where_is_waldo 0.1.13 → 0.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d06a950b27e51d7506062dc38518912b7b631a91be886eb29801f01e0ac438ac
-  data.tar.gz: fb1f82a4742a5099eee4d7a70f9d5445010dc52bd17408cfe2451363c04051a2
+  metadata.gz: 55b6e1ced7f3e93a1e415bc0e28d10b15a212ad134e3108f585bea84220a1f10
+  data.tar.gz: 6c068bbd05c86ea7c6ba9b2136295f5ef17c02bd19bf9211f8b4ee59a83b17f1
 SHA512:
-  metadata.gz: 5bfd8270b07bed9227be801b90b1f354a30a1eeaf748a3b7b7ff0d1a551bb0f3d6685792862f7c8e5676d411ea263b14fe64c67a76be422b0e55055a01672900
-  data.tar.gz: '053823564618b09793ded991cf679d9017eb3be14c8069bf1d33ee0fbe50d8872b0e004a7d0ab8ac0969a08e3eb4c7b427c562800e2c002fa9ec8c1cc9bd3e22'
+  metadata.gz: 9d96b99856186d169d3e6c97f4a032f298158ecb9e8532238c40d98a0fc7388d2a3a4eaa195417fe21064d1babc389b1c083bf85dbdfc20a33f5fb50d223d076
+  data.tar.gz: 4f0a4167858defcc5403deb7fafeac5abdb7556af91017fc1e679c952bfb39e067609ca09320353d99663106dba8f0afc9c7740c28642aff3e231057681c6b5f

data/CHANGELOG.md

@@ -5,6 +5,27 @@ Notable changes to where_is_waldo. Format loosely follows
 
 ## Unreleased
 
+## 0.1.14 - 2026-11-06
+
+### Fixed
+
+- **Cable connections were rejected in every app using an external identity
+  server.** `JwtConnection` resolved the connection's subject with
+  `find_by(id: payload["sub"])`. That is correct when `sub` is the application's
+  own user id, but an identity server issues a UUID subject, so the lookup
+  matched nothing and every connection was refused -- which meant no presence
+  and no broadcasting at all.
+
+  The failure was silent: a rejected connection is indistinguishable from a
+  client that never subscribed, and a count of presence rows cannot detect it
+  either, since those rows are TTL-transient and zero is also the healthy idle
+  state.
+
+  Resolution now goes through the host application's identity resolver when it
+  is in that mode, mapping the subject through `users.identity_id`. An
+  application whose presence subject is some other model keeps the
+  primary-key lookup, and an application without corebyscott is untouched.
+
 ## 0.1.13 - 2026-11-04
 
 ### Documentation

data/VERSION

@@ -1 +1 @@
-0.1.13
+0.1.14

data/app/channels/where_is_waldo/jwt_connection.rb

@@ -50,13 +50,47 @@ module WhereIsWaldo
       payload = wiw_token_payload
       reject_unauthorized_connection unless payload
 
-      klass = WhereIsWaldo.configuration.subject_class_constant
-      user = klass&.find_by(id: payload["sub"] || payload[:sub])
+      user = wiw_resolve_subject(payload)
       reject_unauthorized_connection unless user
 
       user
     end
 
+    # `sub` is not always this app's primary key.
+    #
+    # Under corebyscott's :identity_server mode it is the identity server's
+    # UUID, so find_by(id:) matches nothing and EVERY cable connection is
+    # rejected -- silently, because a rejected connection is indistinguishable
+    # from a client that never subscribed. Core's resolver maps the UUID through
+    # users.identity_id, the same path its HTTP auth takes, so cable and request
+    # auth cannot disagree about who someone is.
+    #
+    # Only used when the configured subject IS core's user class. An app whose
+    # presence subject is some other model keeps the primary-key lookup, since
+    # core's resolver would hand back a user rather than that subject.
+    def wiw_resolve_subject(payload)
+      klass = WhereIsWaldo.configuration.subject_class_constant
+
+      if wiw_identity_mode? && klass && klass == wiw_core_user_class
+        return ::Corebyscott::IdentityResolver.resolve(payload)
+      end
+
+      klass&.find_by(id: payload["sub"] || payload[:sub])
+    end
+
+    def wiw_identity_mode?
+      defined?(::Corebyscott::IdentityResolver) &&
+        ::Corebyscott.respond_to?(:config) &&
+        ::Corebyscott.config.respond_to?(:auth_mode) &&
+        ::Corebyscott.config.auth_mode.to_s == "identity_server"
+    end
+
+    def wiw_core_user_class
+      return nil unless ::Corebyscott.config.respond_to?(:user_class_constant)
+
+      ::Corebyscott.config.user_class_constant
+    end
+
     # Optional container scoping from the JWT's `cid` claim. nil when the app
     # doesn't scope tokens to a container, or corebyscott isn't present.
     def wiw_container

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: where_is_waldo
 version: !ruby/object:Gem::Version
-  version: 0.1.13
+  version: 0.1.14
 platform: ruby
 authors:
 - Scott Gibson
@@ -79,6 +79,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.2.1
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
 - !ruby/object:Gem::Dependency
   name: redis
   requirement: !ruby/object:Gem::Requirement