session-check 1.1.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c086b705a832734d76b4abdeb2e2ce98c3b3278629efce7a7dd0714cedf0134
-  data.tar.gz: 4059cbfc502675d24fbb5360e4c3e9de0917690165aaab8a1a39f2ea51f0c33d
+  metadata.gz: 75caa11e24f6f750c18ee096a9d39ba72c86713e74836d479885625f2d72d262
+  data.tar.gz: 6eaa656c8f9aac3a935483393aa4835e9286d6e96fe87446477c238ab575cd75
 SHA512:
-  metadata.gz: f330839b1cee46fb05e160c0c5f3174a38611a8711a113533a41102016f2cdc6b833787fc95835a33cc07f6dd3bb36e2bd895066b905d429df68428ec48c8106
-  data.tar.gz: c0f2cac5d5f86949e0a6c924d35badafdc2bab9c9ae435eae1f5990745476a1d8be383b7ff24f82c623f35ca9a4cc9e2ed3d00b476c4f0e1f575bc1c71548722
+  metadata.gz: 5375698f650fb0fccf732a4a7c735e4e9248084a6b3d2f3126d49be384116cfb3b66751bbc549f137c6f6f3971a99d35dc2fbc641ce611136aff0718f073a67e
+  data.tar.gz: 9bc95912cb792257bd9449702a0092d29331b5be003b191061b2b7b8b3e62add21d1bef242513ac7f0b8409ef5a6db2bfc2752bd099bc25a04149b6d983b33bc

data/README.md

@@ -1,4 +1,8 @@
-# Session Check
+Session Check
+=========
+
+[![Gem Version](https://img.shields.io/gem/v/session-check?color=green)](https://rubygems.org/gems/session-check)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
 A gem that returns you to your application's sign in page when your Devise session expires.
 
@@ -29,7 +33,65 @@ their browser, you can start the ping process by calling:
 
     SessionCheck.should_session_check = true;
 
+# Configuration
+
+`logged_out_url` — the URL users are redirected to when their session expires. Defaults to `/users/sign_in`.
+
+    Session::Check.configure do |config|
+      config.logged_out_url = '/login'
+      config.check_every_s = 30
+    end
+
+These can also be overridden per-call:
+
+    <%= session_check logged_out_url: '/login', check_every_s: 30 %>
+
+# Custom session detection
+
+If your application uses a non-Devise session mechanism (e.g. token-based principals stored in the session hash),
+you can override how the gem detects an active session by configuring a `session_active_proc`.
+
+The proc receives the current context (controller in the ping endpoint, view/helper context in the `session_check` helper) and must return a Hash with two keys:
+- `exists` — Boolean, whether an active session is present
+- `expires_in` — Integer (seconds), how long until the session expires
+
+    Session::Check.configure do |config|
+      config.session_active_proc = ->(controller) {
+        if controller.current_user
+          # Devise-backed session
+          expires_in = Session::Check::Devise.expires_in(controller.session)
+          { exists: true, expires_in: expires_in }
+        elsif controller.session[:my_custom_principal]
+          { exists: true, expires_in: 3600 }
+        else
+          { exists: false, expires_in: 0 }
+        end
+      }
+    end
+
+When `session_active_proc` is configured it replaces the default `current_user` check in both the
+server-side ping endpoint and the initial JS `should_session_check` value. All other behaviour
+(check interval, AJAX counter reset, redirect URL) remains unchanged and configurable via the
+`session_check` helper options.
+
+If `session_active_proc` is not set the gem uses the default Devise behaviour, computing remaining session time from the Warden last-request timestamp.
+
+# Development
+
+The client-side JS lives in `app/assets/javascripts/session_check.js` as plain, dependency-free JS
+so it can be unit tested in isolation. The `_session_check` partial only passes configuration in via
+`window.SessionCheckConfig` and inlines this file's contents — no asset pipeline setup is required
+by consuming applications.
+
+JS unit tests (Jest + jsdom) live under `spec/javascript` and are scoped to this repo only —
+`package.json`/`node_modules` are dev-only and excluded from the published gem. Run them with:
+
+    npm install
+    npm test
+
 # Changelog
 
+Version 2.0.1 : Fix session-expiry check drifting in background/inactive tabs
+Version 2.0.0 : **Breaking change** — default Devise behaviour now correctly computes remaining session time from the Warden last-request timestamp rather than always returning the full timeout. `current_user` is no longer exposed to the session check partial. Added `session_active_proc` configuration option for non-Devise session support. Fixed setTimeout multiplier (5000 → 1000) so session checks fire at the correct interval. Bump your dependency to `>= 2.0.0`.
 Version 1.1.0 : Added optional nonce
 Version 0.2.1 : Added explicit reference to Devise (which is required)

data/app/assets/javascripts/session_check.js

@@ -0,0 +1,125 @@
+/* eslint-disable no-var */
+// This file is plain JS (no ERB) so it can be loaded directly in unit tests
+// (see spec/javascript) as well as served as-is by the Rails asset pipeline.
+//
+// Configuration is supplied at runtime via a `window.SessionCheckConfig`
+// object assigned by app/views/_session_check.html.erb, e.g.:
+//
+//   window.SessionCheckConfig = {
+//     should_session_check: true,
+//     check_every_s: 30,
+//     session_time: 3600,
+//     logged_out_url: '/users/sign_in',
+//     reset_counter_on_ajax: true
+//   };
+(function (global) {
+  'use strict';
+
+  // `createSessionCheck` builds a fresh instance of the session-check
+  // behaviour. `deps` allows tests to inject fakes for jQuery, the clock and
+  // timer functions instead of relying on browser globals.
+  function createSessionCheck(config, deps) {
+    config = config || {};
+    deps = deps || {};
+
+    var $ = deps.$ || global.$;
+    var now = deps.now || function () {
+      return Date.now();
+    };
+    var setTimeoutFn = deps.setTimeout || global.setTimeout;
+    var documentRef = deps.document || global.document;
+    var locationRef = deps.location || global;
+
+    var check_every_s = config.check_every_s;
+    var session_time = config.session_time;
+    var check_every_ms = check_every_s * 1000;
+    var min_check_interval_ms = 5 * 1000; // don't re-check more than once per 5s
+    var session_expires_at = now() + session_time * 1000; // absolute timestamp, not a countdown
+    var last_check_at = now();
+
+    var SessionCheck = {
+      should_session_check: !!config.should_session_check
+    };
+
+    var force_sign_in = function () {
+      locationRef.location = config.logged_out_url;
+    };
+
+    var check_session_with_server = function () {
+      last_check_at = now();
+      $.get('/session_check/time_to_session_expiry')
+        .done(function (d) {
+          if (!d.session_exists) {
+            force_sign_in();
+          } else {
+            session_expires_at = now() + d.session_expires_in * 1000;
+          }
+        })
+        .fail(force_sign_in);
+    };
+
+    var session_check = function () {
+      if (SessionCheck.should_session_check && now() >= session_expires_at) {
+        check_session_with_server();
+      }
+      setTimeoutFn(session_check, check_every_ms);
+    };
+
+    var on_visibility_change = function () {
+      if (documentRef.visibilityState === 'visible' && SessionCheck.should_session_check) {
+        if (now() - last_check_at > min_check_interval_ms) {
+          check_session_with_server();
+        }
+      }
+    };
+
+    var on_ajax_complete = function () {
+      session_expires_at = now() + session_time * 1000;
+      last_check_at = now();
+    };
+
+    var start = function () {
+      setTimeoutFn(session_check, check_every_ms);
+
+      // Whenever the tab becomes visible again, go straight to the server
+      // for ground truth instead of trusting local timers/clock math.
+      // Debounced so rapid tab-switching doesn't spam the endpoint.
+      documentRef.addEventListener('visibilitychange', on_visibility_change);
+
+      if (config.reset_counter_on_ajax) {
+        $.ajaxSetup({
+          complete: on_ajax_complete
+        });
+      }
+    };
+
+    return {
+      SessionCheck: SessionCheck,
+      start: start,
+      // Exposed for unit testing only.
+      _internal: {
+        force_sign_in: force_sign_in,
+        check_session_with_server: check_session_with_server,
+        session_check: session_check,
+        on_visibility_change: on_visibility_change,
+        on_ajax_complete: on_ajax_complete,
+        get session_expires_at() {
+          return session_expires_at;
+        },
+        get last_check_at() {
+          return last_check_at;
+        }
+      }
+    };
+  }
+
+  if (typeof module !== 'undefined' && module.exports) {
+    module.exports = createSessionCheck;
+  }
+
+  if (typeof global.SessionCheckConfig !== 'undefined') {
+    var instance = createSessionCheck(global.SessionCheckConfig);
+    global.SessionCheck = instance.SessionCheck;
+    instance.start();
+  }
+})(typeof window !== 'undefined' ? window : this);

data/app/controllers/session/check/session_checks_controller.rb

@@ -7,38 +7,15 @@ module Session
 
       prepend_before_action :dont_update_request_time
 
-      # Find it there is a session, and if it has any warden information. If so, the user is logged in.
       def time_to_session_expiry
-        session_exists = false
-        session_expires_in = 0
-        if current_user
-          session_exists = true
-          # This calculates how many seconds there are until they are logged out
-          session_expires_in = calculate_session_expires_in
-        end
-        render json: { session_exists: session_exists, session_expires_in: session_expires_in }
+        result = Session::Check.configuration.call_session_active_proc(self)
+        render json: { session_exists: !!result[:exists], session_expires_in: result[:expires_in].to_i }
       end
 
       # This ensures this request ping doesn't update their last access time.
       private def dont_update_request_time
         request.env['devise.skip_trackable'] = true
       end
-
-      private def calculate_session_expires_in
-        User.timeout_in -
-          Time.now.utc.to_i.seconds +
-          SessionChecksController.time_of_last_warden_request(session).to_i.seconds
-      rescue => _e
-        1000000.seconds
-      end
-
-      class << self
-        def time_of_last_warden_request(session)
-          session['warden.user.user.session']['last_request_at']
-        rescue => _e
-          Time.zone.now
-        end
-      end
     end
   end
 end

data/app/helpers/session/check/session_check_helper.rb

@@ -1,18 +1,20 @@
 # frozen_string_literal: true
 
-require 'devise'
-
 module Session
   module Check
     module SessionCheckHelper
       def session_check(options = {})
+        result = Session::Check.configuration.call_session_active_proc(self)
+        session_active = !!result[:exists]
+        session_time = result[:expires_in].to_i
+
         locals = {
-          session_time: Devise.timeout_in,
-          check_every: 10,
+          session_time: session_time,
+          check_every_s: Session::Check.configuration.check_every_s,
           reset_counter_on_ajax: true,
-          logged_out_url: '/users/sign_in',
-          current_user: current_user
-        }.merge options
+          logged_out_url: Session::Check.configuration.logged_out_url,
+          session_active: session_active
+        }.merge(options)
 
         ActionController::Base.render(partial: '/session_check', locals: locals)
       end

data/app/views/_session_check.html.erb

@@ -1,35 +1,12 @@
 <script<% if local_assigns[:nonce] %> nonce="<%= nonce %>"<% end %>>
-    var SessionCheck = {
-        should_session_check: <%= !current_user.nil? %>
-    };
-    (function () {
-        var check_every_s = <%= check_every %>;
-        var session_time_left = <%= session_time %>;
-        var force_sign_in = function () {
-            window.location = '<%= logged_out_url %>';
-        };
-        var session_check = function () {
-            session_time_left = session_time_left - check_every_s;
-            if (SessionCheck.should_session_check && session_time_left < 0) {
-                $.get('/session_check/time_to_session_expiry')
-                        .done(function (d) {
-                            if (!d.session_exists) {
-                                force_sign_in();
-                            } else {
-                                session_time_left = d.session_expires_in;
-                            }
-                        })
-                        .fail(force_sign_in);
-            }
-            setTimeout(session_check, check_every_s * 5000);
-        };
-        setTimeout(session_check, check_every_s * 5000);
-        <% if reset_counter_on_ajax %>
-        $.ajaxSetup({
-            complete: function (xhr) {
-                session_time_left = <%= session_time %>;
-            }
-        });
-        <% end %>
-    }());
-</script>
+window.SessionCheckConfig = {
+  should_session_check: <%= session_active %>,
+  check_every_s: <%= check_every_s %>,
+  session_time: <%= session_time %>,
+  logged_out_url: <%= raw ERB::Util.json_escape(logged_out_url.to_json) %>,
+  reset_counter_on_ajax: <%= !!reset_counter_on_ajax %>
+};
+</script>
+<script<% if local_assigns[:nonce] %> nonce="<%= nonce %>"<% end %>>
+<%= raw File.read(Session::Check::Engine.root.join('app', 'assets', 'javascripts', 'session_check.js')) %>
+</script>

data/config/routes.rb

@@ -1,5 +1,12 @@
 # frozen_string_literal: true
 
+# Draw directly into the host application's routes (rather than
+# `Session::Check::Engine.routes.draw`) so the endpoint is auto-wired for any
+# consuming app without requiring an explicit `mount Session::Check::Engine`,
+# matching the README usage (`<%= session_check %>` only).
 Rails.application.routes.draw do
-  get 'session_check/time_to_session_expiry', to: 'session/check/session_checks#time_to_session_expiry'
+  get 'session_check/time_to_session_expiry',
+      to: 'session/check/session_checks#time_to_session_expiry',
+      format: :json,
+      defaults: { format: :json }
 end

data/lib/session/check/configuration.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'devise'
+
+module Session
+  module Check
+    class Configuration
+      # Proc used to determine session state. Called with the controller/helper context as its
+      # sole argument. Must return a Hash: { exists: Boolean, expires_in: Integer (seconds) }
+      #
+      # Override to customise session detection for non-Devise sessions.
+      attr_accessor :session_active_proc, :logged_out_url, :check_every_s
+
+      def initialize
+        @logged_out_url = '/users/sign_in'
+        @check_every_s = 10
+        @session_active_proc = ->(controller) {
+          user = begin
+            controller.current_user
+          rescue NoMethodError
+            nil
+          end
+          if user
+            expires_in = Session::Check::Devise.expires_in(controller.session)
+            { exists: true, expires_in: expires_in }
+          else
+            { exists: false, expires_in: 0 }
+          end
+        }
+      end
+
+      def call_session_active_proc(context)
+        result = session_active_proc.call(context)
+        unless result.is_a?(Hash)
+          raise ArgumentError,
+            "session_active_proc must return a Hash with :exists and :expires_in keys, got #{result.class}"
+        end
+        normalized = result.transform_keys(&:to_sym)
+        { exists: normalized[:exists], expires_in: normalized[:expires_in] }
+      end
+    end
+  end
+end

data/lib/session/check/devise.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Session
+  module Check
+    module Devise
+      def self.expires_in(session)
+        last_request_at = begin
+          session['warden.user.user.session']['last_request_at'].to_i
+        rescue NoMethodError, TypeError
+          Time.now.utc.to_i
+        end
+        remaining = ::Devise.timeout_in.to_i - (Time.now.utc.to_i - last_request_at)
+        [remaining, 0].max
+      end
+    end
+  end
+end

data/lib/session/check/version.rb

@@ -2,6 +2,6 @@
 
 module Session
   module Check
-    VERSION = '1.1.0'
+    VERSION = '2.0.1'
   end
 end

data/lib/session/check.rb

@@ -1 +1,17 @@
-require_relative 'check/engine'
+require_relative 'check/configuration'
+require_relative 'check/devise'
+require_relative 'check/engine'
+
+module Session
+  module Check
+    class << self
+      def configure
+        yield configuration
+      end
+
+      def configuration
+        @configuration ||= Configuration.new
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: session-check
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Harry Lascelles
@@ -71,14 +71,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '7.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '7.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -128,12 +128,15 @@ extensions: []
 extra_rdoc_files: []
 files:
 - README.md
+- app/assets/javascripts/session_check.js
 - app/controllers/session/check/session_checks_controller.rb
 - app/helpers/session/check/session_check_helper.rb
 - app/views/_session_check.html.erb
 - config/routes.rb
 - lib/session-check.rb
 - lib/session/check.rb
+- lib/session/check/configuration.rb
+- lib/session/check/devise.rb
 - lib/session/check/engine.rb
 - lib/session/check/version.rb
 homepage: https://github.com/bambooengineering/session-check