ae/notatest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: ctx nil pointer error & user del. cookie invalidation

Browse Source
This commit is contained in:
ae 2025-04-12 16:34:02 +03:00
parent 2dde8d7942
commit 6867392042
Signed by: ae
GPG Key ID: 995EFD5C1B532B3E
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
server/internal/service/auth.go
View File

@ -256,6 +256,10 @@ func (rs authResource) Login(w http.ResponseWriter, r *http.Request) {
// claims set into the request's context by a middleware. // claims set into the request's context by a middleware.
func (rs authResource) Get(w http.ResponseWriter, r *http.Request) { func (rs authResource) Get(w http.ResponseWriter, r *http.Request) {
user := rs.userFromCtxClaims(w, r) user := rs.userFromCtxClaims(w, r)
if user == nil {
return
}
respondJSON(w, http.StatusOK, userResponse{ respondJSON(w, http.StatusOK, userResponse{
ID: user.ID, ID: user.ID,
Username: user.Username, Username: user.Username,
@ -281,6 +285,9 @@ func (rs authResource) UpdatePassword(w http.ResponseWriter, r *http.Request) {
} }
user := rs.userFromCtxClaims(w, r) user := rs.userFromCtxClaims(w, r)
if user == nil {
return
}
// Verify the old password before proceeding with the update // Verify the old password before proceeding with the update
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.OldPassword)); err != nil { if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.OldPassword)); err != nil {
@ -327,6 +334,9 @@ func (rs authResource) OwnerDelete(w http.ResponseWriter, r *http.Request) {
} }
user := rs.userFromCtxClaims(w, r) user := rs.userFromCtxClaims(w, r)
if user == nil {
return
}
// Verify the old password before allowing the deletion // Verify the old password before allowing the deletion
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil { if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
@ -340,6 +350,17 @@ func (rs authResource) OwnerDelete(w http.ResponseWriter, r *http.Request) {
return return
} }
// Clear the refresh token cookie
http.SetCookie(w, &http.Cookie{
Name: "notatest.refresh_token",
Value: "",
Path: "/api/auth/cookie",
MaxAge: 0, // Expires immediately
HttpOnly: true,
Secure: rs.Config.IsProd,
SameSite: http.SameSiteStrictMode,
})
if err := rs.Users.RevokeAllUserRefreshTokens(r.Context(), user.ID); err != nil { if err := rs.Users.RevokeAllUserRefreshTokens(r.Context(), user.ID); err != nil {
log.Error().Msgf("Failed to revoke refresh tokens: %s", err) log.Error().Msgf("Failed to revoke refresh tokens: %s", err)
} }