auth

Paddy 2015-04-11 Parent:5f670aba87b4 Child:6f473576c6ae

159:cf6c1f05eb21 Go to Latest

auth/session_postgres.go

Enable terminating sessions through the API. Add a terminateSession method to the sessionStore that sets the Active property of the Session to false. Create a Context.TerminateSession wrapper for the terminateSession method on the sessionStore. Add a Sessions property to our response type so we can return a []Session in API responses. Use the URL-safe encoding when base64 encoding our session ID and CSRFToken, so the ID can be passed in the URL and so our encodings are consistent. Add a TerminateSessionHandler function that will extract a Session ID from the request URL, authenticate the user, check that the authenticated user owns the session in question, and terminate the session. Add implementations for our new terminateSession method for the memstore and postgres types. Test both the memstore and postgres implementation of our terminateSession helper in session_test.go.

Download raw file
View source Diff to previous Annotate
History
paddy@154 1 package auth
paddy@154 2
paddy@154 3 import (
paddy@154 4 "time"
paddy@154 5
paddy@154 6 "code.secondbit.org/uuid.hg"
paddy@154 7
paddy@154 8 "github.com/lib/pq"
paddy@154 9 "github.com/secondbit/pan"
paddy@154 10 )
paddy@154 11
paddy@154 12 func (s Session) GetSQLTableName() string {
paddy@154 13 return "sessions"
paddy@154 14 }
paddy@154 15
paddy@154 16 func (p *postgres) createSessionSQL(session Session) *pan.Query {
paddy@154 17 fields, values := pan.GetFields(session)
paddy@154 18 query := pan.New(pan.POSTGRES, "INSERT INTO "+pan.GetTableName(session))
paddy@154 19 query.Include("(" + pan.QueryList(fields) + ")")
paddy@154 20 query.Include("VALUES")
paddy@154 21 query.Include("("+pan.VariableList(len(values))+")", values...)
paddy@154 22 return query.FlushExpressions(" ")
paddy@154 23 }
paddy@154 24
paddy@154 25 func (p *postgres) createSession(session Session) error {
paddy@154 26 query := p.createSessionSQL(session)
paddy@154 27 _, err := p.db.Exec(query.String(), query.Args...)
paddy@154 28 if e, ok := err.(*pq.Error); ok && e.Constraint == "sessions_pkey" {
paddy@154 29 err = ErrSessionAlreadyExists
paddy@154 30 }
paddy@154 31 return err
paddy@154 32 }
paddy@154 33
paddy@154 34 func (p *postgres) getSessionSQL(id string) *pan.Query {
paddy@154 35 var session Session
paddy@154 36 fields, _ := pan.GetFields(session)
paddy@154 37 query := pan.New(pan.POSTGRES, "SELECT "+pan.QueryList(fields)+" FROM "+pan.GetTableName(session))
paddy@154 38 query.IncludeWhere()
paddy@154 39 query.Include(pan.GetUnquotedColumn(session, "ID")+" = ?", id)
paddy@154 40 return query.FlushExpressions(" ")
paddy@154 41 }
paddy@154 42
paddy@154 43 func (p *postgres) getSession(id string) (Session, error) {
paddy@154 44 query := p.getSessionSQL(id)
paddy@154 45 rows, err := p.db.Query(query.String(), query.Args...)
paddy@154 46 if err != nil {
paddy@154 47 return Session{}, err
paddy@154 48 }
paddy@154 49 var session Session
paddy@154 50 var found bool
paddy@154 51 for rows.Next() {
paddy@154 52 err := pan.Unmarshal(rows, &session)
paddy@154 53 if err != nil {
paddy@154 54 return session, err
paddy@154 55 }
paddy@154 56 found = true
paddy@154 57 }
paddy@154 58 if err = rows.Err(); err != nil {
paddy@154 59 return session, err
paddy@154 60 }
paddy@154 61 if !found {
paddy@154 62 return session, ErrSessionNotFound
paddy@154 63 }
paddy@154 64 return session, nil
paddy@154 65 }
paddy@154 66
paddy@159 67 func (p *postgres) terminateSessionSQL(id string) *pan.Query {
paddy@159 68 var session Session
paddy@159 69 query := pan.New(pan.POSTGRES, "UPDATE "+pan.GetTableName(session)+" SET")
paddy@159 70 query.Include(pan.GetUnquotedColumn(session, "Active")+" = ?", false)
paddy@159 71 query.IncludeWhere()
paddy@159 72 query.Include(pan.GetUnquotedColumn(session, "ID")+" = ?", id)
paddy@159 73 return query.FlushExpressions(" ")
paddy@159 74 }
paddy@159 75
paddy@159 76 func (p *postgres) terminateSession(id string) error {
paddy@159 77 query := p.terminateSessionSQL(id)
paddy@159 78 res, err := p.db.Exec(query.String(), query.Args...)
paddy@159 79 if err != nil {
paddy@159 80 return err
paddy@159 81 }
paddy@159 82 rows, err := res.RowsAffected()
paddy@159 83 if err != nil {
paddy@159 84 return err
paddy@159 85 }
paddy@159 86 if rows < 1 {
paddy@159 87 return ErrSessionNotFound
paddy@159 88 }
paddy@159 89 return nil
paddy@159 90 }
paddy@159 91
paddy@154 92 func (p *postgres) removeSessionSQL(id string) *pan.Query {
paddy@154 93 var session Session
paddy@154 94 query := pan.New(pan.POSTGRES, "DELETE FROM "+pan.GetTableName(session))
paddy@154 95 query.IncludeWhere()
paddy@154 96 query.Include(pan.GetUnquotedColumn(session, "ID")+" = ?", id)
paddy@154 97 return query.FlushExpressions(" ")
paddy@154 98 }
paddy@154 99
paddy@154 100 func (p *postgres) removeSession(id string) error {
paddy@154 101 query := p.removeSessionSQL(id)
paddy@154 102 res, err := p.db.Exec(query.String(), query.Args...)
paddy@154 103 if err != nil {
paddy@154 104 return err
paddy@154 105 }
paddy@154 106 rows, err := res.RowsAffected()
paddy@154 107 if err != nil {
paddy@154 108 return err
paddy@154 109 }
paddy@154 110 if rows < 1 {
paddy@154 111 return ErrSessionNotFound
paddy@154 112 }
paddy@154 113 return nil
paddy@154 114 }
paddy@154 115
paddy@154 116 func (p *postgres) listSessionsSQL(profile uuid.ID, before time.Time, num int64) *pan.Query {
paddy@154 117 var session Session
paddy@154 118 fields, _ := pan.GetFields(session)
paddy@154 119 query := pan.New(pan.POSTGRES, "SELECT "+pan.QueryList(fields)+" FROM "+pan.GetTableName(session))
paddy@154 120 query.IncludeWhere()
paddy@154 121 query.Include(pan.GetUnquotedColumn(session, "ProfileID")+" = ?", profile)
paddy@154 122 if !before.IsZero() {
paddy@154 123 query.Include(pan.GetUnquotedColumn(session, "Created")+" < ?", before)
paddy@154 124 }
paddy@154 125 query.FlushExpressions(" AND ")
paddy@154 126 if num > 0 {
paddy@154 127 query.IncludeLimit(num)
paddy@154 128 }
paddy@154 129 return query.FlushExpressions(" ")
paddy@154 130 }
paddy@154 131
paddy@154 132 func (p *postgres) listSessions(profile uuid.ID, before time.Time, num int64) ([]Session, error) {
paddy@154 133 query := p.listSessionsSQL(profile, before, num)
paddy@154 134 rows, err := p.db.Query(query.String(), query.Args...)
paddy@154 135 if err != nil {
paddy@154 136 return []Session{}, err
paddy@154 137 }
paddy@154 138 var sessions []Session
paddy@154 139 for rows.Next() {
paddy@154 140 var session Session
paddy@154 141 err := pan.Unmarshal(rows, &session)
paddy@154 142 if err != nil {
paddy@154 143 return sessions, err
paddy@154 144 }
paddy@154 145 sessions = append(sessions, session)
paddy@154 146 }
paddy@154 147 if err = rows.Err(); err != nil {
paddy@154 148 return sessions, err
paddy@154 149 }
paddy@154 150 return sessions, nil
paddy@154 151 }