machina-auth 0.1.5 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca27cf7dd475d64e5bbf876084d6e7445a56ac65dbf9967d5b9b50a91f04f155
-  data.tar.gz: ad165e21c3628da603b016a7e40911f7efc3e60131cbad506ee1c5cb2dde48c8
+  metadata.gz: 376d280c6510f8afa38049e22a0c73df81355c57571b83ef571d547e340ee7c3
+  data.tar.gz: 13ce052358975310f67e3b3a65daee423fb48ddc9e2490632b548c66aa0f32d9
 SHA512:
-  metadata.gz: 3830bfe8f9b10c30bfedf347d3efa00ecc36feb09a028ed9372512c7c0a3f6817bee27a321c008394c6361b68c85e2aeb5ad0d71b41a72fd779ea8340d7e7fe6
-  data.tar.gz: f6c04f4aea2b6ad6f01c5632c3e49e92291a8341bb01c751f11eb22d6612aaad8e7f9b4c1124d77d9138c34094de00f41195cbabd60d6957293613111fa60bef
+  metadata.gz: 271245b4d9c4e3a28d4feafe688d9c3e1985d28566f5f86037ab68ef76fa246f266c67b5dad94ad0d23b111844f9c9e9224e656f97bdeaf9ef76efaf4f18311b
+  data.tar.gz: f719e7340acaab6a85ea6b96408c639e0608c797dcbd64f57fa9f5fa76921c5a6ccaac3d0c2751932d77de0ca1019fd4f127479f9b461686b6b0b36c99206c95

data/lib/machina/middleware/authentication.rb

@@ -23,10 +23,7 @@ module Machina
         # Token present but invalid/expired: clear the stale cache entry and
         # fall through with nil authorized. API callers get 401 from the
         # controller; browser users get redirected to login by authenticate!.
-        unless session_data
-          Machina.cache.delete(cache_key(token))
-          return @app.call(env)
-        end
+        return handle_expired_token(env, request, token) unless session_data
 
         Machina::Current.authorized = Machina::Authorized.new(session_data)
 
@@ -56,11 +53,23 @@ module Machina
         end
       end
 
+      # Clears the cache entry for the expired token and, when the token
+      # originated from the session cookie, deletes that cookie so the
+      # browser stops sending it on subsequent requests. This prevents a
+      # redirect loop where an expired cookie shadows fresh callback tokens.
+      def handle_expired_token(env, request, token)
+        Machina.cache.delete(cache_key(token))
+
+        status, headers, body = @app.call(env)
+        Rack::Utils.delete_cookie_header!(headers, 'machina_session') if request.cookies['machina_session'] == token
+        [status, headers, body]
+      end
+
       def extract_token(request)
-        request.cookies['machina_session']
+        request.params['token']
+          || request.cookies['machina_session']
           || extract_bearer(request)
           || request.headers['X-Api-Key']
-          || request.params['token']
       end
 
       def extract_bearer(request)
@@ -117,7 +126,6 @@ module Machina
       def cache_key(token)
         "machina:session:#{token}"
       end
-
     end
   end
 end

data/lib/machina/permission_sync.rb

@@ -14,13 +14,12 @@ module Machina
     def call!
       manifest = load_manifest
 
-      product_id = manifest[:product_id] || Machina.config.product_id
-      if product_id.blank?
-        raise Machina::ConfigurationError, 'product_id is required for permission sync (set in machina.yml or Machina.config)'
+      if Machina.config.product_id.blank?
+        raise Machina::ConfigurationError, 'product_id is required for permission sync (set Machina.config.product_id)'
       end
 
       Machina.identity_client.sync_permissions(
-        product_id:,
+        product_id: Machina.config.product_id,
         policies: manifest.fetch(:policies, []),
         permissions: manifest.fetch(:permissions),
       )

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '0.1.5'
+  VERSION = '0.1.7'
 end

data/lib/machina.rb

@@ -101,7 +101,8 @@ module Machina
       callback = config.identity_callback_uri
 
       if callback.blank?
-        raise ConfigurationError, 'identity_callback_uri must be configured to use authorize_url without an explicit redirect_to'
+        raise ConfigurationError,
+              'identity_callback_uri must be configured to use authorize_url without an explicit redirect_to'
       end
 
       return_to.present? ? "#{callback}?return_to=#{CGI.escape(return_to)}" : callback

data/spec/machina/current_spec.rb

@@ -19,10 +19,10 @@ RSpec.describe Machina::Current do
       # but each CurrentAttributes subclass has its own thread-local storage.
       described_class.authorized = authorized
 
-      expect(::Current.authorized).to be_nil
+      expect(Current.authorized).to be_nil
       expect(described_class.authorized).to eq(authorized)
     ensure
-      ::Current.reset
+      Current.reset
     end
 
     it 'returns nil when nothing is set' do

data/spec/machina/middleware/authentication_spec.rb

@@ -100,6 +100,66 @@ RSpec.describe Machina::Middleware::Authentication do
     expect(Machina.cache.read(cache_key)).to be_nil
   end
 
+  context 'when a stale cookie coexists with a fresh callback token' do
+    let(:stale_token) { 'ps_expired_cookie' }
+    let(:fresh_token) { 'ps_fresh_callback' }
+
+    before do
+      allow(identity_client).to receive(:resolve_session).with(stale_token).and_return(
+        Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+      )
+
+      allow(identity_client).to receive(:resolve_session).with(fresh_token).and_return(
+        Machina::IdentityClient::Response.new(status: 200, body: MockResponses.session_resolution),
+      )
+    end
+
+    it 'prefers the query param token over the stale cookie' do
+      env = Rack::MockRequest.env_for(
+        '/auth/machina/callback?token=ps_fresh_callback',
+        'HTTP_COOKIE' => 'machina_session=ps_expired_cookie',
+      )
+
+      status, _headers, body = middleware.call(env)
+
+      expect(status).to eq(200)
+      parsed = JSON.parse(body.first)
+      expect(parsed['user_id']).to eq(MockResponses.session_resolution['data']['user']['id'])
+      expect(identity_client).not_to have_received(:resolve_session).with(stale_token)
+    end
+  end
+
+  it 'deletes the session cookie when a cookie-sourced token is expired' do
+    allow(identity_client).to receive(:resolve_session).with('ps_expired_cookie').and_return(
+      Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+    )
+
+    env = Rack::MockRequest.env_for(
+      '/resource',
+      'HTTP_COOKIE' => 'machina_session=ps_expired_cookie',
+    )
+
+    _status, headers, _body = middleware.call(env)
+
+    expect(headers['set-cookie']).to include('machina_session=')
+    expect(headers['set-cookie']).to include('max-age=0')
+  end
+
+  it 'does not delete the cookie when a bearer token fails resolution' do
+    allow(identity_client).to receive(:resolve_session).with('ps_expired_bearer').and_return(
+      Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+    )
+
+    env = Rack::MockRequest.env_for(
+      '/resource',
+      'HTTP_AUTHORIZATION' => 'Bearer ps_expired_bearer',
+    )
+
+    _status, headers, _body = middleware.call(env)
+
+    expect(headers['set-cookie']).to be_nil
+  end
+
   it 'uses the cache on subsequent requests' do
     response = Machina::IdentityClient::Response.new(
       status: 200,

data/spec/machina/permission_sync_spec.rb

@@ -4,9 +4,10 @@ require_relative '../rails_helper'
 
 RSpec.describe Machina::PermissionSync do
   let(:client) { instance_double(Machina::IdentityClient) }
+  let(:config_product_id) { 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' }
 
   before do
-    Machina.config.product_id = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890'
+    Machina.config.product_id = config_product_id
     allow(Machina).to receive(:identity_client).and_return(client)
     allow(client).to receive(:sync_permissions)
   end
@@ -15,7 +16,7 @@ RSpec.describe Machina::PermissionSync do
     described_class.call!
 
     expect(client).to have_received(:sync_permissions).with(
-      product_id: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890',
+      product_id: config_product_id,
       permissions: [{ key: 'sessions.view', description: 'View sessions' }],
       policies: [{ name: 'Viewer', api_name: 'viewer', permissions: ['sessions.view'] }],
     )
@@ -31,8 +32,6 @@ RSpec.describe Machina::PermissionSync do
     let(:tmpfile) do
       file = Tempfile.new(['machina', '.yml'])
       file.write(<<~YAML)
-        product_id: flat-product-id
-
         permissions:
           - key: items.view
             description: View items
@@ -54,7 +53,7 @@ RSpec.describe Machina::PermissionSync do
       described_class.call!
 
       expect(client).to have_received(:sync_permissions).with(
-        product_id: 'flat-product-id',
+        product_id: config_product_id,
         permissions: [{ key: 'items.view', description: 'View items' }],
         policies: [{ name: 'Reader', api_name: 'reader', permissions: ['items.view'] }],
       )
@@ -66,14 +65,12 @@ RSpec.describe Machina::PermissionSync do
       file = Tempfile.new(['machina', '.yml'])
       file.write(<<~YAML)
         test:
-          product_id: test-product-id
           permissions:
             - key: reports.view
               description: View reports
           policies: []
 
         production:
-          product_id: prod-product-id
           permissions:
             - key: reports.view
               description: View reports
@@ -85,18 +82,14 @@ RSpec.describe Machina::PermissionSync do
       file
     end
 
-    before do
-      Machina.config.manifest = tmpfile.path
-      Machina.config.product_id = nil
-    end
-
+    before { Machina.config.manifest = tmpfile.path }
     after { tmpfile.unlink }
 
     it 'loads the manifest scoped to the current Rails environment' do
       described_class.call!
 
       expect(client).to have_received(:sync_permissions).with(
-        product_id: 'test-product-id',
+        product_id: config_product_id,
         permissions: [{ key: 'reports.view', description: 'View reports' }],
         policies: [],
       )
@@ -107,8 +100,6 @@ RSpec.describe Machina::PermissionSync do
     let(:tmpfile) do
       file = Tempfile.new(['machina', '.yml'])
       file.write(<<~YAML)
-        product_id: <%= "erb-product-id" %>
-
         permissions:
           - key: tasks.view
             description: View tasks
@@ -119,51 +110,20 @@ RSpec.describe Machina::PermissionSync do
       file
     end
 
-    before do
-      Machina.config.manifest = tmpfile.path
-      Machina.config.product_id = nil
-    end
-
+    before { Machina.config.manifest = tmpfile.path }
     after { tmpfile.unlink }
 
     it 'evaluates ERB before parsing YAML' do
       described_class.call!
 
       expect(client).to have_received(:sync_permissions).with(
-        product_id: 'erb-product-id',
+        product_id: config_product_id,
         permissions: [{ key: 'tasks.view', description: 'View tasks' }],
         policies: [],
       )
     end
   end
 
-  context 'when manifest product_id is absent but config product_id is set' do
-    let(:tmpfile) do
-      file = Tempfile.new(['machina', '.yml'])
-      file.write(<<~YAML)
-        permissions:
-          - key: items.view
-            description: View items
-        policies: []
-      YAML
-      file.close
-      file
-    end
-
-    before { Machina.config.manifest = tmpfile.path }
-    after { tmpfile.unlink }
-
-    it 'falls back to Machina.config.product_id' do
-      described_class.call!
-
-      expect(client).to have_received(:sync_permissions).with(
-        product_id: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890',
-        permissions: [{ key: 'items.view', description: 'View items' }],
-        policies: [],
-      )
-    end
-  end
-
   context 'when policies key is omitted from manifest' do
     let(:tmpfile) do
       file = Tempfile.new(['machina', '.yml'])
@@ -183,7 +143,7 @@ RSpec.describe Machina::PermissionSync do
       described_class.call!
 
       expect(client).to have_received(:sync_permissions).with(
-        product_id: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890',
+        product_id: config_product_id,
         permissions: [{ key: 'items.view', description: 'View items' }],
         policies: [],
       )

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.7
 platform: ruby
 authors:
 - ZAR