A bunch of fixes

internal/web/session.go

@@ -1,13 +1,15 @@
 package web
 
 import (
+	"fmt"
 	"net/http"
 	"net/url"
 
 	"uPortal/internal/auth"
+
+	"github.com/mileusna/useragent"
 )
 
-// HandleSessions lists the current user's active sessions.
 func (s *WebService) HandleSessions(w http.ResponseWriter, r *http.Request) {
 	data, ok := s.basicViewData(w, r, "Sessions")
 	if !ok {
@@ -15,20 +17,41 @@ func (s *WebService) HandleSessions(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// A generous limit; the page renders whatever comes back.
 	sessions, err := s.auths.GetSessionByUserId(r.Context(), data.User.Id, 100, 0)
 	if err != nil {
 		s.log.Error("failed to get sessions: %v", err)
 		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 		return
 	}
-	data.Sessions = sessions
+	for _, session := range sessions {
+		ua := useragent.Parse(session.Device)
+		var class string
+		if ua.Mobile {
+			class = "Mobile"
+		}
+		if ua.Tablet {
+			class = "Tablet"
+		}
+		if ua.Desktop {
+			class = "Desktop"
+		}
+		if ua.Bot {
+			class = "Bot"
+		}
 
+		newSession := auth.Session{
+			Device: fmt.Sprintf("%s, %s %s, %s %s %s", class, ua.Name, ua.Version, ua.OS, ua.OSVersion, ua.Device),
+			Address: session.Address,
+			Token: session.Token,
+			CreatedAt: session.CreatedAt,
+			ExpiresAt: session.ExpiresAt,
+			UserId: session.UserId,
+		}
+		data.Sessions = append(data.Sessions, newSession)
+	}
 	s.render(w, r, "session/view.html", data)
 }
 
-// HandleSessionEnd deletes a single session identified by the form field "token".
-// It enforces ownership: a user can only delete their own session unless they are a superuser.
 func (s *WebService) HandleSessionEnd(w http.ResponseWriter, r *http.Request) {
 	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
 		http.Redirect(w, r, "/sessions", http.StatusSeeOther)
@@ -54,10 +77,8 @@ func (s *WebService) HandleSessionEnd(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if session.UserId == currentUser.Id {
-		// User deleting their own session — use defense-in-depth method
 		_ = s.auths.DeleteSessionByTokenAndUserId(r.Context(), token, currentUser.Id)
 	} else if currentUser.SuperUser {
-		// Superuser overriding — can delete any session
 		_ = s.auths.DeleteSession(r.Context(), token)
 	} else {
 		http.Error(w, "Forbidden", http.StatusForbidden)
@@ -67,7 +88,6 @@ func (s *WebService) HandleSessionEnd(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/sessions", http.StatusSeeOther)
 }
 
-// HandleSessionEndAll ends every session belonging to the current user.
 func (s *WebService) HandleSessionEndAll(w http.ResponseWriter, r *http.Request) {
 	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
 		http.Redirect(w, r, "/sessions", http.StatusSeeOther)