celogeek/photos-api
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

split session and token auth

Browse Source
This commit is contained in:
celogeek 2022-02-05 12:17:00 +01:00
parent 4de39dd9d4
commit 9a7f58b9f7
Signed by: celogeek
GPG Key ID: E6B7BDCFC446233A
3 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
internal/photos/api/account.go
View File

@ -70,9 +70,13 @@ func (s *Service) Login(c *gin.Context) {
}
func (s *Service) Logout(c *gin.Context) {
var sess *models.Session = c.MustGet("session").(*models.Session)
if err := s.DB.Delete(sess).Error; err != nil {
s.Error(c, http.StatusInternalServerError, err)
res := s.DB.Where("token = ?", c.GetString("token")).Delete(&models.Session{})
if res.Error != nil {
s.Error(c, http.StatusInternalServerError, res.Error)
return
}
if res.RowsAffected == 0 {
s.Error(c, http.StatusNotFound, ErrSessionNotFound)
return
}
c.JSON(http.StatusOK, gin.H{

2
internal/photos/api/main.go
View File

@ -53,7 +53,7 @@ func (s *Service) SetupRoutes() {
ac := s.Gin.Group("/account")
ac.POST("/signup", s.Signup)
ac.POST("/login", s.Login)
ac.GET("/logout", s.RequireSession, s.Logout)
ac.GET("/logout", s.RequireAuthToken, s.Logout)
s.Gin.NoRoute(func(c *gin.Context) {
s.Error(c, http.StatusNotFound, ErrReqNotFound)

11
internal/photos/api/session.go
View File

@ -10,7 +10,7 @@ import (
"gorm.io/gorm"
)
func (s *Service) RequireSession(c *gin.Context) {
func (s *Service) RequireAuthToken(c *gin.Context) {
token := c.GetHeader("Authorization")
if !strings.HasPrefix(token, "Private ") {
s.Error(c, http.StatusForbidden, ErrTokenMissing)
@ -18,9 +18,16 @@ func (s *Service) RequireSession(c *gin.Context) {
}
token = token[8:]
c.Set("token", token)
}
func (s *Service) RequireSession(c *gin.Context) {
s.RequireAuthToken(c)
if c.IsAborted() {
return
}
sess := &models.Session{}
if err := s.DB.Preload("Account").Where("token = ?", token).First(sess).Error; err != nil {
if err := s.DB.Preload("Account").Where("token = ?", c.GetString("token")).First(sess).Error; err != nil {
if errors.Is(err, gorm.ErrRecordNotFound) {
s.Error(c, http.StatusForbidden, ErrSessionNotFound)
} else {