yiffspace-auth 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eaf8f70d591dd62b1fe71e4c6b0269b89178dbbfc96aa00d2f220dc0c051b625
-  data.tar.gz: 60e9eb43743d443d4cced565c7891fd491344d5274317b72a2a599d9c5118cb0
+  metadata.gz: 1f5aee7054914b1cde58a8f4c83fc06d965c193afdb25acb1da500898a276e09
+  data.tar.gz: 2f61fd4c8f81f28e604fb5ba9c1570b5e5ae689e3d452bf7c11a3ea97ca0e88c
 SHA512:
-  metadata.gz: eca3a821613c9e57b8216ecc8a80608bd2068b31a2521d281183dbe1bd3dd2750111dfa20727912d6076ab08e1a53750b77d8ff0a111602792e791d3bd47fa96
-  data.tar.gz: 3df50557690c89ffc87e32a94c30b9f3e664702a168fb441cb5a0aa3897928114f169a3da43b8f09bd4dca599906ae42a823d9a66a246e6336a93652584f5a3c
+  metadata.gz: 11e9fdc2a871e7873010e4aba4911909dd49ffb463ce7fe8348fe8f20f0fe740283ad10449126084278d09e8937ff991c02d1a04fc749e9d7418b5749b95cef4
+  data.tar.gz: 9e84e8b6df2a18886760cb304fe9762cb8383dcdd2c23a620873bb5c33887eb3097b19a5d53b6207b486651e14fa8c1da58c4108e4d24056c2a243b8280425df

data/lib/yiffspace/auth/helper.rb

@@ -1,12 +1,20 @@
 # frozen_string_literal: true
 
 require("active_support/concern")
+require("securerandom")
 
 module YiffSpace
   module Auth
     module Helper
       extend(ActiveSupport::Concern)
 
+      # auth/user session values (raw Discord profile + OIDC token claims) can easily exceed a
+      # cookie's ~4KB limit, so the session cookie itself only holds an opaque pointer - the real
+      # payload lives in Rails.cache (already a hard dependency of this module, see
+      # #sync_auth_if_dirty! below), keyed off that pointer.
+      SESSION_CACHE_KEY = "yiffspace:auth:session:%s"
+      SESSION_CACHE_TTL = 30.days
+
       module ClassMethods
         def set_client_name(name) # rubocop:disable Naming/AccessorMethodName
           before_action do |controller|
@@ -27,7 +35,7 @@ module YiffSpace
       end
 
       def auth_raw
-        session[auth_client_config.auth_session_key]
+        read_session_cache(auth_client_config.auth_session_key)
       end
 
       def auth
@@ -41,16 +49,16 @@ module YiffSpace
       end
 
       def auth=(value)
-        value                                        = nil if value.is_a?(AuthInfo::Anonymous)
-        session[auth_client_config.auth_session_key] = value&.to_session
+        value = nil if value.is_a?(AuthInfo::Anonymous)
+        write_session_cache(auth_client_config.auth_session_key, value&.to_session)
       end
 
       def reset_auth!
-        session.delete(auth_client_config.auth_session_key)
+        write_session_cache(auth_client_config.auth_session_key, nil)
       end
 
       def user_raw
-        session[auth_client_config.user_session_key]
+        read_session_cache(auth_client_config.user_session_key)
       end
 
       def user
@@ -64,12 +72,12 @@ module YiffSpace
       end
 
       def user=(value)
-        value                                        = nil if value.is_a?(UserInfo::Anonymous)
-        session[auth_client_config.user_session_key] = value&.to_session
+        value = nil if value.is_a?(UserInfo::Anonymous)
+        write_session_cache(auth_client_config.user_session_key, value&.to_session)
       end
 
       def reset_user!
-        session.delete(auth_client_config.user_session_key)
+        write_session_cache(auth_client_config.user_session_key, nil)
       end
 
       def full_reset!
@@ -148,6 +156,32 @@ module YiffSpace
         request.env[CLIENT_NAME_ENV] = value.to_sym
       end
 
+      private
+
+      def read_session_cache(session_key)
+        token = session[session_key]
+        return nil if token.blank?
+
+        Rails.cache.read(format(SESSION_CACHE_KEY, token))
+      end
+
+      # A fresh token is minted on every write (rather than reusing/refreshing the existing one)
+      # so a stale token left over from a previous login can never be replayed to read whatever
+      # happens to be written at that cache key next.
+      def write_session_cache(session_key, value)
+        old_token = session[session_key]
+        Rails.cache.delete(format(SESSION_CACHE_KEY, old_token)) if old_token.present?
+
+        if value.nil?
+          session.delete(session_key)
+          return
+        end
+
+        token = SecureRandom.hex(32)
+        Rails.cache.write(format(SESSION_CACHE_KEY, token), value, expires_in: SESSION_CACHE_TTL)
+        session[session_key] = token
+      end
+
       module Scoped
         extend(ActiveSupport::Concern)
         include(Helper)

data/lib/yiffspace/auth/version.rb

@@ -2,6 +2,6 @@
 
 module YiffSpace
   module Auth
-    VERSION = "0.0.1"
+    VERSION = "0.0.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yiffspace-auth
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Donovan_DMC