Class: Tep::AuthSessionCookie

Inherits:
Object
  • Object
show all
Defined in:
lib/tep/auth_session_cookie.rb

Class Method Summary collapse

Class Method Details

.clear(req) ⇒ Object

Drop the identity fields from req.session. The session itself stays valid (signed cookie continues to round-trip), but any subsequent try() returns nil because identity_sub is empty.



75
76
77
78
79
80
81
 
# File 'lib/tep/auth_session_cookie.rb', line 75

def self.clear(req)
  req.session.set("identity_sub", "")
  req.session.set("identity_caps", "")
  req.session.set("identity_delegate", "")
  req.session.set("identity_exp", "")
  0
end

.format_caps(caps) ⇒ Object

[:read, :write, :post_summary] -> "read,write,post_summary"



116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'lib/tep/auth_session_cookie.rb', line 116

def self.format_caps(caps)
  out = ""
  first = true
  caps.each do |c|
    if !first
      out = out + ","
    end
    out = out + c.to_s
    first = false
  end
  out
end

.format_delegate(deleg) ⇒ Object

AgentDelegation -> "agent_id|issued_at|expires_at|origin". Inverse of Tep::AuthBearerToken.parse_delegate.



131
132
133
134
135
136
 
# File 'lib/tep/auth_session_cookie.rb', line 131

def self.format_delegate(deleg)
  deleg.agent_id + "|" +
    deleg.issued_at.to_s + "|" +
    deleg.expires_at.to_s + "|" +
    deleg.origin.to_s
end

.set(req, identity, exp) ⇒ Object

Write an Identity into req.session. Caller is responsible for ensuring Tep.session_secret is configured -- otherwise the response cookie won't get signed and the next request can't round-trip the identity back.

exp is unix epoch seconds; nil disables expiry (the cookie itself still expires per its own Max-Age / Expires headers or browser session lifetime).



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/tep/auth_session_cookie.rb', line 53

def self.set(req, identity, exp)
  req.session.set("identity_sub", identity.principal_id)
  req.session.set("identity_caps",
    Tep::AuthSessionCookie.format_caps(identity.capabilities))
  delegate = identity.acting_via
  if delegate == nil
    req.session.set("identity_delegate", "")
  else
    req.session.set("identity_delegate",
      Tep::AuthSessionCookie.format_delegate(delegate))
  end
  if exp > 0
    req.session.set("identity_exp", exp.to_s)
  else
    req.session.set("identity_exp", "")
  end
  0
end

.try(req) ⇒ Object

Attempt to recover an Identity from req.session. Returns nil if the session has no identity (no prior #set call, or after #clear) or the stored identity is expired.



86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
 
# File 'lib/tep/auth_session_cookie.rb', line 86

def self.try(req)
  # Session#get on a missing key reads as nil (sinatra-parity Hash
  # semantics; same class as tep#235) -- guard before String calls.
  sub = req.session.get("identity_sub")
  sub = "" if sub.nil?
  if sub.length == 0
    return nil
  end

  exp_str = req.session.get("identity_exp")
  exp_str = "" if exp_str.nil?
  if exp_str.length > 0
    exp = exp_str.to_i
    if exp > 0 && Time.now.to_i >= exp
      return nil
    end
  end

  caps_str = req.session.get("identity_caps")
  caps_str = "" if caps_str.nil?
  caps = Tep::AuthBearerToken.parse_caps(caps_str)

  delegate_str = req.session.get("identity_delegate")
  delegate_str = "" if delegate_str.nil?
  delegation = Tep::AuthBearerToken.parse_delegate(delegate_str)

  Tep::Identity.new(sub, delegation, caps)
end