yiffspace-auth 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f5aee7054914b1cde58a8f4c83fc06d965c193afdb25acb1da500898a276e09
-  data.tar.gz: 2f61fd4c8f81f28e604fb5ba9c1570b5e5ae689e3d452bf7c11a3ea97ca0e88c
+  metadata.gz: d19d9d8174528781d36a8abe31c4ac5a1571bef1ef9405cb9ba6397924bb6acc
+  data.tar.gz: 17545c629a6b9e975716d6e9c4dee590655157f497018fd58adb7464e2038bd3
 SHA512:
-  metadata.gz: 11e9fdc2a871e7873010e4aba4911909dd49ffb463ce7fe8348fe8f20f0fe740283ad10449126084278d09e8937ff991c02d1a04fc749e9d7418b5749b95cef4
-  data.tar.gz: 9e84e8b6df2a18886760cb304fe9762cb8383dcdd2c23a620873bb5c33887eb3097b19a5d53b6207b486651e14fa8c1da58c4108e4d24056c2a243b8280425df
+  metadata.gz: db86285b83c9782a81dabe08dd176656f1d6bd6ad229934da632719dea0a435bf3d6b82d4989aba0690a140d992490d650b3cf429240367a500f65f8e8309e81
+  data.tar.gz: b1bff84f959da2b59b0ef5bf5f9fa593134b934f2ef895d7c6e2246c87c04910312f88d7ad1690d26804d5d0b8282769b87d2155a31f2a5a5d4a3861311bd568

data/lib/yiffspace/auth/version.rb

@@ -2,6 +2,6 @@
 
 module YiffSpace
   module Auth
-    VERSION = "0.0.2"
+    VERSION = "0.0.3"
   end
 end

data/lib/yiffspace/extensions/logto/named_session_storage.rb

@@ -1,16 +1,50 @@
 # frozen_string_literal: true
 
 require("logto/client")
+require("securerandom")
 
 module YiffSpace
   module Extensions
     module Logto
+      # LogtoClient::SessionStorage (our superclass) stores its values - PKCE verifier, nonce,
+      # state, and eventually the access/ID/refresh tokens themselves - directly in the Rails
+      # session, which is more than enough on its own to blow the ~4KB cookie limit. The gem's
+      # LogtoClient::RailsCacheStorage avoids the cookie but keys purely off app_id, with no
+      # per-browser scoping, so concurrent sign-ins from different users would stomp on each
+      # other's in-flight OAuth state. This keeps the per-browser scoping (still keyed off the
+      # session) but only stores a small opaque token there, with the real value in Rails.cache.
       class NamedSessionStorage < LogtoClient::SessionStorage
+        CACHE_KEY = "yiffspace:auth:logto_storage:%s"
+        CACHE_TTL = 30.days
+
         def initialize(name, session, app_id: nil)
           super(session, app_id: app_id)
           @name = name
         end
 
+        def get(key)
+          token = @session[get_session_key(key)]
+          return nil if token.blank?
+
+          Rails.cache.read(format(CACHE_KEY, token))
+        end
+
+        def set(key, value)
+          session_key = get_session_key(key)
+          old_token = @session[session_key]
+          Rails.cache.delete(format(CACHE_KEY, old_token)) if old_token.present?
+
+          token = SecureRandom.hex(32)
+          Rails.cache.write(format(CACHE_KEY, token), value, expires_in: CACHE_TTL)
+          @session[session_key] = token
+        end
+
+        def remove(key)
+          session_key = get_session_key(key)
+          token = @session.delete(session_key)
+          Rails.cache.delete(format(CACHE_KEY, token)) if token.present?
+        end
+
         protected
 
         def get_session_key(key)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yiffspace-auth
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Donovan_DMC