main
use crate::protos::auth::common::v1::{PageRequest, SessionInfo};
use crate::protos::auth::v1::ListUserSessionsResponse;
use ::session::{AuthedUser, Session};
use api::http::{Path, Query, State};
use api::pagination::{Page, PageQuery, paginate};
use api::rest::{AppResponseData, NoData};
use serde::{Deserialize, Serialize};
use time::OffsetDateTime;
use utoipa::ToSchema;
use uuid::Uuid;
use crate::AuthService;
use crate::errors::ApiError;
use crate::share::account_helpers;
const SESSION_PAGE_SIZE: i32 = 100;
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
pub enum SessionKind {
WebLogin,
BearerAccess,
}
#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
pub struct SessionDto {
pub id: Uuid,
pub kind: SessionKind,
pub client_ip_hash: Option<String>,
pub user_agent_hash: Option<String>,
pub device_id: Option<Uuid>,
pub last_seen_at: OffsetDateTime,
pub created_at: OffsetDateTime,
pub expires_at: OffsetDateTime,
pub is_revoked: bool,
pub revoked_at: Option<OffsetDateTime>,
pub is_current: bool,
}
#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
pub struct CountResp {
pub count: i64,
}
#[derive(Debug, Deserialize, utoipa::IntoParams)]
#[serde(deny_unknown_fields)]
pub struct SessionQuery {
pub kind: Option<SessionKind>,
pub include_revoked: Option<bool>,
pub limit: Option<u64>,
pub offset: Option<u64>,
}
impl SessionQuery {
fn page(&self) -> PageQuery {
PageQuery {
limit: self.limit,
offset: self.offset,
}
}
}
pub(crate) fn session_list(
listed: ListUserSessionsResponse,
current: Option<&str>,
) -> Result<Vec<SessionDto>, ApiError> {
let mut out = Vec::with_capacity(listed.sessions.len());
for info in listed.sessions {
out.push(session_dto(info, current)?);
}
Ok(out)
}
fn session_dto(info: SessionInfo, current: Option<&str>) -> Result<SessionDto, ApiError> {
let created_at = info
.created_at
.and_then(|ts| account_helpers::datetime(ts.seconds, ts.nanos))
.ok_or_else(|| ApiError::internal("auth service returned a session without created_at"))?;
let last_seen_at = info
.last_seen_at
.and_then(|ts| account_helpers::datetime(ts.seconds, ts.nanos))
.unwrap_or(created_at);
let expires_at = info
.expires_at
.and_then(|ts| account_helpers::datetime(ts.seconds, ts.nanos))
.unwrap_or(created_at);
Ok(SessionDto {
id: Uuid::parse_str(&info.session_id)
.map_err(|_| ApiError::internal("auth service returned a malformed session id"))?,
kind: SessionKind::WebLogin,
client_ip_hash: hash_field(&info.client_ip),
user_agent_hash: hash_field(&info.user_agent),
device_id: None,
is_current: current == Some(info.session_id.as_str()),
is_revoked: info.revoked_at.is_some(),
revoked_at: info
.revoked_at
.and_then(|ts| account_helpers::datetime(ts.seconds, ts.nanos)),
last_seen_at,
created_at,
expires_at,
})
}
pub(crate) fn hash_field(value: &str) -> Option<String> {
if value.trim().is_empty() {
None
} else {
Some(account_helpers::digest(value))
}
}
#[utoipa::path(
get,
path = "/me/sessions",
tag = "user",
description = "列出当前账号的登录会话，并标记当前会话。",
params(SessionQuery),
responses(
(status = 200, description = "sessions", body = AppResponseData<Page<SessionDto>>),
(status = 401, description = "authentication required", body = AppResponseData<NoData>)
)
)]
pub async fn list_sessions(
State(service): State<AuthService>,
session: Session,
AuthedUser(uid): AuthedUser,
Query(query): Query<SessionQuery>,
) -> Result<AppResponseData<Page<SessionDto>>, ApiError> {
let listed = service
.accounts
.list_user_sessions(
uid,
query.include_revoked.unwrap_or(false),
true,
PageRequest {
page_size: SESSION_PAGE_SIZE,
page_token: String::new(),
},
)
.await
.map_err(|error| ApiError::internal(error.to_string()))?;
let current_session = session.session_id();
let sessions = session_list(listed, current_session.as_deref())?;
Ok(AppResponseData::ok(paginate(sessions, &query.page())?))
}
#[utoipa::path(
delete,
path = "/me/sessions",
tag = "user",
description = "吊销当前账号除当前会话以外的全部会话。",
responses(
(status = 200, description = "sessions revoked", body = AppResponseData<CountResp>),
(status = 401, description = "authentication required", body = AppResponseData<NoData>)
)
)]
pub async fn revoke_all_sessions(
State(service): State<AuthService>,
session: Session,
AuthedUser(uid): AuthedUser,
) -> Result<AppResponseData<CountResp>, ApiError> {
let keep = session.session_id().unwrap_or_default();
let revoked = service
.accounts
.revoke_user_sessions(uid, keep.as_str(), "user_logout", false)
.await
.map_err(|error| ApiError::internal(error.to_string()))?;
Ok(AppResponseData::ok(CountResp {
count: i64::from(revoked.revoked_count),
}))
}
#[utoipa::path(
delete,
path = "/me/sessions/{session_id}",
tag = "user",
description = "吊销指定会话；会话不存在或不属于当前账号时返回 404。",
params(("session_id" = Uuid, Path)),
responses(
(status = 200, description = "session revoked", body = AppResponseData<NoData>),
(status = 401, description = "authentication required", body = AppResponseData<NoData>),
(status = 404, description = "not found", body = AppResponseData<NoData>)
)
)]
pub async fn revoke_session(
State(service): State<AuthService>,
AuthedUser(uid): AuthedUser,
Path(session_id): Path<Uuid>,
) -> Result<AppResponseData<NoData>, ApiError> {
let revoked = service
.accounts
.revoke_session(uid, &session_id.to_string(), "user_revoked")
.await
.map_err(|error| ApiError::internal(error.to_string()))?;
let _ = revoked;
Ok(AppResponseData::empty())
}