upkeep-rails 0.2.5-aarch64-linux-gnu

data/lib/upkeep/rails/activation_token.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "active_support/message_verifier"
+require "securerandom"
+
+module Upkeep
+  module Rails
+    module ActivationToken
+      PURPOSE = "upkeep-subscription-activation"
+
+      module_function
+
+      def generate(subscription)
+        subscription_id = subscription.respond_to?(:id) ? subscription.id : subscription
+        verifier.generate(
+          { "subscription_id" => subscription_id.to_s },
+          purpose: PURPOSE,
+          expires_in: Upkeep::Rails.configuration.activation_token_expires_in
+        )
+      end
+
+      def valid_for_subscription?(token, subscription_id)
+        payload = verifier.verified(token.to_s, purpose: PURPOSE)
+        token_subscription_id(payload) == subscription_id.to_s
+      end
+
+      def token_subscription_id(payload)
+        return unless payload.respond_to?(:[])
+
+        payload["subscription_id"] || payload[:subscription_id]
+      end
+
+      def verifier
+        rails_message_verifier || fallback_verifier
+      end
+
+      def rails_message_verifier
+        return unless defined?(::Rails) && ::Rails.respond_to?(:application)
+        return unless ::Rails.application.respond_to?(:message_verifier)
+
+        ::Rails.application.message_verifier(PURPOSE)
+      rescue StandardError
+        nil
+      end
+
+      def fallback_verifier
+        @fallback_verifier ||= ActiveSupport::MessageVerifier.new(fallback_secret)
+      end
+
+      def fallback_secret
+        @fallback_secret ||= SecureRandom.hex(64)
+      end
+    end
+  end
+end

data/lib/upkeep/rails/cable/channel.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "action_cable"
+require "active_support/notifications"
+
+module Upkeep
+  module Rails
+    module Cable
+      class Channel < ::ActionCable::Channel::Base
+        SUBSCRIBE_NOTIFICATION = "subscribe_channel.upkeep"
+
+        # Liveness heartbeat: a connected page touches its subscription row on
+        # this interval, keeping updated_at fresh so opportunistic pruning only
+        # ever removes abandoned subscriptions. Invariant: connected =>
+        # touched at least every HEARTBEAT_INTERVAL => retained, so this must
+        # stay far below config.subscription_ttl (20 minutes vs a 24 hour
+        # default). It is a constant because ActionCable fixes periodic timer
+        # intervals at class load, before app configuration is readable.
+        HEARTBEAT_INTERVAL = 20 * 60
+
+        periodically :touch_upkeep_subscription, every: HEARTBEAT_INTERVAL
+
+        def subscribed
+          if ActiveSupport::Notifications.notifier.listening?(SUBSCRIBE_NOTIFICATION)
+            instrumented_subscribe
+          else
+            subscribe_without_instrumentation
+          end
+        end
+
+        def unsubscribed
+          Upkeep::Rails.subscriptions.unregister(subscription_id)
+        rescue KeyError
+          nil
+        end
+
+        private
+
+        # Cheap liveness touch (update_columns on the subscription row). Must
+        # never raise into the cable process; a missed heartbeat just leaves
+        # the subscription for a later beat or the opportunistic trim.
+        def touch_upkeep_subscription
+          Upkeep::Rails.subscriptions.touch(subscription_id)
+          nil
+        rescue StandardError
+          nil
+        end
+
+        def instrumented_subscribe
+          payload = { subscription_id: safe_subscription_id }
+          ActiveSupport::Notifications.instrument(SUBSCRIBE_NOTIFICATION, payload) do
+            subscribe_without_instrumentation(payload: payload)
+          end
+        end
+
+        def subscribe_without_instrumentation(payload: nil)
+          id = subscription_id
+          payload[:subscription_id] = id if payload
+          unless measure(payload, :activation_token_ms) { valid_activation_token?(id) }
+            return reject_upkeep_subscription(payload, "invalid_activation_token")
+          end
+
+          subscription = measure(payload, :fetch_ms) { Upkeep::Rails.subscriptions.fetch(id) }
+          authorized = measure(payload, :authorization_ms) { authorized_subscription?(subscription) }
+          unless authorized
+            return reject_upkeep_subscription(payload, "unauthorized_identity")
+          end
+
+          measure(payload, :activation_ms) { Upkeep::Rails.subscriptions.activate(id) }
+          stream_count = measure(payload, :stream_attach_ms) { attach_streams(subscription) }
+          payload[:stream_count] = stream_count if payload
+        rescue KeyError
+          reject_upkeep_subscription(payload, missing_activation_token? ? "missing_activation_token" : "missing_subscription")
+        rescue UnidentifiedSubscriber
+          reject_upkeep_subscription(payload, "unidentified_subscriber")
+        end
+
+        def reject_upkeep_subscription(payload, reason)
+          payload[:rejected] = true if payload
+          payload[:reject_reason] = reason if payload
+          log_subscription_rejection(reason)
+          reject
+        end
+
+        def attach_streams(subscription)
+          stream_from stream_name_for(subscription)
+          count = 1
+          shared_stream_names_for(subscription).each do |stream_name|
+            stream_from stream_name
+            count += 1
+          end
+          count
+        end
+
+        def measure(payload, key)
+          return yield unless payload
+
+          started_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          yield
+        ensure
+          payload[key] = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started_at) * 1000.0).round(3) if payload && started_at
+        end
+
+        def safe_subscription_id
+          subscription_id
+        rescue KeyError
+          nil
+        end
+
+        def subscription_id
+          params.fetch(:subscription_id)
+        end
+
+        def activation_token
+          params.fetch(:activation_token)
+        rescue KeyError
+          @missing_activation_token = true
+          raise
+        end
+
+        def missing_activation_token?
+          @missing_activation_token == true
+        end
+
+        def valid_activation_token?(id)
+          ActivationToken.valid_for_subscription?(activation_token, id)
+        end
+
+        def log_subscription_rejection(reason)
+          return unless defined?(::Rails) && ::Rails.respond_to?(:logger) && ::Rails.logger
+
+          message = +"[upkeep] subscription rejected (#{reason}) subscription_id=#{safe_subscription_id.inspect}."
+          if reason == "missing_activation_token"
+            message << " If this started after upgrading upkeep-rails, " \
+              "refresh app/javascript/upkeep/subscription.js from the install generator."
+          end
+          ::Rails.logger.warn(message)
+        end
+
+        def authorized_subscription?(subscription)
+          return true if anonymous_public_subscription?(subscription)
+          return true unless metadata_value(subscription, :identity_mode)
+
+          SubscriberIdentity.derive_for_subscription(connection, subscription).subscriber_id == subscription.subscriber_id
+        end
+
+        def anonymous_public_subscription?(subscription)
+          metadata_value(subscription, :identity_mode) == SubscriberIdentity::ANONYMOUS_PUBLIC_MODE
+        end
+
+        def stream_name_for(subscription)
+          Delivery::ActionCableAdapter.subscription_stream_name_for(subscription.id)
+        end
+
+        def shared_stream_names_for(subscription)
+          metadata_value(subscription, :shared_stream_names) || []
+        end
+
+        def metadata_value(subscription, key)
+          subscription.metadata[key] || subscription.metadata[key.to_s]
+        end
+      end
+    end
+  end
+end

data/lib/upkeep/rails/cable/subscriber_identity.rb

@@ -0,0 +1,361 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "securerandom"
+
+module Upkeep
+  module Rails
+    module Cable
+      class UnidentifiedSubscriber < StandardError; end
+
+      Identity = Data.define(:subscriber_id, :stream_name, :components)
+      Decision = Data.define(:mode, :anonymous, :deopt_reason, :identity_sources, :identity_names)
+
+      class SubscribeContext
+        def initialize(connection)
+          @action_cable_connection = connection
+        end
+
+        def session
+          action_cable_request.session
+        end
+
+        def cookies
+          action_cable_request.cookies
+        end
+
+        def method_missing(name, *args, &block)
+          if action_cable_connection.respond_to?(name)
+            action_cable_connection.public_send(name, *args, &block)
+          else
+            super
+          end
+        end
+
+        def respond_to_missing?(name, include_private = false)
+          action_cable_connection.respond_to?(name, false) || super
+        end
+
+        private
+
+        attr_reader :action_cable_connection
+
+        # ActionCable::Connection::Base keeps `request` private on Rails
+        # 7.1-8.x but exposes `env` as a public attr_reader; the adapterized
+        # connection on Rails main exposes both publicly. Prefer a public
+        # `request`, otherwise build one from the public Rack env the same
+        # way Action Cable does. Never reach into private connection API.
+        def action_cable_request
+          @action_cable_request ||=
+            if action_cable_connection.respond_to?(:request)
+              action_cable_connection.request
+            elsif action_cable_connection.respond_to?(:env)
+              ::ActionDispatch::Request.new(rails_rack_env)
+            else
+              raise UnidentifiedSubscriber,
+                "ActionCable connection exposes neither a public request nor a public env"
+            end
+        end
+
+        def rails_rack_env
+          env = action_cable_connection.env
+          return env unless defined?(::Rails.application) && ::Rails.application
+
+          ::Rails.application.env_config.merge(env)
+        end
+      end
+
+      module SubscriberIdentity
+        ANONYMOUS_PUBLIC_MODE = "anonymous_public"
+        IDENTIFIED_MODE = "identified"
+        DECLARATION_REQUIRED_SOURCES = %w[Current.user current_attribute warden_user].freeze
+
+        module_function
+
+        def derive(connection)
+          derive_all(connection).last
+        end
+
+        def derive_all(connection)
+          components = subscribe_components(connection, configuration.identity_definitions)
+          raise UnidentifiedSubscriber, "ActionCable connection has no declared Upkeep identities" if components.empty?
+
+          [for_components(components)]
+        end
+
+        def derive_for_subscription(connection, subscription)
+          names = metadata_value(subscription, :identity_names) || []
+          definitions = names.map { |name| configuration.identity_definition(name) }
+          components = subscribe_components(connection, definitions)
+          raise UnidentifiedSubscriber, "ActionCable connection did not resolve subscription identities #{names.inspect}" if components.empty?
+
+          for_components(components)
+        end
+
+        def derive_from_request(request, recorder:, decision: decision_for(request, recorder: recorder))
+          components = if decision.anonymous
+            anonymous_components
+          else
+            recorder_components(recorder)
+          end
+
+          if components.empty?
+            raise UnidentifiedSubscriber,
+              "subscription has identity dependencies but no declared Upkeep identity mapping"
+          end
+
+          for_components(components)
+        end
+
+        def decision_for(_request = nil, recorder:)
+          configured_dependencies = configured_identity_dependencies(recorder)
+          undeclared_dependencies = undeclared_identity_dependencies(recorder)
+
+          if configured_dependencies.any?
+            Decision.new(
+              IDENTIFIED_MODE,
+              false,
+              "identity_dependencies_present",
+              configured_dependencies.map { |definition, _dependency| definition.source.to_s }.uniq.sort,
+              configured_dependencies.map { |definition, _dependency| definition.name.to_s }.uniq.sort
+            )
+          elsif undeclared_dependencies.any?
+            Decision.new(
+              IDENTIFIED_MODE,
+              false,
+              "identity_setup_required",
+              undeclared_dependencies.map { |dependency| dependency.source.to_s }.uniq.sort,
+              []
+            )
+          else
+            Decision.new(
+              ANONYMOUS_PUBLIC_MODE,
+              true,
+              nil,
+              [],
+              []
+            )
+          end
+        end
+
+        def identifier_components(connection)
+          identifiers = Array(connection.identifiers)
+          identifiers.map { |name| component_for(name, connection.public_send(name)) }
+        end
+
+        def for_identifiers(identifiers)
+          for_components(identifiers.map { |name, value| component_for(name, value) })
+        end
+
+        def for_components(components)
+          canonical_bytes = JSON.generate(components.sort_by { |component| component.fetch(:name) })
+          subscriber_id = "action_cable:#{Digest::SHA256.hexdigest(canonical_bytes)}"
+
+          Identity.new(
+            subscriber_id,
+            Delivery::ActionCableAdapter.stream_name_for(subscriber_id),
+            components
+          )
+        end
+
+        def recorder_components(recorder)
+          components_by_name = Hash.new { |hash, key| hash[key] = [] }
+          configured_identity_dependencies(recorder).each do |definition, dependency|
+            component = component_for_dependency(definition, dependency)
+            components_by_name[definition.name] << component if component
+          end
+
+          components_by_name.map do |name, components|
+            unique_components = components.uniq
+            if unique_components.size > 1
+              raise UnidentifiedSubscriber, "captured identity :#{name} changed during request"
+            end
+
+            unique_components.first
+          end.compact
+        end
+
+        def anonymous_components
+          [ scalar_component(:anonymous_public_subscription, SecureRandom.uuid) ]
+        end
+
+        def identity_dependencies(recorder)
+          return [] unless recorder
+
+          recorder.graph.dependency_nodes
+            .map(&:payload)
+            .select { |dependency| Dependencies.partitioning_identity?(dependency) }
+            .uniq(&:cache_key)
+        end
+
+        def configured_identity_dependencies(recorder)
+          definitions = configuration.identity_definitions
+          return [] if definitions.empty?
+
+          identity_dependencies(recorder).flat_map do |dependency|
+            definitions.select { |definition| definition.matches_dependency?(dependency) }
+              .reject { |definition| definition.absent_dependency?(dependency) }
+              .map { |definition| [definition, dependency] }
+          end
+        end
+
+        def undeclared_identity_dependencies(recorder)
+          identity_dependencies(recorder).select do |dependency|
+            declaration_required_dependency?(dependency) &&
+              configured_identity_dependencies_for_dependency(dependency).empty?
+          end
+        end
+
+        def configured_identity_dependencies_for_dependency(dependency)
+          configuration.identity_definitions.select { |definition| definition.matches_dependency?(dependency) }
+        end
+
+        def declaration_required_dependency?(dependency)
+          DECLARATION_REQUIRED_SOURCES.include?(dependency.source.to_s)
+        end
+
+        def component_for_dependency(definition, dependency)
+          if definition.absent_dependency?(dependency)
+            raise UnidentifiedSubscriber, "captured identity :#{definition.name} from #{definition.source_label} is absent"
+          end
+
+          identity_component(definition.name, dependency.key.fetch(:value))
+        end
+
+        def subscribe_components(connection, definitions)
+          definitions.filter_map do |definition|
+            value = call_subscribe_block(definition, connection)
+            if definition.absent?(value)
+              raise UnidentifiedSubscriber, "subscribe identity :#{definition.name} from #{definition.source_label} is absent"
+            end
+
+            identity_component(definition.name, subscribe_identity_value(definition, value))
+          end
+        end
+
+        def call_subscribe_block(definition, connection)
+          block = definition.subscribe_block
+          context = SubscribeContext.new(connection)
+          block.arity == 1 ? block.call(context) : context.instance_exec(&block)
+        end
+
+        def subscribe_identity_value(definition, value)
+          case definition.source
+          when :session, :cookie
+            Dependencies.private_fingerprint(value)
+          else
+            canonical_identity_value(value)
+          end
+        end
+
+        def identity_component(name, value)
+          {
+            name: name.to_s,
+            kind: "identity",
+            value: normalize_component_value(value)
+          }
+        end
+
+        def canonical_identity_value(value)
+          case value
+          when nil, true, false, Numeric, String, Symbol
+            value
+          when Array
+            value.map { |item| canonical_identity_value(item) }
+          when Hash
+            value.keys.sort_by(&:to_s).to_h { |key| [key.to_s, canonical_identity_value(value.fetch(key))] }
+          else
+            model_identity = Dependencies.model_identity(value)
+            return model_identity if model_identity
+
+            return { global_id: value.to_gid_param } if value.respond_to?(:to_gid_param)
+
+            raise UnidentifiedSubscriber, "identity value #{value.class.name} has no canonical identity"
+          end
+        end
+
+        def normalize_component_value(value)
+          case value
+          when Hash
+            value.keys.sort_by(&:to_s).to_h { |key| [key.to_s, normalize_component_value(value.fetch(key))] }
+          when Array
+            value.map { |item| normalize_component_value(item) }
+          when Symbol
+            value.to_s
+          else
+            value
+          end
+        end
+
+        def model_component(name, identity)
+          return unless identity.is_a?(Hash) && identity[:model] && identity[:id]
+
+          {
+            name: name.to_s,
+            kind: "model",
+            model: identity.fetch(:model),
+            id: identity.fetch(:id).to_s
+          }
+        end
+
+        def component_for(name, value)
+          raise UnidentifiedSubscriber, "ActionCable identifier #{name} is nil" if value.nil?
+
+          if active_record?(value)
+            active_record_component(name, value)
+          elsif scalar?(value)
+            scalar_component(name, value)
+          elsif value.respond_to?(:to_gid_param)
+            global_id_component(name, value)
+          else
+            raise UnidentifiedSubscriber, "ActionCable identifier #{name} has no canonical identity"
+          end
+        end
+
+        def active_record?(value)
+          defined?(::ActiveRecord::Base) && value.is_a?(::ActiveRecord::Base)
+        end
+
+        def active_record_component(name, record)
+          raise UnidentifiedSubscriber, "ActionCable identifier #{name} is an unsaved record" unless record.id
+
+          model_component(name, model: record.class.name, id: record.id)
+        end
+
+        def scalar?(value)
+          value.is_a?(String) ||
+            value.is_a?(Symbol) ||
+            value.is_a?(Integer) ||
+            value == true ||
+            value == false
+        end
+
+        def scalar_component(name, value)
+          {
+            name: name.to_s,
+            kind: "scalar",
+            class: value.class.name,
+            value: value.to_s
+          }
+        end
+
+        def global_id_component(name, value)
+          {
+            name: name.to_s,
+            kind: "global_id",
+            value: value.to_gid_param
+          }
+        end
+
+        def metadata_value(subscription, key)
+          subscription.metadata[key] || subscription.metadata[key.to_s]
+        end
+
+        def configuration
+          Upkeep::Rails.configuration
+        end
+      end
+    end
+  end
+end

data/lib/upkeep/rails/cable.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require_relative "cable/subscriber_identity"
+require_relative "cable/channel"

data/lib/upkeep/rails/client_subscription.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "cgi"
+
+module Upkeep
+  module Rails
+    module ClientSubscription
+      CHANNEL = "Upkeep::Rails::Cable::Channel"
+      ID_HEADER = "X-Upkeep-Subscription-Id"
+      TOKEN_HEADER = "X-Upkeep-Subscription-Token"
+      CHANNEL_HEADER = "X-Upkeep-Subscription-Channel"
+      STREAM_HEADER = "X-Upkeep-Subscription-Stream"
+      ACTION_HEADER = "X-Upkeep-Subscription-Action"
+
+      module_function
+
+      def inject(html, identity:, subscription:)
+        marker = marker_for(identity: identity, subscription: subscription)
+        insert_before_closing("body", html, marker) ||
+          "#{html}#{marker}"
+      end
+
+      # The payload travels as attributes (like turbo-cable-stream-source), never
+      # as text content, so it can't show up as page text when JS is absent.
+      def marker_for(identity:, subscription:)
+        attributes = payload_for(identity: identity, subscription: subscription).merge(
+          "id" => "upkeep-subscription-source"
+        )
+
+        [
+          %(<upkeep-subscription-source ),
+          attributes.map { |name, value| %(#{name}="#{CGI.escapeHTML(value.to_s)}") }.join(" "),
+          %( hidden style="display:none" data-upkeep-subscription>),
+          %(</upkeep-subscription-source>)
+        ].join
+      end
+
+      def headers_for(identity:, subscription:)
+        payload = payload_for(identity: identity, subscription: subscription)
+        {
+          ID_HEADER => payload.fetch("subscription-id"),
+          TOKEN_HEADER => payload.fetch("activation-token"),
+          CHANNEL_HEADER => payload.fetch("channel"),
+          STREAM_HEADER => payload.fetch("stream-name")
+        }
+      end
+
+      def payload_for(identity:, subscription:)
+        {
+          "channel" => CHANNEL,
+          "subscription-id" => subscription.id,
+          "activation-token" => ActivationToken.generate(subscription),
+          "stream-name" => identity.stream_name
+        }
+      end
+
+      def insert_before_closing(tag, html, marker)
+        index = html.rindex(%(</#{tag}>)) || html.rindex(%(</#{tag.upcase}>))
+        return unless index
+
+        "#{html[0...index]}#{marker}#{html[index..]}"
+      end
+    end
+  end
+end