standard_id 0.43.1 → 0.43.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8003e8ad18d3a88d9684bb3877d88bbc1d9d207a897776e6ef3a6cd01b0f1191
-  data.tar.gz: 3fb388482c096695f36d79ee02e122e1cbede9fc1d11b14c6236a4d423a82a0b
+  metadata.gz: 4bb59a29db3ed35482b44a1a0755a3827d7e02a6ad3a78bad5e5bd22e309d048
+  data.tar.gz: 93491ec90c91e2fdc6cf900bc62f9475ee786c723f4591dc40446964fbac1492
 SHA512:
-  metadata.gz: 2aade7f1bba3cb85827120d4ac19e55b0a2a039955097cd43af6ef75a84f1516080c4e6c0fc36a87d15731bb332603eab987c93130e69e2e2f5701a5ac929053
-  data.tar.gz: c0a8bc153ac8db1de5f5186fb014e4ed89e0b5db06ef7e295ee276f032fc59ec39a591eb6e54e440263a22d43faf8b426f6e1acf4ab09fed72870e96c4e17f85
+  metadata.gz: 0daceb3e839301ec3b294b8aa36af72441ec5b52ea82bcdcb7066fbc1bfef97cb5efaa11d62f729995c4a7ad22b22afd946e3ed1ff4999fa694a3dc2446b8a50
+  data.tar.gz: ab971a917f3ea552ca3c54d6928a88086bfef17066131cb727a12df721d6bfd2988fb348a33ded3fd529d09102ea053b904ff5146129e9b5008e10e64d7b2f15

data/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.43.2] - 2026-09-25
+
+### Fixed
+
+- **`CleanupExpiredSessionsJob` failed on every run once an expired session had a refresh token** (sidekick-web SIDEKICK-WEB-3K / cron monitor SIDEKICK-WEB-3M: `PG::ForeignKeyViolation … violates foreign key constraint "fk_rails_db44ba6f6e" on table "standard_id_refresh_tokens"`). `standard_id_refresh_tokens.session_id` references `standard_id_sessions` with no `ON DELETE` action, and `Session.where(...).delete_all` skipped the model's `dependent: :nullify`. This affected every host that schedules the job, directly or through `CleanupAllJob`, and nothing was ever cleaned up. Now, per batch of 1,000 (`batch_size:`), in one transaction, with the candidate rows re-checked under `FOR UPDATE SKIP LOCKED`:
+  - **An expired session that still has a live refresh token (unrevoked, unexpired) is kept.** Refresh tokens deliberately outlive their session's expiry: `RefreshTokenFlow#validate_parent_session!` checks revocation, not expiry, since 0.35.x, so `refresh_token_lifetime` alone decides how long a client stays signed in (jumpdrive-web runs 1-day browser sessions against 30-day refresh tokens). Deleting such a session would detach its token and lose "revoking this session ends its access". Revoking the token, as `Session#destroy` does, would sign the client out early. The session is collected on a later run, once its tokens are dead, so at most `refresh_token_lifetime` after it would otherwise have gone.
+  - **Dead refresh tokens (revoked or expired) of the sessions being deleted are detached** (`session_id` → `NULL`, as `dependent: :nullify` does) rather than deleted. `CleanupExpiredRefreshTokensJob` removes them on its own window, and until then a replayed revoked token still triggers reuse detection.
+  - A host whose copy of the migration added `on_delete: :nullify` to that FK (sidekick-web's `db/schema.rb` shows one, although its production constraint evidently has none) no longer has live tokens silently detached from their sessions either.
+- The other cleanup jobs had no such hazard. Nothing references `standard_id_authorization_codes` or `standard_id_code_challenges`, and the only foreign key into `standard_id_refresh_tokens` is its own `previous_token_id`, which is `ON DELETE SET NULL`. `standard_id_refresh_tokens.session_id` is the only foreign key into `standard_id_sessions`, in the gem, standard_id-provider and all five apps.
+
+### Changed
+
+- **Requires Rails 8.1** (`rails >= 8.1`, was `>= 8.0`; #344, merged since 0.43.1). All five consumer apps already run Rails 8.1.3.1, and 8.0 was never tested in CI.
+
+### Upgrade notes
+
+Bump only. The first run after upgrading deletes, in batches, the backlog of expired sessions the job never managed to remove.
+
 ## [0.43.1] - 2026-09-24
 
 Fixes found while shipping 0.43.0. **Take this instead of 0.43.0** — hosts on `c.passwordless.delivery = :built_in` with the WebEngine mounted (jumpdrive-web, nutripod-web) would otherwise email email-verification codes as "your sign-in code".

data/app/jobs/standard_id/cleanup_expired_sessions_job.rb

@@ -2,14 +2,70 @@ module StandardId
   class CleanupExpiredSessionsJob < ApplicationJob
     queue_as :default
 
+    DEFAULT_BATCH_SIZE = 1_000
+
     # Delete sessions that expired more than `grace_period_seconds` ago.
     # A grace period avoids deleting sessions that just expired and might
     # still be referenced in in-flight requests.
     # Accepts integer seconds for reliable ActiveJob serialization across all queue adapters.
-    def perform(grace_period_seconds: 7.days.to_i)
+    #
+    # Refresh tokens reference their session (standard_id_refresh_tokens.session_id,
+    # a foreign key with no ON DELETE action in the gem's migration), and
+    # `delete_all` skips the model's `dependent: :nullify`, so a bare delete
+    # failed the whole run once any expired session had a refresh token
+    # (sidekick-web SIDEKICK-WEB-3K). Per batch, in one transaction:
+    #
+    # * An expired session that still has a LIVE refresh token (unrevoked,
+    #   unexpired) is kept. Refresh tokens deliberately outlive their session's
+    #   expiry — RefreshTokenFlow#validate_parent_session! checks revocation,
+    #   not expiry, so refresh_token_lifetime alone governs how long a client
+    #   stays signed in. Deleting the session would detach the token from it and
+    #   lose "revoking this session ends its access"; revoking the token (what
+    #   Session#destroy does) would sign the client out early. The session is
+    #   collected on a later run, once its tokens are dead — at most
+    #   refresh_token_lifetime later.
+    # * Dead refresh tokens (revoked or expired) of the sessions being deleted
+    #   are detached (`session_id` → NULL, the model's `dependent: :nullify`),
+    #   not deleted: CleanupExpiredRefreshTokensJob removes them on its own
+    #   window, and until then a replayed revoked token still triggers reuse
+    #   detection.
+    #
+    # Batches (`in_batches`) keep each transaction and its locks small.
+    def perform(grace_period_seconds: 7.days.to_i, batch_size: DEFAULT_BATCH_SIZE)
       cutoff = grace_period_seconds.seconds.ago
-      deleted = StandardId::Session.where("expires_at < ?", cutoff).delete_all
+      deleted = 0
+
+      StandardId::Session.where("expires_at < ?", cutoff).in_batches(of: batch_size) do |batch|
+        deleted += delete_batch(batch.pluck(:id), cutoff)
+      end
+
       Rails.logger.info("[StandardId] Cleaned up #{deleted} expired sessions older than #{cutoff}")
     end
+
+    private
+
+    def delete_batch(candidate_ids, cutoff)
+      StandardId::Session.transaction do
+        # Re-check under a row lock: a sign-in may have revived one of these
+        # rows (OauthSessionPersistence reuses an expired, unrevoked device
+        # session and bumps expires_at) or issued it a refresh token since the
+        # batch was read. SKIP LOCKED leaves a row another transaction holds for
+        # the next run. (SQLite ignores the lock clause; it serialises writers.)
+        ids = StandardId::Session
+          .where(id: candidate_ids)
+          .where("expires_at < ?", cutoff)
+          .where.not(id: live_refresh_tokens.select(:session_id))
+          .lock("FOR UPDATE SKIP LOCKED")
+          .pluck(:id)
+        next 0 if ids.empty?
+
+        StandardId::RefreshToken.where(session_id: ids).update_all(session_id: nil)
+        StandardId::Session.where(id: ids).delete_all
+      end
+    end
+
+    def live_refresh_tokens
+      StandardId::RefreshToken.active.where.not(session_id: nil)
+    end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.43.1"
+  VERSION = "0.43.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.43.1
+  version: 0.43.2
 platform: ruby
 authors:
 - Jaryl Sim
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '8.0'
+        version: '8.1'
 - !ruby/object:Gem::Dependency
   name: bcrypt
   requirement: !ruby/object:Gem::Requirement
@@ -345,7 +345,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A comprehensive authentication engine for Rails, built on the security primitives
   introduced in Rails 8.