mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-04 04:24:49 +00:00
refactor!: move go-chi/session into Gitea (#39504)
The `gitea.com/go-chi/session` package only exists for Gitea, so it moves into `modules/session` to fix its bugs directly. Fixes the flake in https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400. - Sessions are only written back when changed, so a read-only request can't revert a concurrent change or restore a logged-out session, like https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12 - The session cookie is only set once a session holds data - Every backend refreshes the expiry on load and file sessions are written atomically - Also fix https://github.com/go-gitea/gitea/issues/36176 ## ⚠️ BREAKING ⚠️ * the `mysql`, `postgres`, `couchbase` and `memcache` session providers are removed, use `file`, `db` or `redis` instead * login-related cookies are renamed to `gitea_session` and `gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME` and `COOKIE_REMEMBER_NAME` in app.ini --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
silverwind
+13
-147
@@ -5,172 +5,38 @@ package session
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"log"
|
||||
"sync"
|
||||
|
||||
"gitea.dev/models/auth"
|
||||
"gitea.dev/modules/log"
|
||||
"gitea.dev/modules/timeutil"
|
||||
|
||||
"gitea.com/go-chi/session"
|
||||
)
|
||||
|
||||
// DBStore represents a session store implementation based on the DB.
|
||||
type DBStore struct {
|
||||
sid string
|
||||
lock sync.RWMutex
|
||||
data map[any]any
|
||||
type dbBackend struct {
|
||||
maxLifetime int64
|
||||
}
|
||||
|
||||
func dbContext() context.Context {
|
||||
return context.Background()
|
||||
}
|
||||
|
||||
// NewDBStore creates and returns a DB session store.
|
||||
func NewDBStore(sid string, kv map[any]any) *DBStore {
|
||||
return &DBStore{
|
||||
sid: sid,
|
||||
data: kv,
|
||||
}
|
||||
}
|
||||
|
||||
// Set sets value to given key in session.
|
||||
func (s *DBStore) Set(key, val any) error {
|
||||
s.lock.Lock()
|
||||
defer s.lock.Unlock()
|
||||
|
||||
s.data[key] = val
|
||||
return nil
|
||||
}
|
||||
|
||||
// Get gets value by given key in session.
|
||||
func (s *DBStore) Get(key any) any {
|
||||
s.lock.RLock()
|
||||
defer s.lock.RUnlock()
|
||||
|
||||
return s.data[key]
|
||||
}
|
||||
|
||||
// Delete delete a key from session.
|
||||
func (s *DBStore) Delete(key any) error {
|
||||
s.lock.Lock()
|
||||
defer s.lock.Unlock()
|
||||
|
||||
delete(s.data, key)
|
||||
return nil
|
||||
}
|
||||
|
||||
// ID returns current session ID.
|
||||
func (s *DBStore) ID() string {
|
||||
return s.sid
|
||||
}
|
||||
|
||||
// Release releases resource and save data to provider.
|
||||
func (s *DBStore) Release() error {
|
||||
// Skip encoding if the data is empty
|
||||
if len(s.data) == 0 {
|
||||
return nil
|
||||
}
|
||||
|
||||
data, err := session.EncodeGob(s.data)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return auth.UpdateSession(dbContext(), s.sid, data)
|
||||
}
|
||||
|
||||
// Flush deletes all session data.
|
||||
func (s *DBStore) Flush() error {
|
||||
s.lock.Lock()
|
||||
defer s.lock.Unlock()
|
||||
|
||||
s.data = make(map[any]any)
|
||||
return nil
|
||||
}
|
||||
|
||||
// DBProvider represents a DB session provider implementation.
|
||||
type DBProvider struct {
|
||||
maxLifetime int64
|
||||
}
|
||||
|
||||
// Init initializes DB session provider.
|
||||
// connStr: username:password@protocol(address)/dbname?param=value
|
||||
func (p *DBProvider) Init(maxLifetime int64, connStr string) error {
|
||||
p.maxLifetime = maxLifetime
|
||||
return nil
|
||||
}
|
||||
|
||||
// Read returns raw session store by session ID.
|
||||
func (p *DBProvider) Read(sid string) (session.RawStore, error) {
|
||||
s, err := auth.ReadSession(dbContext(), sid)
|
||||
if err != nil {
|
||||
func (b *dbBackend) load(sid string) ([]byte, error) {
|
||||
sess, exist, err := auth.GetSession(dbContext(), sid)
|
||||
if err != nil || !exist || sess.LastAccessTime.Add(b.maxLifetime) <= timeutil.TimeStampNow() {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var kv map[any]any
|
||||
if len(s.Data) == 0 || s.Expiry.Add(p.maxLifetime) <= timeutil.TimeStampNow() {
|
||||
kv = make(map[any]any)
|
||||
} else {
|
||||
kv, err = session.DecodeGob(s.Data)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
return NewDBStore(sid, kv), nil
|
||||
return sess.Data, auth.UpdateSessionLastAccessTime(dbContext(), sid)
|
||||
}
|
||||
|
||||
// Exist returns true if session with given ID exists.
|
||||
func (p *DBProvider) Exist(sid string) (bool, error) {
|
||||
has, err := auth.ExistSession(dbContext(), sid)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("session/DB: error checking existence: %w", err)
|
||||
}
|
||||
return has, nil
|
||||
func (b *dbBackend) save(sid string, data []byte, create bool) error {
|
||||
return auth.UpdateSession(dbContext(), sid, data, create)
|
||||
}
|
||||
|
||||
// Destroy deletes a session by session ID.
|
||||
func (p *DBProvider) Destroy(sid string) error {
|
||||
func (b *dbBackend) destroy(sid string) error {
|
||||
return auth.DestroySession(dbContext(), sid)
|
||||
}
|
||||
|
||||
// Regenerate regenerates a session store from old session ID to new one.
|
||||
func (p *DBProvider) Regenerate(oldsid, sid string) (_ session.RawStore, err error) {
|
||||
s, err := auth.RegenerateSession(dbContext(), oldsid, sid)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var kv map[any]any
|
||||
if len(s.Data) == 0 || s.Expiry.Add(p.maxLifetime) <= timeutil.TimeStampNow() {
|
||||
kv = make(map[any]any)
|
||||
} else {
|
||||
kv, err = session.DecodeGob(s.Data)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
return NewDBStore(sid, kv), nil
|
||||
}
|
||||
|
||||
// Count counts and returns number of sessions.
|
||||
func (p *DBProvider) Count() (int, error) {
|
||||
total, err := auth.CountSessions(dbContext())
|
||||
if err != nil {
|
||||
return 0, fmt.Errorf("session/DB: error counting records: %w", err)
|
||||
}
|
||||
return int(total), nil
|
||||
}
|
||||
|
||||
// GC calls GC to clean expired sessions.
|
||||
func (p *DBProvider) GC() {
|
||||
if err := auth.CleanupSessions(dbContext(), p.maxLifetime); err != nil {
|
||||
log.Printf("session/DB: error garbage collecting: %v", err)
|
||||
func (b *dbBackend) gc() {
|
||||
if err := auth.CleanupSessions(dbContext(), b.maxLifetime); err != nil {
|
||||
log.Error("Unable to garbage collect sessions: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func init() {
|
||||
session.Register("db", &DBProvider{})
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user