1
0
mirror of https://github.com/aclindsa/moneygo.git synced 2024-10-30 15:50:04 -04:00
moneygo/internal/handlers/sessions.go

160 lines
3.1 KiB
Go
Raw Normal View History

package handlers
2015-06-25 22:36:58 -04:00
import (
"crypto/rand"
"encoding/base64"
2015-06-25 22:36:58 -04:00
"encoding/json"
"fmt"
"io"
"log"
2015-06-25 22:36:58 -04:00
"net/http"
"strings"
"time"
2015-06-25 22:36:58 -04:00
)
type Session struct {
SessionId int64
SessionSecret string `json:"-"`
UserId int64
}
func (s *Session) Write(w http.ResponseWriter) error {
enc := json.NewEncoder(w)
return enc.Encode(s)
}
func (s *Session) Read(json_str string) error {
dec := json.NewDecoder(strings.NewReader(json_str))
return dec.Decode(s)
}
func GetSession(db *DB, r *http.Request) (*Session, error) {
2015-06-25 22:36:58 -04:00
var s Session
cookie, err := r.Cookie("moneygo-session")
if err != nil {
return nil, fmt.Errorf("moneygo-session cookie not set")
2015-06-25 22:36:58 -04:00
}
s.SessionSecret = cookie.Value
2015-06-25 22:36:58 -04:00
err = db.SelectOne(&s, "SELECT * from sessions where SessionSecret=?", s.SessionSecret)
2015-06-25 22:36:58 -04:00
if err != nil {
return nil, err
}
return &s, nil
}
func DeleteSessionIfExists(db *DB, r *http.Request) error {
// TODO do this in one transaction
session, err := GetSession(db, r)
2015-06-25 22:36:58 -04:00
if err == nil {
_, err := db.Delete(session)
if err != nil {
return err
}
2015-06-25 22:36:58 -04:00
}
return nil
2015-06-25 22:36:58 -04:00
}
func NewSessionCookie() (string, error) {
bits := make([]byte, 128)
if _, err := io.ReadFull(rand.Reader, bits); err != nil {
return "", err
}
return base64.StdEncoding.EncodeToString(bits), nil
}
func NewSession(db *DB, w http.ResponseWriter, r *http.Request, userid int64) (*Session, error) {
2015-06-25 22:36:58 -04:00
s := Session{}
session_secret, err := NewSessionCookie()
2015-06-25 22:36:58 -04:00
if err != nil {
return nil, err
}
cookie := http.Cookie{
Name: "moneygo-session",
Value: session_secret,
Path: "/",
Domain: r.URL.Host,
Expires: time.Now().AddDate(0, 1, 0), // a month from now
Secure: true,
HttpOnly: true,
}
http.SetCookie(w, &cookie)
s.SessionSecret = session_secret
s.UserId = userid
err = db.Insert(&s)
2015-06-25 22:36:58 -04:00
if err != nil {
return nil, err
}
return &s, nil
2015-06-25 22:36:58 -04:00
}
func SessionHandler(w http.ResponseWriter, r *http.Request, db *DB) {
2015-06-25 22:36:58 -04:00
if r.Method == "POST" || r.Method == "PUT" {
user_json := r.PostFormValue("user")
if user_json == "" {
WriteError(w, 3 /*Invalid Request*/)
return
}
user := User{}
err := user.Read(user_json)
if err != nil {
WriteError(w, 3 /*Invalid Request*/)
return
}
dbuser, err := GetUserByUsername(db, user.Username)
2015-06-25 22:36:58 -04:00
if err != nil {
WriteError(w, 2 /*Unauthorized Access*/)
return
}
user.HashPassword()
if user.PasswordHash != dbuser.PasswordHash {
WriteError(w, 2 /*Unauthorized Access*/)
return
}
err = DeleteSessionIfExists(db, r)
if err != nil {
WriteError(w, 999 /*Internal Error*/)
log.Print(err)
return
}
2015-06-25 22:36:58 -04:00
session, err := NewSession(db, w, r, dbuser.UserId)
2015-06-25 22:36:58 -04:00
if err != nil {
WriteError(w, 999 /*Internal Error*/)
return
}
err = session.Write(w)
if err != nil {
WriteError(w, 999 /*Internal Error*/)
log.Print(err)
return
}
2015-06-25 22:36:58 -04:00
} else if r.Method == "GET" {
s, err := GetSession(db, r)
2015-06-25 22:36:58 -04:00
if err != nil {
WriteError(w, 1 /*Not Signed In*/)
return
}
s.Write(w)
} else if r.Method == "DELETE" {
err := DeleteSessionIfExists(db, r)
if err != nil {
WriteError(w, 999 /*Internal Error*/)
log.Print(err)
return
}
2015-06-25 22:36:58 -04:00
WriteSuccess(w)
}
}