mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-27 16:06:48 +09:00
Jeremy Daer
6cab924097
A push subscription belongs to the user, not a session, so a device signed out by a password change kept getting notifications. Changing the password now removes every subscription along with the sessions, in the same transaction. A browser still signed in keeps its own subscription in its service worker, so the notifications controller posts it once per session: the bell names the session by a digest of its id, never its token, and the browser remembers the last one it posted for. That post never unsubscribes the browser when the server refuses it. A request that authenticated just before the change could put a subscription back after it. The create action now checks the session still exists and saves in one immediate transaction, after validating the endpoint outside it.
8 lines
415 B
Ruby
8 lines
415 B
Ruby
module Users::PushSubscriptionsHelper
|
|
# Names the session without revealing its token, so the browser can tell when it's in a new one. The creation
|
|
# time keeps an id reused by a new database from looking like the same session.
|
|
def push_subscription_session_marker
|
|
Digest::SHA256.hexdigest("push-subscription-session-#{Current.session.id}-#{Current.session.created_at.to_f}") if Current.session
|
|
end
|
|
end
|