celogeek/photos-api
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

split session and token auth

Browse Source
This commit is contained in:
celogeek 2022-02-05 12:17:00 +01:00
parent 4de39dd9d4
commit 9a7f58b9f7
Signed by: celogeek
GPG Key ID: E6B7BDCFC446233A
3 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
internal/photos/api/account.go
View File

@ -70,9 +70,13 @@ func (s *Service) Login(c *gin.Context) {
} }
func (s *Service) Logout(c *gin.Context) { func (s *Service) Logout(c *gin.Context) {
var sess *models.Session = c.MustGet("session").(*models.Session) res := s.DB.Where("token = ?", c.GetString("token")).Delete(&models.Session{})
if err := s.DB.Delete(sess).Error; err != nil { if res.Error != nil {
s.Error(c, http.StatusInternalServerError, err) s.Error(c, http.StatusInternalServerError, res.Error)
return
}
if res.RowsAffected == 0 {
s.Error(c, http.StatusNotFound, ErrSessionNotFound)
return return
} }
c.JSON(http.StatusOK, gin.H{ c.JSON(http.StatusOK, gin.H{

2
internal/photos/api/main.go
View File

@ -53,7 +53,7 @@ func (s *Service) SetupRoutes() {
ac := s.Gin.Group("/account") ac := s.Gin.Group("/account")
ac.POST("/signup", s.Signup) ac.POST("/signup", s.Signup)
ac.POST("/login", s.Login) ac.POST("/login", s.Login)
ac.GET("/logout", s.RequireSession, s.Logout) ac.GET("/logout", s.RequireAuthToken, s.Logout)
s.Gin.NoRoute(func(c *gin.Context) { s.Gin.NoRoute(func(c *gin.Context) {
s.Error(c, http.StatusNotFound, ErrReqNotFound) s.Error(c, http.StatusNotFound, ErrReqNotFound)

11
internal/photos/api/session.go
View File

@ -10,7 +10,7 @@ import (
"gorm.io/gorm" "gorm.io/gorm"
) )
func (s *Service) RequireSession(c *gin.Context) { func (s *Service) RequireAuthToken(c *gin.Context) {
token := c.GetHeader("Authorization") token := c.GetHeader("Authorization")
if !strings.HasPrefix(token, "Private ") { if !strings.HasPrefix(token, "Private ") {
s.Error(c, http.StatusForbidden, ErrTokenMissing) s.Error(c, http.StatusForbidden, ErrTokenMissing)
@ -18,9 +18,16 @@ func (s *Service) RequireSession(c *gin.Context) {
} }
token = token[8:] token = token[8:]
c.Set("token", token) c.Set("token", token)
}
func (s *Service) RequireSession(c *gin.Context) {
s.RequireAuthToken(c)
if c.IsAborted() {
return
}
sess := &models.Session{} sess := &models.Session{}
if err := s.DB.Preload("Account").Where("token = ?", token).First(sess).Error; err != nil { if err := s.DB.Preload("Account").Where("token = ?", c.GetString("token")).First(sess).Error; err != nil {
if errors.Is(err, gorm.ErrRecordNotFound) { if errors.Is(err, gorm.ErrRecordNotFound) {
s.Error(c, http.StatusForbidden, ErrSessionNotFound) s.Error(c, http.StatusForbidden, ErrSessionNotFound)
} else { } else {