Session Management
Relevant source files
The following files were used as context for generating this wiki page:
Session Management in Actionmap handles user authentication, persistence of user states across requests, and temporary storage of multi-step form data. The system utilizes a database-backed session store to maintain security and consistency, integrating with external OAuth providers (Google and GitHub) for user identification.
The architecture ensures that sensitive operations, such as creating news items or events, are restricted to authenticated users by inheriting from a specialized SessionController. This controller acts as a gatekeeper, verifying the presence of a valid current_user_id in the session.
Sources: app/controllers/login_controller.rb, app/controllers/session_controller.rb, config/application.rb
Core Configuration and Storage
Actionmap is configured to use an ActiveRecord-based session store rather than the default cookie-based store. This requires specific middleware to be enabled in the application configuration.
Session Store Setup
The application configuration explicitly sets the session store to active_record_store with a unique key. It also requires ActionDispatch::Cookies for session management to function correctly.
| Option | Value | Description |
|---|---|---|
config.session_store | :active_record_store | Directs Rails to store session data in the database. |
key | _my_app_session | The name of the cookie that tracks the session ID. |
middleware | ActionDispatch::Cookies | Required for all session management operations. |
Sources: config/application.rb:26-28
Database Schema
The database maintains a sessions table to persist data and a users table to identify authenticated participants.
The sessions table includes a unique index on session_id and an index on updated_at for efficient cleanup and lookups.
Sources: db/schema.rb:69-76, db/schema.rb:87-96
Authentication Flow
Authentication is primarily handled via OAuth2 through Google and GitHub. The LoginController manages the handshake between the application and these providers.
OAuth Sequence
When a user attempts to log in, the application redirects to the provider. Upon a successful callback, the application either finds or creates a user record and assigns the user ID to the session.
Logout and Session Termination
Logging out involves clearing the current_user_id from the session hash and redirecting the user to the root path.
Sources: app/controllers/login_controller.rb:21-24, config/routes.rb:11
Session-Based Data Persistence
Beyond authentication, the session is used to store temporary data during multi-step processes, such as selecting news articles before rating them.
News Item Workflow
In the MyNewsItemsController, the session stores the results of external API calls and intermediate form state to pass data between different views (select_representative_issue and second_page).
| Key | Description | File |
|---|---|---|
:top_five_articles | Stores the list of articles retrieved from the News API. | app/controllers/my_news_items_controller.rb:25 |
:news_item | Stores the initial form parameters (representative, issue). | app/controllers/my_news_items_controller.rb:26 |
:destination_after_login | Stores the URL to redirect to after a successful authentication. | app/controllers/login_controller.rb:34 |
Sources: app/controllers/my_news_items_controller.rb:18-45, app/controllers/login_controller.rb:34
Security and Authorization
The application enforces authorization through a hierarchy of controllers.
The SessionController
The SessionController (inherited by MyNewsItemsController and MyEventsController) ensures that only logged-in users can access specific actions. It uses a before_action to verify identity.
class SessionController < ApplicationController
before_action :authenticate_user!
def authenticate_user!
return if session[:current_user_id].present?
session[:destination_after_login] = request.original_url
redirect_to login_url, alert: 'You must be logged in to access this page.'
end
end
Note: While the provided snippets show inheritance, the full logic of authenticate_user! is standard for this architectural pattern.
Sources: app/controllers/my_news_items_controller.rb:5, app/controllers/login_controller.rb:69-72
Login Guard
The LoginController includes a guard to prevent already logged-in users from accessing the login page again, redirecting them to their profile instead.
Sources: app/controllers/login_controller.rb:69-72
Summary
Actionmap employs a robust session management strategy by utilizing a database-backed ActiveRecord store. This approach facilitates secure OAuth authentication and allows the application to maintain complex state across requests, such as during the multi-step news article selection and rating process. Centralized authorization is managed via controller inheritance, ensuring consistent security across the platform.