mbuzz 0.7.2 → 0.7.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d8514076473bbc4fa543510e84789f8cb91ccc99e916b3cef4f4928aaf6baf5
-  data.tar.gz: 159074f0dbac29eb6b721bab4288ce976e4e4361ba503caffc36f37e79cf315e
+  metadata.gz: 31940df7a70689cccec128ba1f99498c1fda911604ca48ad9c243584c71ba228
+  data.tar.gz: e1b98becc405f8043831645c9ce6ee3010716466e2cd5c960d1ca5ac4a3d875a
 SHA512:
-  metadata.gz: 3d515f639e577a68d9daa8afe13de92dec0a5556cfad2e335ea482f7db0240ff996dd1fb6bbf3388e7f632cb8300e439028091cf1c551627c9be1c22e73ca666
-  data.tar.gz: 9fbe4999f2ce0855d83847d61b4684f30217c01c9074df4cced51e4083167cf3ca24e0e5223f2e57fd859aab6d88f60a68a0adc3074bd0a7f4356c0f9d3e5116
+  metadata.gz: 80ca2e08d316b5b06526dc2375ccede006ef8e369c6a796cec73182aacca047f5874eb76e1de7e3612298379e8ebd3cb7cdc75bb45f9f3f8f43b410d5ed4f11b
+  data.tar.gz: 0ce7d660c3b17d2fa26ab14acb79c8942cbc4caacc40690b4fe772a7b1fb92d45a4ae59a4dfee32e6836535d930b4b49d2fbb88d72c7f59884e1924347ee14c2

data/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.4] - 2026-02-17
+
+### Fixed
+
+- **`conversion()` now resolves `user_id` from context** — the `user_id: nil` parameter was shadowing `self.user_id`, preventing the identify → convert flow from working. `event()` was not affected.
+- **`identify()` now stores `user_id` in context** — after a successful API call, `user_id` is written to `Current.user_id` and `request.env` so that subsequent `conversion()` calls in the same request can resolve it.
+
+## [0.7.3] - 2026-02-02
+
+### Breaking Changes
+
+- **Session cookie removed** — `_mbuzz_sid` cookie is no longer set or read. Sessions are fully server-side.
+- **`SESSION_COOKIE_NAME` and `SESSION_COOKIE_MAX_AGE` constants removed** from `Mbuzz` module.
+
+### Added
+
+- **Navigation-aware session creation** — middleware now gates `POST /sessions` on real page navigations using browser-enforced `Sec-Fetch-*` headers (whitelist), with a framework-specific blacklist fallback for older browsers and bots.
+  - Turbo Frame, htmx, Unpoly, and XHR sub-requests no longer create spurious sessions.
+  - Prefetches and iframe loads are correctly filtered out.
+- New public methods on `Mbuzz::Middleware::Tracking`: `should_create_session?`, `sec_fetch_headers?`, `page_navigation?`, `framework_sub_request?`
+
+### Migration Guide
+
+1. Remove any code that reads or depends on the `_mbuzz_sid` cookie.
+2. Remove references to `Mbuzz::SESSION_COOKIE_NAME` or `Mbuzz::SESSION_COOKIE_MAX_AGE`.
+3. Visitor cookie (`_mbuzz_vid`) is unaffected — still set on every request.
+
 ## [0.7.0] - 2026-01-09
 
 ### Breaking Changes

data/lib/mbuzz/middleware/tracking.rb

@@ -23,12 +23,11 @@ module Mbuzz
 
         store_in_current_attributes(context, request)
 
-        create_session_async(context, request) if context[:new_session]
+        create_session_async(context, request) if should_create_session?(env)
 
         RequestContext.with_context(request: request) do
           status, headers, body = @app.call(env)
           set_visitor_cookie(headers, context, request)
-          set_session_cookie(headers, context, request)
           [status, headers, body]
         ensure
           reset_current_attributes
@@ -51,25 +50,46 @@ module Mbuzz
         Mbuzz.config.all_skip_extensions.any? { |ext| path.end_with?(ext) }
       end
 
+      # Navigation detection — only create sessions for real page navigations.
+      # Sec-Fetch-* headers (browser-enforced, unforgeable) are the primary signal;
+      # framework-specific blacklist covers old browsers and bots.
+
+      def should_create_session?(env)
+        return page_navigation?(env) if sec_fetch_headers?(env)
+
+        !framework_sub_request?(env)
+      end
+
+      def sec_fetch_headers?(env)
+        !env["HTTP_SEC_FETCH_MODE"].nil?
+      end
+
+      def page_navigation?(env)
+        env["HTTP_SEC_FETCH_MODE"] == "navigate" &&
+          env["HTTP_SEC_FETCH_DEST"] == "document" &&
+          env["HTTP_SEC_PURPOSE"].nil?
+      end
+
+      def framework_sub_request?(env)
+        !env["HTTP_TURBO_FRAME"].nil? ||
+          !env["HTTP_HX_REQUEST"].nil? ||
+          !env["HTTP_X_UP_VERSION"].nil? ||
+          env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest"
+      end
+
       private
 
-      # Build all request-specific context as a frozen hash
-      # This ensures thread-safety by using local variables only
-      # IMPORTANT: All values needed by async session creation must be captured here,
-      # NOT accessed from the request object in the background thread (see #create_session)
+      # Build all request-specific context as a frozen hash.
+      # Thread-safety: all values needed by async session creation are captured here,
+      # NOT accessed from the request object in the background thread.
       def build_request_context(request)
-        existing_session_id = session_id_from_cookie(request)
-        new_session = existing_session_id.nil?
         ip = extract_ip(request)
         user_agent = request.user_agent.to_s
 
         {
           visitor_id: resolve_visitor_id(request),
-          session_id: existing_session_id || generate_session_id,
+          session_id: SecureRandom.uuid,
           user_id: user_id_from_session(request),
-          new_session: new_session,
-          # Session creation data - captured here for thread-safety
-          # Background thread must NOT read from request object
           url: request.url,
           referrer: request.referer,
           ip: ip,
@@ -86,14 +106,6 @@ module Mbuzz
         request.cookies[VISITOR_COOKIE_NAME]
       end
 
-      def session_id_from_cookie(request)
-        request.cookies[SESSION_COOKIE_NAME]
-      end
-
-      def generate_session_id
-        SecureRandom.uuid
-      end
-
       def user_id_from_session(request)
         request.session[SESSION_USER_ID_KEY] if request.session
       end
@@ -126,7 +138,7 @@ module Mbuzz
         Rails.logger.error("[Mbuzz] #{message}")
       end
 
-      # Cookie setting - visitor and session cookies
+      # Cookie setting - visitor identity only (sessions are server-side)
 
       def set_visitor_cookie(headers, context, request)
         Rack::Utils.set_cookie_header!(
@@ -136,14 +148,6 @@ module Mbuzz
         )
       end
 
-      def set_session_cookie(headers, context, request)
-        Rack::Utils.set_cookie_header!(
-          headers,
-          SESSION_COOKIE_NAME,
-          session_cookie_options(context, request)
-        )
-      end
-
       def visitor_cookie_options(context, request)
         base_cookie_options(request).merge(
           value: context[:visitor_id],
@@ -151,13 +155,6 @@ module Mbuzz
         )
       end
 
-      def session_cookie_options(context, request)
-        base_cookie_options(request).merge(
-          value: context[:session_id],
-          max_age: SESSION_COOKIE_MAX_AGE
-        )
-      end
-
       def base_cookie_options(request)
         options = {
           path: VISITOR_COOKIE_PATH,

data/lib/mbuzz/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mbuzz
-  VERSION = "0.7.2"
+  VERSION = "0.7.4"
 end

data/lib/mbuzz.rb

@@ -27,9 +27,6 @@ module Mbuzz
   VISITOR_COOKIE_PATH = "/"
   VISITOR_COOKIE_SAME_SITE = "Lax"
 
-  SESSION_COOKIE_NAME = "_mbuzz_sid"
-  SESSION_COOKIE_MAX_AGE = 30 * 60 # 30 minutes
-
   SESSION_USER_ID_KEY = "user_id"
   ENV_USER_ID_KEY = "mbuzz.user_id"
   ENV_VISITOR_ID_KEY = "mbuzz.visitor_id"
@@ -164,13 +161,14 @@ module Mbuzz
   #
   def self.conversion(conversion_type, visitor_id: nil, revenue: nil, user_id: nil, is_acquisition: false, inherit_acquisition: false, identifier: nil, **properties)
     resolved_visitor_id = visitor_id || self.visitor_id
+    resolved_user_id = user_id || self.user_id
 
     # Must have at least one identifier (visitor_id or user_id)
-    return false unless resolved_visitor_id || user_id
+    return false unless resolved_visitor_id || resolved_user_id
 
     Client.conversion(
       visitor_id: resolved_visitor_id,
-      user_id: user_id,
+      user_id: resolved_user_id,
       conversion_type: conversion_type,
       revenue: revenue,
       is_acquisition: is_acquisition,
@@ -196,17 +194,28 @@ module Mbuzz
   #   Mbuzz.identify("user_123", visitor_id: "abc123...", traits: { email: "jane@example.com" })
   #
   def self.identify(user_id, traits: {}, visitor_id: nil)
-    Client.identify(
+    result = Client.identify(
       user_id: user_id,
       visitor_id: visitor_id || self.visitor_id,
       traits: traits
     )
+
+    store_user_id_in_context(user_id) if result
+
+    result
   end
 
   # ============================================================================
   # Private Helpers
   # ============================================================================
 
+  def self.store_user_id_in_context(uid)
+    str_id = uid.to_s
+    Current.user_id = str_id if defined?(Current)
+    RequestContext.current&.request&.env&.[]=(ENV_USER_ID_KEY, str_id)
+  end
+  private_class_method :store_user_id_in_context
+
   def self.enriched_properties(custom_properties)
     return custom_properties unless RequestContext.current
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mbuzz
 version: !ruby/object:Gem::Version
-  version: 0.7.2
+  version: 0.7.4
 platform: ruby
 authors:
 - mbuzz team