machina-auth 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3aea4a4e50f2d2700c3e84c0a5c66715d7fad74f6da3f32438da1e372dee3531
-  data.tar.gz: d6f1a257b9fe0dcf868fce3cffeac7c625cba2774d86402e6bf666567c466cc5
+  metadata.gz: c8b85487ba807943451cf345d17e7aec7ee18a9b61a233adcdb213f86134cde0
+  data.tar.gz: 49908d36c4fb879354aa6c3b9ae96e33eaed76d98df2cd3dbfb8a51ce72b03a4
 SHA512:
-  metadata.gz: 9d0137c9be1a30603f8cc165d234bf34e99f3325439ddf3aad96ea46ee96a5bedeb67388ede7edf54399391213bb904569f9186c454f5375cf392a3b8f0425f8
-  data.tar.gz: b67d7e820671b4ed7e495853924ad1e8f134030960be3a4c8cfe5bc17a594a662294807b5e058ee3ec45d291b91afc58dec65ca918b29b36251cfff5c0f0e340
+  metadata.gz: 97716d4c519933b65a8410615655adcf7e70a4013d9595e7ef5ca4a96ae2a57c44574640b33de5dc1adcd675b626c2ae39d09ffd0c5cf4fbcbb2932924988be9
+  data.tar.gz: 868b463264e64e8551c938704bcfad481714e0d6a9f4aa8dcc6152eb4d8df1bda0c6a01ff2ab55f89e534ceeb03b1d53abed3792dc2afaa1de660c6726dd2e2c

data/lib/machina/middleware/authentication.rb

@@ -11,11 +11,11 @@ module Machina
 
       def call(env)
         request = ActionDispatch::Request.new(env)
-
+        # Skip paths allow the developer to disable the middleware from validating
+        # any token or headers on any matched URL or Path.
         return @app.call(env) if skip_path?(request)
 
         token = extract_token(request)
-
         return @app.call(env) if token.blank?
 
         session_data = resolve_session(token)
@@ -53,10 +53,7 @@ module Machina
       end
 
       def extract_token(request)
-        request.cookies['machina_session'] ||
-          extract_bearer(request) ||
-          request.headers['X-Api-Key'] ||
-          request.params['token']
+        request.cookies['machina_session'] || extract_bearer(request) || request.headers['X-Api-Key'] || request.params['token']
       end
 
       def extract_bearer(request)
@@ -76,7 +73,11 @@ module Machina
 
       def fetch_from_identity_service(token)
         response = Machina.identity_client.resolve_session(token)
-        return nil unless response.success?
+
+        unless response.success?
+          Machina.cache.delete(cache_key(token))
+          return nil
+        end
 
         data = unwrap_payload(response.parsed)
         Machina.cache.write(cache_key(token), data, expires_in: Machina.config.cache_ttl)
@@ -91,6 +92,7 @@ module Machina
       def cache_workspace_ref(data)
         workspace = data['workspace']
         organization = data['organization']
+
         return unless workspace.is_a?(Hash) && organization.is_a?(Hash)
         return unless defined?(Machina::WorkspaceRef) && Machina::WorkspaceRef.table_exists?
 

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '0.1.3'
+  VERSION = '0.1.4'
 end

data/lib/machina.rb

@@ -32,6 +32,7 @@ module Machina
 
   # Test helpers are opt-in; load with `require "machina/test_helpers"` or autoload
   autoload :TestHelpers, 'machina/test_helpers'
+
   class << self
     def configure
       yield(config)

data/spec/machina/middleware/authentication_spec.rb

@@ -54,6 +54,52 @@ RSpec.describe Machina::Middleware::Authentication do
     expect(JSON.parse(body.first)).to eq('error' => 'unauthorized')
   end
 
+  it 'evicts cached session when Console returns non-200 on stale re-fetch' do
+    token = 'ps_stale_token'
+    cache_key = "machina:session:#{token}"
+    stale_data = MockResponses.session_resolution_minimal['data'].merge(stale: true)
+
+    Machina.cache.write(cache_key, stale_data, expires_in: 5.minutes)
+
+    allow(identity_client).to receive(:resolve_session).with(token).and_return(
+      Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+    )
+
+    env = Rack::MockRequest.env_for('/resource', 'HTTP_AUTHORIZATION' => "Bearer #{token}")
+    status, = middleware.call(env)
+
+    expect(status).to eq(401)
+    expect(Machina.cache.read(cache_key)).to be_nil
+  end
+
+  it 'evicts cached session when Console returns non-200 after cache expires' do
+    token = 'ps_expired_cache'
+    cache_key = "machina:session:#{token}"
+
+    # First request: populate cache via successful resolution
+    allow(identity_client).to receive(:resolve_session).with(token).and_return(
+      Machina::IdentityClient::Response.new(status: 200, body: MockResponses.session_resolution_minimal),
+    )
+
+    env = Rack::MockRequest.env_for('/resource', 'HTTP_AUTHORIZATION' => "Bearer #{token}")
+    status, = middleware.call(env)
+    expect(status).to eq(200)
+
+    # Simulate cache expiry
+    Machina.cache.delete(cache_key)
+
+    # Console now rejects the token
+    allow(identity_client).to receive(:resolve_session).with(token).and_return(
+      Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+    )
+
+    env = Rack::MockRequest.env_for('/resource', 'HTTP_AUTHORIZATION' => "Bearer #{token}")
+    status, = middleware.call(env)
+
+    expect(status).to eq(401)
+    expect(Machina.cache.read(cache_key)).to be_nil
+  end
+
   it 'uses the cache on subsequent requests' do
     response = Machina::IdentityClient::Response.new(
       status: 200,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - ZAR