Flash data is now in a separately prefixed session storage thingy

[catagits/Catalyst-Plugin-Session.git] / lib / Catalyst / Plugin / Session.pm

diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm
index 91c220e..f66ab64 100644 (file)
--- a/lib/Catalyst/Plugin/Session.pm
+++ b/lib/Catalyst/Plugin/Session.pm
@@ -14,7 +14,7 @@ use overload            ();
 our $VERSION = "0.02";
 
 BEGIN {
-    __PACKAGE__->mk_accessors(qw/_sessionid _session _session_delete_reason/);
+    __PACKAGE__->mk_accessors(qw/_sessionid _session _session_delete_reason _flash _flash_stale_keys/);
 }
 
 sub setup {
@@ -60,17 +60,33 @@ sub setup_session {
 sub finalize {
     my $c = shift;
 
+    $c->_save_session;
+    $c->_save_flash;
+
+    $c->NEXT::finalize(@_);
+}
+
+sub _save_session {
+    my $c = shift;
+    
     if ( my $session_data = $c->_session ) {
 
         # all sessions are extended at the end of the request
         my $now = time;
         @{ $session_data }{qw/__updated __expires/} =
           ( $now, $c->config->{session}{expires} + $now );
-        delete @{ $session_data->{__flash} }{ @{ delete $session_data->{__flash_stale_keys} || [] } };
-        $c->store_session_data( $c->sessionid, $session_data );
+
+        $c->store_session_data( "session:" . $c->sessionid, $session_data );
     }
+}
 
-    $c->NEXT::finalize(@_);
+sub _save_flash {
+    my $c = shift;
+
+    if ( my $flash_data = $c->_flash ) {
+        delete @{ $flash_data }{ @{ $c->_flash_stale_keys || [] } };
+        $c->store_session_data( "flash:" . $c->sessionid, $flash_data );
+    }
 }
 
 sub _load_session {
@@ -79,7 +95,7 @@ sub _load_session {
     if ( my $sid = $c->_sessionid ) {
                no warnings 'uninitialized'; # ne __address
 
-        my $session_data = $c->_session || $c->_session( $c->get_session_data($sid) );
+        my $session_data = $c->_session || $c->_session( $c->get_session_data( "session:$sid" ) );
         if ( !$session_data or $session_data->{__expires} < time ) {
 
             # session expired
@@ -101,7 +117,6 @@ sub _load_session {
         }
        
         $c->_expire_ession_keys;
-        $session_data->{__flash_stale_keys} = [ keys %{ $session_data->{__flash} } ];
 
         return $session_data;
     }
@@ -109,6 +124,19 @@ sub _load_session {
     return undef;
 }
 
+sub _load_flash {
+    my $c = shift;
+
+    if ( my $sid = $c->_sessionid ) {
+        if ( my $flash_data = $c->_flash || $c->_flash( $c->get_session_data("flash:$sid") ) ) {
+            $c->_flash_stale_keys([ keys %$flash_data ]);
+            return $flash_data;
+        }
+    }
+
+    return undef;
+}
+
 sub _expire_ession_keys {
     my ( $c, $data ) = @_;
 
@@ -126,7 +154,7 @@ sub delete_session {
 
     # delete the session data
     my $sid = $c->_sessionid || return;
-    $c->delete_session_data($sid);
+    $c->delete_session_data( "session:$sid" );
 
     # reset the values in the context object
     $c->_session(undef);
@@ -182,7 +210,7 @@ sub session {
 
 sub flash {
     my $c = shift;
-    return $c->session->{__flash} ||= {};
+    $c->_flash || $c->_load_flash || $c->_flash( {} );
 }
 
 sub session_expire_key {
@@ -363,6 +391,36 @@ requests.
 This method will automatically create a new session and session ID if none
 exists.
 
+=item flash
+
+This is like Ruby on Rails' flash data structure. Think of it as a stash that
+lasts a single redirect, not only a forward.
+
+    sub moose : Local {
+        my ( $self, $c ) = @_;
+
+        $c->flash->{beans} = 10;
+        $c->response->redirect( $c->uri_for("foo") );
+    }
+
+    sub foo : Local {
+        my ( $self, $c ) = @_;
+
+        my $value = $c->flash->{beans};
+
+        # ...
+
+        $c->response->redirect( $c->uri_for("bar") );
+    }
+
+    sub bar : Local {
+        my ( $self, $c ) = @_;
+
+        if ( exists $c->flash->{beans} ) { # false
+        
+        }
+    }
+
 =item session_delete_reason
 
 This accessor contains a string with the reason a session was deleted. Possible
@@ -588,6 +646,8 @@ This value is only populated if C<verify_address> is true in the configuration.
 
 =head1 CAVEATS
 
+=head2 Round the Robin Proxies
+
 C<verify_address> could make your site inaccessible to users who are behind
 load balanced proxies. Some ISPs may give a different IP to each request by the
 same client due to this type of proxying. If addresses are verified these
@@ -599,6 +659,48 @@ that it's OK for the address of the client to change. When the server sees that
 this box is checked it should delete the C<__address> sepcial key from the
 session hash when the hash is first created.
 
+=head2 Race Conditions
+
+In this day and age where cleaning detergents and dutch football (not the
+american kind) teams roam the plains in great numbers, requests may happen
+simultaneously. This means that there is some risk of session data being
+overwritten, like this:
+
+=over 4
+
+=item 1.
+
+request a starts, request b starts, with the same session id
+
+=item 2.
+
+session data is loaded in request a
+
+=item 3.
+
+session data is loaded in request b
+
+=item 4.
+
+session data is changed in request a
+
+=item 5.
+
+request a finishes, session data is updated and written to store
+
+=item 6.
+
+request b finishes, session data is updated and written to store, overwriting
+changes by request a
+
+=back
+
+If this is a concern in your application, a soon to be developed locking
+solution is the only safe way to go. This will have a bigger overhead.
+
+For applications where any given user is only making one request at a time this
+plugin should be safe enough.
+
 =head1 AUTHORS
 
 =over 4