Fix MessageVerifier to work with new API

[zzak]

This API changed in rails/rails@91b2a15 (#47325)

/cc @jonathanhefner

How to reproduce:

>> GlobalID::Locator.locate_signed(Company.first.to_sgid(for: :debug), for: :debug)
  Company Load (0.1ms)  SELECT "companies".* FROM "companies" ORDER BY "companies"."id" ASC LIMIT ?  [["LIMIT", 1]]
  Company Load (0.1ms)  SELECT "companies".* FROM "companies" WHERE "companies"."id" = ? LIMIT ?  [["id", 1], ["LIMIT", 1]]
=> #<Company:0x00000001052f1560 id: 1, name: "nintendo", created_at: Mon, 07 Aug 2023 10:27:45.223195000 UTC +00:00, updated_at: Mon, 07 Aug 2023 10:27:45.223195000 UTC +00:00>

Previously, using the JSON method, this would return nil.

[zzak]

I should mention this doesn't occur when using other non-JSON message serializers, via:

Rails.application.config.active_support.message_serializer = :message_pack

The new default :json_allow_marshal also returns nil.

[zzak]

Also found #149 as possibly related, but haven't looked into it much further, could be a red herring.

[jonathanhefner]

rails/rails@91b2a15 did not change these method names; it just factored them out into ActiveSupport::Messages::Codec. The sign_encoded and extract_encoded methods are different.

The problem here is actually the change of the default serializer from Marshal to JSON (via rails/rails#42843). JSON does not roundtrip symbols. So if you change your example to

GlobalID::Locator.locate_signed(Company.first.to_sgid(for: "debug"), for: "debug")

it will work. You can even change it to

GlobalID::Locator.locate_signed(Company.first.to_sgid(for: :debug), for: "debug")

and it will work.

To support symbol purposes for all serializers, we would need to change

globalid/lib/global_id/signed_global_id.rb

Line 45 in 86ddaae

metadata['gid'] if pick_purpose(options) == metadata['purpose']

to

        metadata['gid'] if pick_purpose(options)&.to_s == metadata['purpose']&.to_s

(Note that ActiveSupport::MessageVerifier already does this internally when using its :purpose option, but SignedGlobalID handles purpose itself.)

[rafaelfranca]

I'm trying to write a test to reproduce this error and this one always pass.

Am I missing something?

  test 'foo' do
    verifier = GlobalID::Verifier.new('muchSECRETsoHIDDEN', serializer: JSON)
    assert_equal Person::Child.new('2'), GlobalID::Locator.locate_signed(Person::Child.new('2').to_sgid(for: :debug, verifier: verifier), for: :debug, verifier: verifier)
  end

[jonathanhefner]

I was testing with a released version of Global ID. It looks like this may be fixed on main by dc9a648 and 12f7629, which route verification through ActiveSupport::MessageVerifier (which calls to_s on the purpose).

[rafaelfranca]

Thanks! I just got that. I updated the test and the legacy verifier behavior to make sure this works.