f3a8d97 Improve Oauth and Session handling, fix session validation logic flaw · gordon

M internal/httpserve/handler/oauth.go +8 -2


@@ -54,12 +54,18 @@ func RenderLoginPage(c echo.Context, a *app.App) error {
54	54
55	55		// StartOAuthGithub starts the Github OAuth flow
56	56		func StartOAuthGithub(c echo.Context, a *app.App) error {
57		-	// Clear the session in case it is already set or corrupted
58		-	err := ResetSession(c)
	57	+	// Check if the session is already here and valid before going for the oauth flow
	58	+	sess, err := getSession(c)
59	59		if err != nil {
60	60		return err
61	61		}
62	62
	63	+	// Check if the session values are valid
	64	+	accountID, ok := sess.Values["accountID"].(string)
	65	+	if ok && accountID != "" {
	66	+	return c.Redirect(http.StatusSeeOther, a.Config.Admin.Path) // StatusSeeOther is HTTP 303
	67	+	}
	68	+
63	69		//Initiate the Github OAuth flow
64	70		clientID := os.Getenv("GITHUB_APP_ID")
65	71		redirectDomain := a.Config.GenerateOauthCallbackURL()

 // StartOAuthGithub starts the Github OAuth flow
 func StartOAuthGithub(c echo.Context, a *app.App) error {
-	// Clear the session in case it is already set or corrupted
+	// Check if the session is already here and valid before going for the oauth flow
-	err := ResetSession(c)
+	sess, err := getSession(c)
 	if err != nil {
 		return err
 	}
+	// Check if the session values are valid
+	accountID, ok := sess.Values["accountID"].(string)
+	if ok && accountID != "" {
+		return c.Redirect(http.StatusSeeOther, a.Config.Admin.Path) // StatusSeeOther is HTTP 303
+	}
 	//Initiate the Github OAuth flow
 	clientID := os.Getenv("GITHUB_APP_ID")
 	redirectDomain := a.Config.GenerateOauthCallbackURL()

M internal/httpserve/middleware/requirelogin.go +20 -15

@@ -1,13 +1,16 @@
1	1		package middleware
2	2
3	3		import (
	4	+	"fmt"
4	5		"log"
5	6		"net/http"
6	7		"time"
7	8
8	9		"github.com/bnema/gordon/internal/app"
9	10		"github.com/bnema/gordon/internal/db/queries"
	11	+
10	12		// "github.com/labstack/echo-contrib/session"
	13	+	"github.com/labstack/echo-contrib/session"
11	14		"github.com/labstack/echo/v4"
12	15		)
13	16

@@ -24,24 +27,26 @@ func RequireLogin(a *app.App) echo.MiddlewareFunc {
24	27		}
25	28
26	29		func validateSessionAndUser(c echo.Context, a *app.App) error {
27		-	// sess, err := session.Get("session", c)
28		-	// if err != nil {
29		-	// return err
30		-	// }
	30	+	sess, err := session.Get("session", c)
	31	+	if err != nil {
	32	+	return err
	33	+	}
31	34
32		-	// if cookieExpired, err := isCookieExpired(c); err != nil \|\| cookieExpired {
33		-	// return err
34		-	// }
	35	+	fmt.Print(sess)
35	36
36		-	// accountID, ok := sess.Values["accountID"].(string)
37		-	// if !ok {
38		-	// return fmt.Errorf("invalid account ID type")
39		-	// }
	37	+	if cookieExpired, err := isCookieExpired(c); err != nil \|\| cookieExpired {
	38	+	return err
	39	+	}
40	40
41		-	// sessionID, ok := sess.Values["sessionID"].(string)
42		-	// if !ok {
43		-	// return fmt.Errorf("invalid session ID type")
44		-	// }
	41	+	_, ok := sess.Values["accountID"].(string)
	42	+	if !ok {
	43	+	return fmt.Errorf("invalid account ID type")
	44	+	}
	45	+
	46	+	_, ok = sess.Values["sessionID"].(string)
	47	+	if !ok {
	48	+	return fmt.Errorf("invalid session ID type")
	49	+	}
45	50
46	51		// if accountCheck, err := isAccountIDInDB(a, accountID); err != nil \|\| !accountCheck {
47	52		// return err

 package middleware
 import (
+	"fmt"
 	"log"
 	"net/http"
 	"time"
 	"github.com/bnema/gordon/internal/app"
 	"github.com/bnema/gordon/internal/db/queries"
 	// "github.com/labstack/echo-contrib/session"
+	"github.com/labstack/echo-contrib/session"
 	"github.com/labstack/echo/v4"
 )
 }
 func validateSessionAndUser(c echo.Context, a *app.App) error {
-	// sess, err := session.Get("session", c)
+	sess, err := session.Get("session", c)
-	// if err != nil {
+	if err != nil {
-	// 	return err
+		return err
-	// }
+	}
-	// if cookieExpired, err := isCookieExpired(c); err != nil || cookieExpired {
+	fmt.Print(sess)
-	// 	return err
-	// }
-	// accountID, ok := sess.Values["accountID"].(string)
+	if cookieExpired, err := isCookieExpired(c); err != nil || cookieExpired {
-	// if !ok {
+		return err
-	// 	return fmt.Errorf("invalid account ID type")
+	}
-	// }
-	// sessionID, ok := sess.Values["sessionID"].(string)
+	_, ok := sess.Values["accountID"].(string)
-	// if !ok {
+	if !ok {
-	// 	return fmt.Errorf("invalid session ID type")
+		return fmt.Errorf("invalid account ID type")
-	// }
+	}
+	_, ok = sess.Values["sessionID"].(string)
+	if !ok {
+		return fmt.Errorf("invalid session ID type")
+	}
 	// if accountCheck, err := isAccountIDInDB(a, accountID); err != nil || !accountCheck {
 	// 	return err

M internal/httpserve/router.go +2 -2


@@ -11,14 +11,14 @@ import (
11	11		// RegisterRoutes registers all routes for the application
12	12		func RegisterRoutes(e echo.Echo, a app.App) *echo.Echo {
13	13		AdminPath := a.Config.Admin.Path
14		-	// Use middlewares
15		-	e.Use(middleware.SecureRoutes())
16	14		// SetCommonDataMiddleware will pass data to the renderer
17	15		e.Use(middleware.SetCommonDataMiddleware(a))
18	16		// Error handler middleware
19	17		e.Use(middleware.ErrorHandler)
20	18		// Initiate the session middleware
21	19		e.Use(middleware.InitSessionMiddleware())
	20	+	// Use middlewares
	21	+	e.Use(middleware.SecureRoutes())
22	22
23	23		// Color scheme detection for dark/light mode
24	24		e.Use(middleware.ColorSchemeDetection)

 // RegisterRoutes registers all routes for the application
 func RegisterRoutes(e *echo.Echo, a *app.App) *echo.Echo {
 	AdminPath := a.Config.Admin.Path
-	// Use middlewares
-	e.Use(middleware.SecureRoutes())
 	// SetCommonDataMiddleware will pass data to the renderer
 	e.Use(middleware.SetCommonDataMiddleware(a))
 	// Error handler middleware
 	e.Use(middleware.ErrorHandler)
 	// Initiate the session middleware
 	e.Use(middleware.InitSessionMiddleware())
+	// Use middlewares
+	e.Use(middleware.SecureRoutes())
 	// Color scheme detection for dark/light mode
 	e.Use(middleware.ColorSchemeDetection)

M internal/webui/public/assets/css/tailwind.css +0 -5