pangolin/server/internal/admin/session.go

package admin

import (
	"context"
	"crypto/rand"
	"crypto/subtle"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"time"

	"github.com/redis/go-redis/v9"
)

// SessionCookieName is the name of the admin session cookie.
const SessionCookieName = "admin_session"

// sessionKeyPrefix namespaces session keys in Redis.
const sessionKeyPrefix = "admin:sess:"

// Session is the server-side state for one logged-in admin.
type Session struct {
	AdminID   int64     `json:"admin_id"`
	Username  string    `json:"username"`
	CSRFToken string    `json:"csrf"`
	CreatedAt time.Time `json:"created_at"`
}

// SessionStore persists admin sessions in Redis with a sliding idle TTL.
type SessionStore struct {
	rdb *redis.Client
	ttl time.Duration
}

// NewSessionStore creates a SessionStore. ttl is the sliding idle timeout.
func NewSessionStore(rdb *redis.Client, ttl time.Duration) *SessionStore {
	if ttl <= 0 {
		ttl = 30 * time.Minute
	}
	return &SessionStore{rdb: rdb, ttl: ttl}
}

// Create starts a new session for the given admin and returns the opaque
// session id (to be set as the cookie value).
func (s *SessionStore) Create(ctx context.Context, adminID int64, username string) (string, *Session, error) {
	sid, err := randToken(32)
	if err != nil {
		return "", nil, err
	}
	csrf, err := randToken(32)
	if err != nil {
		return "", nil, err
	}
	sess := &Session{
		AdminID:   adminID,
		Username:  username,
		CSRFToken: csrf,
		CreatedAt: time.Now().UTC(),
	}
	if err := s.save(ctx, sid, sess); err != nil {
		return "", nil, err
	}
	return sid, sess, nil
}

// Get loads a session and slides its TTL forward. Returns (nil, nil) when the
// session is absent or expired.
func (s *SessionStore) Get(ctx context.Context, sid string) (*Session, error) {
	if sid == "" {
		return nil, nil
	}
	val, err := s.rdb.Get(ctx, sessionKeyPrefix+sid).Bytes()
	if errors.Is(err, redis.Nil) {
		return nil, nil
	}
	if err != nil {
		return nil, fmt.Errorf("admin.SessionStore.Get: %w", err)
	}
	var sess Session
	if err := json.Unmarshal(val, &sess); err != nil {
		return nil, fmt.Errorf("admin.SessionStore.Get unmarshal: %w", err)
	}
	// Slide the idle timeout.
	if err := s.rdb.Expire(ctx, sessionKeyPrefix+sid, s.ttl).Err(); err != nil {
		return nil, fmt.Errorf("admin.SessionStore.Get expire: %w", err)
	}
	return &sess, nil
}

// Delete removes a session (logout).
func (s *SessionStore) Delete(ctx context.Context, sid string) error {
	if sid == "" {
		return nil
	}
	return s.rdb.Del(ctx, sessionKeyPrefix+sid).Err()
}

func (s *SessionStore) save(ctx context.Context, sid string, sess *Session) error {
	b, err := json.Marshal(sess)
	if err != nil {
		return fmt.Errorf("admin.SessionStore.save: %w", err)
	}
	if err := s.rdb.Set(ctx, sessionKeyPrefix+sid, b, s.ttl).Err(); err != nil {
		return fmt.Errorf("admin.SessionStore.save set: %w", err)
	}
	return nil
}

// ValidCSRF reports, in constant time, whether token matches the session's
// CSRF token.
func (sess *Session) ValidCSRF(token string) bool {
	if sess == nil || sess.CSRFToken == "" || token == "" {
		return false
	}
	return subtle.ConstantTimeCompare([]byte(sess.CSRFToken), []byte(token)) == 1
}

// randToken returns a URL-safe random token of n bytes of entropy.
func randToken(n int) (string, error) {
	buf := make([]byte, n)
	if _, err := rand.Read(buf); err != nil {
		return "", fmt.Errorf("admin.randToken: %w", err)
	}
	return base64.RawURLEncoding.EncodeToString(buf), nil
}