85 lines
2.5 KiB
Go
85 lines
2.5 KiB
Go
|
package web
|
||
|
|
|
||
|
|
import (
|
||
|
|
"net/http"
|
||
|
|
"net/url"
|
||
|
|
|
||
|
|
"uPortal/internal/auth"
|
||
|
|
)
|
||
|
|
|
||
|
|
// HandleSessions lists the current user's active sessions.
|
||
|
|
func (s *WebService) HandleSessions(w http.ResponseWriter, r *http.Request) {
|
||
|
|
data, ok := s.basicViewData(w, r, "Sessions")
|
||
|
|
if !ok {
|
||
|
|
http.Redirect(w, r, "/signin", http.StatusSeeOther)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
// A generous limit; the page renders whatever comes back.
|
||
|
|
sessions, err := s.auths.GetSessionByUserId(r.Context(), data.User.Id, 100, 0)
|
||
|
|
if err != nil {
|
||
|
|
s.log.Error("failed to get sessions: %v", err)
|
||
|
|
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
data.Sessions = sessions
|
||
|
|
|
||
|
|
s.render(w, r, "session/view.html", data)
|
||
|
|
}
|
||
|
|
|
||
|
|
// HandleSessionEnd deletes a single session identified by the form field "token".
|
||
|
|
// It enforces ownership: a user can only delete their own session unless they are a superuser.
|
||
|
|
func (s *WebService) HandleSessionEnd(w http.ResponseWriter, r *http.Request) {
|
||
|
|
if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
|
||
|
|
http.Redirect(w, r, "/sessions", http.StatusSeeOther)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
currentUser, err := s.currentUser(r)
|
||
|
|
if err != nil {
|
||
|
|
http.Redirect(w, r, "/signin", http.StatusSeeOther)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
token := r.FormValue("token")
|
||
|
|
if token == "" {
|
||
|
|
http.Redirect(w, r, "/sessions", http.StatusSeeOther)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
session, err := s.auths.GetSessionByToken(r.Context(), token)
|
||
|
|
if err != nil {
|
||
|
|
http.Redirect(w, r, "/sessions", http.StatusSeeOther)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
if session.UserId == currentUser.Id {
|
||
|
|
// User deleting their own session — use defense-in-depth method
|
||
|
|
_ = s.auths.DeleteSessionByTokenAndUserId(r.Context(), token, currentUser.Id)
|
||
|
|
} else if currentUser.SuperUser {
|
||
|
|
// Superuser overriding — can delete any session
|
||
|
|
_ = s.auths.DeleteSession(r.Context(), token)
|
||
|
|
} else {
|
||
|
|
http.Error(w, "Forbidden", http.StatusForbidden)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
http.Redirect(w, r, "/sessions", http.StatusSeeOther)
|
||
|
|
}
|
||
|
|
|
||
|
|
// HandleSessionEndAll ends every session belonging to the current user.
|
||
|
|
func (s *WebService) HandleSessionEndAll(w http.ResponseWriter, r *http.Request) {
|
||
|
|
if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
|
||
|
|
http.Redirect(w, r, "/sessions", http.StatusSeeOther)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
u, err := s.currentUser(r)
|
||
|
|
if err != nil {
|
||
|
|
http.Redirect(w, r, "/signin?redirect="+url.PathEscape(r.URL.RequestURI()), http.StatusSeeOther)
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
_ = s.auths.DeleteSessionsByUserId(r.Context(), u.Id)
|
||
|
|
http.Redirect(w, r, "/sessions", http.StatusSeeOther)
|
||
|
|
}
|