session lifetime

src/auth.rs

@@ -172,6 +172,8 @@ pub async fn update_resource(State(state): State<SharedState>, headers: HeaderMa
     ensure_owner(&state, user.id, &req.kind, &req.slug).await?;
     let query = match req.kind.as_str() { "workspace" => queries::USER_SET_WORKSPACE_PASSWORD, "pad" => queries::USER_SET_PAD_PASSWORD, _ => return Err(AuthError::bad_request("Unknown resource type.")) };
     sqlx::query(queries::get(state.db.kind(), query)).bind(hash).bind(req.slug.trim()).execute(state.db.pool()).await.map_err(AuthError::database)?;
+    sqlx::query(queries::get(state.db.kind(), "DELETE FROM resource_access_tokens WHERE resource_kind = ? AND resource_slug = ?"))
+        .bind(req.kind.as_str()).bind(req.slug.trim()).execute(state.db.pool()).await.map_err(AuthError::database)?;
     Ok(Json(serde_json::json!({"ok":true})))
 }
 
@@ -179,6 +181,8 @@ pub async fn delete_resource(State(state): State<SharedState>, headers: HeaderMa
     let user = require_user(&state, &headers).await?;
     ensure_owner(&state, user.id, &req.kind, &req.slug).await?;
     let query = match req.kind.as_str() { "workspace" => queries::USER_DELETE_WORKSPACE, "pad" => queries::USER_DELETE_PAD, _ => return Err(AuthError::bad_request("Unknown resource type.")) };
+    sqlx::query(queries::get(state.db.kind(), "DELETE FROM resource_access_tokens WHERE resource_kind = ? AND resource_slug = ?"))
+        .bind(req.kind.as_str()).bind(req.slug.trim()).execute(state.db.pool()).await.map_err(AuthError::database)?;
     sqlx::query(queries::get(state.db.kind(), query)).bind(req.slug.trim()).execute(state.db.pool()).await.map_err(AuthError::database)?;
     Ok(Json(serde_json::json!({"ok":true})))
 }
@@ -276,7 +280,7 @@ pub async fn authorize_nickname(state: &SharedState, nickname: Option<String>, t
 
 async fn create_session(state: &SharedState, user: &User) -> Result<SessionResponse, AuthError> {
     let token = random_token();
-    let expires_at = (Utc::now() + Duration::days(30)).to_rfc3339();
+    let expires_at = (Utc::now() + Duration::days(state.user_session_ttl_days)).to_rfc3339();
     sqlx::query(queries::get(state.db.kind(), queries::AUTH_INSERT_SESSION))
         .bind(&token).bind(user.id).bind(&expires_at).execute(state.db.pool()).await.map_err(AuthError::database)?;
     debug!(user_id = user.id, expires_at = %expires_at, "authentication session created");