standard_id 0.39.0 → 0.40.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aafcc86281b43717bf4afeae67e469f9f773f62bb674137adce6b7924eb24be2
-  data.tar.gz: 1236e399e761f545b7c2c749d44bd317f48355650b1f76accbf22704940f00d5
+  metadata.gz: 89d297a5e9c69566991b97cca501fd5a714b2d2e1200d2e740b3e45684981aab
+  data.tar.gz: d93fc7206735373f14ac2cd51c4612aaf7b1d19244022d884f0c84757d8f78c6
 SHA512:
-  metadata.gz: 0cbb9b1a8fd120918f0dbf986822b70990105c6e288ede4b8f2fc790b82cfa2f5ded7cbc774ae4e18afc6e03b29f40e93ffc736d8fd7021ce2ae81f10b03a59c
-  data.tar.gz: dcbdbea82b00733fb9de47a2ba1b4f44362f819ee27ccac2bbb3b1c10573a225afac8d98c50644648ca9756d5a15ecc4262448ff899632f109e8510f2edf5fcd
+  metadata.gz: 1ce536a136af167e65ec9d01e370a187d71f77a2f60f0c5af47ee5c23a9b58cb87444b95191a019fa06689902765f51eaff20656aeedcdef288e34f577c99c91
+  data.tar.gz: f825db9970c937a76592c421fb71a9607f3ea0667dfafa105ff2d6ce78bbd754f5ca01f873cf3321962876c3ab0f8c7f7314ec95604cf5900d56291cede6ec57

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.40.0] - 2026-09-05
+
+### Fixed
+
+- **`sign_in_account` now supersedes a nil memoised earlier in the same request.** With the `session_resolved` / `account_resolved` memo introduced in the entry below, a guard or shared prop that read `current_account` before the sign-in action ran would have kept returning nil for the rest of that request. Sign-in now memoises the new session and resets the account memo, so the next `current_account` re-derives the account through `load_current_account` — `config.account_scope` and `strict_loading!(false)` apply exactly as on an ordinary authenticated request (caught in review of #326 and #327).
+
+- **An anonymous request no longer queries the session table on every `current_account` call, and no longer writes an empty Rails session.** `Web::SessionManager#current_session` memoised with `Current.session ||= …`, which never memoises a nil answer, so a visitor with no session paid the `BrowserSession.by_token(nil)` lookup on every read — shared props, guards, locale selection, nav helpers — five or six times per page. On one consumer's marketing homepage that was ~6 session-table queries per anonymous request and the app's single largest query by total time (fundbright/delivery-ops#598). Worse, the "no session" branch called `clear_session!`, whose `session.delete` loads the Rack session, and Rack persists every loaded session: a new empty session row and a `Set-Cookie` on every anonymous response, which is what stops a CDN from caching a public page.
+
+  Two new `Current` attributes, `session_resolved` and `account_resolved`, record that the question was answered (nil included) for the rest of the request. `load_session_from_session_token` returns without a query when there is no token, and only falls back to `session[:session_token]` when the Rails session is already loaded or its cookie is actually present on the request (`request.session_options[:key]`) — so a bare GET never allocates one. `load_session_from_remember_token` returns early without a `remember_token` cookie. `clear_session!` only touches the Rails session when it is loaded, and the no-session branch only clears at all when there is stale state to clear (a `session_token`/`remember_token` cookie, or session keys). Hosts that include `StandardId::CurrentAttributes` get the new attributes automatically; a host that hand-rolls `Current` must add them.
+
 ## [0.39.0] - 2026-08-10
 
 ### Added

data/lib/standard_id/current_attributes.rb

@@ -4,6 +4,10 @@ module StandardId
 
     included do
       attribute :session, :account, :request_id, :ip_address, :user_agent, :scope
+      # Set once Web::SessionManager has answered "which session / account is
+      # this request?" — including when the answer is nil — so the lookup is
+      # never repeated within a request. Reset with the rest of Current.
+      attribute :session_resolved, :account_resolved
     end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.39.0"
+  VERSION = "0.40.0"
 end

data/lib/standard_id/web/session_manager.rb

@@ -11,12 +11,25 @@ module StandardId
         @reset_session = reset_session
       end
 
+      # Both readers memoise their answer for the rest of the request — including
+      # a nil answer. `Current.session ||= …` never did: an anonymous visitor has
+      # no session, so every `current_account` call (shared props, before_actions,
+      # locale selection, nav helpers — five or six per page) re-ran the lookup.
+      # On one consumer's marketing homepage that was ~6 session-table queries
+      # per anonymous request, the app's single largest query by total time
+      # (fundbright/delivery-ops#598).
       def current_session
-        Current.session ||= load_current_session
+        return Current.session if Current.session_resolved
+
+        Current.session_resolved = true
+        load_current_session
       end
 
       def current_account
-        Current.account ||= load_current_account
+        return Current.account if Current.account_resolved
+
+        Current.account_resolved = true
+        Current.account = load_current_account
       end
 
       def sign_in_account(account, scope_name: nil)
@@ -41,7 +54,18 @@ module StandardId
             scopes << scope_name.to_s unless scopes.include?(scope_name.to_s)
             session[:standard_id_scopes] = scopes
           end
+          # Sign-in supersedes whatever this request already resolved: a guard
+          # or shared prop that asked `current_account` before the sign-in
+          # action ran memoised nil, and that memo must not outlive the sign-in.
+          # The session is known here, so memoise it; the account is NOT
+          # assigned directly — the memo is reset so the next `current_account`
+          # re-derives it through load_current_account, which applies
+          # `config.account_scope` and `strict_loading!(false)` exactly as an
+          # ordinary authenticated request would (review of #327).
           Current.session = browser_session
+          Current.session_resolved = true
+          Current.account = nil
+          Current.account_resolved = false
           emit_session_created(browser_session, account, "browser")
         end
       end
@@ -61,8 +85,18 @@ module StandardId
 
       def clear_session!
         # TODO: make token key names configurable
-        session.delete(:session_token)
-        session.delete(:standard_id_scopes)
+        #
+        # Only touch the Rails session when it is already loaded. Reading or
+        # deleting a key on an unloaded Rack session loads it, and Rack commits
+        # every loaded session on the way out — so on an anonymous request this
+        # used to write a brand-new empty session to the store and stamp a
+        # session cookie on the response, which is what stops any CDN from
+        # caching a public page. If the session was never loaded there is nothing
+        # in it to clear.
+        if rails_session_loaded?
+          session.delete(:session_token)
+          session.delete(:standard_id_scopes)
+        end
         # Delete the cookie outright. Assigning `cookies.encrypted[:session_token] = nil`
         # writes a fresh encrypted blob through the jar's default options (no httponly)
         # on every unauthenticated request, leaving a confusing non-HttpOnly
@@ -72,10 +106,32 @@ module StandardId
         cookies.delete(:remember_token)
 
         Current.session = nil
+        Current.account = nil
+        Current.session_resolved = true
+        Current.account_resolved = true
       end
 
       private
 
+      # A Rack session reports `loaded?`; the plain Hash the specs (and some
+      # hosts' test doubles) hand in does not, and a Hash is always "loaded".
+      def rails_session_loaded?
+        !session.respond_to?(:loaded?) || session.loaded?
+      end
+
+      # Whether the request carries the host app's Rails session cookie at all.
+      # Reading `session[...]` when it does not would make Rack allocate and
+      # then persist an empty session (see clear_session!). Without a request
+      # that can answer, assume it does — the old behaviour.
+      def rails_session_cookie_present?
+        return true unless request.respond_to?(:session_options) && request.respond_to?(:cookies)
+
+        key = request.session_options[:key]
+        return true if key.blank?
+
+        request.cookies.key?(key.to_s)
+      end
+
       # Persist the session token in an encrypted cookie whose lifetime matches
       # the DB session's expires_at, so an authenticated session survives a full
       # browser restart (a bare session cookie would be cleared on browser close,
@@ -117,19 +173,32 @@ module StandardId
             clear_session!
           end
         else
-          clear_session!
+          # Nothing identified a session. Clear stale state only when there is
+          # some — a bare anonymous GET has no cookies to delete and no session
+          # to touch, and touching it is what makes the response uncacheable.
+          clear_session! if stale_session_state?
         end
 
         Current.session
       end
 
+      def stale_session_state?
+        cookies.encrypted[:session_token].present? || cookies[:session_token].present? || cookies[:remember_token].present? ||
+          (rails_session_loaded? && (session[:session_token].present? || session[:standard_id_scopes].present?))
+      end
+
       def load_session_from_session_token
         # Try encrypted cookie first (for Action Cable), then fall back to session (for backward compatibility)
-        session_token = cookies.encrypted[:session_token] || session[:session_token]
+        session_token = cookies.encrypted[:session_token]
+        session_token ||= session[:session_token] if rails_session_loaded? || rails_session_cookie_present?
+        return if session_token.blank?
+
         StandardId::BrowserSession.eager_load(:account).by_token(session_token).first
       end
 
       def load_session_from_remember_token
+        return if cookies[:remember_token].blank?
+
         password_credential = StandardId::PasswordCredential.find_by_token_for(:remember_me, cookies[:remember_token])
         return if password_credential.blank?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.39.0
+  version: 0.40.0
 platform: ruby
 authors:
 - Jaryl Sim