Working on session validation

api/src/auth/session.rs

@@ -2,15 +2,14 @@ use actix_web::cookie::{time::Duration, Cookie};
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use redis::{AsyncCommands, RedisResult};
-
+use tokio::task;
 use crate::{
   db::redis_async_connection,
   error::{Error, ApiResult},
 };
-
 use super::{csprng, hash, verify_hash};
 
-pub const DEFAULT_SESSION_TTL: i64 = 86400; // (In seconds) 24 hours
+const DEFAULT_SESSION_TTL: i64 = 86400; // (In seconds) 24 hours
 pub const SESSION_COOKIE_NAME: &str = "session";
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -23,6 +22,10 @@ pub struct Session {
 }
 
 impl Session {
+  pub fn default(email: &str, ip_address: &str) -> Self {
+    Self::new(64, email, ip_address, Some(DEFAULT_SESSION_TTL))
+  }
+
   pub fn new(take: usize, email: &str, ip_address: &str, ttl: Option<i64>) -> Self {
     let now = Utc::now();
     Self {
@@ -53,16 +56,32 @@ impl Session {
     }
   }
 
-  pub async fn get(session_id: &str) -> ApiResult<Option<Self>> {
+  pub async fn get(session_id: &str) -> ApiResult<Self> {
     let mut conn = redis_async_connection().await?;
     let result: RedisResult<Option<String>> = conn.get(session_id).await;
     match result {
-      Ok(Some(value)) => Ok(Some(serde_json::from_str(&value)?)),
-      Ok(None) => Ok(None),
+      Ok(Some(value)) => Ok(serde_json::from_str(&value)?),
+      Ok(None) => Err(Error::new(401, format!("Missing session {}", session_id))),
       Err(err) => Err(err.into()),
     }
   }
 
+  pub async fn replace(session_id: &str, ip_address: &str) -> ApiResult<Self> {
+    let mut session = Self::verify(session_id, ip_address).await?;
+    let session_id_owned = session_id.to_owned();
+    task::spawn(async move {
+      if let Err(err) = Self::delete(&session_id_owned).await {
+        log::error!(
+          "Error deleting old session in replace session call: {}",
+          err
+        );
+      };
+    });
+    session = Session::default(&session.email, ip_address);
+    session.store().await?;
+    Ok(session)
+  }
+
   pub async fn delete(session_id: &str) -> ApiResult<()> {
     let mut conn = redis_async_connection().await?;
     let result: RedisResult<()> = conn.del(session_id).await;
@@ -73,11 +92,7 @@ impl Session {
   }
 
   pub async fn verify(session_id: &str, ip_address: &str) -> ApiResult<Self> {
-    // Check if the session exists
-    let session = match Self::get(session_id).await? {
-      Some(session) => session,
-      None => return Err(Error::new(401, "Session does not exist".to_string())),
-    };
+    let session = Self::get(session_id).await?;
 
     // Check if the IP Address matches the Session's IP Address
     if verify_hash(ip_address, &session.ip_address) {
@@ -87,7 +102,7 @@ impl Session {
     }
   }
 
-  pub fn to_cookie(&self) -> Cookie {
+  pub fn cookie(&self) -> Cookie {
     let expires_at = match self.expires_at {
       Some(expires_at) => expires_at.timestamp(),
       None => DEFAULT_SESSION_TTL,
@@ -96,14 +111,13 @@ impl Session {
     let mut cookie = Cookie::build(SESSION_COOKIE_NAME, self.session_id.clone())
       .path("/")
       .max_age(Duration::seconds(ttl))
-      // TODO: enable secure and http_only
       .secure(true)
       .http_only(true)
       .finish();
 
     if let Ok(environment) = std::env::var("ENVIRONMENT") {
       if environment == "development" || environment == "dev" {
-        log::debug!(
+        log::trace!(
           "Development cookie [Email: {}]: {}",
           self.email,
           self.session_id
@@ -115,4 +129,22 @@ impl Session {
 
     cookie
   }
+
+  pub fn empty_cookie() -> Cookie<'static> {
+    let mut cookie = Cookie::build(SESSION_COOKIE_NAME, "")
+      .path("/")
+      .max_age(Duration::seconds(-1))
+      .secure(true)
+      .http_only(true)
+      .finish();
+
+    if let Ok(environment) = std::env::var("ENVIRONMENT") {
+      if environment == "development" || environment == "dev" {
+        cookie.set_secure(false);
+        cookie.set_http_only(false);
+      }
+    }
+
+    cookie
+  }
 }