amadan

oficina / memoria Public

Clear definitively stale sessions before starting Home sign-in

Paul Campbell pushed by paul@keymail.dev a9814d6e0c9d25a00a17f1663712b2c79ca63c3a parent 5bc0500
2 files changed, +28 −1
  • internal/memoria/home.go +1 −1
  • internal/memoria/home_router_test.go +27 −0

CI passed — run details

diff --git a/internal/memoria/home.go b/internal/memoria/home.go
index 8429789..4006405 100644
--- a/internal/memoria/home.go
+++ b/internal/memoria/home.go
@@ -82,7 +82,7 @@ func (a *app) homeMiddleware(origin string) func(http.Handler) http.Handler {
func (a *app) signin(w http.ResponseWriter, r *http.Request) {
if a.home != nil {
- a.home.routes.Signin(w, r)
+ a.home.sessions.Middleware(http.HandlerFunc(a.home.routes.Signin)).ServeHTTP(w, r)
return
}
a.localSignin(w, r)
diff --git a/internal/memoria/home_router_test.go b/internal/memoria/home_router_test.go
index 8330d2b..c9bb99c 100644
--- a/internal/memoria/home_router_test.go
+++ b/internal/memoria/home_router_test.go
@@ -272,3 +272,30 @@ func TestHomeRouterMissingKeymailFreshnessCannotAllocateLink(t *testing.T) {
t.Fatal("missing freshness allocated identity", n, err)
}
}
+func TestHomeSigninClearsOnlyDefinitivelyStaleSession(t *testing.T) {
+ f := newHomeRouterFixture(t)
+ f.local(t)
+ cookieName := f.app.home.sessions.CookieName()
+ saved := f.cookies[cookieName].Value
+ if _, err := f.app.db.Writer().Exec("ALTER TABLE sessions RENAME TO unavailable_sessions"); err != nil {
+ t.Fatal(err)
+ }
+ homeRedirect(t, f.do("GET", "/signin", ""))
+ if f.cookies[cookieName] == nil || f.cookies[cookieName].Value != saved {
+ t.Fatal("temporary storage failure cleared valid cookie")
+ }
+ if _, err := f.app.db.Writer().Exec("ALTER TABLE unavailable_sessions RENAME TO sessions"); err != nil {
+ t.Fatal(err)
+ }
+ if _, err := f.app.db.Writer().Exec("DELETE FROM sessions"); err != nil {
+ t.Fatal(err)
+ }
+ start := homeRedirect(t, f.do("GET", "/signin", ""))
+ if f.cookies[cookieName] != nil {
+ t.Fatal("stale cookie not cleared")
+ }
+ target := homeRedirect(t, f.do("GET", start, ""))
+ if !strings.HasPrefix(target, homeTestIssuer+"/") {
+ t.Fatal("stale cookie prevented Home sign-in", target)
+ }
+}