session check

src/auth/mod.rs

@@ -1199,13 +1199,41 @@ pub async fn confirm_reset(
 }
 
 pub async fn user_from_token(state: &SharedState, token: &str) -> Result<Option<User>, AuthError> {
-    let now = Utc::now().to_rfc3339();
-    sqlx::query_as::<_, User>(queries::get(state.db.kind(), queries::AUTH_USER_BY_SESSION))
+    let now = Utc::now();
+    let now_rfc3339 = now.to_rfc3339();
+    let user = sqlx::query_as::<_, User>(queries::get(state.db.kind(), queries::AUTH_USER_BY_SESSION))
         .bind(token)
-        .bind(now)
+        .bind(&now_rfc3339)
         .fetch_optional(state.db.pool())
         .await
-        .map_err(AuthError::database)
+        .map_err(AuthError::database)?;
+
+    if let Some(user) = user {
+        let expires_at = (now + Duration::days(state.user_session_ttl_days)).to_rfc3339();
+        let refreshed = sqlx::query(queries::get(state.db.kind(), queries::AUTH_REFRESH_SESSION))
+            .bind(&expires_at)
+            .bind(token)
+            .bind(&now_rfc3339)
+            .execute(state.db.pool())
+            .await
+            .map_err(AuthError::database)?;
+        if refreshed.rows_affected() == 1 {
+            debug!(user_id = user.id, expires_at = %expires_at, "authentication session extended");
+            Ok(Some(user))
+        } else {
+            Ok(None)
+        }
+    } else {
+        sqlx::query(queries::get(
+            state.db.kind(),
+            queries::AUTH_DELETE_SESSION_BY_TOKEN,
+        ))
+        .bind(token)
+        .execute(state.db.pool())
+        .await
+        .map_err(AuthError::database)?;
+        Ok(None)
+    }
 }
 
 pub async fn authorize_nickname(