lynndylanhurley / lynndylanhurley/devise_token_auth

Token validation could raise exception in v1.1.0

Open
#1,304 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Ruby
Stars
3.6k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

The validation made on line 105 of the `set_user_by_token.rb` is causing me trouble.

There are some cases where my before_validation callbacks change my user model. I do it for cleaning some old dates from my model, before running validations that ensure these dates are clean.

After I upgraded to DTA v1.1.0, in some requests, the call `unless @resource.reload.valid?` leaves the `@resource` with unpersisted changes, and the exception is thrown right after, when the `@resource.with_lock` is called.

```
A RuntimeError occurred in token_validations#validate_token:

Locking a record with unpersisted changes is not supported. Use `save` to persist the changes, or `reload` to discard them explicitly.

```

I could change my callback to be an after save, but I really don't understand the goal of this validation (and the reload, that causes an extra database query), because we lock the object right after it, which is when we query for the updated version of the object.

Contributor guide

Open the contributing guide

Research direction

Start in set_user_by_token.rb at the validation on line 105, then trace how @resource.reload.valid? relates to the later @resource.with_lock call. Determine the intended validation and locking behavior, including whether the extra reload is necessary; done means the reported unpersisted-change exception is addressed without breaking token validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
rails, ruby
Domain
api, authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.