Fix expiring sessions crashing app

LetsChurch · Sep 11, 2024 · d602d96 · d602d96
1 parent d2b8249
commit d602d96
Show file tree

Hide file tree

Showing 6 changed files with 43 additions and 49 deletions.
diff --git a/services/web/internal/data/auth.sql b/services/web/internal/data/auth.sql
@@ -59,6 +59,3 @@ WHERE u.id = sqlc.arg(id);
 
 -- name: ChangePassword :exec
 UPDATE app_user SET password=sqlc.arg(password) WHERE id=sqlc.arg(id);
-
--- name: GetValidSession :one
-SELECT * FROM app_session WHERE id = sqlc.arg(id) AND expires_at > NOW();
diff --git a/services/web/internal/data/auth.sql.go b/services/web/internal/data/auth.sql.go
diff --git a/services/web/internal/data/session.sql b/services/web/internal/data/session.sql
@@ -1,4 +1,4 @@
--- name: GetSession :one
+-- name: GetValidSession :many
 SELECT s.*, u.id as user_id, u.username as username
 FROM app_session s, app_user u
 WHERE s.id = sqlc.arg(id)

diff --git a/services/web/internal/data/session.sql.go b/services/web/internal/data/session.sql.go
diff --git a/services/web/internal/handler/auth.go b/services/web/internal/handler/auth.go
@@ -473,7 +473,7 @@ func (h *Handler) createSession(c echo.Context, user *data.GetUserRow, remember
 	return &sessionId, nil
 }
 
-func (h *Handler) deleteSession(c echo.Context, sessionRow *data.GetSessionRow) error {
+func (h *Handler) deleteSession(c echo.Context, sessionRow *data.GetValidSessionRow) error {
 	eb := oops.In("deleteSession")
 	sess, err := session.Get("session", c)
 	if err != nil {

diff --git a/services/web/internal/handler/handler.go b/services/web/internal/handler/handler.go
@@ -22,7 +22,7 @@ type Handler struct {
 	ZxcvbnMinimumScore int
 }
 
-func (h *Handler) getAppSession(c echo.Context) (*data.GetSessionRow, error) {
+func (h *Handler) getAppSession(c echo.Context) (*data.GetValidSessionRow, error) {
 	sess, _ := session.Get("session", c)
 	sessionId := sess.Values["id"]
 
@@ -37,12 +37,16 @@ func (h *Handler) getAppSession(c echo.Context) (*data.GetSessionRow, error) {
 		return nil, eb.Wrap(err)
 	}
 
-	session, err := h.Queries.GetSession(c.Request().Context(), sessionUuid.Pg())
+	session, err := h.Queries.GetValidSession(c.Request().Context(), sessionUuid.Pg())
 
-	return &session, eb.Wrap(err)
+	if len(session) == 0 {
+		return nil, eb.Errorf("No valid session found")
+	}
+
+	return &session[0], eb.Wrap(err)
 }
 
-func (h *Handler) getAppUserFromSession(c echo.Context, session *data.GetSessionRow) (*data.GetUserByIdRow, error) {
+func (h *Handler) getAppUserFromSession(c echo.Context, session *data.GetValidSessionRow) (*data.GetUserByIdRow, error) {
 	if session == nil {
 		return nil, nil
 	}
@@ -62,18 +66,16 @@ func (h *Handler) getAppContext(c echo.Context) (*util.AppContext, error) {
 	flashes := lo.Map(sess.Flashes(), func(f any, _ int) util.Flash {
 		return f.(util.Flash)
 	})
+
 	eb := oops.In("getAppContext")
 	err := sess.Save(c.Request(), c.Response())
-	if err != nil {
-		return nil, eb.Hint("Could not save session after getting flashes").Wrap(err)
-	}
 
-	appSession, err := h.getAppSession(c)
 	if err != nil {
-		return nil, eb.Hint("Could not get app session").Wrap(err)
+		return nil, eb.Hint("Could not save session after getting flashes").Wrap(err)
 	}
 
-	appUser, err := h.getAppUserFromSession(c, appSession)
+	appSession, _ := h.getAppSession(c)
+	appUser, _ := h.getAppUserFromSession(c, appSession)
 
 	return &util.AppContext{
 		Flashes:       flashes,