Hornwitser
3f492edea2
If a session is rotate in the middle of a server side rendering then some random portions of requests made on the server side will fail with a session taken error as the server is not going to update the cookies of the client during these requests. To avoid this pitfall extend the expiry time of sessions to be 10 seconds after the session has been rotated. This is accomplished by introducing a new timestamp on sessions called the rotateAt at time alongside the expiresAt time. Sessions used after rotateAt that haven't been rotated get rotated into a new session and the existing session gets the expiresAt time set to 10 seconds in the future. Sessions that are past the expiredAt time have no access. This makes the logic around session expiry simpler, and also makes it possible to audit when a session got rotated, and to mark sessions as expired without a chance to rotate to a new session without having to resort to a finished flag.
79 lines
2 KiB
TypeScript
79 lines
2 KiB
TypeScript
/*
|
|
SPDX-FileCopyrightText: © 2025 Hornwitser <code@hornwitser.no>
|
|
SPDX-License-Identifier: AGPL-3.0-or-later
|
|
*/
|
|
import { readSessions, readUsers, writeSessions, writeUsers } from "~/server/database";
|
|
import { apiUserPatchSchema } from "~/shared/types/api";
|
|
import { z } from "zod/v4-mini";
|
|
import { broadcastEvent } from "~/server/streams";
|
|
|
|
export default defineEventHandler(async (event) => {
|
|
await requireServerSessionWithAdmin(event);
|
|
const { success, error, data: patch } = apiUserPatchSchema.safeParse(await readBody(event));
|
|
if (!success) {
|
|
throw createError({
|
|
status: 400,
|
|
statusText: "Bad Request",
|
|
message: z.prettifyError(error),
|
|
});
|
|
}
|
|
|
|
const users = await readUsers();
|
|
const user = users.find(user => user.id === patch.id);
|
|
if (!user || user.deleted) {
|
|
throw createError({
|
|
status: 409,
|
|
statusText: "Conflict",
|
|
message: "User does not exist",
|
|
});
|
|
|
|
}
|
|
|
|
let accessChanged = false;
|
|
if (patch.type && patch.type !== user.type) {
|
|
if (patch.type === "anonymous" || user.type === "anonymous") {
|
|
throw createError({
|
|
status: 409,
|
|
statusText: "Conflict",
|
|
message: "Anonymous user type cannot be changed.",
|
|
});
|
|
}
|
|
user.type = patch.type;
|
|
accessChanged = true;
|
|
}
|
|
if (patch.name) {
|
|
if (user.type === "anonymous") {
|
|
throw createError({
|
|
status: 409,
|
|
statusText: "Conflict",
|
|
message: "Anonymous user cannot have name set.",
|
|
});
|
|
}
|
|
user.name = patch.name;
|
|
}
|
|
user.updatedAt = new Date().toISOString();
|
|
await writeUsers(users);
|
|
broadcastEvent({
|
|
type: "user-update",
|
|
data: serverUserToApi(user),
|
|
});
|
|
|
|
// Rotate sessions with the user in it if the access changed
|
|
if (accessChanged) {
|
|
const sessions = await readSessions();
|
|
const nowMs = Date.now();
|
|
for (const session of sessions) {
|
|
if (session.accountId === user.id) {
|
|
session.rotatesAtMs = nowMs;
|
|
broadcastEvent({
|
|
type: "session-expired",
|
|
sessionId: session.id,
|
|
});
|
|
}
|
|
}
|
|
await writeSessions(sessions);
|
|
}
|
|
|
|
// Update Schedule counts.
|
|
await updateScheduleInterestedCounts(users);
|
|
})
|