Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Merge pull request from GHSA-7w3c-p9j8-mq3x

Browse source 
* Ensure destruction of OAuth Applications notifies streaming

Due to doorkeeper using a dependent: delete_all relationship, the destroy of an OAuth Application bypassed the existing AccessTokenExtension callbacks for announcing destructing of access tokens.

* Ensure password resets revoke access to Streaming API

* Improve performance of deleting OAuth tokens

---------

Co-authored-by: Claire <claire.github-309c@sitedethib.com>
This commit is contained in:
Emelia Smith 2024-02-14 15:15:34 +01:00 • committed by GitHub
parent 554e2a019e
commit 68eaa804c9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 37 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
app/models/user.rb
View file

@ -344,6 +344,16 @@ class User < ApplicationRecord
Doorkeeper::AccessToken.by_resource_owner(self).in_batches do |batch|
batch.update_all(revoked_at: Time.now.utc)
Web::PushSubscription.where(access_token_id: batch).delete_all
# Revoke each access token for the Streaming API, since `update_all``
# doesn't trigger ActiveRecord Callbacks:
# TODO: #28793 Combine into a single topic
payload = Oj.dump(event: :kill)
redis.pipelined do |pipeline|
batch.ids.each do |id|
pipeline.publish("timeline:access_token:#{id}", payload)
end
end
end
end