machina-auth 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95a0c331d428907d79a618631f8b39aea1aa20e297090e44229aed0bc93c0324
-  data.tar.gz: 1489dd29fdf00291cb414b57f198d210bd9e1af818d373b4064b7cda6c0f1b66
+  metadata.gz: 60692b69e1db477292fba2a947650c2ac15099a616a05318071860a02a550694
+  data.tar.gz: 3625e766f4645037333365f8771e6363be979de0c484ff086b61ced3b335b84b
 SHA512:
-  metadata.gz: '08a671be6f57a8ef5098444165e335e33cfb85e371f7d34d7842699854bab66050f1de191dc203839dc7c4b94dc72a556803699bc08333e453a5552fd0b94007'
-  data.tar.gz: 236485e85bfc0ef18afc0ddde3251b411f8579ff90b1fa870958b403e2175fbfbfce751d9c629d787c9848f709473e7f7f3779843ab6232b100aee27f1acfb83
+  metadata.gz: 10cb1b5e52daf7e76f344bfb8445e2ecca186d5cda9b1693dd376cd7ad4e503306229eabe510879ab72cd10c0a275b5c51ba2d84275758539b5fe1d8ca12b482
+  data.tar.gz: a168a7dd638f5663394dda922ba91582bfef041922325c635deff9d2ce79b7828916f21553ab5357d12a8b88276e6f8c560584898c212a9daaea0a4b560a7b98

data/lib/machina/configuration.rb

@@ -10,12 +10,14 @@ module Machina
                   :product_slug,
                   :cache_store,
                   :cache_ttl,
+                  :negative_cache_ttl,
                   :manifest,
                   :skip_paths,
                   :identity_callback_uri
 
     def initialize
       @cache_ttl = 5.minutes
+      @negative_cache_ttl = 30.seconds
       @skip_paths = []
     end
   end

data/lib/machina/middleware/authentication.rb

@@ -8,7 +8,11 @@ module Machina
     # resolves them against the identity service, and sets Current.authorized.
     class Authentication
       TRANSIENT_FAILURE = :transient_failure
-      private_constant :TRANSIENT_FAILURE
+
+      # Negative-cache marker for a rejected token. A Hash, so it round-trips through any cache coder.
+      INVALID_SESSION = { '__machina_invalid__' => true }.freeze
+
+      private_constant :TRANSIENT_FAILURE, :INVALID_SESSION
 
       def initialize(app)
         @app = app
@@ -39,7 +43,7 @@ module Machina
         if transient_failure?(session_data)
           @app.call(env)
         else
-          handle_expired_token(env, request, token, hints)
+          handle_expired_token(env, request, token)
         end
       end
 
@@ -62,10 +66,9 @@ module Machina
         end
       end
 
-      # Clears the cache and cookie for a token that Console explicitly rejected.
-      def handle_expired_token(env, request, token, hints)
-        Machina.cache.delete(cache_key(token, hints))
-
+      # Clears the cookie for a rejected token. The cache holds the INVALID_SESSION
+      # sentinel (written in fetch_from_identity_service) and must not be cleared here.
+      def handle_expired_token(env, request, token)
         status, headers, body = @app.call(env)
         Rack::Utils.delete_cookie_header!(headers, 'machina_session') if request.cookies['machina_session'] == token
         [status, headers, body]
@@ -92,6 +95,7 @@ module Machina
 
       def resolve_session(token, hints)
         cached = Machina.cache.read(cache_key(token, hints))
+        return nil if cached == INVALID_SESSION
         return cached if cached.present? && !(cached.is_a?(Hash) && cached['stale'])
 
         fetch_from_identity_service(token, hints)
@@ -109,7 +113,7 @@ module Machina
         response = Machina.identity_client.resolve_session(token, **hints.to_resolve_kwargs)
 
         unless response.success?
-          Machina.cache.delete(cache_key(token, hints))
+          Machina.cache.write(cache_key(token, hints), INVALID_SESSION, expires_in: Machina.config.negative_cache_ttl)
           return nil
         end
 

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '0.3.0'
+  VERSION = '0.4.0'
 end

data/spec/machina/middleware/authentication_spec.rb

@@ -154,7 +154,7 @@ RSpec.describe Machina::Middleware::Authentication do
     expect(JSON.parse(body.first)).to eq('user_id' => nil, 'permissions' => nil)
   end
 
-  it 'evicts cached session and passes through when Console returns non-200 on stale re-fetch' do
+  it 'negative-caches the rejection and passes through when Console returns non-200 on stale re-fetch' do
     token = 'ps_stale_token'
     cache_key = "machina:session:#{token}"
     stale_data = MockResponses.session_resolution_minimal['data'].merge('stale' => true)
@@ -169,10 +169,11 @@ RSpec.describe Machina::Middleware::Authentication do
     status, = middleware.call(env)
 
     expect(status).to eq(200)
-    expect(Machina.cache.read(cache_key)).to be_nil
+    # The stale session is replaced by the short-lived negative sentinel, not deleted.
+    expect(Machina.cache.read(cache_key)).to eq('__machina_invalid__' => true)
   end
 
-  it 'evicts cached session when Console returns non-200 after cache expires' do
+  it 'negative-caches the rejection when Console returns non-200 after cache expires' do
     token = 'ps_expired_cache'
     cache_key = "machina:session:#{token}"
 
@@ -197,7 +198,24 @@ RSpec.describe Machina::Middleware::Authentication do
     status, = middleware.call(env)
 
     expect(status).to eq(200)
-    expect(Machina.cache.read(cache_key)).to be_nil
+    expect(Machina.cache.read(cache_key)).to eq('__machina_invalid__' => true)
+  end
+
+  it 'does not re-hit Console for a rejected token while the negative cache is warm' do
+    token = 'ps_dead_token'
+
+    allow(identity_client).to receive(:resolve_session).with(token).and_return(
+      Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+    )
+
+    3.times do
+      env = Rack::MockRequest.env_for('/resource', 'HTTP_AUTHORIZATION' => "Bearer #{token}")
+      status, = middleware.call(env)
+      expect(status).to eq(200)
+    end
+
+    # Without negative caching this would be 3 calls; the sentinel absorbs the retries.
+    expect(identity_client).to have_received(:resolve_session).with(token).once
   end
 
   context 'when a stale cookie coexists with a fresh callback token' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - ZAR