parsing of sessions works now

auth/oidc.go

@@ -36,6 +36,7 @@ import (
 type OIDCSession struct {
 	State string
 	Nonce string
+	token *oauth2.Token
 }
 
 func NewOIDCSession() (s *OIDCSession, err error) {
@@ -101,7 +102,7 @@ func (b *OIDCBackend) HandleLogin(w http.ResponseWriter, r *http.Request) {
 
 	if s != nil && s.oidc != nil {
 		if s.Username != "" {
-			http.Error(w, "you stilled logged in, please logout first!", http.StatusBadRequest)
+			http.Error(w, "you are still logged in, please logout first!", http.StatusBadRequest)
 			return
 		}
 		http.Error(w, "OIDC login already in progress, retry later", http.StatusConflict)
@@ -142,8 +143,10 @@ func (h *oidcCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 		http.Error(w, "no session cookie found, who are you?", http.StatusUnauthorized)
 		return
 	}
-	s := auth.sessions.get(sc.Value)
-	if s == nil {
+	sid := sc.Value
+
+	s := auth.sessions.get(sid)
+	if s == nil || s.Expired() {
 		invalidateSessionCookie(w)
 		http.Error(w, "invalid session cookie or session already expired", http.StatusUnauthorized)
 		return
@@ -159,7 +162,7 @@ func (h *oidcCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 
 	if r.URL.Query().Get("state") != s.oidc.State {
 		invalidateSessionCookie(w)
-		auth.sessions.remove(sc.Value)
+		auth.sessions.remove(sid)
 		http.Error(w, "OIDC: state did not match", http.StatusBadRequest)
 		return
 	}
@@ -167,7 +170,7 @@ func (h *oidcCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 	oauth2Token, err := h.backend.oauth2Config.Exchange(r.Context(), r.URL.Query().Get("code"))
 	if err != nil {
 		invalidateSessionCookie(w)
-		auth.sessions.remove(sc.Value)
+		auth.sessions.remove(sid)
 		http.Error(w, "OIDC: failed to exchange token: "+err.Error(), http.StatusBadRequest)
 		return
 	}
@@ -175,7 +178,7 @@ func (h *oidcCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 	rawIDToken, ok := oauth2Token.Extra("id_token").(string)
 	if !ok {
 		invalidateSessionCookie(w)
-		auth.sessions.remove(sc.Value)
+		auth.sessions.remove(sid)
 		http.Error(w, "OIDC: no id_token field in oauth2 token.", http.StatusInternalServerError)
 		return
 	}
@@ -183,13 +186,13 @@ func (h *oidcCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 	idToken, err := h.backend.verifier.Verify(r.Context(), rawIDToken)
 	if err != nil {
 		invalidateSessionCookie(w)
-		auth.sessions.remove(sc.Value)
+		auth.sessions.remove(sid)
 		http.Error(w, "OIDC: failed to verify ID Token: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
 	if idToken.Nonce != s.oidc.Nonce {
 		invalidateSessionCookie(w)
-		auth.sessions.remove(sc.Value)
+		auth.sessions.remove(sid)
 		http.Error(w, "OIDC: invalid ID token nonce", http.StatusInternalServerError)
 		return
 	}
@@ -197,25 +200,26 @@ func (h *oidcCallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 	userInfo, err := h.backend.provider.UserInfo(r.Context(), oauth2.StaticTokenSource(oauth2Token))
 	if err != nil {
 		invalidateSessionCookie(w)
-		auth.sessions.remove(sc.Value)
+		auth.sessions.remove(sid)
 		http.Error(w, "OIDC: failed to get userinfo: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
 
-	resp := struct {
-		OAuth2Token *oauth2.Token
-		UserInfo    *json.RawMessage
-	}{oauth2Token, new(json.RawMessage)}
-
-	if err := userInfo.Claims(&resp.UserInfo); err != nil {
+	newS := &Session{}
+	if err := userInfo.Claims(newS); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
-
-	data, err := json.MarshalIndent(resp, "", "    ")
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+	newS.Expires = s.Expires
+	newS.oidc = &OIDCSession{State: s.oidc.State, Nonce: s.oidc.Nonce}
+	newS.oidc.token = oauth2Token
+	if err = auth.sessions.update(sid, newS); err != nil {
+		invalidateSessionCookie(w)
+		auth.sessions.remove(sid)
+		http.Error(w, "OIDC: failed to update session: "+err.Error(), http.StatusInternalServerError)
 		return
 	}
+
+	data, _ := json.MarshalIndent(newS, "", "    ")
 	w.Write(data)
 }

auth/sessions.go

@@ -36,9 +36,9 @@ const (
 )
 
 type Session struct {
-	Expires  time.Time
-	Username string
-	Groups   []string
+	Expires  time.Time `json:"expires"`
+	Username string    `json:"username"`
+	Shows    []string  `json:"shows"`
 	oidc     *OIDCSession
 }