Class: YiffSpace::Extensions::Logto::NamedSessionStorage

Inherits:
LogtoClient::SessionStorage
  • Object
show all
Defined in:
lib/yiffspace/extensions/logto/named_session_storage.rb

Overview

LogtoClient::SessionStorage (our superclass) stores its values - PKCE verifier, nonce, state, and eventually the access/ID/refresh tokens themselves - directly in the Rails session, which is more than enough on its own to blow the ~4KB cookie limit. The gem's LogtoClient::RailsCacheStorage avoids the cookie but keys purely off app_id, with no per-browser scoping, so concurrent sign-ins from different users would stomp on each other's in-flight OAuth state. This keeps the per-browser scoping (still keyed off the session) but only stores a small opaque token there, with the real value in Rails.cache.

Constant Summary collapse

CACHE_KEY = 
"yiffspace:auth:logto_storage:%s"
CACHE_TTL = 
30.days

Instance Method Summary collapse

Constructor Details

#initialize(name, session, app_id: nil) ⇒ NamedSessionStorage

Returns a new instance of NamedSessionStorage.



20
21
22
23
 
# File 'lib/yiffspace/extensions/logto/named_session_storage.rb', line 20

def initialize(name, session, app_id: nil)
  super(session, app_id: app_id)
  @name = name
end

Instance Method Details

#get(key) ⇒ Object 



25
26
27
28
29
30
 
# File 'lib/yiffspace/extensions/logto/named_session_storage.rb', line 25

def get(key)
  token = @session[get_session_key(key)]
  return nil if token.blank?

  Rails.cache.read(format(CACHE_KEY, token))
end

#remove(key) ⇒ Object 



42
43
44
45
46
 
# File 'lib/yiffspace/extensions/logto/named_session_storage.rb', line 42

def remove(key)
  session_key = get_session_key(key)
  token = @session.delete(session_key)
  Rails.cache.delete(format(CACHE_KEY, token)) if token.present?
end

#set(key, value) ⇒ Object 



32
33
34
35
36
37
38
39
40
 
# File 'lib/yiffspace/extensions/logto/named_session_storage.rb', line 32

def set(key, value)
  session_key = get_session_key(key)
  old_token = @session[session_key]
  Rails.cache.delete(format(CACHE_KEY, old_token)) if old_token.present?

  token = SecureRandom.hex(32)
  Rails.cache.write(format(CACHE_KEY, token), value, expires_in: CACHE_TTL)
  @session[session_key] = token
end