Sessions, cookies, flash and Current

# The session of a Rails 8.1 app travels in one encrypted cookie. This one-file app is called Kaksha, so its cookie is
# _kaksha_session. An integration session, the tool Rails' own integration tests use, plays the browser: it keeps the
# cookies each response sets and sends them back with the next request. After four ordinary requests it sends an
# old copy of the cookie (a replay), then tries to keep 5,000 characters in the session.
require "rails"
require "action_controller/railtie"
require "action_dispatch/testing/integration"

module Kaksha
  class Application < Rails::Application
    config.load_defaults 8.1
    config.eager_load = false
    config.logger = Logger.new(nil)
    config.secret_key_base = "kaksha-one-file-example-" * 3 # a real app keeps this in its credentials
    config.hosts << "kaksha.example"
    # These requests come from a script, not from a form, so they carry no form token; a real app keeps this check.
    config.action_controller.allow_forgery_protection = false
    config.action_dispatch.show_exceptions = :none # let an exception reach this script instead of an error page
  end
end
Kaksha::Application.initialize!

class CentreController < ActionController::Base
  def choose
    session[:centre_id] = 7
    session[:mock_tests_left] = 3
    render plain: "centre 7 chosen"
  end

  def show
    render plain: "centre_id=#{session[:centre_id].inspect} mock_tests_left=#{session[:mock_tests_left].inspect}"
  end

  def take_test
    session[:mock_tests_left] -= 1
    render plain: "test started, mock_tests_left=#{session[:mock_tests_left]}"
  end

  def save_notes
    session[:notes] = "x" * 5000
    render plain: "notes saved"
  end
end

Kaksha::Application.routes.draw do
  post "/centre", to: "centre#choose"
  get "/centre", to: "centre#show"
  post "/tests", to: "centre#take_test"
  post "/notes", to: "centre#save_notes"
end

browser = ActionDispatch::Integration::Session.new(Kaksha::Application)
browser.host! "kaksha.example"

# Sends one request and prints the answer, then each Set-Cookie line with its encrypted value left out: the value is
# different on every response, because each encryption starts from a new random number. Its length is printed instead,
# as the server wrote it, before the characters + / and = were escaped for the header.
visit = lambda do |verb, path|
  browser.public_send(verb, path)
  response = browser.response
  puts "#{verb.upcase} #{path} -> #{response.status} #{response.body}"
  Array(response.headers["set-cookie"]).flat_map { it.split("\n") }.each do |line|
    name, rest = line.split("=", 2)
    value, attributes = rest.split("; ", 2)
    puts "  Set-Cookie: #{name}=<encrypted, #{CGI.unescape(value).size} characters>; #{attributes}"
  end
end

visit.(:get, "/centre")
visit.(:post, "/centre")
visit.(:get, "/centre")
copy = browser.cookies["_kaksha_session"] # someone keeps a copy of the cookie as it is now
visit.(:post, "/tests")
visit.(:get, "/centre")

puts "The browser sends the old copy back:"
browser.cookies["_kaksha_session"] = copy
visit.(:get, "/centre")

begin
  visit.(:post, "/notes")
rescue ActionDispatch::Cookies::CookieOverflow => error
  puts "POST /notes -> #{error.class}: #{error.message}"
end

GET /centre -> 200 centre_id=nil mock_tests_left=nil
POST /centre -> 200 centre 7 chosen
  Set-Cookie: _kaksha_session=<encrypted, 284 characters>; path=/; httponly; samesite=lax
GET /centre -> 200 centre_id=7 mock_tests_left=3
  Set-Cookie: _kaksha_session=<encrypted, 284 characters>; path=/; httponly; samesite=lax
POST /tests -> 200 test started, mock_tests_left=2
  Set-Cookie: _kaksha_session=<encrypted, 284 characters>; path=/; httponly; samesite=lax
GET /centre -> 200 centre_id=7 mock_tests_left=2
  Set-Cookie: _kaksha_session=<encrypted, 284 characters>; path=/; httponly; samesite=lax
The browser sends the old copy back:
GET /centre -> 200 centre_id=7 mock_tests_left=3
  Set-Cookie: _kaksha_session=<encrypted, 284 characters>; path=/; httponly; samesite=lax
POST /notes -> ActionDispatch::Cookies::CookieOverflow: _kaksha_session cookie overflowed with size 9207 bytes

# Three cookie jars of Rails 8.1 side by side: a plain cookie, a signed one and an encrypted one, written by one action
# and read back by another. The script then does what any user can do in the browser's developer tools: it reads the
# values it was sent, changes one in each cookie, and sends them back.
require "rails"
require "action_controller/railtie"
require "action_dispatch/testing/integration"

module Kaksha
  class Application < Rails::Application
    config.load_defaults 8.1
    config.eager_load = false
    config.logger = Logger.new(nil)
    config.secret_key_base = "kaksha-one-file-example-" * 3 # a real app keeps this in its credentials
    config.hosts << "kaksha.example"
  end
end
Kaksha::Application.initialize!

class PreferencesController < ActionController::Base
  def write
    cookies[:theme] = "dark"
    cookies.signed[:batch_id] = 12
    cookies.encrypted[:referral] = "KAKSHA-REF-4471"
    head :no_content
  end

  def read
    render plain: "theme=#{cookies[:theme].inspect} batch_id=#{cookies.signed[:batch_id].inspect} " \
                  "referral=#{cookies.encrypted[:referral].inspect}"
  end
end

Kaksha::Application.routes.draw do
  get "/write", to: "preferences#write"
  get "/read", to: "preferences#read"
end

browser = ActionDispatch::Integration::Session.new(Kaksha::Application)
browser.host! "kaksha.example"

browser.get "/write"
Array(browser.response.headers["set-cookie"]).flat_map { it.split("\n") }.each do |line|
  name, rest = line.split("=", 2)
  value = rest.split("; ").first
  value = "<encrypted, changes on every response>" if name == "referral"
  puts "Set-Cookie #{name}: #{value}"
end

signed = browser.cookies["batch_id"] # the jar hands back the value as the browser stores it
data, digest = signed.split("--")
envelope = Base64.strict_decode64(data)
message = JSON.parse(envelope).dig("_rails", "message")
puts "batch_id before the --, decoded: #{envelope}"
puts "Its message #{message.inspect}, decoded: #{Base64.strict_decode64(message)}"
puts "After the --: a signature of #{digest.size} hex digits"

browser.get "/read"
puts "As sent:  #{browser.response.body}"

# The user edits each cookie: a new theme, batch 13 with the old signature, and one character of the encrypted value.
browser.cookies["theme"] = "light"
forged = Base64.strict_encode64(envelope.sub(message.to_json, Base64.strict_encode64("13").to_json))
browser.cookies["batch_id"] = "#{forged}--#{digest}"
encrypted = browser.cookies["referral"]
browser.cookies["referral"] = encrypted.sub(/\A./) { it == "A" ? "B" : "A" }

browser.get "/read"
puts "Edited:   #{browser.response.body}"

Set-Cookie theme: dark
Set-Cookie batch_id: eyJfcmFpbHMiOnsibWVzc2FnZSI6Ik1UST0iLCJleHAiOm51bGwsInB1ciI6ImNvb2tpZS5iYXRjaF9pZCJ9fQ%3D%3D--fc803abe8cc4cd54611e927d29ecc30f9001817d
Set-Cookie referral: <encrypted, changes on every response>
batch_id before the --, decoded: {"_rails":{"message":"MTI=","exp":null,"pur":"cookie.batch_id"}}
Its message "MTI=", decoded: 12
After the --: a signature of 40 hex digits
As sent:  theme="dark" batch_id=12 referral="KAKSHA-REF-4471"
Edited:   theme="light" batch_id=nil referral=nil

# What config.force_ssl changes in the cookies of a Rails 8.1 app in production. The file runs itself twice in
# production mode: once as `rails new` leaves production.rb (force_ssl commented out, so off) and once with
# config.force_ssl = true. Each run signs in the way the authentication generator's code does (a signed, permanent
# session_id cookie) and with the same cookie set to expire in 14 days, over http:// and over https://.
require "rbconfig"

unless ENV["KAKSHA_FORCE_SSL"]
  %w[false true].each do |force_ssl|
    puts "config.force_ssl = #{force_ssl}"
    system({ "KAKSHA_FORCE_SSL" => force_ssl }, RbConfig.ruby, __FILE__, exception: true)
  end
  exit
end

ENV["RAILS_ENV"] = "production"
require "rails"
require "action_controller/railtie"
require "action_dispatch/testing/integration"
require "active_support/testing/time_helpers"

module Kaksha
  class Application < Rails::Application
    config.load_defaults 8.1
    config.eager_load = false
    config.logger = Logger.new(nil)
    config.secret_key_base = "kaksha-one-file-example-" * 3 # production keeps this in its credentials
    config.force_ssl = ENV["KAKSHA_FORCE_SSL"] == "true"
    # These requests come from a script, not from a form, so they carry no form token; a real app keeps this check.
    config.action_controller.allow_forgery_protection = false
  end
end
Kaksha::Application.initialize!

class SessionsController < ActionController::Base
  def create
    session[:centre_id] = 7
    if params[:days]
      cookies.signed[:session_id] = { value: 41, httponly: true, same_site: :lax, expires: params[:days].to_i.days }
    else
      cookies.signed.permanent[:session_id] = { value: 41, httponly: true, same_site: :lax } # as generated
    end
    head :no_content
  end

  def show
    render plain: "session_id read as #{cookies.signed[:session_id].inspect}"
  end
end

Kaksha::Application.routes.draw { resource :session, only: %i[create show] }

browser = ActionDispatch::Integration::Session.new(Kaksha::Application)

# Prints the status (and where a redirect points, and the HSTS header), then each cookie with its value left out and
# its expiry as the time from now.
visit = lambda do |verb, url|
  browser.public_send(verb, url)
  response = browser.response
  extra = response.location ? " to #{response.location}" : ""
  extra += ", strict-transport-security: #{response.headers["strict-transport-security"]}" if response.headers["strict-transport-security"]
  puts "  #{verb.upcase} #{url} -> #{response.status}#{extra}"
  Array(response.headers["set-cookie"]).flat_map { it.split("\n") }.each do |line|
    name, rest = line.split("=", 2)
    attributes = rest.split("; ").drop(1).map do |attribute|
      next attribute unless attribute.start_with?("expires=")
      "expires in #{((Time.httpdate(attribute.delete_prefix("expires=")) - Time.now) / 1.day).round} days"
    end
    puts "    #{name}: #{attributes.join("; ")}"
  end
end

visit.(:post, "http://kaksha.example/session")
visit.(:post, "https://kaksha.example/session")
permanent = browser.cookies["session_id"]
visit.(:post, "https://kaksha.example/session?days=14")
fortnight = browser.cookies["session_id"]

if ENV["KAKSHA_FORCE_SSL"] == "true"
  include ActiveSupport::Testing::TimeHelpers
  travel 15.days do
    puts "Fifteen days later, a copy of each session_id cookie is sent back:"
    browser.cookies["session_id"] = fortnight
    browser.get "https://kaksha.example/session"
    puts "  the 14-day cookie: #{browser.response.body}"
    browser.cookies["session_id"] = permanent
    browser.get "https://kaksha.example/session"
    puts "  the permanent cookie: #{browser.response.body}"
  end
end

config.force_ssl = false
  POST http://kaksha.example/session -> 204
    session_id: path=/; expires in 7305 days; httponly; samesite=lax
    _kaksha_session: path=/; httponly; samesite=lax
  POST https://kaksha.example/session -> 204
    session_id: path=/; expires in 7305 days; httponly; samesite=lax
    _kaksha_session: path=/; httponly; samesite=lax
  POST https://kaksha.example/session?days=14 -> 204
    session_id: path=/; expires in 14 days; httponly; samesite=lax
    _kaksha_session: path=/; httponly; samesite=lax
config.force_ssl = true
  POST http://kaksha.example/session -> 308 to https://kaksha.example/session
  POST https://kaksha.example/session -> 204, strict-transport-security: max-age=63072000; includeSubDomains
    session_id: path=/; expires in 7305 days; httponly; samesite=lax; secure
    _kaksha_session: path=/; secure; httponly; samesite=lax
  POST https://kaksha.example/session?days=14 -> 204, strict-transport-security: max-age=63072000; includeSubDomains
    session_id: path=/; expires in 14 days; httponly; samesite=lax; secure
    _kaksha_session: path=/; secure; httponly; samesite=lax
Fifteen days later, a copy of each session_id cookie is sent back:
  the 14-day cookie: session_id read as nil
  the permanent cookie: session_id read as 41

# Signs a teacher in and out of Kaksha through the code `bin/rails generate authentication` wrote, the way a browser
# would, and prints the cookies each response sets and the rows of the sessions table. An integration session, the
# tool of Rails' integration tests, plays the browser: it keeps cookies between requests and follows no redirect by
# itself. Run it with: bin/rails runner --skip-executor script/sign_in_tour.rb
require "action_dispatch/testing/integration"

User.create!(email_address: "asha@kaksha.example", password: "example-password-1")

# allow_browser in ApplicationController turns away browsers without modern features, so the requests say they come
# from a current Chrome.
CHROME = { "User-Agent" => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 " \
                           "(KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" }

browser = ActionDispatch::Integration::Session.new(Rails.application)
browser.host! "localhost"

# Prints the status, where a redirect points, and each cookie the response sets: its name, then its attributes, with
# the value left out and an expiry shown as the time from now.
visit = lambda do |verb, path, **options|
  browser.public_send(verb, path, headers: CHROME.merge(options.delete(:headers) || {}), **options)
  response = browser.response
  puts "#{verb.upcase} #{path} -> #{response.status}#{" to #{response.location}" if response.location}"
  Array(response.headers["set-cookie"]).flat_map { it.split("\n") }.each do |line|
    name, rest = line.split("=", 2)
    value, *attributes = rest.split("; ")
    attributes.map! do |attribute|
      next attribute unless attribute.start_with?("expires=")
      days = ((Time.httpdate(attribute.delete_prefix("expires=")) - Time.now) / 1.day).round
      days.negative? ? "expires in the past" : "expires in #{days} days"
    end
    puts "  Set-Cookie: #{name}=#{value.empty? ? "(empty)" : "…"}; #{attributes.join("; ")}"
  end
end

visit.(:get, "/")
visit.(:get, "/session/new")
token = browser.response.body[/<meta name="csrf-token" content="([^"]+)"/, 1] # the form token, as a browser has it

visit.(:post, "/session", params: { email_address: "asha@kaksha.example", password: "wrong" },
                          headers: { "X-CSRF-Token" => token })
puts "  flash[:alert] = #{browser.flash[:alert].inspect}"

visit.(:post, "/session", params: { email_address: "asha@kaksha.example", password: "example-password-1" },
                          headers: { "X-CSRF-Token" => token })
row = Session.sole
puts "  sessions table: id #{row.id}, user #{row.user.email_address}, ip #{row.ip_address}"
copy = browser.cookies["session_id"] # someone keeps a copy of the sign-in cookie

visit.(:get, "/")
puts "  #{browser.response.body}"

visit.(:delete, "/session", headers: { "X-CSRF-Token" => token })
puts "  sessions table: #{Session.count} rows"

puts "The browser sends the old copy of session_id back:"
browser.cookies["session_id"] = copy
visit.(:get, "/")

# Kaksha after `bin/rails generate authentication` (users and sessions tables, the Authentication concern) and one
# added page, DashboardController#show at /. db:prepare builds the development database from db/schema.rb; the
# runner script then signs in and out through the generated SessionsController. --skip-executor leaves the script
# outside Rails' executor, so each request runs in an executor of its own, as it does when Puma serves it.
require_relative "session"

Session.run(<<~SH)
  cd ../kaksha
  bin/rails db:prepare
  bin/rails runner --skip-executor script/sign_in_tour.rb
SH

$ cd ../kaksha
$ bin/rails db:prepare
$ bin/rails runner --skip-executor script/sign_in_tour.rb
GET / -> 302 to http://localhost/session/new
  Set-Cookie: _kaksha_session=…; path=/; httponly; samesite=lax
GET /session/new -> 200
  Set-Cookie: _kaksha_session=…; path=/; httponly; samesite=lax
POST /session -> 302 to http://localhost/session/new
  Set-Cookie: _kaksha_session=…; path=/; httponly; samesite=lax
  flash[:alert] = "Try another email address or password."
POST /session -> 302 to http://localhost/
  Set-Cookie: session_id=…; path=/; expires in 7305 days; httponly; samesite=lax
  Set-Cookie: _kaksha_session=…; path=/; httponly; samesite=lax
  sessions table: id 1, user asha@kaksha.example, ip 127.0.0.1
GET / -> 200
  Signed in as asha@kaksha.example
DELETE /session -> 303 to http://localhost/session/new
  Set-Cookie: _kaksha_session=…; path=/; httponly; samesite=lax
  Set-Cookie: session_id=(empty); path=/; max-age=0; expires in the past; samesite=lax
  sessions table: 0 rows
The browser sends the old copy of session_id back:
GET / -> 302 to http://localhost/session/new
  Set-Cookie: _kaksha_session=…; path=/; httponly; samesite=lax

# The flash of Rails 8.1 after a redirect, after a render, and with flash.now. Three actions answer a form for a
# notice: one saves and redirects, one fails and renders the form again with flash[:alert], and one fails and renders
# with flash.now[:alert]. Every page starts with the flash it shows, as an app's layout would.
require "rails"
require "action_controller/railtie"
require "action_dispatch/testing/integration"

module Kaksha
  class Application < Rails::Application
    config.load_defaults 8.1
    config.eager_load = false
    config.logger = Logger.new(nil)
    config.secret_key_base = "kaksha-one-file-example-" * 3 # a real app keeps this in its credentials
    config.hosts << "kaksha.example"
    # These requests come from a script, not from a form, so they carry no form token; a real app keeps this check.
    config.action_controller.allow_forgery_protection = false
  end
end
Kaksha::Application.initialize!

class NoticesController < ActionController::Base
  def index
    page "the notice board"
  end

  def create
    redirect_to "/notices", notice: "Notice published"
  end

  def create_with_flash
    flash[:alert] = "Title can't be blank"
    page "the form again", status: :unprocessable_content
  end

  def create_with_flash_now
    flash.now[:alert] = "Title can't be blank"
    page "the form again", status: :unprocessable_content
  end

  private
    def page(text, status: :ok)
      shown = flash.map { |name, message| "#{name}: #{message}" }.join(", ").presence || "no flash"
      render plain: "[#{shown}] #{text}", status: status
    end
end

Kaksha::Application.routes.draw do
  get "/notices", to: "notices#index"
  post "/notices", to: "notices#create"
  post "/notices/blank", to: "notices#create_with_flash"
  post "/notices/blank-now", to: "notices#create_with_flash_now"
end

browser = ActionDispatch::Integration::Session.new(Kaksha::Application)
browser.host! "kaksha.example"

visit = lambda do |verb, path|
  browser.public_send(verb, path)
  response = browser.response
  shown = response.redirect? ? "redirect to #{response.location}" : response.body
  puts "#{verb.upcase} #{path} -> #{response.status} #{shown}"
end

puts "Saved, then a redirect:"
visit.(:post, "/notices")
visit.(:get, "/notices")
visit.(:get, "/notices")
puts "Not saved, flash[:alert] and render:"
visit.(:post, "/notices/blank")
visit.(:get, "/notices")
puts "Not saved, flash.now[:alert] and render:"
visit.(:post, "/notices/blank-now")
visit.(:get, "/notices")

Saved, then a redirect:
POST /notices -> 302 redirect to http://kaksha.example/notices
GET /notices -> 200 [notice: Notice published] the notice board
GET /notices -> 200 [no flash] the notice board
Not saved, flash[:alert] and render:
POST /notices/blank -> 422 [alert: Title can't be blank] the form again
GET /notices -> 200 [alert: Title can't be blank] the notice board
Not saved, flash.now[:alert] and render:
POST /notices/blank-now -> 422 [alert: Title can't be blank] the form again
GET /notices -> 200 [no flash] the notice board

class Current < ActiveSupport::CurrentAttributes
  attribute :session
  delegate :user, to: :session, allow_nil: true
end

# Current attributes in Rails 8.1: a controller sets Current.user once per request, a model reads it when it creates
# a record, and Rails empties it when the response is done. Beside it, a plain class attribute shows what happens to
# per-request data that nothing resets. Last, a job enqueued in the request runs the way a queue worker runs it,
# after the request and outside it.
ENV["DATABASE_URL"] = "sqlite3::memory:" # an in-memory database instead of config/database.yml
require "rails"
require "active_record/railtie"
require "active_job/railtie"
require "action_controller/railtie"
require "action_dispatch/testing/integration"

module Kaksha
  class Application < Rails::Application
    config.load_defaults 8.1
    config.eager_load = false
    config.logger = Logger.new(nil)
    config.secret_key_base = "kaksha-one-file-example-" * 3 # a real app keeps this in its credentials
    config.hosts << "kaksha.example"
    config.active_job.queue_adapter = :test # keep enqueued jobs in a list instead of a queue
    # These requests come from a script, not from a form, so they carry no form token; a real app keeps this check.
    config.action_controller.allow_forgery_protection = false
  end
end
Kaksha::Application.initialize!
ActiveRecord::Schema.verbose = false
ActiveRecord::Schema.define do
  create_table(:users) { |t| t.string :name }
  create_table(:notices) { |t| t.string :title; t.references :creator }
end

class Current < ActiveSupport::CurrentAttributes
  attribute :user
end

class LastSeen # per-request data kept in a class attribute, which nothing resets
  cattr_accessor :user
end

class User < ActiveRecord::Base; end

class Notice < ActiveRecord::Base
  belongs_to :creator, class_name: "User", optional: true, default: -> { Current.user }
end

class NoticeMailJob < ActiveJob::Base
  def perform(notice)
    puts "  the job: Current.user = #{Current.user&.name.inspect}, notice.creator = #{notice.creator&.name.inspect}"
  end
end

class NoticesController < ActionController::Base
  before_action do
    Current.user = User.find_by(name: request.headers["X-Teacher"]) # stands in for the signed-in user
    LastSeen.user = Current.user if Current.user
  end

  def create
    notice = Notice.create!(title: params[:title])
    NoticeMailJob.perform_later(notice)
    render plain: "notice #{notice.id} by #{notice.creator&.name.inspect}; LastSeen.user = #{LastSeen.user&.name.inspect}"
  end
end

Kaksha::Application.routes.draw { post "/notices", to: "notices#create" }
User.create!(name: "Asha")

browser = ActionDispatch::Integration::Session.new(Kaksha::Application)
browser.host! "kaksha.example"
adapter = ActiveJob::Base.queue_adapter

browser.post "/notices", params: { title: "Holiday on Friday" }, headers: { "X-Teacher" => "Asha" }
puts "Asha's request: #{browser.response.body}"
puts "  after the response: Current.user = #{Current.user.inspect}, LastSeen.user = #{LastSeen.user&.name.inspect}"

browser.post "/notices", params: { title: "Fees due" } # nobody signed in
puts "A request with nobody signed in: #{browser.response.body}"

puts "A worker runs the job of Asha's request:"
ActiveJob::Base.execute(adapter.enqueued_jobs.first.stringify_keys) # what a queue worker does with a job it takes

Asha's request: notice 1 by "Asha"; LastSeen.user = "Asha"
  after the response: Current.user = nil, LastSeen.user = "Asha"
A request with nobody signed in: notice 2 by nil; LastSeen.user = "Asha"
A worker runs the job of Asha's request:
  the job: Current.user = nil, notice.creator = "Asha"