where_is_waldo 0.1.5 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9caee3a6cb5747d9ce5ab460315fdaca5a9f05f7521dbe07f36a6d9fe5de48d9
-  data.tar.gz: f7e293f87b04039c7a2dbc21e6a80ef574a773438800588a9f87255b9336497a
+  metadata.gz: 0daa39b5301b15f20943db48e10565bb18c7a33e12917551d6f9bea954311e20
+  data.tar.gz: 4ffb5a45341e48e9d4bc5f8dd08c9cf5a970dc0939de4e6e869d8a8bfa14c99b
 SHA512:
-  metadata.gz: 95e63474cdbfff6c224b4bc4882bba3fb96cb157bf73a7769a1755f8b6326cba60e19aee6b06fc8fb58fc483496a68f8aa3e6bd03513a1782802ca123f8b9cb7
-  data.tar.gz: 9abb3e965ddf1a13722e5700c2c3c8927c9b6b43593801e592670ec4ab09483ce2a3cf2da6a764dfbfb204e238a0107cbd9628067c5e06b0d7920a24412a0726
+  metadata.gz: 59dfa8c1cfb8c29b53dde974da7db16a3f8c16fd4ba24e7adcf1dedac260ec6bad7618d718e161dd7d11b466a3f06b87a8168cabaf0deabeca21c0d00ae71ba0
+  data.tar.gz: 27ad4732f42cc5257c1c9f39cbff46a6d21570e1c7c8fb695da6a9caabdf9ff92742f3e82633b793dfdce786beff64e8933839be6c3d850b5465d31326a86859

data/CHANGELOG.md

@@ -3,6 +3,61 @@
 Notable changes to where_is_waldo. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/).
 
+## 0.1.7
+
+### Added
+
+- **`last_activity` in roster member payloads.** Each member in a
+  `roster_snapshot` / `roster_delta` message now carries a `last_activity`
+  ISO8601 timestamp — the most recent `subject_active: true` heartbeat time
+  across all of the subject's live sessions (web, mobile, whichever). `nil`
+  when the subject has no live sessions. Lets hosts derive "seconds idle"
+  client-side (`Date.now() - new Date(last_activity)`) and apply their own
+  thresholds instead of being tied to the gem's active↔idle boundary.
+
+  Example: a picker that wants "stay green until 3 minutes without input"
+  no longer needs a server-side `activityTimeout` override — it reads
+  `member.last_activity` and thresholds against its own clock. The
+  server's own active/idle enum still ships in `status` for consumers who
+  do want it, and the roster still broadcasts only on transitions (no
+  extra bandwidth beyond the added field).
+
+  Payload shape:
+  ```json
+  { "id": 7, "status": "idle",
+    "devices": { "web": "idle", "mobile": "active" },
+    "last_activity": "2026-07-27T15:23:04Z",
+    "name": "Alan Smith" }
+  ```
+
+  Both adapters were already tracking `last_activity` per session — this
+  release plumbs it through the roster aggregation (max across sessions)
+  and normalizes to an ISO string in the broadcast payload, absorbing the
+  DB-adapter-returns-string / Redis-adapter-returns-Time mismatch at the
+  roster boundary.
+
+## 0.1.6
+
+### Security
+
+- **The built-in connection no longer authenticates from client-supplied
+  `subject_id` in production.** `WhereIsWaldo::ApplicationCable::Connection`
+  previously fell back to `request.params[:subject_id]` whenever no
+  `authenticate_proc` was configured — so a client could connect with
+  `?subject_id=<anyone>` and be authenticated as that subject (cross-account
+  impersonation). The params path is now permitted **only in local dev/test**;
+  production **fails closed** (rejects the connection) unless `authenticate_proc`
+  (or a self-identified connection such as `JwtConnection`) establishes the
+  subject. Apps that mount the built-in connection in production without an
+  `authenticate_proc` will now be rejected — configure one.
+
+### Tests
+
+- Added a two-account roster isolation spec (a viewer streams only their own
+  org's stream, sees only their own members, and receives none of another
+  account's deltas) and a connection spec proving the params-fallback path
+  fails closed in production.
+
 ## 0.1.5
 
 ### Security / correctness

data/README.md

@@ -2,6 +2,11 @@
 
 Real-time presence tracking for Rails + React using ActionCable.
 
+[![CI](https://github.com/byscott-io/where_is_waldo/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/byscott-io/where_is_waldo/actions/workflows/ci.yml)
+[![Gem Version](https://img.shields.io/gem/v/where_is_waldo)](https://rubygems.org/gems/where_is_waldo)
+[![npm version](https://img.shields.io/npm/v/@byscott-io/where-is-waldo)](https://www.npmjs.com/package/@byscott-io/where-is-waldo)
+[![License](https://img.shields.io/github/license/byscott-io/where_is_waldo)](LICENSE)
+
 ## Features
 
 - **Presence tracking** - know who's online

data/VERSION

@@ -1 +1 @@
-0.1.5
+0.1.7

data/app/channels/where_is_waldo/application_cable/connection.rb

@@ -29,9 +29,16 @@ module WhereIsWaldo
             reject_unauthorized_connection
           end
         else
-          # Default: try to get subject_id from params
-          self.waldo_subject_id = request.params[:subject_id]
-          self.waldo_session_id = request.params[:session_id] || generate_session_id
+          # No authenticate_proc configured. The only remaining identity source
+          # is client-controlled params, which must NEVER authenticate a real
+          # connection (a client could pass ?subject_id=<anyone> and impersonate
+          # them). Permit it ONLY in local dev/test as a convenience; fail closed
+          # everywhere else. Production apps must configure `authenticate_proc`
+          # (or identify the connection themselves, e.g. via JwtConnection).
+          if Rails.env.local?
+            self.waldo_subject_id = request.params[:subject_id]
+            self.waldo_session_id = request.params[:session_id] || generate_session_id
+          end
 
           reject_unauthorized_connection unless waldo_subject_id
         end

data/app/services/where_is_waldo/roster.rb

@@ -8,12 +8,18 @@ module WhereIsWaldo
   #
   # A member's presence is reported per device AND as an overall roll-up:
   #
-  #   { id: 7, status: "active", devices: { "web" => "active", "mobile" => "idle" } }
+  #   { id: 7, status: "active",
+  #     devices: { "web" => "active", "mobile" => "idle" },
+  #     last_activity: "2026-07-27T15:23:04Z" }
   #
   # `devices[platform]` is that platform's own aggregate status (several browser
   # tabs roll up into one "web" status); `status` is the highest level across
   # all platforms — the "is the user active anywhere?" answer, while
-  # `devices["mobile"]` answers "is the user active on mobile?". Each status is:
+  # `devices["mobile"]` answers "is the user active on mobile?". `last_activity`
+  # is the most recent input timestamp across all of the subject's live sessions
+  # (nil when offline), letting the client subtract from its own clock to derive
+  # seconds-idle and apply its own thresholds without new broadcasts. Each
+  # status is:
   #
   #   active      - a live session on that device is tab-visible AND working
   #   idle        - a live session is tab-visible but not actively using
@@ -182,15 +188,21 @@ module WhereIsWaldo
       # Reduce a subject's live sessions to per-device statuses plus an overall
       # roll-up. Sessions are grouped by platform (so several browser tabs form
       # one "web" status); the overall status is the highest across platforms.
+      # `last_activity` is the max across all sessions (any platform), so it
+      # answers "when did any of this subject's tabs last see input?".
       # @param sessions [Array<Hash>] presence hashes from the adapter
-      # @return [Hash] { status: "active", devices: { "web" => "active", ... } }
+      # @return [Hash] { status:, devices:, last_activity: }
       def aggregate(sessions)
         devices = sessions.group_by { |s| platform(s) }
                           .transform_values { |sess| platform_level(sess) }
         overall = devices.values.max_by { |level| RANK[level] } || :offline
+        # DB adapter returns last_activity as ISO string, Redis as Time; both sort
+        # correctly among themselves. Normalize to ISO string in the payload.
+        last = sessions.filter_map { |s| s[:last_activity] }.max
         {
           status: overall.to_s,
-          devices: devices.transform_values(&:to_s)
+          devices: devices.transform_values(&:to_s),
+          last_activity: last.respond_to?(:iso8601) ? last.iso8601 : last
         }
       end
 
@@ -229,12 +241,13 @@ module WhereIsWaldo
         data.merge(
           id: id || record&.id,
           status: state[:status],
-          devices: state[:devices]
+          devices: state[:devices],
+          last_activity: state[:last_activity]
         )
       end
 
       def offline_state
-        { status: "offline", devices: {} }
+        { status: "offline", devices: {}, last_activity: nil }
       end
 
       def find_subject(subject_id)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: where_is_waldo
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.7
 platform: ruby
 authors:
 - Scott Gibson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-24 00:00:00.000000000 Z
+date: 2026-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails