lynndylanhurley / lynndylanhurley/devise_token_auth
Token validation could raise exception in v1.1.0
- Dominant language
- Ruby
- Stars
- 3.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
The validation made on line 105 of the `set_user_by_token.rb` is causing me trouble.
There are some cases where my before_validation callbacks change my user model. I do it for cleaning some old dates from my model, before running validations that ensure these dates are clean.
After I upgraded to DTA v1.1.0, in some requests, the call `unless @resource.reload.valid?` leaves the `@resource` with unpersisted changes, and the exception is thrown right after, when the `@resource.with_lock` is called.
```
A RuntimeError occurred in token_validations#validate_token:
Locking a record with unpersisted changes is not supported. Use `save` to persist the changes, or `reload` to discard them explicitly.
```
I could change my callback to be an after save, but I really don't understand the goal of this validation (and the reload, that causes an extra database query), because we lock the object right after it, which is when we query for the updated version of the object.
Contributor guide
Research direction
Start in set_user_by_token.rb at the validation on line 105, then trace how @resource.reload.valid? relates to the later @resource.with_lock call. Determine the intended validation and locking behavior, including whether the extra reload is necessary; done means the reported unpersisted-change exception is addressed without breaking token validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rails, ruby
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100