Getting ActionCable authentication/identification to work when using Anycable

[synth]

This might be a bug, or it might be a fundamental misunderstanding of mine so we'll start this as a discussion.

In order to get authentication/identification to work, the common documentation is:

module ApplicationCable
  class Connection < ActionCable::Connection::Base

    identified_by :current_user

    def initialize(*args)
      debugger
      super
    end

    def connect
      debugger
      self.current_user = find_verified_user
    end

    private

    def find_verified_user
      if verified_user = env['warden'].user
        verified_user
      else
        reject_unauthorized_connection
      end
    end
  end
end

However, I've stuck breakpoints in both the connect method and in the initialize method as shown above and they never get called. I've tried with the http broadcaster and redis broadcaster and neither seem to work. I also checked the AnyCable demo app and stuck breakpoints in there and didn't see it hit. It fees like I'm missing something fundamental.

In my case, I'm trying to simply use AnyCable as the backend for realtime turbostream updates. I've worked around this and gotten these updates to work by creating custom Turbo::StreamsChannel and explicitly passing a user id like:

<%= turbo_stream_from "space", channel: SpaceChannel, data: {current_user_id: current_user.id, space_id: @space.id}%>

along with:

class SpaceChannel < Turbo::StreamsChannel
  state_attr_accessor :current_user, :space, :space_membership
  def subscribed
    super
    setup
    space_membership.here!
  end

  def unsubscribed
    super
    setup
    space_membership.away!
  end

  private

  def setup
    self.current_user ||= User.find_by(id: params[:current_user_id])
    self.space ||= current_user.spaces.find_by(id: params[:space_id])
    self.space_membership ||= current_user.space_memberships.for_space(space)
  end
end

So, AnyCable is working with TurboStreams (with both http and redis broadcasters) but just not with the authentication/identification for ActionCable that is typically documented. I've done some digging and it seems like AnyCable::Rails::Connection#handle_open method is never called and spelunked further and it seemed like something with how the websocket connections are handled but at this level things are way beyond me.

[palkan]

Hey, Peter,

Could you please tell about your AnyCable server configuration? (Or just show startup logs). Do you use JWT auth?

[synth]

Yep, definitely using JWT auth. Here are the server logs:

ws     | Started with pid 33471...
ws     | 2024-05-28 21:59:53.906 INF Starting AnyCable 1.5.1-01a996e (pid: 33892, open file limit: 245760, gomaxprocs: 10) nodeid=Hn_GI0
ws     | 2024-05-28 21:59:53.906 INF JWT authentication is enabled (param: jid, enforced: false) nodeid=Hn_GI0
ws     | 2024-05-28 21:59:53.906 INF Using channels router: $pubsub nodeid=Hn_GI0
ws     | 2024-05-28 21:59:53.907 INF Anonymized telemetry is on. Learn more: https://docs.anycable.io/anycable-go/telemetry nodeid=Hn_GI0 context=telemetry
ws     | 2024-05-28 21:59:53.908 INF Using no-op (legacy) broker nodeid=Hn_GI0
ws     | 2024-05-28 21:59:53.908 INF auto-generated authorization secret from the application secret nodeid=Hn_GI0 context=broadcast provider=http
ws     | 2024-05-28 21:59:53.908 INF Accept broadcast requests at http://localhost:8090/_broadcast (authorization required) nodeid=Hn_GI0 context=broadcast provider=http
ws     | 2024-05-28 21:59:53.908 INF auto-generated authorization secret from the application secret nodeid=Hn_GI0 context=rpc
ws     | 2024-05-28 21:59:53.908 INF RPC controller initialized: http://localhost:3000/_anycable (concurrency: 28, impl: http, enable_tls: false, proto_versions: v1) nodeid=Hn_GI0 context=rpc
ws     | 2024-05-28 21:59:53.908 INF Handle WebSocket connections at http://localhost:8090/cable nodeid=Hn_GI0
ws     | 2024-05-28 21:59:53.908 INF Handle health requests at http://localhost:8090/health nodeid=Hn_GI0

[synth]

Makes sense, but then how does the Rails side identify current user? I certainly like the advantage to not make RPC calls.

[palkan]

how does the Rails side identify current user?

You provide identifiers as your token payload, e.g., action_cable_with_jwt_meta_tag(user: current_user). AnyCable encodes them and make accessible in subsequent RPC calls.

[synth]

ahh, so here's what I've got now:

# A "space" is basically like a chatroom
# this class manages presence of a user in a particular space
class SpaceChannel < Turbo::StreamsChannel
  def subscribed
    super
    space_membership.here!
  end

  def unsubscribed
    super
    space_membership.away!
  end

  private

  def current_user
    # I found two ways to get the jwt token
    # this way is gnarly
    # jwt = CGI.parse(self.connection.env["QUERY_STRING"])["jid"]

    @current_user ||= begin
     # this way is clean but "request" is (annoyingly) a private method on connection.
      jwt = connection.send(:request).params[:jid]

     # then we can decode, easy peasy
      identifiers = AnyCable::JWT.decode(jwt)
      identifiers[:current_user]
    end
  end

  def space
    @space ||= current_user.spaces.find_by(id: params[:space_id])
  end

  def space_membership
    @space_membership ||= current_user.space_memberships.for_space(space)
  end
end

[palkan]

But you don't need to decode identifiers yourself; if you have identified_by :current_user in your Connection class then calling current_user in your channel would do the same for you.

[synth]

Ahhh, yess! It works! The piece I was missing was just the simple class

module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user
  end
end

I thought we had to have the connect method which assigns the current user.

In any case, this is awesome! Turbo Streams truly backed by AnyCable without rpc server and with authentication. I watched all your videos, and read all the docs, apologies if I missed it in there somewhere :) Thank you!