where_is_waldo 0.1.12 → 0.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9b514019f64edaaea98c2d51266e3668f5a3bd270c5727013bb38bd7db51232
-  data.tar.gz: c4313e9f5f1f05b3640c2e019dcbe7883f4a59f027944f6395878baa60bdfdf4
+  metadata.gz: 55b6e1ced7f3e93a1e415bc0e28d10b15a212ad134e3108f585bea84220a1f10
+  data.tar.gz: 6c068bbd05c86ea7c6ba9b2136295f5ef17c02bd19bf9211f8b4ee59a83b17f1
 SHA512:
-  metadata.gz: 02aaa7a93acfa3c4732eec460b1fad4f6361dc0c64e9ed60539914b025d785db4dd4ed8acb8b0e55ae92a4cda116c31acb1f46745c1567196b461470b2ea8e27
-  data.tar.gz: 955493cf1cab229f550e25ffc3a8e54069ba297bf9bf9e0ee6ed0acc5e092bae61c00278b684a44d14833fe23210b0b35409fc2a09f6234cabcd10df2a44bf91
+  metadata.gz: 9d96b99856186d169d3e6c97f4a032f298158ecb9e8532238c40d98a0fc7388d2a3a4eaa195417fe21064d1babc389b1c083bf85dbdfc20a33f5fb50d223d076
+  data.tar.gz: 4f0a4167858defcc5403deb7fafeac5abdb7556af91017fc1e679c952bfb39e067609ca09320353d99663106dba8f0afc9c7740c28642aff3e231057681c6b5f

data/CHANGELOG.md

@@ -5,6 +5,51 @@ Notable changes to where_is_waldo. Format loosely follows
 
 ## Unreleased
 
+## 0.1.14 - 2026-11-06
+
+### Fixed
+
+- **Cable connections were rejected in every app using an external identity
+  server.** `JwtConnection` resolved the connection's subject with
+  `find_by(id: payload["sub"])`. That is correct when `sub` is the application's
+  own user id, but an identity server issues a UUID subject, so the lookup
+  matched nothing and every connection was refused -- which meant no presence
+  and no broadcasting at all.
+
+  The failure was silent: a rejected connection is indistinguishable from a
+  client that never subscribed, and a count of presence rows cannot detect it
+  either, since those rows are TTL-transient and zero is also the healthy idle
+  state.
+
+  Resolution now goes through the host application's identity resolver when it
+  is in that mode, mapping the subject through `users.identity_id`. An
+  application whose presence subject is some other model keeps the
+  primary-key lookup, and an application without corebyscott is untouched.
+
+## 0.1.13 - 2026-11-04
+
+### Documentation
+
+No code changes. This release exists to get the README onto the npm page, which
+only refreshes its rendered README on a new version.
+
+- **The README now says where this came from.** It previously mentioned
+  byscott.io zero times in 543 lines, so the one public, indexed page the
+  project owns pointed back at nothing. Adds a line under the tagline and an
+  About section naming the suite and three sibling tools.
+- **States plainly what the gem requires, and what it does not.** No account, no
+  API key, and no outbound calls of any kind — verified against the shipped
+  code, which contains no HTTP client and no hostnames. The sibling tools linked
+  in that section are hosted services and do require accounts; this does not,
+  and the distinction is now explicit rather than left to the reader.
+- **States that presence data is transient and lives in the consumer's own
+  store.** One table, or Redis keys with a TTL; a session's row is removed once
+  it stops heartbeating. This answers the question a developer actually asks of
+  a presence library — whether it quietly accumulates rows they then have to
+  manage.
+- `homepage` now points at byscott.io. `repository` and `bugs` still point at
+  this public repo, so source and issues stay one click away from the npm page.
+
 ## 0.1.12 - 2026-10-27
 
 ### Fixed

data/README.md

@@ -2,6 +2,9 @@
 
 Real-time presence tracking for Rails + React using ActionCable.
 
+Open source, and built for and used in production by the [byscott.io](https://byscott.io)
+suite of tools for churches, educators, small businesses and families.
+
 [![CI](https://github.com/byscott-io/where_is_waldo/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/byscott-io/where_is_waldo/actions/workflows/ci.yml)
 [![Gem Version](https://img.shields.io/gem/v/where_is_waldo)](https://rubygems.org/gems/where_is_waldo)
 [![npm version](https://img.shields.io/npm/v/@byscott-io/where-is-waldo)](https://www.npmjs.com/package/@byscott-io/where-is-waldo)
@@ -538,6 +541,34 @@ gem guarantees, and what your app must do:
   are gated to transitions. For large or hostile deployments use the Redis
   adapter and consider rate-limiting.
 
+## About
+
+WhereIsWaldo is maintained by Scott Gibson and came out of a real need across
+[byscott.io](https://byscott.io) — a suite of software tools for churches,
+educators, small businesses and families, where several Rails and React apps
+each wanted "who is online right now" without paying for a hosted websocket
+service.
+
+**No account or API key is required, and nothing phones home.** This gem keeps
+no store of its own. Presence lives in one table in your own database, or as
+expiring keys in your own Redis, and it is transient either way — a session's
+row is removed once it stops heartbeating, and Redis keys carry a TTL. The only
+infrastructure it needs is the ActionCable you already run.
+
+The sibling tools below are hosted services and do require an account; this gem
+is a library and does not.
+
+Other tools from the same suite, if a shared backend is what you actually want
+rather than a library:
+
+- **[IssuesByScott](https://issues.byscott.io)** — error reporting, an issue
+  portal your users can file into, and deploy tracking
+- **[BillingByScott](https://billing.byscott.io)** — subscriptions, invoicing
+  and entitlement checks across several apps
+- **[MetricsByScott](https://metrics.byscott.io)** — events, page views and
+  time-varied metrics, with a data warehouse rather than a dashboard you cannot
+  query
+
 ## License
 
 MIT

data/VERSION

@@ -1 +1 @@
-0.1.12
+0.1.14

data/app/channels/where_is_waldo/jwt_connection.rb

@@ -50,13 +50,47 @@ module WhereIsWaldo
       payload = wiw_token_payload
       reject_unauthorized_connection unless payload
 
-      klass = WhereIsWaldo.configuration.subject_class_constant
-      user = klass&.find_by(id: payload["sub"] || payload[:sub])
+      user = wiw_resolve_subject(payload)
       reject_unauthorized_connection unless user
 
       user
     end
 
+    # `sub` is not always this app's primary key.
+    #
+    # Under corebyscott's :identity_server mode it is the identity server's
+    # UUID, so find_by(id:) matches nothing and EVERY cable connection is
+    # rejected -- silently, because a rejected connection is indistinguishable
+    # from a client that never subscribed. Core's resolver maps the UUID through
+    # users.identity_id, the same path its HTTP auth takes, so cable and request
+    # auth cannot disagree about who someone is.
+    #
+    # Only used when the configured subject IS core's user class. An app whose
+    # presence subject is some other model keeps the primary-key lookup, since
+    # core's resolver would hand back a user rather than that subject.
+    def wiw_resolve_subject(payload)
+      klass = WhereIsWaldo.configuration.subject_class_constant
+
+      if wiw_identity_mode? && klass && klass == wiw_core_user_class
+        return ::Corebyscott::IdentityResolver.resolve(payload)
+      end
+
+      klass&.find_by(id: payload["sub"] || payload[:sub])
+    end
+
+    def wiw_identity_mode?
+      defined?(::Corebyscott::IdentityResolver) &&
+        ::Corebyscott.respond_to?(:config) &&
+        ::Corebyscott.config.respond_to?(:auth_mode) &&
+        ::Corebyscott.config.auth_mode.to_s == "identity_server"
+    end
+
+    def wiw_core_user_class
+      return nil unless ::Corebyscott.config.respond_to?(:user_class_constant)
+
+      ::Corebyscott.config.user_class_constant
+    end
+
     # Optional container scoping from the JWT's `cid` claim. nil when the app
     # doesn't scope tokens to a container, or corebyscott isn't present.
     def wiw_container

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: where_is_waldo
 version: !ruby/object:Gem::Version
-  version: 0.1.12
+  version: 0.1.14
 platform: ruby
 authors:
 - Scott Gibson
@@ -79,6 +79,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.2.1
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
 - !ruby/object:Gem::Dependency
   name: redis
   requirement: !ruby/object:Gem::Requirement