machina-auth 0.1.6 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 779a01d0ee76aefd789279497b06a5eb82bafc444d783d6f279cf75e31e37b57
-  data.tar.gz: 3533cf0c697aa3698225c9527df313f7d09643cd04e641af597d0b0d874ab518
+  metadata.gz: 376d280c6510f8afa38049e22a0c73df81355c57571b83ef571d547e340ee7c3
+  data.tar.gz: 13ce052358975310f67e3b3a65daee423fb48ddc9e2490632b548c66aa0f32d9
 SHA512:
-  metadata.gz: 4d896e66034311c92ef6b5b99f1ffd6d0adfa8033f78922305d354c5009500e516ebbd49b766f615758cbaee4003246017a2fed1209cdbbb2539b3e614e78d5f
-  data.tar.gz: e7276fa8589250b587754784882592380d20bf30e05b0dcf71b352b7d5664375decc54907c18821d8369e4aa83ae5f6c00d208ff0efe8f1ecd0f8e86873a3c00
+  metadata.gz: 271245b4d9c4e3a28d4feafe688d9c3e1985d28566f5f86037ab68ef76fa246f266c67b5dad94ad0d23b111844f9c9e9224e656f97bdeaf9ef76efaf4f18311b
+  data.tar.gz: f719e7340acaab6a85ea6b96408c639e0608c797dcbd64f57fa9f5fa76921c5a6ccaac3d0c2751932d77de0ca1019fd4f127479f9b461686b6b0b36c99206c95

data/lib/machina/middleware/authentication.rb

@@ -23,10 +23,7 @@ module Machina
         # Token present but invalid/expired: clear the stale cache entry and
         # fall through with nil authorized. API callers get 401 from the
         # controller; browser users get redirected to login by authenticate!.
-        unless session_data
-          Machina.cache.delete(cache_key(token))
-          return @app.call(env)
-        end
+        return handle_expired_token(env, request, token) unless session_data
 
         Machina::Current.authorized = Machina::Authorized.new(session_data)
 
@@ -56,11 +53,23 @@ module Machina
         end
       end
 
+      # Clears the cache entry for the expired token and, when the token
+      # originated from the session cookie, deletes that cookie so the
+      # browser stops sending it on subsequent requests. This prevents a
+      # redirect loop where an expired cookie shadows fresh callback tokens.
+      def handle_expired_token(env, request, token)
+        Machina.cache.delete(cache_key(token))
+
+        status, headers, body = @app.call(env)
+        Rack::Utils.delete_cookie_header!(headers, 'machina_session') if request.cookies['machina_session'] == token
+        [status, headers, body]
+      end
+
       def extract_token(request)
-        request.cookies['machina_session']
+        request.params['token']
+          || request.cookies['machina_session']
           || extract_bearer(request)
           || request.headers['X-Api-Key']
-          || request.params['token']
       end
 
       def extract_bearer(request)

data/lib/machina/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Machina
-  VERSION = '0.1.6'
+  VERSION = '0.1.7'
 end

data/spec/machina/middleware/authentication_spec.rb

@@ -100,6 +100,66 @@ RSpec.describe Machina::Middleware::Authentication do
     expect(Machina.cache.read(cache_key)).to be_nil
   end
 
+  context 'when a stale cookie coexists with a fresh callback token' do
+    let(:stale_token) { 'ps_expired_cookie' }
+    let(:fresh_token) { 'ps_fresh_callback' }
+
+    before do
+      allow(identity_client).to receive(:resolve_session).with(stale_token).and_return(
+        Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+      )
+
+      allow(identity_client).to receive(:resolve_session).with(fresh_token).and_return(
+        Machina::IdentityClient::Response.new(status: 200, body: MockResponses.session_resolution),
+      )
+    end
+
+    it 'prefers the query param token over the stale cookie' do
+      env = Rack::MockRequest.env_for(
+        '/auth/machina/callback?token=ps_fresh_callback',
+        'HTTP_COOKIE' => 'machina_session=ps_expired_cookie',
+      )
+
+      status, _headers, body = middleware.call(env)
+
+      expect(status).to eq(200)
+      parsed = JSON.parse(body.first)
+      expect(parsed['user_id']).to eq(MockResponses.session_resolution['data']['user']['id'])
+      expect(identity_client).not_to have_received(:resolve_session).with(stale_token)
+    end
+  end
+
+  it 'deletes the session cookie when a cookie-sourced token is expired' do
+    allow(identity_client).to receive(:resolve_session).with('ps_expired_cookie').and_return(
+      Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+    )
+
+    env = Rack::MockRequest.env_for(
+      '/resource',
+      'HTTP_COOKIE' => 'machina_session=ps_expired_cookie',
+    )
+
+    _status, headers, _body = middleware.call(env)
+
+    expect(headers['set-cookie']).to include('machina_session=')
+    expect(headers['set-cookie']).to include('max-age=0')
+  end
+
+  it 'does not delete the cookie when a bearer token fails resolution' do
+    allow(identity_client).to receive(:resolve_session).with('ps_expired_bearer').and_return(
+      Machina::IdentityClient::Response.new(status: 404, body: '{}'),
+    )
+
+    env = Rack::MockRequest.env_for(
+      '/resource',
+      'HTTP_AUTHORIZATION' => 'Bearer ps_expired_bearer',
+    )
+
+    _status, headers, _body = middleware.call(env)
+
+    expect(headers['set-cookie']).to be_nil
+  end
+
   it 'uses the cache on subsequent requests' do
     response = Machina::IdentityClient::Response.new(
       status: 200,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: machina-auth
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.7
 platform: ruby
 authors:
 - ZAR