volcano-sdk 0.9.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf20d0cdb7959be9f989d8b1f1e5f88b53a065a7b899b42f7c3a09af5d1327c6
-  data.tar.gz: 3350d3a721b2d25b67aaf0a76a8cab45cb1ca26c69d386c600789bb60589cfca
+  metadata.gz: 9c502d5485b551f8308988375a3b89d581b46ef42af03143898afc583395cc0b
+  data.tar.gz: 336f60885935dd30f4ff6886505095f90bfb4d9c7c7b1f572e5511b53e824897
 SHA512:
-  metadata.gz: 94a0671011cb9256c3bf768fe05fbea0e1d49fb8c3d29adb694cc5a01eb83e80fb0d978b4aa1c83919a3b38ca7cdd6069a7af5b41eaefa743622bdc745f68083
-  data.tar.gz: 756140f1665c4f360839a37da9ad15de033cf45373bee40a57b7b109d8d0830094af36974923841d538722869bd9f7fe987c7e3f50a55d5b5f9e657d6106d84f
+  metadata.gz: 7849ada9eaa8cf569961c5a4b750c33610ff46ff0914321a753e09ff2b3b5f969b9879c11db7014199f2e31ba61052b45fa67ef61603b4fa7e427f9857628f84
+  data.tar.gz: 782fbaf15537f564c4349cea3f206c63857b95f8e1b919203784f0e4963a0e31a0ce9739ac10011336847e84e9137b69232379acd96d9ee9e1d8218b14e5c1a1

data/README.md

@@ -440,11 +440,14 @@ client.auth.sign_out
 raise "still signed in" if client.auth.current_session
 ```
 
-`sign_out` uses the access-token session when available, even if a refresh token was supplied.
+Sign-out uses the refresh token directly when the SDK received both credentials together from
+sign-in or a validated refresh. Supplied credentials use the access-token session; on HTTP 401,
+the SDK can refresh once and revoke that same session without adopting the renewed credentials.
 It revokes the captured session and clears the captured in-memory
 session. It succeeds without a request when no session exists. If revocation
-fails, the SDK still clears that session and raises the typed error. A concurrent
-refresh of the same session is cleared; a separate sign-in or adoption remains current.
+fails, the SDK still clears that session and raises the typed error. Sign-out waits for an already-running refresh and uses its validated credentials.
+Later refresh attempts raise `Volcano::Error::SessionChangedError` without a request.
+Concurrent sign-out calls share one result. A separate sign-in or adoption remains current.
 
 ### Invoke a function
 

data/lib/volcano/auth.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'monitor'
-
 module Volcano
   # Authenticates users and updates the client session.
   class Auth
@@ -12,7 +10,6 @@ module Volcano
       @client = client
       @transport = transport
       @api_url = api_url
-      @refresh_lock = Monitor.new
     end
 
     def current_session
@@ -56,6 +53,15 @@ module Volcano
       end
     end
 
+    def refresh_response(refresh_token)
+      Transport.invoke do
+        @transport.auth_refresh(
+          authorization: @client.anon_token,
+          refresh_token: refresh_token
+        )
+      end
+    end
+
     def build_session(payload)
       owned_session(
         access_token: payload.fetch('access_token'),
@@ -65,6 +71,12 @@ module Volcano
       )
     end
 
+    def parse_refresh_session(payload)
+      owned_complete_session(build_session(payload))
+    rescue KeyError, TypeError, NoMethodError, ArgumentError => e
+      raise Error::TransportError, INCOMPLETE_SESSION, cause: e
+    end
+
     def complete_session?(session)
       return false unless session.is_a?(Session)
 

data/lib/volcano/auth_refresh.rb

@@ -52,10 +52,12 @@ module Volcano
 
     def refresh_with_notifications(binding)
       notifications = []
-      @refresh_lock.synchronize do
-        active_generation, = owned_session_binding(binding)
-        perform_refresh(binding, notifications) if active_generation == binding.first
-      end
+      active_generation, = owned_session_binding(binding)
+      binding[1].refresh { perform_refresh(binding, notifications) } if active_generation == binding.first
+      raise Error::SessionChangedError if binding[1].closing?
+    rescue Error::VolcanoError
+      validate_read_failure(binding)
+      raise
     ensure
       # Only the dispatcher owner drains, after refresh coordination is released.
       notifications.each(&:call)
@@ -74,50 +76,48 @@ module Volcano
     def rejected_refresh?(binding, active)
       generation, lineage, = binding
       @rejected_refresh == [generation, lineage] &&
-        active == [generation + 1, lineage + 1, nil]
+        active.first == generation + 1 && active.last.nil?
     end
 
     def perform_refresh(binding, notifications)
+      active = owned_session_binding(binding)
+      return active.last if active.first != binding.first
       raise Error::AuthenticationError, 'No refresh token' unless binding.last.refresh_token
 
-      SessionCredentials.validate_refresh_source(binding.last)
       session = refreshed_session(binding, notifications)
-      stored = @client.store_session_if_current?(
-        session, binding.first, event: :token_refreshed, notifications: notifications
-      )
-      raise Error::SessionChangedError unless stored
+      unless binding[1].closing?
+        @client.store_session_if_current?(
+          session, binding.first, event: :token_refreshed, notifications: notifications
+        )
+      end
+      session
     end
 
     def refreshed_session(binding, notifications)
-      parse_refresh_session(refresh_payload(binding, notifications))
+      _, owner, current = binding
+      verified = owner.verified_pair?(current)
+      SessionCredentials.validate_refresh_source(current, verified: verified)
+      owner.verify_pair(nil)
+      session = parse_refresh_session(refresh_payload(binding, notifications))
+      verify_refreshed_session(owner, current, session)
+      session
+    rescue Error::RateLimitedError
+      owner.verify_pair(current) if verified
+      raise
     end
 
-    def parse_refresh_session(payload)
-      owned_complete_session(build_session(payload))
-    rescue KeyError, TypeError, NoMethodError, ArgumentError => e
-      raise Error::TransportError, INCOMPLETE_SESSION, cause: e
-    end
-
-    def refresh_response(refresh_token)
-      Transport.invoke do
-        @transport.auth_refresh(
-          authorization: @client.anon_token,
-          refresh_token: refresh_token
-        )
-      end
+    def verify_refreshed_session(owner, current, session)
+      SessionCredentials.validate_refresh(current, session)
+      owner.verify_pair(session)
     end
 
     def refresh_payload(binding, notifications)
       Transport.body(refresh_response(binding.last.refresh_token), 200)
     rescue Error::AuthenticationError
-      generation, lineage, = binding
-      cleared = @client.clear_session_if_current?(generation, notifications: notifications)
-      raise Error::SessionChangedError unless cleared
-
-      @rejected_refresh = [generation, lineage]
-      raise
-    rescue Error::VolcanoError
-      owned_session_binding(binding)
+      generation, owner, = binding
+      if !owner.closing? && @client.clear_session_if_current?(generation, notifications: notifications)
+        @rejected_refresh = [generation, owner]
+      end
       raise
     end
   end

data/lib/volcano/auth_sign_out.rb

@@ -5,29 +5,32 @@ module Volcano
   class Auth
     def sign_out
       binding = @client.capture_session_binding
-      return unless binding.last
+      return binding[1].wait_for_sign_out unless binding.last
 
       notifications = []
-      @refresh_lock.synchronize { sign_out_captured(binding, notifications) }
+      binding[1].sign_out do |preceding, pending|
+        sign_out_captured(binding, preceding, pending, notifications)
+      end
     ensure
       notifications&.each(&:call)
     end
 
     private
 
-    def sign_out_captured(binding, notifications)
-      generation, lineage, current = revocation_binding(binding)
-      error = revocation_error(current)
-      lineage = nil unless access_token_session_id(current.access_token)
-      cleared = @client.clear_session_if_current?(generation, lineage: lineage, notifications: notifications)
+    def sign_out_captured(binding, preceding, pending, notifications)
+      generation, owner, = binding
+      current, refresh_error = revocation_credentials(binding, preceding)
+      error = revocation_error(current, owner, pending ? refresh_error : nil, joined: pending)
+      cleared = @client.clear_session_if_current?(generation, lineage: owner, notifications: notifications)
       raise Error::SessionChangedError, cause: error unless cleared
 
       raise error if error
     end
 
-    def revocation_binding(binding)
-      active = @client.capture_session_binding
-      active.last && active[1] == binding[1] ? active : binding
+    def revocation_credentials(binding, preceding)
+      [binding[1].result(preceding) || binding.last, nil]
+    rescue Error::VolcanoError => e
+      [binding.last, e]
     end
 
     def logout_response(refresh_token)
@@ -39,9 +42,11 @@ module Volcano
       end
     end
 
-    def revocation_error(session)
+    def revocation_error(session, owner, refresh_error, joined:)
       session_id = access_token_session_id(session.access_token)
-      return revoke_access_session(session, session_id) if session_id
+      verified = owner.verified_pair?(session)
+      return revoke_access_session(session, session_id, refresh_error, joined: joined) if session_id && !verified
+      return refresh_error if refresh_error && !verified
       return unless session.refresh_token
 
       Transport.body(logout_response(session.refresh_token), 204)
@@ -50,9 +55,10 @@ module Volcano
       e
     end
 
-    def revoke_access_session(session, session_id)
+    def revoke_access_session(session, session_id, refresh_error, joined:)
       error = delete_session_error(session.access_token, session_id)
       return error unless error&.status == 401 && session.refresh_token
+      return refresh_error || error if joined
 
       refreshed = parse_refresh_session(Transport.body(refresh_response(session.refresh_token), 200))
       SessionCredentials.validate_refresh(session, refreshed)

data/lib/volcano/auth_state.rb

@@ -27,7 +27,7 @@ module Volcano
     def initialize(session: nil)
       @mutex = Mutex.new
       @generation = 0
-      @lineage = 0
+      @lineage = SessionOperations.new
       @session = session
       @callbacks = {}
       @next_callback_id = 0
@@ -51,8 +51,9 @@ module Volcano
     def store_if_current?(session, generation, event: :signed_in, notifications: nil, lineage: nil)
       dispatch = @mutex.synchronize do
         return false unless lineage.nil? ? generation == @generation : lineage == @lineage
+        return true if session.nil? && @session.nil?
 
-        enqueue_notification(replace(session, event), event, session)
+        enqueue_notification(replace(session, event, verified_pair: session), event, session)
       end
       return true unless dispatch
 
@@ -80,19 +81,19 @@ module Volcano
 
     private
 
-    def replace(session, event)
+    def replace(session, event, verified_pair: nil)
       SessionCredentials.validate_refresh(@session, session) if event == :token_refreshed
       @session = session
       @generation += 1
-      @lineage += 1 unless event == :token_refreshed
+      @lineage.clear_local_credentials unless session
+      @lineage = SessionOperations.new(verified_pair) if session && event != :token_refreshed
       @callbacks.keys
     end
 
     def register(callback)
-      callback_id = @next_callback_id
       @next_callback_id += 1
-      @callbacks[callback_id] = callback
-      [callback_id, @session]
+      @callbacks[@next_callback_id] = callback
+      [@next_callback_id, @session]
     end
 
     def unsubscribe(callback_id)

data/lib/volcano/realtime/postgres_delivery.rb

@@ -103,8 +103,8 @@ module Volcano
       def postgres_stop?(request) = request.equal?(STOP)
 
       def current_postgres_request?(request)
-        _, lineage, = @realtime.__send__(:capture_session_binding)
-        @subscribed && request.subscription_epoch == @postgres_epoch &&
+        _, lineage, session = @realtime.__send__(:capture_session_binding)
+        @subscribed && session && request.subscription_epoch == @postgres_epoch &&
           request.session_lineage == lineage
       end
     end

data/lib/volcano/session.rb

@@ -28,16 +28,15 @@ module Volcano
     end
     private_class_method :credential
 
-    def self.validate_refresh_source(current)
-      return if current.user_id || session_id(current.access_token)
+    def self.validate_refresh_source(current, verified: false)
+      return if verified || session_id(current.access_token)
 
-      raise Error::AuthenticationError, 'Cannot refresh unknown identity without a session identifier'
+      raise Error::AuthenticationError, 'Cannot refresh supplied credentials without a session identifier'
     end
 
     def self.validate_refresh(current, refreshed)
       return unless current
 
-      validate_refresh_source(current)
       expected = session_id(current.access_token)
       if expected && expected != session_id(refreshed&.access_token)
         raise Error::AuthenticationError, 'Refreshed credentials belong to a different server session'

data/lib/volcano/session_operations.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require 'English'
+
+module Volcano
+  # Keeps refresh and revocation attached to one explicit sign-in/adoption.
+  class SessionOperations
+    Outcome = Struct.new(:done, :value, :error)
+    private_constant :Outcome
+
+    def initialize(verified = nil)
+      @mutex = Mutex.new
+      @condition = ConditionVariable.new
+      @refresh = nil
+      @sign_out = nil
+      @locally_cleared = false
+      verify_pair(verified)
+    end
+
+    def verify_pair(session)
+      @mutex.synchronize do
+        @verified_pair = session && [session.access_token, session.refresh_token].freeze unless @locally_cleared
+      end
+    end
+
+    def clear_local_credentials
+      @mutex.synchronize do
+        return if @sign_out
+
+        @locally_cleared = true
+        @verified_pair = nil
+        @refresh = nil if @refresh&.done
+      end
+    end
+
+    def verified_pair?(session)
+      @mutex.synchronize { session.refresh_token && @verified_pair == [session.access_token, session.refresh_token] }
+    end
+
+    def closing? = @mutex.synchronize { !@sign_out.nil? }
+
+    def refresh(&)
+      operation, owner = @mutex.synchronize do
+        raise Error::SessionChangedError if @sign_out || @locally_cleared
+        next [@refresh, false] if @refresh && !@refresh.done
+
+        @refresh = Outcome.new(false)
+        [@refresh, true]
+      end
+      execute(operation, owner, &)
+    end
+
+    def sign_out
+      operation, owner, preceding, pending = @mutex.synchronize do
+        first = @sign_out.nil?
+        @sign_out ||= Outcome.new(false)
+        [@sign_out, first, @refresh, @refresh && !@refresh.done]
+      end
+      execute(operation, owner) do
+        yield(preceding, pending)
+      ensure
+        @mutex.synchronize { @verified_pair = @refresh = nil }
+      end
+    end
+
+    def wait_for_sign_out
+      operation = @mutex.synchronize { @sign_out unless @sign_out&.done }
+      result(operation)
+    end
+
+    def result(operation)
+      return unless operation
+
+      @mutex.synchronize { @condition.wait(@mutex) until operation.done }
+      raise operation.error if operation.error
+
+      operation.value
+    end
+
+    private
+
+    def execute(operation, owner)
+      return result(operation) unless owner
+
+      completed = false
+      begin
+        value = yield
+        completed = true
+      ensure
+        complete(operation, value, completed ? nil : $ERROR_INFO)
+      end
+      value
+    end
+
+    def complete(operation, value, error)
+      @mutex.synchronize do
+        operation.value = value
+        operation.error = error
+        operation.done = true
+        @refresh = nil if @locally_cleared && @refresh == operation
+        @condition.broadcast
+      end
+    end
+  end
+end

data/lib/volcano/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Volcano
-  VERSION = '0.9.0'
+  VERSION = '0.9.1'
 end

data/lib/volcano.rb

@@ -7,6 +7,7 @@ require_relative 'volcano/session'
 require_relative 'volcano/function_response'
 require_relative 'volcano/log_responses'
 require_relative 'volcano/storage_models'
+require_relative 'volcano/session_operations'
 require_relative 'volcano/auth_state'
 require_relative 'volcano/errors'
 require_relative 'volcano/redaction'
@@ -53,7 +54,7 @@ require_relative 'volcano/client'
 # Public namespace for the Volcano Ruby SDK.
 module Volcano
   private_constant :GeneratedTransport, :LockAutoRenewal, :LockLeaseClock, :LockRenewer, :LockSession,
-                   :Redaction
+                   :Redaction, :SessionOperations
 
   Realtime.private_constant :Protocol, :ProtocolDispatch, :ProtocolPublicationDispatch, :ProtocolRecovery,
                             :ProtocolRecoveryDispatch, :ProtocolRecoveryPosition

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: volcano-sdk
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Kong
@@ -576,6 +576,7 @@ files:
 - lib/volcano/realtime/reconnect.rb
 - lib/volcano/redaction.rb
 - lib/volcano/session.rb
+- lib/volcano/session_operations.rb
 - lib/volcano/sign_up_result.rb
 - lib/volcano/storage.rb
 - lib/volcano/storage_models.rb