|
|
|
@ -3,105 +3,153 @@ package auth |
|
|
|
import ( |
|
|
|
import ( |
|
|
|
"encoding/json" |
|
|
|
"encoding/json" |
|
|
|
"fmt" |
|
|
|
"fmt" |
|
|
|
|
|
|
|
"github.com/gin-contrib/sessions" |
|
|
|
"github.com/gin-gonic/gin" |
|
|
|
"github.com/gin-gonic/gin" |
|
|
|
"github.com/gorilla/sessions" |
|
|
|
"github.com/gorilla/securecookie" |
|
|
|
|
|
|
|
"github.com/markbates/goth" |
|
|
|
|
|
|
|
"net/url" |
|
|
|
"sponsorahacker/config" |
|
|
|
"sponsorahacker/config" |
|
|
|
"sponsorahacker/db" |
|
|
|
"sponsorahacker/db" |
|
|
|
|
|
|
|
"strconv" |
|
|
|
|
|
|
|
"time" |
|
|
|
) |
|
|
|
) |
|
|
|
|
|
|
|
|
|
|
|
type SessionManager interface { |
|
|
|
type SessionStore interface { |
|
|
|
SetSession(username string, c *gin.Context) error |
|
|
|
CreateSession(*gin.Context) error |
|
|
|
GetSession(c *gin.Context) (string, error) |
|
|
|
GetSession(string) (Session, error) |
|
|
|
|
|
|
|
DeleteSession(string) error |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
type SessionStore struct { |
|
|
|
type SessionManager struct { |
|
|
|
SessionDB db.Database |
|
|
|
DB *db.DBClient |
|
|
|
Store *sessions.CookieStore |
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
func NewSessionManager(dbUrl string) (*SessionStore, error) { |
|
|
|
type Session struct { |
|
|
|
db, err := db.NewDbClient(dbUrl) |
|
|
|
sessionId string |
|
|
|
if err != nil { |
|
|
|
sessionData string |
|
|
|
return nil, err |
|
|
|
createdOn string |
|
|
|
|
|
|
|
modifiedOn string |
|
|
|
|
|
|
|
expiresOn string |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
// Create sessions table if not exist
|
|
|
|
var secureCookie *securecookie.SecureCookie |
|
|
|
_, err = db.Exec(` |
|
|
|
|
|
|
|
CREATE TABLE IF NOT EXISTS sessions ( |
|
|
|
func NewSessionManager(db *db.DBClient) SessionManager { |
|
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT, |
|
|
|
|
|
|
|
session_id TEXT NOT NULL UNIQUE, |
|
|
|
return SessionManager{DB: db} |
|
|
|
data BLOB NOT NULL, |
|
|
|
} |
|
|
|
created_at DATETIME DEFAULT CURRENT_TIMESTAMP, |
|
|
|
|
|
|
|
updated_at DATETIME DEFAULT CURRENT_TIMESTAMP |
|
|
|
|
|
|
|
); |
|
|
|
|
|
|
|
`) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
func (s *SessionManager) CreateSession(user goth.User, c *gin.Context) error { |
|
|
|
|
|
|
|
// create a new row that will store the user data
|
|
|
|
|
|
|
|
sessionData, err := json.Marshal(user) |
|
|
|
if err != nil { |
|
|
|
if err != nil { |
|
|
|
return nil, err |
|
|
|
fmt.Printf("error marshalling user: %v", err) |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
sessionSecret := config.GetEnvVar("SESSION_SECRET") |
|
|
|
auth := Session{ |
|
|
|
|
|
|
|
sessionData: string(sessionData), |
|
|
|
|
|
|
|
createdOn: time.Now().Format("20060102150405"), |
|
|
|
|
|
|
|
modifiedOn: time.Now().Format("20060102150405"), |
|
|
|
|
|
|
|
expiresOn: user.ExpiresAt.Format("20060102150405"), |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// todo: insert the query once you figure the rest out
|
|
|
|
|
|
|
|
result, err := s.DB.Exec(` |
|
|
|
|
|
|
|
INSERT INTO sessions (sessionData, createdOn, modifiedOn, expiresOn) |
|
|
|
|
|
|
|
VALUES (?, ?, ?, ?);`, auth.sessionData, auth.createdOn, auth.modifiedOn, auth.expiresOn) |
|
|
|
|
|
|
|
|
|
|
|
store := sessions.NewCookieStore([]byte(sessionSecret)) |
|
|
|
if result == nil { |
|
|
|
return &SessionStore{db, store}, nil |
|
|
|
fmt.Printf("error getting result from database while creating the session: %v", err) |
|
|
|
|
|
|
|
return err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
func (s *SessionStore) SetSession(username string, c *gin.Context) error { |
|
|
|
sessionId, err := result.LastInsertId() |
|
|
|
session, err := s.Store.Get(c.Request, "session") |
|
|
|
|
|
|
|
if err != nil { |
|
|
|
if err != nil { |
|
|
|
return err |
|
|
|
fmt.Printf("error getting session id from database while creating the session: %v", err) |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
hash := []byte(config.GetEnvVar("COOKIE_HASH")) |
|
|
|
|
|
|
|
block := []byte(config.GetEnvVar("COOKIE_BLOCK")) |
|
|
|
|
|
|
|
secureCookie = securecookie.New(hash, block) |
|
|
|
|
|
|
|
cookieValue := map[string]string{ |
|
|
|
|
|
|
|
"sessionId": strconv.Itoa(int(sessionId)), |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
session.Values["username"] = username |
|
|
|
encoded, err := secureCookie.Encode("_session", cookieValue) |
|
|
|
if err := session.Save(c.Request, c.Writer); err != nil { |
|
|
|
|
|
|
|
|
|
|
|
if err != nil { |
|
|
|
|
|
|
|
fmt.Printf("error encoding cookie value: %v", err) |
|
|
|
return err |
|
|
|
return err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
return s.saveSessionToDB(session) |
|
|
|
c.SetCookie("_session", encoded, 3600, "/", "localhost", false, true) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return nil |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
func (s *SessionStore) GetSession(c *gin.Context) (string, error) { |
|
|
|
func (s *SessionManager) GetSession(session sessions.Session) (Session, error) { |
|
|
|
session, err := s.Store.Get(c.Request, "session") |
|
|
|
// query for one row
|
|
|
|
|
|
|
|
result, err := s.DB.Query(`SELECT sessionData FROM sessions WHERE sessionId=$1 LIMIT 1`, session.ID()) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// if err, then return an empty struct
|
|
|
|
if err != nil { |
|
|
|
if err != nil { |
|
|
|
return "", err |
|
|
|
return Session{}, err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
username, ok := session.Values["username"].(string) |
|
|
|
// else go through the results and create a Session
|
|
|
|
if !ok { |
|
|
|
for result.Next() { |
|
|
|
return "", fmt.Errorf("username not found in session") |
|
|
|
var s Session |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
// unless there is an error, of course, then return an empty struct
|
|
|
|
|
|
|
|
if err := result.StructScan(&s); err != nil { |
|
|
|
|
|
|
|
return Session{}, err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
return username, nil |
|
|
|
return s, nil |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
func (s *SessionStore) DeleteSession(c *gin.Context) error { |
|
|
|
// if we get nothing, well, we go nothing
|
|
|
|
session, err := s.Store.Get(c.Request, "session") |
|
|
|
return Session{}, nil |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
func (s *SessionManager) DeleteSession(c *gin.Context) error { |
|
|
|
|
|
|
|
if cookie, err := c.Request.Cookie("_session"); err == nil { |
|
|
|
|
|
|
|
value := make(map[string]string) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
cookieValue, _ := url.QueryUnescape(cookie.Value) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
hash := []byte(config.GetEnvVar("COOKIE_HASH")) |
|
|
|
|
|
|
|
block := []byte(config.GetEnvVar("COOKIE_BLOCK")) |
|
|
|
|
|
|
|
secureCookie := securecookie.New(hash, block) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
err = secureCookie.Decode("_session", cookieValue, &value) |
|
|
|
|
|
|
|
|
|
|
|
if err != nil { |
|
|
|
if err != nil { |
|
|
|
|
|
|
|
fmt.Printf("error decoding cookie value: %v", err) |
|
|
|
return err |
|
|
|
return err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
session.Values["username"] = make(map[interface{}]interface{}) |
|
|
|
sessionId := value["sessionId"] |
|
|
|
|
|
|
|
sessionIdInt, err := strconv.Atoi(sessionId) |
|
|
|
|
|
|
|
|
|
|
|
if err := session.Save(c.Request, c.Writer); err != nil { |
|
|
|
if err != nil { |
|
|
|
|
|
|
|
fmt.Printf("error converting sessionId to int: %v", err) |
|
|
|
return err |
|
|
|
return err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
_, err = s.SessionDB.Exec("DELETE FROM sessions WHERE session_id = ?", session.ID) |
|
|
|
_, err = s.DB.Exec(`DELETE FROM sessions WHERE ID = ?`, sessionIdInt) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if err != nil { |
|
|
|
return err |
|
|
|
return err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
func (s *SessionStore) saveSessionToDB(session *sessions.Session) error { |
|
|
|
|
|
|
|
data, err := json.Marshal(session.Values) |
|
|
|
|
|
|
|
if err != nil { |
|
|
|
if err != nil { |
|
|
|
return err |
|
|
|
return err |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
_, err = s.SessionDB.Exec(` |
|
|
|
c.SetCookie("_session", "", -1, "/", "localhost", false, true) |
|
|
|
INSERT INTO sessions (session_id, data, updated_at) |
|
|
|
|
|
|
|
VALUES (?, ?, CURRENT_TIMESTAMP) |
|
|
|
|
|
|
|
ON CONFLICT(session_id) DO UPDATE SET data = ?, updated_at = CURRENT_TIMESTAMP |
|
|
|
|
|
|
|
`, session.ID, data, data) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return err |
|
|
|
return nil |
|
|
|
} |
|
|
|
} |
|
|
|
|
