v3 : relecture de decbc0b — lien annulé retiré de la page, liens annulés avant les sessions, pluriel espagnol

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ld-server/src/access.rs

@@ -233,20 +233,7 @@ pub async fn close_sessions(
     admin_only(&user)?;
     auth::load_identity(&state, &id).await?;
     let current = auth::session_hash(&state, &headers).unwrap_or_default();
-    // Counted as the overview counts them; the expired ones go too.
-    let open: i64 = sqlx::query_scalar(
-        "SELECT COUNT(*) FROM sessions WHERE identity_id = ? AND token_hash != ? AND expires_at > ?",
-    )
-    .bind(&id)
-    .bind(&current)
-    .bind(util::now())
-    .fetch_one(&state.db)
-    .await?;
-    sqlx::query("DELETE FROM sessions WHERE identity_id = ? AND token_hash != ?")
-        .bind(&id)
-        .bind(&current)
-        .execute(&state.db)
-        .await?;
+    // The waiting link first: opened in between, it would open a session that stays.
     let links = sqlx::query(
         "UPDATE invitations SET expires_at = ? WHERE identity_id = ? AND used_at IS NULL AND expires_at > ?",
     )
@@ -256,6 +243,19 @@ pub async fn close_sessions(
     .execute(&state.db)
     .await?
     .rows_affected();
+    // Counted as the overview counts them; the expired ones go too.
+    let open = sqlx::query("DELETE FROM sessions WHERE identity_id = ? AND token_hash != ? AND expires_at > ?")
+        .bind(&id)
+        .bind(&current)
+        .bind(util::now())
+        .execute(&state.db)
+        .await?
+        .rows_affected();
+    sqlx::query("DELETE FROM sessions WHERE identity_id = ? AND token_hash != ?")
+        .bind(&id)
+        .bind(&current)
+        .execute(&state.db)
+        .await?;
     tracing::info!(identity = %id, closed = open, links, by = %user.id, "sessions closed");
     Ok(Json(json!({ "closed": open, "links": links })))
 }

crates/ld-server/src/auth.rs

@@ -191,10 +191,18 @@ pub(crate) fn session_hash(state: &AppState, headers: &HeaderMap) -> Option<Stri
 pub async fn me(State(state): State<AppState>, headers: HeaderMap, Viewer(viewer): Viewer) -> Response {
     let mut res = Json(json!({ "me": viewer })).into_response();
     if let (Some(me), Some(token)) = (&viewer, cookie_value(&headers, session_cookie(&state))) {
-        match renew(&state, &me.id, &token).await {
+        match renew(&state, &token).await {
             Ok(true) => {
                 res.headers_mut()
                     .append(SET_COOKIE, cookie(&state, session_cookie(&state), &token, "/", SESSION_DAYS * 86_400));
+                let seen = sqlx::query("UPDATE identities SET last_seen_at = ? WHERE id = ?")
+                    .bind(util::now())
+                    .bind(&me.id)
+                    .execute(&state.db)
+                    .await;
+                if let Err(e) = seen {
+                    tracing::warn!(error = %e, "last visit not recorded");
+                }
             }
             Ok(false) => {}
             Err(e) => tracing::warn!(error = %e, "session not renewed"),
@@ -204,7 +212,7 @@ pub async fn me(State(state): State<AppState>, headers: HeaderMap, Viewer(viewer
 }
 
 /// Whether the session was renewed: still open, and renewed more than a day ago.
-async fn renew(state: &AppState, identity_id: &str, token: &str) -> AppResult<bool> {
+async fn renew(state: &AppState, token: &str) -> AppResult<bool> {
     let renewed =
         sqlx::query("UPDATE sessions SET expires_at = ? WHERE token_hash = ? AND expires_at > ? AND expires_at < ?")
             .bind(util::in_days(SESSION_DAYS))
@@ -213,15 +221,7 @@ async fn renew(state: &AppState, identity_id: &str, token: &str) -> AppResult<bo
             .bind(util::in_days(SESSION_DAYS - 1))
             .execute(&state.db)
             .await?;
-    if renewed.rows_affected() != 1 {
-        return Ok(false);
-    }
-    sqlx::query("UPDATE identities SET last_seen_at = ? WHERE id = ?")
-        .bind(util::now())
-        .bind(identity_id)
-        .execute(&state.db)
-        .await?;
-    Ok(true)
+    Ok(renewed.rows_affected() == 1)
 }
 
 /// Only local paths, never `//host` nor a scheme.
@@ -585,6 +585,31 @@ mod tests {
         assert_eq!(safe_return(None), "/groupes");
     }
 
+    #[tokio::test]
+    async fn a_session_over_is_never_renewed() {
+        let db = crate::open_db("sqlite::memory:").await.expect("db");
+        let state = AppState::new(crate::Config::for_tests(), db).await.expect("state");
+        sqlx::query("INSERT INTO identities (id, kind, display_name, g1_member, admin, created_at) VALUES ('dev:a', 'dev', 'A', 0, 0, ?)")
+            .bind(util::now())
+            .execute(&state.db)
+            .await
+            .expect("identity");
+        for (token, expires) in [("over", util::in_seconds(-1)), ("open", util::in_days(10))] {
+            sqlx::query(
+                "INSERT INTO sessions (token_hash, identity_id, created_at, expires_at) VALUES (?, 'dev:a', ?, ?)",
+            )
+            .bind(util::sha256_hex(token))
+            .bind(util::now())
+            .bind(expires)
+            .execute(&state.db)
+            .await
+            .expect("session");
+        }
+        assert!(!renew(&state, "over").await.expect("renew"));
+        assert!(renew(&state, "open").await.expect("renew"));
+        assert!(!renew(&state, "open").await.expect("renew"), "once a day at most");
+    }
+
     #[test]
     fn cookie_parsing() {
         let mut h = HeaderMap::new();

crates/ld-server/tests/api.rs

@@ -487,6 +487,10 @@ async fn a_session_lasts_until_it_is_closed() {
         .execute(&state.db)
         .await
         .expect("age the session");
+    sqlx::query("UPDATE identities SET last_seen_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now', '-10 days')")
+        .execute(&state.db)
+        .await
+        .expect("and the last visit");
     let (_, v) = chiara.call("GET", "/api/me", None).await;
     assert_eq!(v["me"]["displayName"], "Chiara");
     assert!(chiara.set_cookie.as_deref().is_some_and(|c| c.contains(FOUR_HUNDRED_DAYS)), "{:?}", chiara.set_cookie);