v3 : relecture de decbc0b — lien annulé retiré de la page, liens annulés avant les sessions, pluriel espagnol

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ld-server/src/auth.rs

@@ -191,10 +191,18 @@ pub(crate) fn session_hash(state: &AppState, headers: &HeaderMap) -> Option<Stri
 pub async fn me(State(state): State<AppState>, headers: HeaderMap, Viewer(viewer): Viewer) -> Response {
     let mut res = Json(json!({ "me": viewer })).into_response();
     if let (Some(me), Some(token)) = (&viewer, cookie_value(&headers, session_cookie(&state))) {
-        match renew(&state, &me.id, &token).await {
+        match renew(&state, &token).await {
             Ok(true) => {
                 res.headers_mut()
                     .append(SET_COOKIE, cookie(&state, session_cookie(&state), &token, "/", SESSION_DAYS * 86_400));
+                let seen = sqlx::query("UPDATE identities SET last_seen_at = ? WHERE id = ?")
+                    .bind(util::now())
+                    .bind(&me.id)
+                    .execute(&state.db)
+                    .await;
+                if let Err(e) = seen {
+                    tracing::warn!(error = %e, "last visit not recorded");
+                }
             }
             Ok(false) => {}
             Err(e) => tracing::warn!(error = %e, "session not renewed"),
@@ -204,7 +212,7 @@ pub async fn me(State(state): State<AppState>, headers: HeaderMap, Viewer(viewer
 }
 
 /// Whether the session was renewed: still open, and renewed more than a day ago.
-async fn renew(state: &AppState, identity_id: &str, token: &str) -> AppResult<bool> {
+async fn renew(state: &AppState, token: &str) -> AppResult<bool> {
     let renewed =
         sqlx::query("UPDATE sessions SET expires_at = ? WHERE token_hash = ? AND expires_at > ? AND expires_at < ?")
             .bind(util::in_days(SESSION_DAYS))
@@ -213,15 +221,7 @@ async fn renew(state: &AppState, identity_id: &str, token: &str) -> AppResult<bo
             .bind(util::in_days(SESSION_DAYS - 1))
             .execute(&state.db)
             .await?;
-    if renewed.rows_affected() != 1 {
-        return Ok(false);
-    }
-    sqlx::query("UPDATE identities SET last_seen_at = ? WHERE id = ?")
-        .bind(util::now())
-        .bind(identity_id)
-        .execute(&state.db)
-        .await?;
-    Ok(true)
+    Ok(renewed.rows_affected() == 1)
 }
 
 /// Only local paths, never `//host` nor a scheme.
@@ -585,6 +585,31 @@ mod tests {
         assert_eq!(safe_return(None), "/groupes");
     }
 
+    #[tokio::test]
+    async fn a_session_over_is_never_renewed() {
+        let db = crate::open_db("sqlite::memory:").await.expect("db");
+        let state = AppState::new(crate::Config::for_tests(), db).await.expect("state");
+        sqlx::query("INSERT INTO identities (id, kind, display_name, g1_member, admin, created_at) VALUES ('dev:a', 'dev', 'A', 0, 0, ?)")
+            .bind(util::now())
+            .execute(&state.db)
+            .await
+            .expect("identity");
+        for (token, expires) in [("over", util::in_seconds(-1)), ("open", util::in_days(10))] {
+            sqlx::query(
+                "INSERT INTO sessions (token_hash, identity_id, created_at, expires_at) VALUES (?, 'dev:a', ?, ?)",
+            )
+            .bind(util::sha256_hex(token))
+            .bind(util::now())
+            .bind(expires)
+            .execute(&state.db)
+            .await
+            .expect("session");
+        }
+        assert!(!renew(&state, "over").await.expect("renew"));
+        assert!(renew(&state, "open").await.expect("renew"));
+        assert!(!renew(&state, "open").await.expect("renew"), "once a day at most");
+    }
+
     #[test]
     fn cookie_parsing() {
         let mut h = HeaderMap::new();