yiffspace-auth 0.0.1 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eaf8f70d591dd62b1fe71e4c6b0269b89178dbbfc96aa00d2f220dc0c051b625
-  data.tar.gz: 60e9eb43743d443d4cced565c7891fd491344d5274317b72a2a599d9c5118cb0
+  metadata.gz: d19d9d8174528781d36a8abe31c4ac5a1571bef1ef9405cb9ba6397924bb6acc
+  data.tar.gz: 17545c629a6b9e975716d6e9c4dee590655157f497018fd58adb7464e2038bd3
 SHA512:
-  metadata.gz: eca3a821613c9e57b8216ecc8a80608bd2068b31a2521d281183dbe1bd3dd2750111dfa20727912d6076ab08e1a53750b77d8ff0a111602792e791d3bd47fa96
-  data.tar.gz: 3df50557690c89ffc87e32a94c30b9f3e664702a168fb441cb5a0aa3897928114f169a3da43b8f09bd4dca599906ae42a823d9a66a246e6336a93652584f5a3c
+  metadata.gz: db86285b83c9782a81dabe08dd176656f1d6bd6ad229934da632719dea0a435bf3d6b82d4989aba0690a140d992490d650b3cf429240367a500f65f8e8309e81
+  data.tar.gz: b1bff84f959da2b59b0ef5bf5f9fa593134b934f2ef895d7c6e2246c87c04910312f88d7ad1690d26804d5d0b8282769b87d2155a31f2a5a5d4a3861311bd568

data/lib/yiffspace/auth/helper.rb

@@ -1,12 +1,20 @@
 # frozen_string_literal: true
 
 require("active_support/concern")
+require("securerandom")
 
 module YiffSpace
   module Auth
     module Helper
       extend(ActiveSupport::Concern)
 
+      # auth/user session values (raw Discord profile + OIDC token claims) can easily exceed a
+      # cookie's ~4KB limit, so the session cookie itself only holds an opaque pointer - the real
+      # payload lives in Rails.cache (already a hard dependency of this module, see
+      # #sync_auth_if_dirty! below), keyed off that pointer.
+      SESSION_CACHE_KEY = "yiffspace:auth:session:%s"
+      SESSION_CACHE_TTL = 30.days
+
       module ClassMethods
         def set_client_name(name) # rubocop:disable Naming/AccessorMethodName
           before_action do |controller|
@@ -27,7 +35,7 @@ module YiffSpace
       end
 
       def auth_raw
-        session[auth_client_config.auth_session_key]
+        read_session_cache(auth_client_config.auth_session_key)
       end
 
       def auth
@@ -41,16 +49,16 @@ module YiffSpace
       end
 
       def auth=(value)
-        value                                        = nil if value.is_a?(AuthInfo::Anonymous)
-        session[auth_client_config.auth_session_key] = value&.to_session
+        value = nil if value.is_a?(AuthInfo::Anonymous)
+        write_session_cache(auth_client_config.auth_session_key, value&.to_session)
       end
 
       def reset_auth!
-        session.delete(auth_client_config.auth_session_key)
+        write_session_cache(auth_client_config.auth_session_key, nil)
       end
 
       def user_raw
-        session[auth_client_config.user_session_key]
+        read_session_cache(auth_client_config.user_session_key)
       end
 
       def user
@@ -64,12 +72,12 @@ module YiffSpace
       end
 
       def user=(value)
-        value                                        = nil if value.is_a?(UserInfo::Anonymous)
-        session[auth_client_config.user_session_key] = value&.to_session
+        value = nil if value.is_a?(UserInfo::Anonymous)
+        write_session_cache(auth_client_config.user_session_key, value&.to_session)
       end
 
       def reset_user!
-        session.delete(auth_client_config.user_session_key)
+        write_session_cache(auth_client_config.user_session_key, nil)
       end
 
       def full_reset!
@@ -148,6 +156,32 @@ module YiffSpace
         request.env[CLIENT_NAME_ENV] = value.to_sym
       end
 
+      private
+
+      def read_session_cache(session_key)
+        token = session[session_key]
+        return nil if token.blank?
+
+        Rails.cache.read(format(SESSION_CACHE_KEY, token))
+      end
+
+      # A fresh token is minted on every write (rather than reusing/refreshing the existing one)
+      # so a stale token left over from a previous login can never be replayed to read whatever
+      # happens to be written at that cache key next.
+      def write_session_cache(session_key, value)
+        old_token = session[session_key]
+        Rails.cache.delete(format(SESSION_CACHE_KEY, old_token)) if old_token.present?
+
+        if value.nil?
+          session.delete(session_key)
+          return
+        end
+
+        token = SecureRandom.hex(32)
+        Rails.cache.write(format(SESSION_CACHE_KEY, token), value, expires_in: SESSION_CACHE_TTL)
+        session[session_key] = token
+      end
+
       module Scoped
         extend(ActiveSupport::Concern)
         include(Helper)

data/lib/yiffspace/auth/version.rb

@@ -2,6 +2,6 @@
 
 module YiffSpace
   module Auth
-    VERSION = "0.0.1"
+    VERSION = "0.0.3"
   end
 end

data/lib/yiffspace/extensions/logto/named_session_storage.rb

@@ -1,16 +1,50 @@
 # frozen_string_literal: true
 
 require("logto/client")
+require("securerandom")
 
 module YiffSpace
   module Extensions
     module Logto
+      # LogtoClient::SessionStorage (our superclass) stores its values - PKCE verifier, nonce,
+      # state, and eventually the access/ID/refresh tokens themselves - directly in the Rails
+      # session, which is more than enough on its own to blow the ~4KB cookie limit. The gem's
+      # LogtoClient::RailsCacheStorage avoids the cookie but keys purely off app_id, with no
+      # per-browser scoping, so concurrent sign-ins from different users would stomp on each
+      # other's in-flight OAuth state. This keeps the per-browser scoping (still keyed off the
+      # session) but only stores a small opaque token there, with the real value in Rails.cache.
       class NamedSessionStorage < LogtoClient::SessionStorage
+        CACHE_KEY = "yiffspace:auth:logto_storage:%s"
+        CACHE_TTL = 30.days
+
         def initialize(name, session, app_id: nil)
           super(session, app_id: app_id)
           @name = name
         end
 
+        def get(key)
+          token = @session[get_session_key(key)]
+          return nil if token.blank?
+
+          Rails.cache.read(format(CACHE_KEY, token))
+        end
+
+        def set(key, value)
+          session_key = get_session_key(key)
+          old_token = @session[session_key]
+          Rails.cache.delete(format(CACHE_KEY, old_token)) if old_token.present?
+
+          token = SecureRandom.hex(32)
+          Rails.cache.write(format(CACHE_KEY, token), value, expires_in: CACHE_TTL)
+          @session[session_key] = token
+        end
+
+        def remove(key)
+          session_key = get_session_key(key)
+          token = @session.delete(session_key)
+          Rails.cache.delete(format(CACHE_KEY, token)) if token.present?
+        end
+
         protected
 
         def get_session_key(key)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yiffspace-auth
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.3
 platform: ruby
 authors:
 - Donovan_DMC