flashii/misuzu
flashii/misuzu
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Rewrote Sessions backend.

Browse source
This commit is contained in:
flash 2023-07-28 20:06:12 +00:00
parent a7b8b905b4
commit 10ec424a4f
23 changed files with 539 additions and 374 deletions
public
index.php

28
public/index.php
View file

@ -3,7 +3,6 @@ namespace Misuzu;
use RuntimeException;
use Misuzu\Users\User;
use Misuzu\Users\UserSession;
require_once __DIR__ . '/../misuzu.php';
@ -95,20 +94,22 @@ if(!isset($authToken))
$authToken = AuthToken::unpack(filter_input(INPUT_COOKIE, 'msz_auth') ?? '');
if($authToken->isValid()) {
$sessions = $msz->getSessions();
$authToken->setCurrent();
try {
$sessionInfo = UserSession::byToken($authToken->getSessionToken());
if($sessionInfo->hasExpired()) {
$sessionInfo->delete();
} elseif($sessionInfo->getUserId() === $authToken->getUserId()) {
$userInfo = $sessionInfo->getUser();
if(!$userInfo->isDeleted()) {
$sessionInfo->setCurrent();
$userInfo->setCurrent();
$sessionInfo->bump($_SERVER['REMOTE_ADDR']);
$sessionInfo = $sessions->getSession(sessionToken: $authToken->getSessionToken());
if($sessionInfo->shouldBumpExpire())
if($sessionInfo->hasExpired()) {
$sessions->deleteSessions(sessionInfos: $sessionInfo);
} elseif($sessionInfo->getUserId() === (string)$authToken->getUserId()) {
$userInfo = User::byId((int)$sessionInfo->getUserId());
if(!$userInfo->isDeleted()) {
$userInfo->setCurrent();
$sessions->updateSession(sessionInfo: $sessionInfo, remoteAddr: $_SERVER['REMOTE_ADDR']);
if($sessionInfo->shouldBumpExpires())
$authToken->applyCookie($sessionInfo->getExpiresTime());
// only allow impersonation when super user
@ -128,11 +129,10 @@ if($authToken->isValid()) {
}
}
} catch(RuntimeException $ex) {
UserSession::unsetCurrent();
User::unsetCurrent();
}
if(UserSession::hasCurrent()) {
if(User::hasCurrent()) {
$userInfo->bumpActivity($_SERVER['REMOTE_ADDR']);
} else
AuthToken::nukeCookie();
@ -140,7 +140,7 @@ if($authToken->isValid()) {
CSRF::init(
$globals['csrf.secret'],
(UserSession::hasCurrent() ? UserSession::getCurrent()->getToken() : ($_SERVER['REMOTE_ADDR'] ?? '::1'))
(User::hasCurrent() ? $authToken->getSessionToken() : $_SERVER['REMOTE_ADDR'])
);
if(!empty($userInfo)) {