feat: make session cookie

apps/lenra_web/lib/lenra_web/controllers/user_controller.ex

@@ -4,7 +4,7 @@ defmodule LenraWeb.UserController do
  alias Lenra.Accounts
  alias Lenra.Accounts.User
  alias Lenra.Repo
- alias LenraWeb.Guardian.Plug
+ alias LenraWeb.Guardian
  alias LenraWeb.TokenHelper
 
  alias Lenra.Errors.BusinessError
@@ -26,22 +26,23 @@ defmodule LenraWeb.UserController do
  end
 
  def refresh_token(conn, _params) do
- conn
- |> Plug.current_token()
+ token = Guardian.Plug.current_token(conn) || Plug.Conn.get_session(conn, :guardian_default_token)
+
+ token
  |> TokenHelper.create_access_token()
  |> case do
  {:ok, access_token} ->
  conn
  |> TokenHelper.assign_access_token(access_token)
- |> reply(Plug.current_resource(conn))
+ |> reply(Guardian.Plug.current_resource(conn))
 
  err ->
  err
  end
  end
 
  def validate_user(conn, params) do
- with user <- Plug.current_resource(conn),
+ with user <- Guardian.Plug.current_resource(conn),
  {:ok, %{updated_user: updated_user}} <- Accounts.validate_user(user, params["code"]) do
  conn
  |> TokenHelper.revoke_current_refresh()
@@ -51,14 +52,14 @@ defmodule LenraWeb.UserController do
  end
 
  def resend_registration_token(conn, _params) do
- with user <- Plug.current_resource(conn),
+ with user <- Guardian.Plug.current_resource(conn),
  {:ok, _any} <- Accounts.resend_registration_code(user) do
  reply(conn)
  end
  end
 
  def validate_dev(conn, _params) do
- with user <- Plug.current_resource(conn),
+ with user <- Guardian.Plug.current_resource(conn),
  {:ok, %{updated_user: updated_user}} <- Accounts.validate_dev(user) do
  conn
  |> TokenHelper.revoke_current_refresh()
@@ -70,12 +71,12 @@ defmodule LenraWeb.UserController do
  def logout(conn, _params) do
  conn
  |> TokenHelper.revoke_current_refresh()
- |> Plug.clear_remember_me()
+ |> Guardian.Plug.clear_remember_me()
  |> reply()
  end
 
  def change_password(conn, params) do
- with user <- Plug.current_resource(conn),
+ with user <- Guardian.Plug.current_resource(conn),
  {:ok, _} <- Accounts.update_user_password(user, params) do
  reply(conn)
  end

apps/lenra_web/lib/lenra_web/guardian/plug/verify_cookie_simple.ex

@@ -8,7 +8,7 @@ defmodule LenraWeb.Plug.VerifyCookieSimple do
 
  def call(conn, opts) do
  with nil <- Guardian.Plug.current_token(conn, opts),
- {:ok, token} <- Guardian.Plug.find_token_from_cookies(conn, opts),
+ {:ok, token} <- get_token(conn, opts),
  claims_to_check <- Keyword.get(opts, :claims, %{}),
  key <- Pipeline.fetch_key(conn, opts),
  {:ok, claims} <- LenraWeb.Guardian.decode_and_verify(token, claims_to_check, opts) do
@@ -29,4 +29,12 @@ defmodule LenraWeb.Plug.VerifyCookieSimple do
  conn
  end
  end
+
+ defp get_token(conn, opts) do
+ if Plug.Conn.get_session(conn, :guardian_default_token) == nil do
+ Guardian.Plug.find_token_from_cookies(conn, opts)
+ else
+ {:ok, Plug.Conn.get_session(conn, :guardian_default_token)}
+ end
+ end
 end

apps/lenra_web/lib/lenra_web/guardian/token_helper.ex

@@ -21,15 +21,16 @@ defmodule LenraWeb.TokenHelper do
  end
 
  def assign_access_and_refresh_token(conn, user) do
- conn = Guardian.Plug.remember_me(conn, user, %{typ: "refresh"}, ttl: {0, :days})
-
- # Do not use create_access_token because sometimes the function returns an error because refresh_token has expired.
- case Guardian.encode_and_sign(user, %{typ: "access"}) do
- {:ok, access_token, _claims} ->
- assign_access_token(conn, access_token)
-
- error ->
- ErrorHandler.auth_error(conn, error, [])
+ with {:ok, refresh, _claims} <- Guardian.encode_and_sign(user, %{typ: "refresh"}),
+ conn <- Guardian.Plug.put_session_token(conn, refresh, key: "guardian_default") do
+ # Do not use create_access_token, sometimes the function returns an error because refresh_token has expired.
+ case Guardian.encode_and_sign(user, %{typ: "access"}) do
+ {:ok, access_token, _claims} ->
+ assign_access_token(conn, access_token)
+
+ error ->
+ ErrorHandler.auth_error(conn, error, [])
+ end
  end
  end
 

apps/lenra_web/lib/lenra_web/router.ex

@@ -9,6 +9,7 @@ defmodule LenraWeb.Router do
 
  pipeline :api do
  plug(:accepts, ["json"])
+ plug(:fetch_session)
  end
 
  pipeline :runner do