serviceiamsession

func Authenticate ¶

func Authenticate(ctx context.Context, sessionID, userAgent, method, path string) (modeliamsession.Session, error)

Authenticate resolves the session sessionID names for a request or call that arrived with userAgent for the action at the HTTP method and path: the one path both the HTTP middleware and the gRPC interceptor of the module take, so a session is admitted or refused the same way over both listeners. The snapshot is loaded and validated; the device the session was established from — operating system, platform, browser engine and browser, as the user agent names them — has to be the one calling, which is what keeps a stolen session id from being used elsewhere, over either listener; the mutable state of the session's user is refreshed; while the user must change the password, only the actions for that are admitted (see MustChangePasswordExempt); and the session is touched.

A refusal is a service error carrying the status and the one fixed message the client is answered with: 401 "no session" with no session id, 401 "session invalid" for a snapshot the store no longer has, one that failed validation or one bound to another device, the user state's own service error or 403 "session invalid" for any other failure of it, and 403 "password change required before using this resource". The reasons are graded — a snapshot storage no longer has, one that expired, one issued to another browser or another OS — and answering each in its own words would hand the bearer of a stolen session id a probe: it could vary one component of the request at a time and read back which one the server objected to. The holder of a live session is told nothing by the distinction either, since every one of these is answered by logging in again, so only the log keeps it. A store that does not answer is the server's failure, answered 500 "failed to load session" (see loadSession); so is a user state that could not be read, answered with its own 500.

A snapshot that fails validation is deleted on the way out, and so are one whose user is refused — gone, disabled or locked — and a stored value that is not a snapshot: none can serve another request, and leaving them would let every later request pay to load and reject them again. A session the store did not answer for, or whose user's state could not be read, is kept for the next request to read it once the store is back.

func BuildAuthenticatedSessionRsp ¶

func BuildAuthenticatedSessionRsp(
	sessionData modeliamsession.Session,
	user *modeliamuser.User,
	email string,
	now time.Time,
	systemRoot bool,
) *modeliamsession.AuthenticatedSessionRsp

BuildAuthenticatedSessionRsp builds the shared login/current response contract.

systemRoot is taken as an argument rather than resolved here. This builder runs once the response is already decided — for login, after the session is stored and the cookie is written — so an authorization lookup failing at this point would fail a request that has otherwise succeeded. Each caller resolves it while it can still refuse.

func ClearCookie ¶

func ClearCookie(ctx *gst.ServiceContext)

ClearCookie removes the session cookie using the same path and security attributes SetCookie wrote it with, which is what makes the browser drop the cookie rather than keep a second one.

func CookieSessionID ¶

func CookieSessionID(ctx *gst.ServiceContext) (string, error)

CookieSessionID returns the session id carried by the request cookie.

A request without one is not an anonymous request this layer can shrug at: every caller of this function is already inside an authenticated route, so a missing cookie is an unauthenticated caller and is reported as one.

func CurrentSession ¶

func CurrentSession(ctx *gst.ServiceContext) (string, modeliamsession.Session, error)

CurrentSession returns the authenticated session of the request or call.

The session the middleware or interceptor admitted is on the context (see WithCurrentSession) and answers first, on either listener: a gRPC call has no cookie to read, and asking its context for one is a call the listener refuses once the action returns. The cookie is read for a request reached without the middleware, whose session is then loaded through loadSession: a store that does not answer is 500, not 401, and a stored value that is not a snapshot is deleted and 401.

A snapshot that fails validation is deleted on the way out. It cannot serve another request, and leaving it would let every later request pay to load and reject it again.

func GetSessionExpiration ¶

func GetSessionExpiration() time.Duration

GetSessionExpiration returns the configured session expiration time. If not configured, it reads IAM_SESSION_EXPIRATION before falling back to 8 hours.

func GetSessionUserStateTTL ¶

func GetSessionUserStateTTL() time.Duration

GetSessionUserStateTTL returns the configured mutable user-state cache TTL. If not configured, it reads IAM_SESSION_USER_STATE_TTL before falling back to 30 seconds.

func MustChangePasswordExempt ¶

func MustChangePasswordExempt(method, path string) bool

MustChangePasswordExempt reports whether the action at the HTTP method and path may proceed while the session's MustChangePassword flag is set: the ones a user needs to get out of that state, changing the password, logging out and reading or ending the current session. Authenticate asks it for both the HTTP middleware and the gRPC interceptor of the module, the gRPC one with the HTTP method and route its call's action is served at.

func NewSessionID ¶

func NewSessionID() (string, error)

NewSessionID returns an opaque random session identifier.

func SetCookie ¶

func SetCookie(ctx *gst.ServiceContext, sessionID string, maxAge time.Duration)

SetCookie writes the session cookie with hardened defaults.

func SetSessionExpiration ¶

func SetSessionExpiration(expiration time.Duration)

SetSessionExpiration sets the session expiration time for iam module. This function should be called during module registration.

func ValidateSession ¶

func ValidateSession(sessionID string, sessionData modeliamsession.Session) error

ValidateSession reports whether a stored snapshot is usable as the session the given id names.

It answers from the snapshot alone. Whether the user behind it may still be authenticated is a separate question, asked of the database through ValidateSessionUserState, because the answer changes without the snapshot changing.

func ValidateSessionUserState ¶

func ValidateSessionUserState(ctx context.Context, session modeliamsession.Session) (modeliamsession.Session, error)

ValidateSessionUserState refreshes the mutable user state required to keep using a session.

func WithCurrentSession ¶

func WithCurrentSession(ctx context.Context, sessionID string, session modeliamsession.Session) context.Context

WithCurrentSession stores a validated session snapshot on the request context so the handlers behind the middleware do not each reload it.