-
Vijay Kumar Chauhan authored33beb087
session.go 4.17 KiB
// package sessionmdl provides APIs to Add, Validate and Delete user sessions. These APIs must be used along with JWT Auth.// If you want to use this functionality, a jwt token must contain `userId` and `sessionId` fields.// A user can have multiple active sessions for different use cases. To check if user has an active session for particular usecase use `CheckForSessionAvailability()`.// And to check user session on each request use `ValidateSessionFromToken()`.//// An in memory cache is used to store sessions. It automatically falls back to redis cache if -gridmode=1 is set.//// The expiraion of session must be same as of token expiration.package sessionmdlimport ( "errors" "corelab.mkcl.org/MKCLOS/coredevelopmentplatform/corepkgv2/cachemdl")type Session struct { SessionFor string SessionId string}// store is used to store sessions in memory, falls back to redis cache on grid mode.var store cachemdl.Cachervar ( ErrUserNotFound = errors.New("user not found") ErrSessionNotFound = errors.New("session not found") ErrInvalidSessionInstance = errors.New("got invalid session instance id") ErrSessionValidationFailed = errors.New("session validation failed"))// Init initializes sessions with provided cache. Subsequent calls will not have any effect after first initialization.func Init(cache cachemdl.Cacher) { if store != nil { return } store = cache}// Set stores the sessions for provided userId. Session is appended to the list. It does not check if the same session exists or not.func Set(userId string, s ...Session) { i, ok := store.Get(userId) if !ok || i == nil { set(userId, s) return } sessions, ok := i.([]Session) if !ok { set(userId, s) return } set(userId, append(sessions, s...))}func set(key string, val interface{}) { // Set the user sessions with no expiry as each session can have different expiry depending on the JWT token expiry. store.SetNoExpiration(key, val)}// Get returns all the available sessions for the user. This may contain expired but not deleted sessions.func Get(userId string) ([]Session, error) { var ( s []Session i interface{} ok bool )7172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140
i, ok = store.Get(userId)
if !ok {
return s, ErrUserNotFound
}
s, _ = i.([]Session)
// if !ok {
// return s, errors.New("failed to retrieve previous sessions")
// }
return s, nil
}
// Delete removes all the sessions associated with the user.
func Delete(userId string) {
store.Delete(userId)
}
// DeleteSession removes a particular session for user, if present.
func DeleteSession(userId, sessionFor string) {
sessions, err := Get(userId)
if err != nil {
return
}
for i := 0; i < len(sessions); i++ {
if sessions[i].SessionFor == sessionFor {
sessions[i] = sessions[len(sessions)-1]
sessions = sessions[:len(sessions)-1]
}
}
if len(sessions) == 0 {
store.Delete(userId)
return
}
set(userId, sessions)
}
// ValidateSessionFromToken checks for session id in claims against available sessions.
// Validate only if a nonempty `sessionId` is present. The claims must contain `userId` field if session is present.
func ValidateSessionFromToken(claims map[string]interface{}) error {
// check for sessionId field, if not present then it is ignored at the time of token generation.
// This means user doesn't want to validate session.
i, ok := claims["sessionId"]
if !ok || i == nil {
return nil
}
sessionId, _ := i.(string)
if len(sessionId) == 0 {
return errors.New("\"sessionId\" field is empty")
}
i, ok = claims["userId"]
if !ok {
return errors.New("\"userId\" field not found in token")
}
userId, _ := i.(string)
if len(userId) == 0 {
return errors.New("\"userId\" field is empty")
}
sessions, err := Get(userId)
if err != nil {
141142143144145146147148149150151152153154155156157158159160161162163164165166
return err
}
for i := range sessions {
if sessions[i].SessionId == sessionId {
return nil
}
}
return ErrSessionNotFound
}
// CheckForSessionAvailability checks if the user has active session for provided `sessionFor`. Returns true if session is available.
func CheckForSessionAvailability(userId, sessionFor string) bool {
sessions, _ := Get(userId)
for i := range sessions {
if sessions[i].SessionFor == sessionFor {
return true
}
}
return false
}