snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/auth/handlers/handle_sessions.go

@@ -0,0 +1,136 @@
+package handlers
+
+import (
+	"crypto/md5"
+	"fmt"
+	"sort"
+	"time"
+
+	"github.com/cortezaproject/corteza/server/auth/request"
+	"github.com/cortezaproject/corteza/server/system/types"
+)
+
+type (
+	userSessions []userSession
+	userSession  struct {
+		id string
+		// this will store hashed ID value of the session ID + auth secret
+		ID             string
+		Current        bool
+		ExpiresAt      time.Time
+		CreatedAt      time.Time
+		Expired        bool
+		ExpiresIn      int
+		RemoteAddr     string
+		SameRemoteAddr bool
+		UserAgent      string
+		SameUserAgent  bool
+	}
+)
+
+// Will sort sessions - current first, then the rest in order of creation
+var _ sort.Interface = userSessions{}
+
+func (set userSessions) Len() int      { return len(set) }
+func (set userSessions) Swap(i, j int) { set[i], set[j] = set[j], set[i] }
+func (set userSessions) Less(i, j int) bool {
+	switch {
+	case set[i].Current:
+		return true
+	default:
+		return set[i].CreatedAt.After(set[j].CreatedAt)
+	}
+
+}
+
+func (h *AuthHandlers) sessionsView(req *request.AuthReq) error {
+	req.Template = TmplSessions
+
+	ss, err := h.getSessions(req)
+	if err != nil {
+		return err
+	}
+
+	sort.Sort(ss)
+	req.Data["sessions"] = ss
+
+	return nil
+}
+
+func (h *AuthHandlers) sessionsProc(req *request.AuthReq) error {
+	ctx := req.Context()
+	ss, err := h.getSessions(req)
+	if err != nil {
+		return err
+	}
+
+	switch {
+	case len(req.Request.PostFormValue("delete-all-but-current")) > 0:
+		for _, s := range ss {
+			if s.Current {
+				continue
+			}
+
+			if err = h.SessionManager.DeleteByID(ctx, s.id); err != nil {
+				return err
+			}
+		}
+
+		err = h.TokenService.DeleteByUserID(ctx, req.AuthUser.User.ID)
+		if err != nil {
+			return err
+		}
+
+		t := translator(req, "auth")
+		req.NewAlerts = append(req.NewAlerts, request.Alert{
+			Type: "primary",
+			Text: t("sessions.alerts.delete-sessions-but-current"),
+		})
+	case len(req.Request.PostFormValue("delete")) > 0:
+		for _, s := range ss {
+			if s.ID != req.Request.PostFormValue("delete") {
+				continue
+			}
+
+			if err = h.SessionManager.DeleteByID(ctx, s.id); err != nil {
+				return err
+			}
+		}
+
+		t := translator(req, "auth")
+		req.NewAlerts = append(req.NewAlerts, request.Alert{
+			Type: "primary",
+			Text: t("sessions.alerts.session-deleted"),
+		})
+	}
+
+	req.RedirectTo = GetLinks().Sessions
+	return nil
+}
+
+func (h *AuthHandlers) getSessions(req *request.AuthReq) (ss userSessions, err error) {
+	var set []*types.AuthSession
+	if set, err = h.SessionManager.Search(req.Context(), req.AuthUser.User.ID); err != nil {
+		return
+	} else {
+		ss = make(userSessions, len(set))
+		for i := range set {
+			isCurrent := req.Session.ID == set[i].ID
+			ss[i] = userSession{
+				id:             set[i].ID,
+				ID:             fmt.Sprintf("%x", md5.Sum([]byte(set[i].ID+h.Opt.Secret))),
+				Current:        isCurrent,
+				CreatedAt:      set[i].CreatedAt,
+				ExpiresAt:      set[i].ExpiresAt,
+				Expired:        set[i].ExpiresAt.Before(time.Now()),
+				ExpiresIn:      int(set[i].ExpiresAt.Sub(time.Now()).Hours() / 24),
+				RemoteAddr:     set[i].RemoteAddr,
+				SameRemoteAddr: set[i].RemoteAddr == req.Request.RemoteAddr,
+				UserAgent:      set[i].UserAgent,
+				SameUserAgent:  set[i].UserAgent == req.Request.UserAgent(),
+			}
+		}
+	}
+
+	return
+}