yvv/decision
2
0
Fork 2
Code Issues Pull Requests Packages Projects Releases Wiki Activity

v3 : une session dure jusqu'à ce qu'on la ferme, l'administration ferme celles d'une identité

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Yvv
2026-10-23 08:45:26 +02:00
co-authored by Claude Opus 5.5
parent 422b45ab75
commit cf634c25d2
11 changed files with 163 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/ld-server/src/auth.rs
+30 -3
View File
@@ -39,7 +39,9 @@ fn session_cookie(state: &AppState) -> &'static str {
fn oauth_cookie(state: &AppState) -> &'static str {
if state.cfg.secure_cookies() { "__Secure-ld_oauth" } else { OAUTH_COOKIE }
}
const SESSION_DAYS: i64 = 30;
/// A session lasts until it is closed (sign-out, or an administrator): 400 days
/// is the longest a browser keeps a cookie, and each visit starts them again.
const SESSION_DAYS: i64 = 400;
const INVITATION_DAYS: i64 = 14;
fn cookie_value(headers: &HeaderMap, name: &str) -> Option<String> {
@@ -178,8 +180,33 @@ pub async fn config(State(state): State<AppState>) -> Json<serde_json::Value> {
Json(json!(AuthConfig { g1: state.cfg.connect.is_some(), dev: state.cfg.dev_login }))
}
pub async fn me(Viewer(viewer): Viewer) -> Json<serde_json::Value> {
Json(json!({ "me": viewer }))
/// The hash of the session this request comes with, if any.
pub(crate) fn session_hash(state: &AppState, headers: &HeaderMap) -> Option<String> {
cookie_value(headers, session_cookie(state)).map(|token| util::sha256_hex(&token))
}
/// Who is signed in. Once a day at most, the visit starts the session's days
/// again, in the database and in the browser.
pub async fn me(State(state): State<AppState>, headers: HeaderMap, Viewer(viewer): Viewer) -> AppResult<Response> {
let mut res = Json(json!({ "me": viewer })).into_response();
if let (Some(me), Some(token)) = (&viewer, cookie_value(&headers, session_cookie(&state))) {
let renewed = sqlx::query("UPDATE sessions SET expires_at = ? WHERE token_hash = ? AND expires_at < ?")
.bind(util::in_days(SESSION_DAYS))
.bind(util::sha256_hex(&token))
.bind(util::in_days(SESSION_DAYS - 1))
.execute(&state.db)
.await?;
if renewed.rows_affected() == 1 {
sqlx::query("UPDATE identities SET last_seen_at = ? WHERE id = ?")
.bind(util::now())
.bind(&me.id)
.execute(&state.db)
.await?;
res.headers_mut()
.append(SET_COOKIE, cookie(&state, session_cookie(&state), &token, "/", SESSION_DAYS * 86_400));
}
}
Ok(res)
}
/// Only local paths, never `//host` nor a scheme.