session-check 1.1.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c086b705a832734d76b4abdeb2e2ce98c3b3278629efce7a7dd0714cedf0134
-  data.tar.gz: 4059cbfc502675d24fbb5360e4c3e9de0917690165aaab8a1a39f2ea51f0c33d
+  metadata.gz: 01760d88d12d072557a3850b09592a39c0d402d18cdd5b4d48193d3c3780a15c
+  data.tar.gz: 1809267c20cc72d9927cacf7521f1dd025d7b7861e0e10f68fc8579191cce167
 SHA512:
-  metadata.gz: f330839b1cee46fb05e160c0c5f3174a38611a8711a113533a41102016f2cdc6b833787fc95835a33cc07f6dd3bb36e2bd895066b905d429df68428ec48c8106
-  data.tar.gz: c0f2cac5d5f86949e0a6c924d35badafdc2bab9c9ae435eae1f5990745476a1d8be383b7ff24f82c623f35ca9a4cc9e2ed3d00b476c4f0e1f575bc1c71548722
+  metadata.gz: e39eb03da722898d4a7d6e8c1618aceadbb643e53a84e549f23651919d5ddc30aab9cf7f3ba84cc8f2ded1950e963c8bf46245b64e0312d4883a8993f478ae83
+  data.tar.gz: 70559131eee0435399dfc94002a6456924bcdb08a8401ed12037ce4098e247f25422457eb72099760697ccecb7f481d4da8866034d41eaad86b39a93d31446ee

data/README.md

@@ -29,7 +29,51 @@ their browser, you can start the ping process by calling:
 
     SessionCheck.should_session_check = true;
 
+# Configuration
+
+`logged_out_url` — the URL users are redirected to when their session expires. Defaults to `/users/sign_in`.
+
+    Session::Check.configure do |config|
+      config.logged_out_url = '/login'
+      config.check_every_s = 30
+    end
+
+These can also be overridden per-call:
+
+    <%= session_check logged_out_url: '/login', check_every_s: 30 %>
+
+# Custom session detection
+
+If your application uses a non-Devise session mechanism (e.g. token-based principals stored in the session hash),
+you can override how the gem detects an active session by configuring a `session_active_proc`.
+
+The proc receives the current context (controller in the ping endpoint, view/helper context in the `session_check` helper) and must return a Hash with two keys:
+- `exists` — Boolean, whether an active session is present
+- `expires_in` — Integer (seconds), how long until the session expires
+
+    Session::Check.configure do |config|
+      config.session_active_proc = ->(controller) {
+        if controller.current_user
+          # Devise-backed session
+          expires_in = Session::Check::Devise.expires_in(controller.session)
+          { exists: true, expires_in: expires_in }
+        elsif controller.session[:my_custom_principal]
+          { exists: true, expires_in: 3600 }
+        else
+          { exists: false, expires_in: 0 }
+        end
+      }
+    end
+
+When `session_active_proc` is configured it replaces the default `current_user` check in both the
+server-side ping endpoint and the initial JS `should_session_check` value. All other behaviour
+(check interval, AJAX counter reset, redirect URL) remains unchanged and configurable via the
+`session_check` helper options.
+
+If `session_active_proc` is not set the gem uses the default Devise behaviour, computing remaining session time from the Warden last-request timestamp.
+
 # Changelog
 
+Version 2.0.0 : **Breaking change** — default Devise behaviour now correctly computes remaining session time from the Warden last-request timestamp rather than always returning the full timeout. `current_user` is no longer exposed to the session check partial. Added `session_active_proc` configuration option for non-Devise session support. Fixed setTimeout multiplier (5000 → 1000) so session checks fire at the correct interval. Bump your dependency to `>= 2.0.0`.
 Version 1.1.0 : Added optional nonce
 Version 0.2.1 : Added explicit reference to Devise (which is required)

data/app/controllers/session/check/session_checks_controller.rb

@@ -7,38 +7,15 @@ module Session
 
       prepend_before_action :dont_update_request_time
 
-      # Find it there is a session, and if it has any warden information. If so, the user is logged in.
       def time_to_session_expiry
-        session_exists = false
-        session_expires_in = 0
-        if current_user
-          session_exists = true
-          # This calculates how many seconds there are until they are logged out
-          session_expires_in = calculate_session_expires_in
-        end
-        render json: { session_exists: session_exists, session_expires_in: session_expires_in }
+        result = Session::Check.configuration.call_session_active_proc(self)
+        render json: { session_exists: !!result[:exists], session_expires_in: result[:expires_in].to_i }
       end
 
       # This ensures this request ping doesn't update their last access time.
       private def dont_update_request_time
         request.env['devise.skip_trackable'] = true
       end
-
-      private def calculate_session_expires_in
-        User.timeout_in -
-          Time.now.utc.to_i.seconds +
-          SessionChecksController.time_of_last_warden_request(session).to_i.seconds
-      rescue => _e
-        1000000.seconds
-      end
-
-      class << self
-        def time_of_last_warden_request(session)
-          session['warden.user.user.session']['last_request_at']
-        rescue => _e
-          Time.zone.now
-        end
-      end
     end
   end
 end

data/app/helpers/session/check/session_check_helper.rb

@@ -1,18 +1,20 @@
 # frozen_string_literal: true
 
-require 'devise'
-
 module Session
   module Check
     module SessionCheckHelper
       def session_check(options = {})
+        result = Session::Check.configuration.call_session_active_proc(self)
+        session_active = !!result[:exists]
+        session_time = result[:expires_in].to_i
+
         locals = {
-          session_time: Devise.timeout_in,
-          check_every: 10,
+          session_time: session_time,
+          check_every_s: Session::Check.configuration.check_every_s,
           reset_counter_on_ajax: true,
-          logged_out_url: '/users/sign_in',
-          current_user: current_user
-        }.merge options
+          logged_out_url: Session::Check.configuration.logged_out_url,
+          session_active: session_active
+        }.merge(options)
 
         ActionController::Base.render(partial: '/session_check', locals: locals)
       end

data/app/views/_session_check.html.erb

@@ -1,9 +1,9 @@
 <script<% if local_assigns[:nonce] %> nonce="<%= nonce %>"<% end %>>
     var SessionCheck = {
-        should_session_check: <%= !current_user.nil? %>
+        should_session_check: <%= session_active %>
     };
     (function () {
-        var check_every_s = <%= check_every %>;
+        var check_every_s = <%= check_every_s %>;
         var session_time_left = <%= session_time %>;
         var force_sign_in = function () {
             window.location = '<%= logged_out_url %>';
@@ -21,9 +21,9 @@
                         })
                         .fail(force_sign_in);
             }
-            setTimeout(session_check, check_every_s * 5000);
+            setTimeout(session_check, check_every_s * 1000);
         };
-        setTimeout(session_check, check_every_s * 5000);
+        setTimeout(session_check, check_every_s * 1000);
         <% if reset_counter_on_ajax %>
         $.ajaxSetup({
             complete: function (xhr) {
@@ -32,4 +32,4 @@
         });
         <% end %>
     }());
-</script>
+</script>

data/lib/session/check/configuration.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'devise'
+
+module Session
+  module Check
+    class Configuration
+      # Proc used to determine session state. Called with the controller/helper context as its
+      # sole argument. Must return a Hash: { exists: Boolean, expires_in: Integer (seconds) }
+      #
+      # Override to customise session detection for non-Devise sessions.
+      attr_accessor :session_active_proc, :logged_out_url, :check_every_s
+
+      def initialize
+        @logged_out_url = '/users/sign_in'
+        @check_every_s = 10
+        @session_active_proc = ->(controller) {
+          user = begin
+            controller.current_user
+          rescue NoMethodError
+            nil
+          end
+          if user
+            expires_in = Session::Check::Devise.expires_in(controller.session)
+            { exists: true, expires_in: expires_in }
+          else
+            { exists: false, expires_in: 0 }
+          end
+        }
+      end
+
+      def call_session_active_proc(context)
+        result = session_active_proc.call(context)
+        unless result.is_a?(Hash)
+          raise ArgumentError,
+            "session_active_proc must return a Hash with :exists and :expires_in keys, got #{result.class}"
+        end
+        normalized = result.transform_keys(&:to_sym)
+        { exists: normalized[:exists], expires_in: normalized[:expires_in] }
+      end
+    end
+  end
+end

data/lib/session/check/devise.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Session
+  module Check
+    module Devise
+      def self.expires_in(session)
+        last_request_at = begin
+          session['warden.user.user.session']['last_request_at'].to_i
+        rescue NoMethodError, TypeError
+          Time.now.utc.to_i
+        end
+        remaining = ::Devise.timeout_in.to_i - (Time.now.utc.to_i - last_request_at)
+        [remaining, 0].max
+      end
+    end
+  end
+end

data/lib/session/check/version.rb

@@ -2,6 +2,6 @@
 
 module Session
   module Check
-    VERSION = '1.1.0'
+    VERSION = '2.0.0'
   end
 end

data/lib/session/check.rb

@@ -1 +1,17 @@
-require_relative 'check/engine'
+require_relative 'check/configuration'
+require_relative 'check/devise'
+require_relative 'check/engine'
+
+module Session
+  module Check
+    class << self
+      def configure
+        yield configuration
+      end
+
+      def configuration
+        @configuration ||= Configuration.new
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: session-check
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Harry Lascelles
@@ -71,14 +71,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '7.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '7.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -134,6 +134,8 @@ files:
 - config/routes.rb
 - lib/session-check.rb
 - lib/session/check.rb
+- lib/session/check/configuration.rb
+- lib/session/check/devise.rb
 - lib/session/check/engine.rb
 - lib/session/check/version.rb
 homepage: https://github.com/bambooengineering/session-check