amadan
Clear stale Meet sessions safely before the Home redirect
2 files changed,
+33
−4
internal/meet/home.go+5 −4internal/meet/home_router_test.go+28 −0
CI passed — run details
diff --git a/internal/meet/home.go b/internal/meet/home.go| index 9b99afe..7f3818a 100644 |
| --- a/internal/meet/home.go |
| +++ b/internal/meet/home.go |
| @@ -18,8 +18,9 @@ import ( |
| var errHomeIdentity = errors.New("meet: Home identity refused") |
| type homeIntegration struct { |
| - bridge *connect.Bridge |
| - routes *connect.Routes |
| + bridge *connect.Bridge |
| + routes *connect.Routes |
| + sessions *sessions.Sessions |
| } |
| func (a *app) wireHome() error { |
| @@ -72,7 +73,7 @@ func (a *app) wireHome() error { |
| if err != nil { |
| return errHomeIdentity |
| } |
| - a.home = &homeIntegration{b, routes} |
| + a.home = &homeIntegration{b, routes, sess} |
| return nil |
| } |
| @@ -99,7 +100,7 @@ func (a *app) personForSession(ctx context.Context, s sessions.Session) (Person, |
| func (a *app) signin(w http.ResponseWriter, r *http.Request) { |
| if a.home != nil { |
| if _, pending := a.readJoinCookie(r); !pending { |
| - a.home.routes.Signin(w, r) |
| + a.home.sessions.Middleware(http.HandlerFunc(a.home.routes.Signin)).ServeHTTP(w, r) |
| return |
| } |
| } |
diff --git a/internal/meet/home_router_test.go b/internal/meet/home_router_test.go| index 1f10c94..4382892 100644 |
| --- a/internal/meet/home_router_test.go |
| +++ b/internal/meet/home_router_test.go |
| @@ -301,3 +301,31 @@ func TestHomeLookupDatabaseFailureKeepsSession(t *testing.T) { |
| t.Fatal("recovered lookup did not preserve session", w.Code) |
| } |
| } |
| + |
| +func TestHomeSigninClearsOnlyDefinitivelyStaleSession(t *testing.T) { |
| + f := newHomeRouterFixture(t) |
| + f.local(t) |
| + cookieName := f.app.home.sessions.CookieName() |
| + saved := f.cookies[cookieName].Value |
| + if _, err := f.app.db.Writer().Exec("ALTER TABLE sessions RENAME TO unavailable_sessions"); err != nil { |
| + t.Fatal(err) |
| + } |
| + homeRedirect(t, f.do("GET", "/signin", "")) |
| + if f.cookies[cookieName] == nil || f.cookies[cookieName].Value != saved { |
| + t.Fatal("temporary storage failure cleared valid cookie") |
| + } |
| + if _, err := f.app.db.Writer().Exec("ALTER TABLE unavailable_sessions RENAME TO sessions"); err != nil { |
| + t.Fatal(err) |
| + } |
| + if _, err := f.app.db.Writer().Exec("DELETE FROM sessions"); err != nil { |
| + t.Fatal(err) |
| + } |
| + start := homeRedirect(t, f.do("GET", "/signin", "")) |
| + if f.cookies[cookieName] != nil { |
| + t.Fatal("stale cookie not cleared") |
| + } |
| + target := homeRedirect(t, f.do("GET", start, "")) |
| + if !strings.HasPrefix(target, homeTestIssuer+"/") { |
| + t.Fatal("stale cookie prevented Home sign-in", target) |
| + } |
| +} |