Initial commit

internal/web/session.go

@@ -0,0 +1,85 @@
+package web
+
+import (
+	"net/http"
+	"net/url"
+
+	"uPortal/internal/auth"
+)
+
+// HandleSessions lists the current user's active sessions.
+func (s *WebService) HandleSessions(w http.ResponseWriter, r *http.Request) {
+	data, ok := s.basicViewData(w, r, "Sessions")
+	if !ok {
+		http.Redirect(w, r, "/signin", http.StatusSeeOther)
+		return
+	}
+
+	// A generous limit; the page renders whatever comes back.
+	sessions, err := s.auths.GetSessionByUserId(r.Context(), data.User.Id, 100, 0)
+	if err != nil {
+		s.log.Error("failed to get sessions: %v", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	data.Sessions = sessions
+
+	s.render(w, r, "session/view.html", data)
+}
+
+// HandleSessionEnd deletes a single session identified by the form field "token".
+// It enforces ownership: a user can only delete their own session unless they are a superuser.
+func (s *WebService) HandleSessionEnd(w http.ResponseWriter, r *http.Request) {
+	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
+		http.Redirect(w, r, "/sessions", http.StatusSeeOther)
+		return
+	}
+
+	currentUser, err := s.currentUser(r)
+	if err != nil {
+		http.Redirect(w, r, "/signin", http.StatusSeeOther)
+		return
+	}
+
+	token := r.FormValue("token")
+	if token == "" {
+		http.Redirect(w, r, "/sessions", http.StatusSeeOther)
+		return
+	}
+
+	session, err := s.auths.GetSessionByToken(r.Context(), token)
+	if err != nil {
+		http.Redirect(w, r, "/sessions", http.StatusSeeOther)
+		return
+	}
+
+	if session.UserId == currentUser.Id {
+		// User deleting their own session — use defense-in-depth method
+		_ = s.auths.DeleteSessionByTokenAndUserId(r.Context(), token, currentUser.Id)
+	} else if currentUser.SuperUser {
+		// Superuser overriding — can delete any session
+		_ = s.auths.DeleteSession(r.Context(), token)
+	} else {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
+	http.Redirect(w, r, "/sessions", http.StatusSeeOther)
+}
+
+// HandleSessionEndAll ends every session belonging to the current user.
+func (s *WebService) HandleSessionEndAll(w http.ResponseWriter, r *http.Request) {
+	if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
+		http.Redirect(w, r, "/sessions", http.StatusSeeOther)
+		return
+	}
+
+	u, err := s.currentUser(r)
+	if err != nil {
+		http.Redirect(w, r, "/signin?redirect="+url.PathEscape(r.URL.RequestURI()), http.StatusSeeOther)
+		return
+	}
+
+	_ = s.auths.DeleteSessionsByUserId(r.Context(), u.Id)
+	http.Redirect(w, r, "/sessions", http.StatusSeeOther)
+}