logout

server/src/account.rs

@@ -99,7 +99,6 @@ pub fn account_login(name: &String, password: &String, tx: &mut Transaction) ->
         SELECT id, password, name
         FROM accounts
         WHERE name = $1
-        RETURNING id, name;
     ";
 
     let result = tx
@@ -134,7 +133,7 @@ pub fn account_login(name: &String, password: &String, tx: &mut Transaction) ->
     account_set_token(tx, &account)
 }
 
-fn account_set_token(tx: &mut Transaction, account: &Account) -> Result<String, Error> {
+pub fn account_set_token(tx: &mut Transaction, account: &Account) -> Result<String, Error> {
     let mut rng = thread_rng();
     let token: String = iter::repeat(())
         .map(|()| rng.sample(Alphanumeric))

server/src/net.rs

@@ -17,7 +17,7 @@ use r2d2_postgres::{TlsMode, PostgresConnectionManager};
 
 use rpc::{receive, RpcResult, RpcErrorResponse, AccountLoginParams, AccountCreateParams};
 use warden::{warden};
-use account::{Account, account_login, account_create, account_from_token};
+use account::{Account, account_login, account_create, account_from_token, account_set_token};
 
 pub type Db = PooledConnection<PostgresConnectionManager>;
 type PgPool = Pool<PostgresConnectionManager>;
@@ -174,6 +174,17 @@ fn token_res(token: String, secure: bool) -> HttpResponse {
     .finish()
 }
 
+fn token_clear() -> HttpResponse {
+   HttpResponse::Ok()
+    .cookie(Cookie::build("x-auth-token", "")
+        // .secure(secure)
+        .http_only(true)
+        .same_site(SameSite::Strict)
+        .max_age(-1) // 1 week aligns with db set
+        .finish())
+    .finish()
+}
+
 fn login(state: web::Data<State>, params: web::Json::<AccountLoginParams>) -> Result<HttpResponse, MnmlError> {
     let db = state.pool.get().or(Err(MnmlError::ServerError))?;
     let mut tx = db.transaction().or(Err(MnmlError::ServerError))?;
@@ -190,6 +201,24 @@ fn login(state: web::Data<State>, params: web::Json::<AccountLoginParams>) -> Re
     }
 }
 
+fn logout(r: HttpRequest, state: web::Data<State>) -> Result<HttpResponse, MnmlError> {
+    match r.cookie("x-auth-token") {
+        Some(t) => {
+            let db = state.pool.get().or(Err(MnmlError::ServerError))?;
+            let mut tx = db.transaction().or(Err(MnmlError::ServerError))?;
+            match account_from_token(t.value().to_string(), &mut tx) {
+                Ok(a) => {
+                    account_set_token(&mut tx, &a).or(Err(MnmlError::Unauthorized))?;
+                    tx.commit().or(Err(MnmlError::ServerError))?;
+                    return Ok(token_clear());
+                },
+                Err(_) => Err(MnmlError::Unauthorized),
+            }
+        },
+        None => Err(MnmlError::Unauthorized),
+    }
+}
+
 fn register(state: web::Data<State>, params: web::Json::<AccountCreateParams>) -> Result<HttpResponse, MnmlError> {
     let db = state.pool.get().or(Err(MnmlError::ServerError))?;
     let mut tx = db.transaction().or(Err(MnmlError::ServerError))?;
@@ -235,6 +264,7 @@ pub fn start() {
                 .wrap(middleware::Logger::default())
                 .wrap(Cors::new().supports_credentials())
                 .service(web::resource("/login").route(web::post().to(login)))
+                .service(web::resource("/logout").route(web::post().to(logout)))
                 .service(web::resource("/register").route(web::post().to(register)))
                 .service(web::resource("/ws/").route(web::get().to(connect))))
                 .bind("127.0.0.1:40000").expect("could not bind to port")
@@ -245,6 +275,7 @@ pub fn start() {
                 .data(State { pool: pool.clone(), secure: true })
                 .wrap(middleware::Logger::default())
                 .service(web::resource("/login").route(web::post().to(login)))
+                .service(web::resource("/logout").route(web::post().to(logout)))
                 .service(web::resource("/register").route(web::post().to(register)))
                 .service(web::resource("/ws/").route(web::get().to(connect))))
                 .bind("127.0.0.1:40000").expect("could not bind to port")