Allow specific session keys to bypass reset_session

[grega]

Adds session_keys_to_persist config option in order to carry over specific session keys from pre-log in to post-log in

(since reset_session is called post-log in in order to prevent session fixation: https://guides.rubyonrails.org/security.html#session-fixation-countermeasures)

[grega]

spec/dummy/spec/requests/auth_request_spec.rb:185 is failing due to the session apparently being stripped 🤷‍♂️

Test puts debug output below:

Initial session
{"session_id"=>"932565ccbd6f22ac33af628c6f5b6d8f", "omniauth.params"=>{}, "foo"=>"bar"}

Old / pre-reset_session session:
{"session_id"=>"932565ccbd6f22ac33af628c6f5b6d8f"}

Logged in (/rpi_auth/auth/callback) session:
{"session_id"=>"e39d3637a2f1256107fd8efc33d73d0d", "current_user"=>{"user_id"=>"3ed9b57a-1eb9-42e1-ae54-9a11c930f035", "country"=>nil, "country_code"=>"GB", "email"=>"person@example.com", "email_verified"=>nil, "name"=>"Sylvester McBean", "nickname"=>"Sylvie", "picture"=>"https://placecage.com/100/100", "postcode"=>nil, "profile"=>"https://my.raspberry.pi/profile/edit", "roles"=>nil}}

The session resetting after /rpi_auth/auth/callback is expected, due to reset_session being called, but I can't figure out why the session params are stripped between the first two instances. It's perhaps suspicious that omniauth.params is removed also, have dug around OmniAuth source but not found anything of note as yet.

---

Fixed in: 8ddfe50

[grega]

Moved CI / Bundle faff to: #66

[patch0]

This all looks fine to me :)

[github-actions]

• GitHub Actions run #7557862252

Test coverage: 100%