0.03 release

[catagits/Web-Session.git] / lib / Plack / Session / State.pm

diff --git a/lib/Plack/Session/State.pm b/lib/Plack/Session/State.pm
index 440be43..b9787d0 100644 (file)
--- a/lib/Plack/Session/State.pm
+++ b/lib/Plack/Session/State.pm
@@ -2,11 +2,15 @@ package Plack::Session::State;
 use strict;
 use warnings;
 
+our $VERSION   = '0.03';
+our $AUTHORITY = 'cpan:STEVAN';
+
 use Digest::SHA1 ();
 
 use Plack::Util::Accessor qw[
     session_key
     sid_generator
+    sid_validator
 ];
 
 sub new {
@@ -17,6 +21,7 @@ sub new {
     $params{'sid_generator'} ||= sub {
         Digest::SHA1::sha1_hex(rand() . $$ . {} . time)
     };
+    $params{'sid_validator'} ||= qr/\A[0-9a-f]{40}\Z/;
 
     bless { %params } => $class;
 }
@@ -33,10 +38,15 @@ sub is_session_expired {
 
 sub check_expired {
     my ($self, $id) = @_;
-    return unless $id && not $self->is_session_expired( $id );
+    return if $self->is_session_expired( $id );
     return $id;
 }
 
+sub validate_session_id {
+    my ($self, $id) = @_;
+    $id =~ $self->sid_validator;
+}
+
 sub get_session_id {
     my ($self, $request) = @_;
     $self->extract( $request )
@@ -44,9 +54,20 @@ sub get_session_id {
     $self->generate( $request )
 }
 
+sub get_session_id_from_request {
+    my ($self, $request) = @_;
+    $request->param( $self->session_key );
+}
+
 sub extract {
     my ($self, $request) = @_;
-    $self->check_expired( $request->param( $self->session_key ) );
+
+    my $id = $self->get_session_id_from_request( $request );
+    return unless defined $id;
+
+    $self->validate_session_id( $id )
+        &&
+    $self->check_expired( $id );
 }
 
 sub generate {
@@ -70,21 +91,56 @@ __END__
 
 Plack::Session::State - Basic parameter-based session state
 
+=head1 SYNOPSIS
+
+  use Plack::Builder;
+  use Plack::Middleware::Session;
+  use Plack::Session::State;
+
+  my $app = sub {
+      return [ 200, [ 'Content-Type' => 'text/plain' ], [ 'Hello Foo' ] ];
+  };
+
+  builder {
+      enable 'Session',
+          state => Plack::Session::State->new;
+      $app;
+  };
+
 =head1 DESCRIPTION
 
+This will maintain session state by passing the session through
+the request params. It does not do this automatically though,
+you are responsible for passing the session param.
+
+This should be considered the state "base" class (although
+subclassing is not a requirement) and defines the spec for
+all B<Plack::Session::State::*> modules. You will only
+need to override a couple methods if you do subclass. See
+L<Plack::Session::State::Cookie> for an example of this.
+
 =head1 METHODS
 
 =over 4
 
 =item B<new ( %params )>
 
+The C<%params> can include I<session_key>, I<sid_generator> and I<sid_checker>
+however in both cases a default will be provided for you.
+
 =item B<session_key>
 
 This is the name of the session key, it default to 'plack_session'.
 
 =item B<sid_generator>
 
-This is a CODE ref used to generate unique session ids.
+This is a CODE ref used to generate unique session ids, by default
+it will generate a SHA1 using fairly sufficient entropy. If you are
+concerned or interested, just read the source.
+
+=item B<sid_validator>
+
+This is a regex used to validate requested session id.
 
 =back
 
@@ -99,13 +155,25 @@ if the is expired or does not exist, it will then generate a new
 session. The C<$request> is expected to be a L<Plack::Request> instance
 or an object with an equivalent interface.
 
+=item B<get_session_id_from_request ( $request )>
+
+This is the method used to extract the session id from a C<$request>.
+Subclasses will often only need to override this method and the
+C<finalize> method.
+
+=item B<validate_session_id ( $session_id )>
+
+This will use the C<sid_validator> regex and confirm that the
+C<$session_id> is valid.
+
 =item B<extract ( $request )>
 
 This will attempt to extract the session from a C<$request> by looking
 for the C<session_key> in the C<$request> params. It will then check to
-see if the session has expired and return the session id if it is not.
-The C<$request> is expected to be a L<Plack::Request> instance or an
-object with an equivalent interface.
+see if the session is valid and that it has not expired. It will return
+the session id if everything is good or undef otherwise. The C<$request>
+is expected to be a L<Plack::Request> instance or an object with an
+equivalent interface.
 
 =item B<generate ( $request )>
 
@@ -157,7 +225,7 @@ Stevan Little E<lt>stevan.little@iinteractive.comE<gt>
 
 =head1 COPYRIGHT AND LICENSE
 
-Copyright 2009 Infinity Interactive, Inc.
+Copyright 2009, 2010 Infinity Interactive, Inc.
 
 L<http://www.iinteractive.com>