session-check 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01760d88d12d072557a3850b09592a39c0d402d18cdd5b4d48193d3c3780a15c
-  data.tar.gz: 1809267c20cc72d9927cacf7521f1dd025d7b7861e0e10f68fc8579191cce167
+  metadata.gz: 75caa11e24f6f750c18ee096a9d39ba72c86713e74836d479885625f2d72d262
+  data.tar.gz: 6eaa656c8f9aac3a935483393aa4835e9286d6e96fe87446477c238ab575cd75
 SHA512:
-  metadata.gz: e39eb03da722898d4a7d6e8c1618aceadbb643e53a84e549f23651919d5ddc30aab9cf7f3ba84cc8f2ded1950e963c8bf46245b64e0312d4883a8993f478ae83
-  data.tar.gz: 70559131eee0435399dfc94002a6456924bcdb08a8401ed12037ce4098e247f25422457eb72099760697ccecb7f481d4da8866034d41eaad86b39a93d31446ee
+  metadata.gz: 5375698f650fb0fccf732a4a7c735e4e9248084a6b3d2f3126d49be384116cfb3b66751bbc549f137c6f6f3971a99d35dc2fbc641ce611136aff0718f073a67e
+  data.tar.gz: 9bc95912cb792257bd9449702a0092d29331b5be003b191061b2b7b8b3e62add21d1bef242513ac7f0b8409ef5a6db2bfc2752bd099bc25a04149b6d983b33bc

data/README.md

@@ -1,4 +1,8 @@
-# Session Check
+Session Check
+=========
+
+[![Gem Version](https://img.shields.io/gem/v/session-check?color=green)](https://rubygems.org/gems/session-check)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
 A gem that returns you to your application's sign in page when your Devise session expires.
 
@@ -72,8 +76,22 @@ server-side ping endpoint and the initial JS `should_session_check` value. All o
 
 If `session_active_proc` is not set the gem uses the default Devise behaviour, computing remaining session time from the Warden last-request timestamp.
 
+# Development
+
+The client-side JS lives in `app/assets/javascripts/session_check.js` as plain, dependency-free JS
+so it can be unit tested in isolation. The `_session_check` partial only passes configuration in via
+`window.SessionCheckConfig` and inlines this file's contents — no asset pipeline setup is required
+by consuming applications.
+
+JS unit tests (Jest + jsdom) live under `spec/javascript` and are scoped to this repo only —
+`package.json`/`node_modules` are dev-only and excluded from the published gem. Run them with:
+
+    npm install
+    npm test
+
 # Changelog
 
+Version 2.0.1 : Fix session-expiry check drifting in background/inactive tabs
 Version 2.0.0 : **Breaking change** — default Devise behaviour now correctly computes remaining session time from the Warden last-request timestamp rather than always returning the full timeout. `current_user` is no longer exposed to the session check partial. Added `session_active_proc` configuration option for non-Devise session support. Fixed setTimeout multiplier (5000 → 1000) so session checks fire at the correct interval. Bump your dependency to `>= 2.0.0`.
 Version 1.1.0 : Added optional nonce
 Version 0.2.1 : Added explicit reference to Devise (which is required)

data/app/assets/javascripts/session_check.js

@@ -0,0 +1,125 @@
+/* eslint-disable no-var */
+// This file is plain JS (no ERB) so it can be loaded directly in unit tests
+// (see spec/javascript) as well as served as-is by the Rails asset pipeline.
+//
+// Configuration is supplied at runtime via a `window.SessionCheckConfig`
+// object assigned by app/views/_session_check.html.erb, e.g.:
+//
+//   window.SessionCheckConfig = {
+//     should_session_check: true,
+//     check_every_s: 30,
+//     session_time: 3600,
+//     logged_out_url: '/users/sign_in',
+//     reset_counter_on_ajax: true
+//   };
+(function (global) {
+  'use strict';
+
+  // `createSessionCheck` builds a fresh instance of the session-check
+  // behaviour. `deps` allows tests to inject fakes for jQuery, the clock and
+  // timer functions instead of relying on browser globals.
+  function createSessionCheck(config, deps) {
+    config = config || {};
+    deps = deps || {};
+
+    var $ = deps.$ || global.$;
+    var now = deps.now || function () {
+      return Date.now();
+    };
+    var setTimeoutFn = deps.setTimeout || global.setTimeout;
+    var documentRef = deps.document || global.document;
+    var locationRef = deps.location || global;
+
+    var check_every_s = config.check_every_s;
+    var session_time = config.session_time;
+    var check_every_ms = check_every_s * 1000;
+    var min_check_interval_ms = 5 * 1000; // don't re-check more than once per 5s
+    var session_expires_at = now() + session_time * 1000; // absolute timestamp, not a countdown
+    var last_check_at = now();
+
+    var SessionCheck = {
+      should_session_check: !!config.should_session_check
+    };
+
+    var force_sign_in = function () {
+      locationRef.location = config.logged_out_url;
+    };
+
+    var check_session_with_server = function () {
+      last_check_at = now();
+      $.get('/session_check/time_to_session_expiry')
+        .done(function (d) {
+          if (!d.session_exists) {
+            force_sign_in();
+          } else {
+            session_expires_at = now() + d.session_expires_in * 1000;
+          }
+        })
+        .fail(force_sign_in);
+    };
+
+    var session_check = function () {
+      if (SessionCheck.should_session_check && now() >= session_expires_at) {
+        check_session_with_server();
+      }
+      setTimeoutFn(session_check, check_every_ms);
+    };
+
+    var on_visibility_change = function () {
+      if (documentRef.visibilityState === 'visible' && SessionCheck.should_session_check) {
+        if (now() - last_check_at > min_check_interval_ms) {
+          check_session_with_server();
+        }
+      }
+    };
+
+    var on_ajax_complete = function () {
+      session_expires_at = now() + session_time * 1000;
+      last_check_at = now();
+    };
+
+    var start = function () {
+      setTimeoutFn(session_check, check_every_ms);
+
+      // Whenever the tab becomes visible again, go straight to the server
+      // for ground truth instead of trusting local timers/clock math.
+      // Debounced so rapid tab-switching doesn't spam the endpoint.
+      documentRef.addEventListener('visibilitychange', on_visibility_change);
+
+      if (config.reset_counter_on_ajax) {
+        $.ajaxSetup({
+          complete: on_ajax_complete
+        });
+      }
+    };
+
+    return {
+      SessionCheck: SessionCheck,
+      start: start,
+      // Exposed for unit testing only.
+      _internal: {
+        force_sign_in: force_sign_in,
+        check_session_with_server: check_session_with_server,
+        session_check: session_check,
+        on_visibility_change: on_visibility_change,
+        on_ajax_complete: on_ajax_complete,
+        get session_expires_at() {
+          return session_expires_at;
+        },
+        get last_check_at() {
+          return last_check_at;
+        }
+      }
+    };
+  }
+
+  if (typeof module !== 'undefined' && module.exports) {
+    module.exports = createSessionCheck;
+  }
+
+  if (typeof global.SessionCheckConfig !== 'undefined') {
+    var instance = createSessionCheck(global.SessionCheckConfig);
+    global.SessionCheck = instance.SessionCheck;
+    instance.start();
+  }
+})(typeof window !== 'undefined' ? window : this);

data/app/views/_session_check.html.erb

@@ -1,35 +1,12 @@
 <script<% if local_assigns[:nonce] %> nonce="<%= nonce %>"<% end %>>
-    var SessionCheck = {
-        should_session_check: <%= session_active %>
-    };
-    (function () {
-        var check_every_s = <%= check_every_s %>;
-        var session_time_left = <%= session_time %>;
-        var force_sign_in = function () {
-            window.location = '<%= logged_out_url %>';
-        };
-        var session_check = function () {
-            session_time_left = session_time_left - check_every_s;
-            if (SessionCheck.should_session_check && session_time_left < 0) {
-                $.get('/session_check/time_to_session_expiry')
-                        .done(function (d) {
-                            if (!d.session_exists) {
-                                force_sign_in();
-                            } else {
-                                session_time_left = d.session_expires_in;
-                            }
-                        })
-                        .fail(force_sign_in);
-            }
-            setTimeout(session_check, check_every_s * 1000);
-        };
-        setTimeout(session_check, check_every_s * 1000);
-        <% if reset_counter_on_ajax %>
-        $.ajaxSetup({
-            complete: function (xhr) {
-                session_time_left = <%= session_time %>;
-            }
-        });
-        <% end %>
-    }());
+window.SessionCheckConfig = {
+  should_session_check: <%= session_active %>,
+  check_every_s: <%= check_every_s %>,
+  session_time: <%= session_time %>,
+  logged_out_url: <%= raw ERB::Util.json_escape(logged_out_url.to_json) %>,
+  reset_counter_on_ajax: <%= !!reset_counter_on_ajax %>
+};
+</script>
+<script<% if local_assigns[:nonce] %> nonce="<%= nonce %>"<% end %>>
+<%= raw File.read(Session::Check::Engine.root.join('app', 'assets', 'javascripts', 'session_check.js')) %>
 </script>

data/config/routes.rb

@@ -1,5 +1,12 @@
 # frozen_string_literal: true
 
+# Draw directly into the host application's routes (rather than
+# `Session::Check::Engine.routes.draw`) so the endpoint is auto-wired for any
+# consuming app without requiring an explicit `mount Session::Check::Engine`,
+# matching the README usage (`<%= session_check %>` only).
 Rails.application.routes.draw do
-  get 'session_check/time_to_session_expiry', to: 'session/check/session_checks#time_to_session_expiry'
+  get 'session_check/time_to_session_expiry',
+      to: 'session/check/session_checks#time_to_session_expiry',
+      format: :json,
+      defaults: { format: :json }
 end

data/lib/session/check/version.rb

@@ -2,6 +2,6 @@
 
 module Session
   module Check
-    VERSION = '2.0.0'
+    VERSION = '2.0.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: session-check
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Harry Lascelles
@@ -128,6 +128,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - README.md
+- app/assets/javascripts/session_check.js
 - app/controllers/session/check/session_checks_controller.rb
 - app/helpers/session/check/session_check_helper.rb
 - app/views/_session_check.html.erb