standard_id 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 956fc621df693ec184f7d65482d96c4f25d99ae55274b68681c9c6b892bde095
-  data.tar.gz: 0d5c39a196c8c9e8c99adb24fa61552698672f3df4a5bcf3d06d03b2b61e6a46
+  metadata.gz: b1c16f53717e8c9b0d2bcf1095f2387c99b9bfeb9b1327d1b101e2ea140d3eaf
+  data.tar.gz: 59d779aa3fe5a74f639f826505f9d21a845964b6edaedd085397d435241d5fa4
 SHA512:
-  metadata.gz: 584c37aa6aa46abe4a576297d6d754e5632c4b710c59dd1bd2b6f8d7c5c17ac86a8aef109df15fe3de720a7d1be405af31441f833a914b3bc8bfea264b296da5
-  data.tar.gz: 1733a94c80aba6290cc5eabbe7df67f4ff145c5af18e8cb9202cd3d598b5e5569039fc729cdfed3eacfee55908fe36bf4801e706da7c0e8b544666383b7b6863
+  metadata.gz: 4cef892853b6d5d87fe83919582b122e41d525cd20a938cd40444252a6cbf3470bca8aba08b8a6e7a04ed5b5eadc237410a2f03a475ad8b10941531dd7cbde8f
+  data.tar.gz: 7d1c980a1be28688515573053cd91c28afd03119a8d8db41d72be8859d4472f8a3ccf50c5d005376ba8f5a91a2f5bb9f0fd27fd3ed75611682c68a8600db94fa

data/app/controllers/concerns/standard_id/sentry_context.rb

@@ -28,7 +28,9 @@ module StandardId
       return unless respond_to?(:current_account, true) && current_account.present?
 
       context = { id: current_account.id }
-      context[:session_id] = current_session.id if respond_to?(:current_session, true) && current_session.present?
+      if respond_to?(:current_session, true) && current_session.present? && current_session.respond_to?(:id)
+        context[:session_id] = current_session.id
+      end
 
       Sentry.set_user(context)
     end

data/lib/standard_id/authorization_bypass.rb

@@ -6,6 +6,19 @@ module StandardId
       cancancan: :check_authorization
     }.freeze
 
+    # Frameworks where the skip falls through to skip_after_action.
+    # ActionPolicy is NOT listed here because it is handled first via
+    # CLASS_METHOD_SKIP. Only :pundit reaches this branch.
+    AFTER_ACTION_FRAMEWORKS = %i[pundit].freeze
+
+    # ActionPolicy provides a dedicated class method to undo
+    # verify_authorized. Using skip_before_action or skip_after_action
+    # would silently do nothing for ActionPolicy because it manages the
+    # callback through its own DSL.
+    CLASS_METHOD_SKIP = {
+      action_policy: :skip_verify_authorized
+    }.freeze
+
     MUTEX = Mutex.new
     private_constant :MUTEX
 
@@ -30,11 +43,12 @@ module StandardId
 
         MUTEX.synchronize do
           # Guard against duplicate to_prepare registrations if called more than
-          # once (e.g. in tests or misconfigured initializers). skip_before_action
-          # is idempotent so duplicates are harmless, but this keeps things tidy.
+          # once (e.g. in tests or misconfigured initializers). The skip methods
+          # are idempotent so duplicates are harmless, but this keeps things tidy.
           return if @callback_name
 
           @callback_name = resolve_callback(framework, callback)
+          @framework = framework&.to_sym
           # @prepared is intentionally NOT cleared by reset!. This ensures
           # at most one to_prepare block is registered per process lifetime.
           # Trade-off: after reset! + apply (e.g. in tests switching
@@ -64,7 +78,7 @@ module StandardId
       end
 
       # Whether apply has been called. Used by ControllerPolicy.register to
-      # decide if newly loaded controllers need immediate skip_before_action.
+      # decide if newly loaded controllers need an immediate authorization skip.
       def applied?
         MUTEX.synchronize { !@callback_name.nil? }
       end
@@ -72,10 +86,11 @@ module StandardId
       # Apply skips to a single controller. Called by ControllerPolicy.register
       # when a controller is lazily loaded after apply has already been called.
       def apply_to_controller(controller, policy)
-        callback = MUTEX.synchronize { @callback_name }
+        callback, framework = MUTEX.synchronize { [@callback_name, @framework] }
         return unless callback
 
-        controller.skip_before_action callback, raise: false
+        skip_authorization_callback(controller, callback, framework)
+
         if policy == :public
           # authenticate_account! is defined in WebAuthentication, not on API
           # controllers. raise: false ensures this is a safe no-op for API
@@ -94,11 +109,15 @@ module StandardId
       end
 
       # @api private — intended for test isolation only.
-      # NOTE: This clears @callback_name (so applied? returns false and apply
-      # can be called again with a different framework) but intentionally does
-      # NOT clear @prepared, so no additional to_prepare block is registered.
+      # NOTE: This clears @callback_name and @framework (so applied? returns
+      # false and apply can be called again with a different framework) but
+      # intentionally does NOT clear @prepared, so no additional to_prepare
+      # block is registered.
       def reset!
-        MUTEX.synchronize { @callback_name = nil }
+        MUTEX.synchronize do
+          @callback_name = nil
+          @framework = nil
+        end
       end
 
       private
@@ -116,6 +135,29 @@ module StandardId
           raise ArgumentError, "Provide either framework: or callback:"
         end
       end
+
+      # Picks the right skip mechanism based on how the framework registers
+      # its authorization check:
+      #
+      # - ActionPolicy: provides `skip_verify_authorized` class method
+      # - Pundit: uses after_action, so `skip_after_action` is needed
+      # - CanCanCan: uses before_action, so `skip_before_action` works
+      # - Custom callback: assumed to be a before_action (caller can use
+      #   framework: for known frameworks)
+      def skip_authorization_callback(controller, callback, framework)
+        if (class_method = CLASS_METHOD_SKIP[framework])
+          # Engine API controllers inherit from ActionController::API, not the
+          # host app's ApplicationController, so they won't include ActionPolicy.
+          # A controller without ActionPolicy can never have verify_authorized in
+          # its callback chain, so skipping the call is safe — not a silent failure.
+          # This mirrors the `raise: false` intent of the other branches.
+          controller.public_send(class_method) if controller.respond_to?(class_method)
+        elsif AFTER_ACTION_FRAMEWORKS.include?(framework)
+          controller.skip_after_action callback, raise: false
+        else
+          controller.skip_before_action callback, raise: false
+        end
+      end
     end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.5.0"
+  VERSION = "0.5.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Jaryl Sim