set auth cookie on register

LemmyNet · Aug 4, 2023 · 09f553f · 09f553f
1 parent 3b6f03d
commit 09f553f
Show file tree

Hide file tree

Showing 7 changed files with 32 additions and 26 deletions.
diff --git a/crates/api/src/local_user/login.rs b/crates/api/src/local_user/login.rs
@@ -11,7 +11,7 @@ use lemmy_api_common::{
   claims::Claims,
   context::LemmyContext,
   person::{Login, LoginResponse},
-  utils::{check_registration_application, check_user_valid},
+  utils::{check_registration_application, check_user_valid, create_login_cookie},
   AUTH_COOKIE_NAME,
 };
 use lemmy_db_views::structs::{LocalUserView, SiteView};
@@ -76,11 +76,8 @@ pub async fn login(
     verify_email_sent: false,
     registration_created: false,
   };
-  let mut cookie = Cookie::new(AUTH_COOKIE_NAME, jwt.into_inner());
-  cookie.set_secure(true);
-  cookie.set_same_site(SameSite::Strict);
-  cookie.set_http_only(true);
+
   let mut res = HttpResponse::Ok().json(json);
-  res.add_cookie(&cookie)?;
+  res.add_cookie(&create_login_cookie(jwt))?;
   Ok(res)
 }
diff --git a/crates/api_common/src/claims.rs b/crates/api_common/src/claims.rs
@@ -28,8 +28,7 @@ impl Claims {
     let claims =
       decode::<Claims>(jwt, &key, &validation).with_lemmy_type(LemmyErrorType::NotLoggedIn)?;
     let user_id = LocalUserId(claims.claims.sub.parse()?);
-    let is_valid =
-      LoginToken::validate(&mut context.pool(), user_id, jwt).await?;
+    let is_valid = LoginToken::validate(&mut context.pool(), user_id, jwt).await?;
     if !is_valid {
       return Err(LemmyErrorType::NotLoggedIn)?;
     }

diff --git a/crates/api_common/src/utils.rs b/crates/api_common/src/utils.rs
@@ -4,7 +4,9 @@ use crate::{
   request::purge_image_from_pictrs,
   sensitive::Sensitive,
   site::FederatedInstances,
+  AUTH_COOKIE_NAME,
 };
+use actix_web::cookie::{Cookie, SameSite};
 use anyhow::Context;
 use chrono::NaiveDateTime;
 use lemmy_db_schema::{
@@ -801,6 +803,14 @@ pub fn sanitize_html_opt(data: &Option<String>) -> Option<String> {
   data.as_ref().map(|d| sanitize_html(d))
 }
 
+pub fn create_login_cookie(jwt: Sensitive<String>) -> Cookie<'static> {
+  let mut cookie = Cookie::new(AUTH_COOKIE_NAME, jwt.into_inner());
+  cookie.set_secure(true);
+  cookie.set_same_site(SameSite::Strict);
+  cookie.set_http_only(true);
+  cookie
+}
+
 #[cfg(test)]
 mod tests {
   #![allow(clippy::unwrap_used)]

diff --git a/crates/api_crud/src/site/read.rs b/crates/api_crud/src/site/read.rs
@@ -4,14 +4,12 @@ use lemmy_api_common::{
   context::LemmyContext,
   sensitive::Sensitive,
   site::{GetSite, GetSiteResponse, MyUserInfo},
-  utils::{check_user_valid},
+  utils::check_user_valid,
 };
-use lemmy_db_schema::{
-  source::{
-    actor_language::{LocalUserLanguage, SiteLanguage},
-    language::Language,
-    tagline::Tagline,
-  },
+use lemmy_db_schema::source::{
+  actor_language::{LocalUserLanguage, SiteLanguage},
+  language::Language,
+  tagline::Tagline,
 };
 use lemmy_db_views::structs::{CustomEmojiView, LocalUserView, SiteView};
 use lemmy_db_views_actor::structs::{

diff --git a/crates/api_crud/src/user/create.rs b/crates/api_crud/src/user/create.rs
@@ -1,10 +1,11 @@
 use activitypub_federation::{config::Data, http_signatures::generate_actor_keypair};
-use actix_web::web::Json;
+use actix_web::{web::Json, HttpResponse};
 use lemmy_api_common::{
   claims::Claims,
   context::LemmyContext,
   person::{LoginResponse, Register},
   utils::{
+    create_login_cookie,
     generate_inbox_url,
     generate_local_apub_endpoint,
     generate_shared_inbox_url,
@@ -41,7 +42,7 @@ use lemmy_utils::{
 pub async fn register(
   data: Json<Register>,
   context: Data<LemmyContext>,
-) -> Result<Json<LoginResponse>, LemmyError> {
+) -> Result<HttpResponse, LemmyError> {
   let site_view = SiteView::read_local(&mut context.pool()).await?;
   let local_site = site_view.local_site;
   let require_registration_application =
@@ -158,6 +159,7 @@ pub async fn register(
       .await?;
   }
 
+  let mut res = HttpResponse::Ok();
   let mut login_response = LoginResponse {
     jwt: None,
     registration_created: false,
@@ -168,7 +170,12 @@ pub async fn register(
   if !local_site.site_setup
     || (!require_registration_application && !local_site.require_email_verification)
   {
-    login_response.jwt = Some(Claims::generate(inserted_local_user.id, &context).await?);
+    let jwt = Claims::generate(inserted_local_user.id, &context).await?;
+    res
+      .cookie(create_login_cookie(jwt.clone()))
+      .await
+      .expect("set auth cookie");
+    login_response.jwt = Some(jwt);
   } else {
     if local_site.require_email_verification {
       let local_user_view = LocalUserView {
@@ -198,5 +205,5 @@ pub async fn register(
     }
   }
 
-  Ok(Json(login_response))
+  Ok(res.json(login_response))
 }
diff --git a/crates/db_schema/src/impls/local_user.rs b/crates/db_schema/src/impls/local_user.rs
@@ -28,9 +28,7 @@ impl LocalUser {
     let password_hash = hash(new_password, DEFAULT_COST).expect("Couldn't hash password");
 
     diesel::update(local_user.find(local_user_id))
-      .set((
-        password_encrypted.eq(password_hash),
-      ))
+      .set((password_encrypted.eq(password_hash),))
       .get_result::<Self>(conn)
       .await
   }

diff --git a/crates/db_schema/src/impls/person.rs b/crates/db_schema/src/impls/person.rs
@@ -14,7 +14,6 @@ use crate::{
 use diesel::{dsl::insert_into, result::Error, ExpressionMethods, JoinOnDsl, QueryDsl};
 use diesel_async::RunQueryDsl;
 
-
 #[async_trait]
 impl Crud for Person {
   type InsertForm = PersonInsertForm;
@@ -68,9 +67,7 @@ impl Person {
 
     // Set the local user info to none
     diesel::update(local_user::table.filter(local_user::person_id.eq(person_id)))
-      .set((
-        local_user::email.eq::<Option<String>>(None),
-      ))
+      .set((local_user::email.eq::<Option<String>>(None),))
       .execute(conn)
       .await?;