.rb

@@ -53,7 +53,7 @@ module Admin
     private
 
     def set_well_known
-      @well_known = ::WellKnown.find(params[:id])
+      @well_known = ::WellKnown.find(params.expect(:id))
     end
 
     def well_known_params

data/app/controllers/concerns/koi/controller/has_admin_users.rb

@@ -14,10 +14,14 @@ module Koi
       end
 
       def admin_signed_in?
+        resume_admin_session
+
         Koi::Current.admin_user.present?
       end
 
       def current_admin_user
+        resume_admin_session
+
         Koi::Current.admin_user
       end
 
@@ -25,7 +29,17 @@ module Koi
       alias_method :current_admin, :current_admin_user
 
       def requires_session_authentication!
-        head(:forbidden) if session[:admin_user_id].blank?
+        head(:forbidden) unless resume_admin_session
+      end
+
+      # @return [Admin::Session, nil]
+      def resume_admin_session
+        Koi::Current.session ||= find_admin_session_by_cookie
+      end
+
+      # @return [Admin::Session, nil]
+      def find_admin_session_by_cookie
+        Admin::Session.find_by(id: cookies.signed[:admin_session_id]) if cookies.signed[:admin_session_id]
       end
 
       module Test
@@ -37,14 +51,18 @@ module Koi
             before do
               view.singleton_class.module_eval do
                 def admin_signed_in?
-                  Koi::Current.admin_user.present?
+                  resume_admin_session.present?
                 end
 
                 def current_admin_user
-                  Koi::Current.admin_user = (respond_to?(:admin_user) ? admin_user : nil)
+                  resume_admin_session&.admin
                 end
 
                 alias_method :current_admin, :current_admin_user
+
+                def resume_admin_session
+                  Koi::Current.session ||= admin_user.sessions.new if respond_to?(:admin_user)
+                end
               end
             end
           end

data/app/controllers/concerns/koi/controller/records_authentication.rb

@@ -3,45 +3,22 @@
 module Koi
   module Controller
     module RecordsAuthentication
-      def create_admin_session!(admin_user = Koi::Current.admin_user)
-        sign_in_at = Time.current
-
-        update_last_sign_in(admin_user)
-
-        admin_user.current_sign_in_at = sign_in_at
-        admin_user.current_sign_in_ip = request.remote_ip
-        admin_user.sign_in_count += 1
-
-        admin_user.save!
-
-        session[:admin_user_id] = admin_user.id
-        session[:admin_user_signed_in_at] = sign_in_at.iso8601
-      end
-
-      def destroy_admin_session!(admin_user = Koi::Current.admin_user)
-        session[:admin_user_id] = nil
-        session[:admin_user_signed_in_at] = nil
-
-        return unless admin_user
-
-        sign_out_at = Time.current
-
-        update_last_sign_in(admin_user)
-
-        admin_user.last_sign_out_at = sign_out_at
-        admin_user.current_sign_in_at = nil
-        admin_user.current_sign_in_ip = nil
-
-        admin_user.save!
+      def create_admin_session!(admin_user)
+        admin_user.sessions.create!(
+          user_agent: request.user_agent,
+          ip_address: request.remote_ip,
+        ).tap do |session|
+          Koi::Current.session                        = session
+          cookies.signed.permanent[:admin_session_id] = { value: session.id, httponly: true, same_site: :lax }
+        end
       end
 
-      private
-
-      def update_last_sign_in(admin_user)
-        return if admin_user.current_sign_in_at.blank?
+      def destroy_admin_sessions!(admin_user)
+        admin_user.device_authorizations.destroy_all
+        admin_user.sessions.destroy_all
 
-        admin_user.last_sign_in_at = admin_user.current_sign_in_at
-        admin_user.last_sign_in_ip = admin_user.current_sign_in_ip
+        Koi::Current.session = nil
+        cookies.delete(:admin_session_id)
       end
     end
   end

data/app/controllers/concerns/koi/controller.rb

@@ -9,7 +9,7 @@ module Koi
       include HasAttachments
       include Katalyst::Tables::Backend
 
-      if (pagy = "Pagy::Method".safe_constantize)
+      if (pagy    = "Pagy::Method".safe_constantize)
         include pagy
       elsif (pagy = "Pagy::Backend".safe_constantize)
         # @deprecated Pagy <43

data/app/models/admin/device_authorization.rb

@@ -15,15 +15,21 @@ module Admin
 
     self.table_name = :admin_device_authorizations
 
-    belongs_to :admin_user, class_name: "Admin::User", optional: true
-
     enum :status, %w[pending approved denied consumed].index_with(&:to_s)
 
+    generates_token_for(:api_access, expires_in: 12.hours) { admin_user&.last_sign_in_at }
+
     validates :device_code_digest, presence: true, uniqueness: true
     validates :request_expires_at, presence: true
     validates :status, presence: true, inclusion: { in: statuses.values }
     validates :user_code, presence: true, uniqueness: true
 
+    belongs_to :admin_user,
+               class_name:    "Admin::User",
+               counter_cache: true,
+               inverse_of:    :device_authorizations,
+               optional:      true
+
     def self.issue!(requested_ip:, user_agent:)
       device_code = SecureRandom.urlsafe_base64(32)
 
@@ -57,7 +63,7 @@ module Admin
           raise TokenError.new(error)
         end
 
-        access_token = device_authorization.admin_user.generate_token_for(:api_access)
+        access_token = device_authorization.generate_token_for(:api_access)
         device_authorization.consume!(token_expires_in:)
 
         {

data/app/models/admin/session.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Admin
+  class Session < ApplicationRecord
+    self.table_name = :admin_sessions
+
+    belongs_to :admin,
+               class_name:    "Admin::User",
+               counter_cache: true,
+               inverse_of:    :sessions
+
+    after_create_commit :record_sign_in!
+    after_destroy_commit :record_sign_out!
+
+    private
+
+    def record_sign_in!
+      admin.update!(
+        last_sign_in_at: created_at,
+        last_sign_in_ip: ip_address,
+        sign_in_count:   admin.sign_in_count + 1,
+      )
+    end
+
+    def record_sign_out!
+      return if admin.destroyed?
+
+      admin.update!(last_sign_out_at: Time.current)
+    rescue ActiveRecord::RecordNotFound
+      nil
+    end
+  end
+end

data/app/models/admin/user.rb

@@ -11,20 +11,32 @@ module Admin
 
     self.table_name = :admins
 
-    # disable validations for password_digest
-    has_secure_password validations: false
-
-    generates_token_for(:api_access, expires_in: 12.hours) { current_sign_in_at }
-    generates_token_for(:password_reset, expires_in: 30.minutes) { current_sign_in_at }
-
-    has_many :credentials, inverse_of: :admin, class_name: "Admin::Credential", dependent: :destroy
-
     attribute :password_login, :string
     enum :password_login, { none: "none", password_only: "password_only", mfa: "mfa" }, prefix: true
 
+    # disable validations for password_digest – we don't require a password (i.e. passkey only user)
+    has_secure_password validations: false
+
+    normalizes :email, with: ->(e) { e.strip.downcase }
+
     validates :name, :email, presence: true
     validates :email, uniqueness: true, format: { with: URI::MailTo::EMAIL_REGEXP }
 
+    generates_token_for(:password_reset, expires_in: 30.minutes) { last_sign_in_at }
+
+    has_many :credentials,
+             class_name: "Admin::Credential",
+             dependent:  :destroy,
+             inverse_of: :admin
+    has_many :device_authorizations,
+             class_name: "Admin::DeviceAuthorization",
+             dependent:  :destroy,
+             inverse_of: :admin_user
+    has_many :sessions,
+             class_name: "Admin::Session",
+             dependent:  :destroy,
+             inverse_of: :admin
+
     scope :alphabetical, -> { order(name: :asc) }
 
     if "PgSearch::Model".safe_constantize
@@ -69,6 +81,20 @@ module Admin
     end
     alias passkey passkey?
 
+    # Describe the last time the user signed in or out. For self-reflection, excludes the current session.
+    #
+    # @return [ActiveSupport::TimeWithZone, nil] the last time the user was active
+    def last_active_at
+      [last_sign_in_at, last_sign_out_at].compact.max
+    end
+
+    # Describe the last time the user signed in or out, excluding the current session (for self).
+    #
+    # @return [ActiveSupport::TimeWithZone, nil] the last time the user was active
+    def previous_active_at(current_session = Koi::Current.session)
+      [last_sign_out_at, sessions.where.not(id: current_session.id).maximum(:created_at)].compact.max
+    end
+
     def password_login
       if password_digest.blank?
         :none

data/app/models/koi/current.rb

@@ -2,7 +2,15 @@
 
 module Koi
   class Current < ActiveSupport::CurrentAttributes
-    # @return [Admin::User]
-    attribute :admin_user
+    # @return [Admin::DeviceAuthorization, nil]
+    attribute :device_authorization
+
+    # @return [Admin::Session, nil]
+    attribute :session
+
+    # @return [Admin::User, nil]
+    def admin_user
+      device_authorization&.admin_user || session&.admin
+    end
   end
 end

data/app/views/admin/admin_users/index.html.erb

@@ -17,13 +17,14 @@
 
 <%= table_with(collection:) do |row| %>
   <% row.select %>
-  <% row.link :name, url: :admin_admin_user_path %>
-  <% row.text :email %>
-  <% row.enum :password_login, label: "Password" %>
-  <% row.boolean :credentials, label: "Passkey" do |cell| %>
+  <% row.link(:name, url: :admin_admin_user_path) %>
+  <% row.text(:email) %>
+  <% row.enum(:password_login, label: "Password") %>
+  <% row.boolean(:credentials, label: "Passkey") do |cell| %>
     <%= cell.value.any? ? "Yes" : "No" %>
   <% end %>
-  <% row.date :last_sign_in_at, label: "Last active" %>
+  <% row.date(:last_active_at, label: "Last active") %>
+  <% row.text(:sessions_count, label: "Sessions") %>
 <% end %>
 
 <%= table_pagination_with(collection:) %>

data/app/views/admin/admin_users/show.html.erb

@@ -16,13 +16,15 @@
 <% end %>
 
 <%= summary_table_with(model: admin_user) do |row| %>
-  <% row.text :name %>
-  <% row.text :email %>
-  <% row.date :created_at %>
-  <% row.date :last_sign_in_at, label: "Last access" %>
-  <% row.boolean :passkey %>
-  <% row.boolean :otp, label: "MFA" %>
-  <% row.boolean :archived? %>
+  <% row.text(:name) %>
+  <% row.text(:email) %>
+  <% row.date(:created_at) %>
+  <% row.text(:sessions_count, label: "Sessions") %>
+  <% row.date(:last_active_at, label: "Last active") %>
+  <% row.text(:sign_in_count, label: "Total logins") %>
+  <% row.boolean(:passkey) %>
+  <% row.boolean(:otp, label: "MFA") %>
+  <% row.boolean(:archived?) %>
 <% end %>
 
 <% unless admin_user.archived? %>

data/app/views/admin/profiles/show.html.erb

@@ -12,7 +12,8 @@
   <% row.text :name %>
   <% row.text :email %>
   <% row.date :created_at %>
-  <% row.date(:last_sign_in_at, label: "Last access") %>
+  <% row.text(:sessions_count, label: "Sessions") %>
+  <% row.date(:previous_active_at, label: "Last active") %>
   <% row.boolean :passkey %>
   <% row.boolean(:otp, label: "MFA") do |otp| %>
     <span class="repel">

data/config/locales/koi.en.yml

@@ -11,6 +11,7 @@ en:
     auth:
       otp_app_name: "%{host}/admin"
       token_invalid: "Token invalid or consumed already"
+      too_many_requests: "Try again later."
     labels:
       new: New
       search: Search

data/db/migrate/20230531063707_update_admin_users.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+# rubocop:disable Rails/BulkChangeTable
 class UpdateAdminUsers < ActiveRecord::Migration[7.0]
   class Admin < ApplicationRecord; end
 
@@ -38,3 +39,4 @@ class UpdateAdminUsers < ActiveRecord::Migration[7.0]
     remove_column :admins, :name, :string
   end
 end
+# rubocop:enable Rails/BulkChangeTable

data/db/migrate/20260525041029_create_admin_sessions.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class CreateAdminSessions < ActiveRecord::Migration[8.1]
+  def change
+    create_table :admin_sessions do |t|
+      t.references :admin, null: false, foreign_key: true
+      t.string :ip_address
+      t.string :user_agent
+
+      t.timestamps
+    end
+  end
+end

data/db/migrate/20260525111759_clean_up_admin_user_timestamps.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+# rubocop:disable Rails/BulkChangeTable
+class CleanUpAdminUserTimestamps < ActiveRecord::Migration[8.1]
+  def change
+    # remove 'last sign in' tracking columns, database sessions make these redundant
+    remove_column :admins, :last_sign_in_at, :datetime, precision: nil
+    remove_column :admins, :last_sign_in_ip, :string
+
+    # rename 'current sign in' columns to 'last sign in', as all active sessions are invalidated by this release
+    rename_column :admins, :current_sign_in_at, :last_sign_in_at
+    rename_column :admins, :current_sign_in_ip, :last_sign_in_ip
+
+    # add counter caches for admin visibility
+    add_column :admins, :device_authorizations_count, :integer, default: 0, null: false
+    add_column :admins, :sessions_count, :integer, default: 0, null: false
+
+    up_only do
+      change_column :admins, :created_at, :datetime, precision: 6
+      change_column :admins, :updated_at, :datetime, precision: 6
+      change_column :admins, :last_sign_in_at, :datetime, precision: 6
+    end
+  end
+end
+# rubocop:enable Rails/BulkChangeTable

data/lib/generators/koi/admin/admin_generator.rb

@@ -8,7 +8,7 @@ module Koi
 
     hook_for :admin_controller, in: :koi, as: :admin, type: :boolean, default: true do |instance, controller|
       args, opts, config = @_initializer
-      opts               ||= {}
+      opts             ||= {}
 
       # setting model_name so that generators will use the controller_class_path
       instance.invoke controller, args, { model_name: instance.name, **opts }, config

data/lib/generators/koi/admin_controller/admin_controller_generator.rb

@@ -41,7 +41,7 @@ module Koi
     def permitted_params
       attachments, others = attributes_names.partition { |name| attachments?(name) }
       params              = others.map { |name| ":#{name}" }
-      params += attachments.map { |name| "#{name}: []" }
+      params             += attachments.map { |name| "#{name}: []" }
       params.join(", ")
     end
   end

data/lib/generators/koi/admin_route/admin_route_generator.rb

@@ -86,8 +86,10 @@ module Koi
         if (namespace_match = match_file(route_file, namespace_pattern))
           base_indent, *, existing_block_indent = namespace_match.captures.compact.map(&:length)
           existing_line_pattern                 = /^ {,#{existing_block_indent}}\S.+\n?/
-          routing_code = rebase_indentation(routing_code, base_indent + 2).gsub(existing_line_pattern, "")
-          namespace_pattern = /#{Regexp.escape namespace_match.to_s}/
+          routing_code                          = rebase_indentation(routing_code, base_indent + 2).gsub(
+            existing_line_pattern, ""
+          )
+          namespace_pattern                     = /#{Regexp.escape namespace_match.to_s}/
         end
 
         inject_into_file route_file, routing_code, after: namespace_pattern, verbose: true, force: false
@@ -115,7 +117,7 @@ module Koi
         resource_match = match_file(route_file, block_pattern)
 
         *, existing_block_indent, _ = resource_match.captures.compact.map(&:length)
-        routing_code = rebase_indentation(routing_code, existing_block_indent + 2)
+        routing_code                = rebase_indentation(routing_code, existing_block_indent + 2)
 
         inject_into_file route_file, routing_code, after: block_pattern, verbose: true, force: false
       end

data/lib/generators/koi/helpers/attribute_helpers.rb

@@ -28,8 +28,8 @@ module Koi
           super(name, type, **)
 
           @association = association
-          @attachment = attachment
-          @enum = enum
+          @attachment  = attachment
+          @enum        = enum
         end
 
         def association?

data/lib/koi/config.rb

@@ -16,15 +16,15 @@ module Koi
                   :site_name
 
     def initialize
-      @admin_name = "Koi"
-      @authenticate_local_admins = Rails.env.development?
-      @resource_name_candidates = %i[title name]
-      @admin_stylesheet = "admin"
+      @admin_name                   = "Koi"
+      @authenticate_local_admins    = Rails.env.development?
+      @resource_name_candidates     = %i[title name]
+      @admin_stylesheet             = "admin"
       @admin_javascript_entry_point = "@katalyst/koi"
-      @document_mime_types = %w[image/png image/gif image/jpeg image/webp application/pdf audio/*].freeze
-      @document_size_limit = 10.megabytes
-      @image_mime_types = %w[image/png image/gif image/jpeg image/webp].freeze
-      @image_size_limit = 10.megabytes
+      @document_mime_types          = %w[image/png image/gif image/jpeg image/webp application/pdf audio/*].freeze
+      @document_size_limit          = 10.megabytes
+      @image_mime_types             = %w[image/png image/gif image/jpeg image/webp].freeze
+      @image_size_limit             = 10.megabytes
     end
   end
 end

data/lib/koi/form/builder.rb

@@ -41,7 +41,7 @@ module Koi
       # @see GOVUKDesignSystemFormBuilder::Builder#govuk_document_field
       def govuk_document_field(attribute_name, hint: {}, **, &)
         if hint.is_a?(Hash)
-          max_size = hint.fetch(:max_size, Koi.config.document_size_limit)
+          max_size      = hint.fetch(:max_size, Koi.config.document_size_limit)
           hint[:text] ||= t("helpers.hint.default.document", max_size: @template.number_to_human_size(max_size))
         end
 
@@ -52,7 +52,7 @@ module Koi
       # @see GOVUKDesignSystemFormBuilder::Builder#govuk_image_field
       def govuk_image_field(attribute_name, hint: {}, **, &)
         if hint.is_a?(Hash)
-          max_size = hint.fetch(:max_size, Koi.config.image_size_limit)
+          max_size      = hint.fetch(:max_size, Koi.config.image_size_limit)
           hint[:text] ||= t("helpers.hint.default.document", max_size: @template.number_to_human_size(max_size))
         end
 

data/lib/koi/middleware/admin_authentication.rb

@@ -17,74 +17,50 @@ module Koi
 
       def admin_call(env)
         request = ActionDispatch::Request.new(env)
-        session = ActionDispatch::Request::Session.find(request)
+        cookies = request.cookie_jar
 
         # Always retrieve user to ensure we are not vulnerable to timing attacks
-        Koi::Current.admin_user = if bearer_token(request).present?
-                                    bearer_admin_user(request)
-                                  else
-                                    session_admin_user(session)
-                                  end
+        if (token         = bearer_token(request:)).present?
+          Koi::Current.device_authorization = find_device_authentication(token:)
 
-        # Remove from session if not found
-        if session.has_key?(:admin_user_id) && !authenticated?
-          session.delete(:admin_user_id)
-          session.delete(:admin_user_signed_in_at)
+          # disable Rails session for API requests
+          request.session_options[:skip]    = true
+        elsif (session_id = cookies.signed[:admin_session_id]).present?
+          Koi::Current.session = find_admin_session(session_id:)
         end
 
+        # Remove from session if not found
+        cookies.delete(:admin_session_id) unless authenticated?
+
         if requires_authentication?(request) && !authenticated?
           unauthorized_response(request)
         else
           @app.call(env)
         end
       ensure
-        Koi::Current.admin_user = nil
+        Koi::Current.reset
       end
 
       private
 
       def requires_authentication?(request)
-        !request.path.starts_with?("/admin/session") && !device_flow_request?(request)
+        !request.path.starts_with?("/admin/session") && !device_flow_request?(request:)
       end
 
       def authenticated?
         Koi::Current.admin_user.present?
       end
 
-      def bearer_admin_user(request)
-        token = bearer_token(request)
-        return if token.blank?
-
-        request.session_options[:skip] = true
-
-        Admin::User.find_by_token_for(:api_access, token)
-      end
-
-      def session_admin_user(session)
-        admin_user = Admin::User.find_by(id: session[:admin_user_id])
-        return unless admin_user
-
-        signed_in_at = session_signed_in_at(session)
-        return if signed_in_at.blank?
-        return if admin_user.last_sign_out_at.present? && signed_in_at < admin_user.last_sign_out_at
-
-        admin_user
+      def find_device_authentication(token:)
+        Admin::DeviceAuthorization.find_by_token_for(:api_access, token)
       end
 
-      def session_signed_in_at(session)
-        Time.zone.parse(session[:admin_user_signed_in_at].to_s)
-      rescue ArgumentError
-        nil
-      end
-
-      def bearer_token(request)
-        return nil if request.authorization.blank?
-
-        request.authorization.match(/^Bearer (?<token>.+)$/)&.named_captures&.fetch("token", nil)
+      def find_admin_session(session_id:)
+        Admin::Session.find_by(id: session_id)
       end
 
       def unauthorized_response(request)
-        if bearer_token(request).present?
+        if bearer_token(request:).present?
           # If the user provided a token, it was not valid, and the request requires authentication
           [401, {}, []]
         else
@@ -98,9 +74,15 @@ module Koi
         end
       end
 
-      def device_flow_request?(request)
+      def device_flow_request?(request:)
         request.post? && %w[/admin/device_authorizations /admin/device_tokens].include?(request.path)
       end
+
+      def bearer_token(request:)
+        return nil if request.authorization.blank?
+
+        request.authorization.match(/^Bearer (?<token>.+)$/)&.named_captures&.fetch("token", nil)
+      end
     end
   end
 end

data/spec/factories/admin_sessions.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :admin_session, class: "Admin::Session" do
+    admin
+    ip_address { "127.0.0.1" }
+    user_agent { "RSpec" }
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: katalyst-koi
 version: !ruby/object:Gem::Version
-  version: 5.6.0
+  version: 5.7.1
 platform: ruby
 authors:
 - Katalyst Interactive
@@ -396,6 +396,7 @@ files:
 - app/models/admin/collection.rb
 - app/models/admin/credential.rb
 - app/models/admin/device_authorization.rb
+- app/models/admin/session.rb
 - app/models/admin/user.rb
 - app/models/application_record.rb
 - app/models/concerns/koi/model/archivable.rb
@@ -471,6 +472,8 @@ files:
 - db/migrate/20250204060748_create_well_knowns.rb
 - db/migrate/20260413014834_create_admin_device_authorizations.rb
 - db/migrate/20260501000000_add_last_sign_out_at_to_admin_users.rb
+- db/migrate/20260525041029_create_admin_sessions.rb
+- db/migrate/20260525111759_clean_up_admin_user_timestamps.rb
 - db/seeds.rb
 - lib/generators/koi/admin/USAGE
 - lib/generators/koi/admin/admin_generator.rb
@@ -508,6 +511,7 @@ files:
 - lib/koi/middleware/url_redirect.rb
 - lib/koi/release.rb
 - spec/factories/admin_device_authorizations.rb
+- spec/factories/admin_sessions.rb
 - spec/factories/admins.rb
 - spec/factories/url_rewrites.rb
 - spec/factories/well_knowns.rb
@@ -530,7 +534,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Koi CMS admin framework
 test_files: []