where_is_waldo 0.1.13 → 0.1.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d06a950b27e51d7506062dc38518912b7b631a91be886eb29801f01e0ac438ac
-  data.tar.gz: fb1f82a4742a5099eee4d7a70f9d5445010dc52bd17408cfe2451363c04051a2
+  metadata.gz: 37761c093f1789ab27d7bc83b57b965deb0039a538e1dcef1450bb8680a5328d
+  data.tar.gz: 23fe780af170d951b2b961cc6674224030f1169247a328e1e37b98a16aceb1b3
 SHA512:
-  metadata.gz: 5bfd8270b07bed9227be801b90b1f354a30a1eeaf748a3b7b7ff0d1a551bb0f3d6685792862f7c8e5676d411ea263b14fe64c67a76be422b0e55055a01672900
-  data.tar.gz: '053823564618b09793ded991cf679d9017eb3be14c8069bf1d33ee0fbe50d8872b0e004a7d0ab8ac0969a08e3eb4c7b427c562800e2c002fa9ec8c1cc9bd3e22'
+  metadata.gz: 662057f2eb1431e5b25f74ee89f6fb387748d20526325f7391112b47ce1a6c4ed10d0039341c668eeeb5e78810ed5e4e956c3076673f76c8a0c9d9a57e59c7ff
+  data.tar.gz: 220b4eaf0a42eec12e38e960afae9c0c2dc150e83cd9b2a9cb4d97efd67da9265a49eb5b0f0e399c52105f019faedd0e322cc6dfdec6c839cd2581eef7b03fc0

data/CHANGELOG.md

@@ -5,6 +5,71 @@ Notable changes to where_is_waldo. Format loosely follows
 
 ## Unreleased
 
+## 0.1.15 - 2026-11-10
+
+### Fixed
+
+- **A reconnecting client kept sending its ORIGINAL token, forever.** The auth
+  token was read once and baked into the consumer's URL string at first
+  connect. ActionCable's `Consumer` declares `get url()`, which re-runs
+  `createWebSocketURL` on every connection attempt -- so passing a string meant
+  each reconnect after a sleep, a network blip or a server restart reused the
+  token from page load.
+
+  With a short-lived access token that is a silent, permanent failure. The
+  first reconnect after expiry is rejected, every retry sends the same dead
+  token, and the client sits disconnected while looking merely idle. Presence
+  empties and anything broadcast to "online" subscribers reaches nobody. In
+  one case a tab opened a socket and the server closed it 74ms later, rejected,
+  while the application kept working and reported nothing.
+
+  `getConsumer` now hands `createConsumer` a FUNCTION, so the token is resolved
+  per attempt and a refreshed one is picked up by the next retry with no
+  intervention.
+
+### Added
+
+- **`getToken` may now return a promise.** A token provider that has to refresh
+  before it can answer could not be expressed before, because the URL callback
+  is invoked synchronously while opening a socket. An async provider is now
+  resolved in the background and its result cached for the next attempt, which
+  costs at most one refused attempt given ActionCable's backoff. Returning a
+  plain value still works exactly as before and stays synchronous.
+
+- A throwing `getToken` no longer takes the socket down with it. A storage
+  accessor can raise outright with cookies blocked or in a private window; the
+  connection now proceeds without a token and lets the server decide.
+
+### Changed
+
+- A **synchronous** `getToken` returning `null` is now taken at face value: the
+  socket connects with no token and the server decides. Previously the last
+  cached token was reused, so after a sign-out a client kept reconnecting with
+  the OLD token rather than being refused properly. A rejected or throwing
+  provider still falls back to the last known token, since those mean "could
+  not answer" rather than "there is no token".
+
+## 0.1.14 - 2026-11-06
+
+### Fixed
+
+- **Cable connections were rejected in every app using an external identity
+  server.** `JwtConnection` resolved the connection's subject with
+  `find_by(id: payload["sub"])`. That is correct when `sub` is the application's
+  own user id, but an identity server issues a UUID subject, so the lookup
+  matched nothing and every connection was refused -- which meant no presence
+  and no broadcasting at all.
+
+  The failure was silent: a rejected connection is indistinguishable from a
+  client that never subscribed, and a count of presence rows cannot detect it
+  either, since those rows are TTL-transient and zero is also the healthy idle
+  state.
+
+  Resolution now goes through the host application's identity resolver when it
+  is in that mode, mapping the subject through `users.identity_id`. An
+  application whose presence subject is some other model keeps the
+  primary-key lookup, and an application without corebyscott is untouched.
+
 ## 0.1.13 - 2026-11-04
 
 ### Documentation

data/README.md

@@ -81,6 +81,45 @@ configureCable({
 </PresenceProvider>
 ```
 
+### `getToken` and short-lived tokens
+
+`getToken` is called **once per connection attempt**, not once at startup. That
+matters because ActionCable reconnects on its own -- after a sleep, a network
+blip, or a server restart -- and each attempt asks again. So returning the
+current token keeps a long-lived tab connected, while capturing one in a
+closure does not:
+
+```jsx
+// Good: read at call time, so a rotated token is picked up on reconnect.
+getToken: () => localStorage.getItem('token')
+
+// Broken: captured once; every reconnect resends the original token, and once
+// it expires the connection is refused for the life of the page.
+const token = localStorage.getItem('token');
+getToken: () => token
+```
+
+**It may also return a promise**, for a provider that has to refresh before it
+can answer:
+
+```jsx
+getToken: async () => (await auth.freshToken()) || null
+```
+
+The URL callback cannot await -- ActionCable invokes it synchronously while
+opening a socket -- so an async provider is resolved in the background and its
+result used from the next attempt. Given ActionCable's backoff that costs at
+most one refused attempt. The provider is not invoked again while a resolve is
+outstanding, so a reconnect storm will not fire a refresh request per attempt.
+
+Two smaller guarantees:
+
+- Returning `null` from a **synchronous** provider is taken at face value: the
+  socket connects with no token and the server decides. Use that on sign-out.
+- A provider that **throws** does not take the connection down. The last known
+  token is used instead, since a storage accessor can raise outright with
+  cookies blocked or in a private window.
+
 ```jsx
 // any component — subscribe to an event type and filter the payload yourself.
 // Auto-unsubscribes on unmount; no central handler config.

data/VERSION

@@ -1 +1 @@
-0.1.13
+0.1.15

data/app/channels/where_is_waldo/jwt_connection.rb

@@ -50,13 +50,47 @@ module WhereIsWaldo
       payload = wiw_token_payload
       reject_unauthorized_connection unless payload
 
-      klass = WhereIsWaldo.configuration.subject_class_constant
-      user = klass&.find_by(id: payload["sub"] || payload[:sub])
+      user = wiw_resolve_subject(payload)
       reject_unauthorized_connection unless user
 
       user
     end
 
+    # `sub` is not always this app's primary key.
+    #
+    # Under corebyscott's :identity_server mode it is the identity server's
+    # UUID, so find_by(id:) matches nothing and EVERY cable connection is
+    # rejected -- silently, because a rejected connection is indistinguishable
+    # from a client that never subscribed. Core's resolver maps the UUID through
+    # users.identity_id, the same path its HTTP auth takes, so cable and request
+    # auth cannot disagree about who someone is.
+    #
+    # Only used when the configured subject IS core's user class. An app whose
+    # presence subject is some other model keeps the primary-key lookup, since
+    # core's resolver would hand back a user rather than that subject.
+    def wiw_resolve_subject(payload)
+      klass = WhereIsWaldo.configuration.subject_class_constant
+
+      if wiw_identity_mode? && klass && klass == wiw_core_user_class
+        return ::Corebyscott::IdentityResolver.resolve(payload)
+      end
+
+      klass&.find_by(id: payload["sub"] || payload[:sub])
+    end
+
+    def wiw_identity_mode?
+      defined?(::Corebyscott::IdentityResolver) &&
+        ::Corebyscott.respond_to?(:config) &&
+        ::Corebyscott.config.respond_to?(:auth_mode) &&
+        ::Corebyscott.config.auth_mode.to_s == "identity_server"
+    end
+
+    def wiw_core_user_class
+      return nil unless ::Corebyscott.config.respond_to?(:user_class_constant)
+
+      ::Corebyscott.config.user_class_constant
+    end
+
     # Optional container scoping from the JWT's `cid` claim. nil when the app
     # doesn't scope tokens to a container, or corebyscott isn't present.
     def wiw_container

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: where_is_waldo
 version: !ruby/object:Gem::Version
-  version: 0.1.13
+  version: 0.1.15
 platform: ruby
 authors:
 - Scott Gibson
@@ -79,6 +79,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.2.1
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
 - !ruby/object:Gem::Dependency
   name: redis
   requirement: !ruby/object:Gem::Requirement