v3 : relecture de cf634c2 — renouvellement sans effet sur la réponse, lien en attente fermé avec les sessions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/ld-server/src/auth.rs

@@ -186,27 +186,42 @@ pub(crate) fn session_hash(state: &AppState, headers: &HeaderMap) -> Option<Stri
 }
 
 /// Who is signed in. Once a day at most, the visit starts the session's days
-/// again, in the database and in the browser.
-pub async fn me(State(state): State<AppState>, headers: HeaderMap, Viewer(viewer): Viewer) -> AppResult<Response> {
+/// again, in the database and in the browser. A renewal that fails is logged,
+/// never answered as signed out.
+pub async fn me(State(state): State<AppState>, headers: HeaderMap, Viewer(viewer): Viewer) -> Response {
     let mut res = Json(json!({ "me": viewer })).into_response();
     if let (Some(me), Some(token)) = (&viewer, cookie_value(&headers, session_cookie(&state))) {
-        let renewed = sqlx::query("UPDATE sessions SET expires_at = ? WHERE token_hash = ? AND expires_at < ?")
+        match renew(&state, &me.id, &token).await {
+            Ok(true) => {
+                res.headers_mut()
+                    .append(SET_COOKIE, cookie(&state, session_cookie(&state), &token, "/", SESSION_DAYS * 86_400));
+            }
+            Ok(false) => {}
+            Err(e) => tracing::warn!(error = %e, "session not renewed"),
+        }
+    }
+    res
+}
+
+/// Whether the session was renewed: still open, and renewed more than a day ago.
+async fn renew(state: &AppState, identity_id: &str, token: &str) -> AppResult<bool> {
+    let renewed =
+        sqlx::query("UPDATE sessions SET expires_at = ? WHERE token_hash = ? AND expires_at > ? AND expires_at < ?")
             .bind(util::in_days(SESSION_DAYS))
-            .bind(util::sha256_hex(&token))
+            .bind(util::sha256_hex(token))
+            .bind(util::now())
             .bind(util::in_days(SESSION_DAYS - 1))
             .execute(&state.db)
             .await?;
-        if renewed.rows_affected() == 1 {
-            sqlx::query("UPDATE identities SET last_seen_at = ? WHERE id = ?")
-                .bind(util::now())
-                .bind(&me.id)
-                .execute(&state.db)
-                .await?;
-            res.headers_mut()
-                .append(SET_COOKIE, cookie(&state, session_cookie(&state), &token, "/", SESSION_DAYS * 86_400));
-        }
+    if renewed.rows_affected() != 1 {
+        return Ok(false);
     }
-    Ok(res)
+    sqlx::query("UPDATE identities SET last_seen_at = ? WHERE id = ?")
+        .bind(util::now())
+        .bind(identity_id)
+        .execute(&state.db)
+        .await?;
+    Ok(true)
 }
 
 /// Only local paths, never `//host` nor a scheme.