sessions.rs 68.7%

57 of 83 lines run, 16 of 37 functions · run #518 on main · run missed

//! Browser sessions as server-side records (oxygenhub#223).

use super::{now_ms, Pool};
use sqlx::FromRow;

/// A session ends after this long unused.
pub const IDLE_MS: i64 = 14 * 24 * 60 * 60_000;
/// And after this long whatever happens.
pub const ABSOLUTE_MS: i64 = 30 * 24 * 60 * 60_000;
/// `seen_ms` is written at most this often per session.
const TOUCH_EVERY_MS: i64 = 60_000;

#[derive(Clone, Debug, FromRow)]
pub struct Session {
    pub id: i64,
    pub account_id: i64,
    pub salt: String,
    pub created_ms: i64,
    pub seen_ms: i64,
    pub address: String,
    pub agent: String,
}

impl Session {
    /// Whether it is still good at `now`, for an account whose salt is `salt`.
    pub fn live(&self, salt: &str, now: i64) -> bool {
        self.salt == salt && now - self.seen_ms < IDLE_MS && now - self.created_ms < ABSOLUTE_MS
    }
}

const COLUMNS: &str = "id, account_id, salt, created_ms, seen_ms, address, agent";

pub async fn create(pool: &Pool, account_id: i64, hash: &str, salt: &str) -> sqlx::Result<i64> {
    let now = now_ms();
    sqlx::query_scalar("INSERT INTO sessions (account_id, hash, salt, created_ms, seen_ms) VALUES ($1, $2, $3, $4, $5) RETURNING id")
        .bind(account_id)
        .bind(hash)
        .bind(salt)
        .bind(now)
        .bind(now)
        .fetch_one(pool)
        .await
}

pub async fn by_hash(pool: &Pool, hash: &str) -> sqlx::Result<Option<Session>> {
    sqlx::query_as(&format!("SELECT {COLUMNS} FROM sessions WHERE hash = $1")).bind(hash).fetch_optional(pool).await
}

/// Note a use: the time (at most once a minute) and, the first time, the
/// address and browser it came from.
pub async fn touch(pool: &Pool, s: &Session, address: &str, agent: &str, now: i64) -> sqlx::Result<()> {
    if s.agent.is_empty() && s.address.is_empty() && (!agent.is_empty() || !address.is_empty()) {
        sqlx::query("UPDATE sessions SET seen_ms = $1, address = $2, agent = $3 WHERE id = $4")
            .bind(now)
            .bind(address)
            .bind(agent)
            .bind(s.id)
            .execute(pool)
            .await?;
    } else if now - s.seen_ms >= TOUCH_EVERY_MS {
        sqlx::query("UPDATE sessions SET seen_ms = $1 WHERE id = $2").bind(now).bind(s.id).execute(pool).await?;
    }
    Ok(())
}

/// An account's live sessions, most recently used first.
pub async fn of_account(pool: &Pool, account_id: i64, salt: &str) -> sqlx::Result<Vec<Session>> {
    let now = now_ms();
    let all: Vec<Session> = sqlx::query_as(&format!("SELECT {COLUMNS} FROM sessions WHERE account_id = $1 ORDER BY seen_ms DESC"))
        .bind(account_id)
        .fetch_all(pool)
        .await?;
    Ok(all.into_iter().filter(|s| s.live(salt, now)).collect())
}

/// End one session of an account's; whether there was one.
pub async fn end(pool: &Pool, account_id: i64, id: i64) -> sqlx::Result<bool> {
    let r = sqlx::query("DELETE FROM sessions WHERE id = $1 AND account_id = $2").bind(id).bind(account_id).execute(pool).await?;
    Ok(r.rows_affected() > 0)
}

pub async fn end_hash(pool: &Pool, hash: &str) -> sqlx::Result<()> {
    sqlx::query("DELETE FROM sessions WHERE hash = $1").bind(hash).execute(pool).await?;
    Ok(())
}

/// Every session of an account's but `keep`.
pub async fn end_others(pool: &Pool, account_id: i64, keep: i64) -> sqlx::Result<()> {
    sqlx::query("DELETE FROM sessions WHERE account_id = $1 AND id != $2").bind(account_id).bind(keep).execute(pool).await?;
    Ok(())
}

/// Forget sessions that can no longer be used; how many.
pub async fn sweep(pool: &Pool) -> sqlx::Result<u64> {
    let now = now_ms();
    let r = sqlx::query(
        "DELETE FROM sessions WHERE seen_ms < $1 OR created_ms < $2 \
         OR salt != (SELECT session_salt FROM accounts WHERE accounts.id = sessions.account_id)",
    )
    .bind(now - IDLE_MS)
    .bind(now - ABSOLUTE_MS)
    .execute(pool)
    .await?;
    Ok(r.rows_affected())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn a_session_ends_on_a_new_salt_when_idle_or_when_old() {
        let t0 = 1_000_000_000_000;
        let s =
            Session { id: 1, account_id: 1, salt: "a".into(), created_ms: t0, seen_ms: t0, address: String::new(), agent: String::new() };
        assert!(s.live("a", t0 + 1000));
        assert!(!s.live("b", t0 + 1000), "a new salt: signed out everywhere");
        assert!(!s.live("a", t0 + IDLE_MS), "unused for 14 days");
        let busy = Session { seen_ms: t0 + ABSOLUTE_MS - 1000, ..s.clone() };
        assert!(busy.live("a", t0 + ABSOLUTE_MS - 1));
        assert!(!busy.live("a", t0 + ABSOLUTE_MS), "30 days, however busy");
    }
}

1		//! Browser sessions as server-side records (oxygenhub#223).
2
3		use super::{now_ms, Pool};
4		use sqlx::FromRow;
5
6		/// A session ends after this long unused.
7		pub const IDLE_MS: i64 = 14 * 24 * 60 * 60_000;
8		/// And after this long whatever happens.
9		pub const ABSOLUTE_MS: i64 = 30 * 24 * 60 * 60_000;
10		/// `seen_ms` is written at most this often per session.
11		const TOUCH_EVERY_MS: i64 = 60_000;
12
13		#[derive(Clone, Debug, FromRow)]
14		pub struct Session {
15		pub id: i64,
16		pub account_id: i64,
17		pub salt: String,
18		pub created_ms: i64,
19		pub seen_ms: i64,
20		pub address: String,
21		pub agent: String,
22		}
23
24		impl Session {
25		/// Whether it is still good at `now`, for an account whose salt is `salt`.
26	1132×	pub fn live(&self, salt: &str, now: i64) -> bool {
27	1132×	self.salt == salt && now - self.seen_ms < IDLE_MS && now - self.created_ms < ABSOLUTE_MS
28	1132×	}
29		}
30
31		const COLUMNS: &str = "id, account_id, salt, created_ms, seen_ms, address, agent";
32
33	141×	pub async fn create(pool: &Pool, account_id: i64, hash: &str, salt: &str) -> sqlx::Result<i64> {
34	141×	let now = now_ms();
35	141×	sqlx::query_scalar("INSERT INTO sessions (account_id, hash, salt, created_ms, seen_ms) VALUES ($1, $2, $3, $4, $5) RETURNING id")
36	141×	.bind(account_id)
37	141×	.bind(hash)
38	141×	.bind(salt)
39	141×	.bind(now)
40	141×	.bind(now)
41	141×	.fetch_one(pool)
42	141×	.await
43	141×	}
44
45	1120×	pub async fn by_hash(pool: &Pool, hash: &str) -> sqlx::Result<Option<Session>> {
46	1120×	sqlx::query_as(&format!("SELECT {COLUMNS} FROM sessions WHERE hash = $1")).bind(hash).fetch_optional(pool).await
47	1120×	}
48
49		/// Note a use: the time (at most once a minute) and, the first time, the
50		/// address and browser it came from.
51	1109×	pub async fn touch(pool: &Pool, s: &Session, address: &str, agent: &str, now: i64) -> sqlx::Result<()> {
52	1109×	if s.agent.is_empty() && s.address.is_empty() && (!agent.is_empty() \|\| !address.is_empty()) {
53	0×	sqlx::query("UPDATE sessions SET seen_ms = $1, address = $2, agent = $3 WHERE id = $4")
54	0×	.bind(now)
55	0×	.bind(address)
56	0×	.bind(agent)
57	0×	.bind(s.id)
58	0×	.execute(pool)
59	0×	.await?;
60	1109×	} else if now - s.seen_ms >= TOUCH_EVERY_MS {
61	0×	sqlx::query("UPDATE sessions SET seen_ms = $1 WHERE id = $2").bind(now).bind(s.id).execute(pool).await?;
62	1109×	}
63	1109×	Ok(())
64	1109×	}
65
66		/// An account's live sessions, most recently used first.
67	7×	pub async fn of_account(pool: &Pool, account_id: i64, salt: &str) -> sqlx::Result<Vec<Session>> {
68	7×	let now = now_ms();
69	7×	let all: Vec<Session> = sqlx::query_as(&format!("SELECT {COLUMNS} FROM sessions WHERE account_id = $1 ORDER BY seen_ms DESC"))
70	7×	.bind(account_id)
71	7×	.fetch_all(pool)
72	7×	.await?;
73	12×	Ok(all.into_iter().filter(\|s\| s.live(salt, now)).collect())
74	7×	}
75
76		/// End one session of an account's; whether there was one.
77	1×	pub async fn end(pool: &Pool, account_id: i64, id: i64) -> sqlx::Result<bool> {
78	1×	let r = sqlx::query("DELETE FROM sessions WHERE id = $1 AND account_id = $2").bind(id).bind(account_id).execute(pool).await?;
79	1×	Ok(r.rows_affected() > 0)
80	1×	}
81
82	1×	pub async fn end_hash(pool: &Pool, hash: &str) -> sqlx::Result<()> {
83	1×	sqlx::query("DELETE FROM sessions WHERE hash = $1").bind(hash).execute(pool).await?;
84	1×	Ok(())
85	1×	}
86
87		/// Every session of an account's but `keep`.
88	0×	pub async fn end_others(pool: &Pool, account_id: i64, keep: i64) -> sqlx::Result<()> {
89	0×	sqlx::query("DELETE FROM sessions WHERE account_id = $1 AND id != $2").bind(account_id).bind(keep).execute(pool).await?;
90	0×	Ok(())
91	0×	}
92
93		/// Forget sessions that can no longer be used; how many.
94	0×	pub async fn sweep(pool: &Pool) -> sqlx::Result<u64> {
95	0×	let now = now_ms();
96	0×	let r = sqlx::query(
97	0×	"DELETE FROM sessions WHERE seen_ms < $1 OR created_ms < $2 \
98	0×	OR salt != (SELECT session_salt FROM accounts WHERE accounts.id = sessions.account_id)",
99	0×	)
100	0×	.bind(now - IDLE_MS)
101	0×	.bind(now - ABSOLUTE_MS)
102	0×	.execute(pool)
103	0×	.await?;
104	0×	Ok(r.rows_affected())
105	0×	}
106
107		#[cfg(test)]
108		mod tests {
109		use super::*;
110
111		#[test]
112	1×	fn a_session_ends_on_a_new_salt_when_idle_or_when_old() {
113	1×	let t0 = 1_000_000_000_000;
114	1×	let s =
115	1×	Session { id: 1, account_id: 1, salt: "a".into(), created_ms: t0, seen_ms: t0, address: String::new(), agent: String::new() };
116	1×	assert!(s.live("a", t0 + 1000));
117	1×	assert!(!s.live("b", t0 + 1000), "a new salt: signed out everywhere");
118	1×	assert!(!s.live("a", t0 + IDLE_MS), "unused for 14 days");
119	1×	let busy = Session { seen_ms: t0 + ABSOLUTE_MS - 1000, ..s.clone() };
120	1×	assert!(busy.live("a", t0 + ABSOLUTE_MS - 1));
121	1×	assert!(!busy.live("a", t0 + ABSOLUTE_MS), "30 days, however busy");
122	1×	}
123		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/hub/src/db/sessions.rs 68.7%

Keyboard