feat: update frontend to use cookie session

* use SessionMiddleware in socket.io server
* add back jwtStrategy for commands

server/src/api/controllers/authController.js

@@ -118,6 +118,6 @@ export function logout(req, res) {
       })
       return
     }
-    res.json({ message: 'success' })
+    res.redirect('/login')
   })
 }

server/src/api/routes/index.js

@@ -4,9 +4,9 @@ import sessions from './sessions.js'
 import quests from './quests.js'
 import commands from './commands.js'
 import authRouter from './auth.js'
+import authRequired from '../../middleware/authRequired.js'
 
 const router = Router()
-router.use(passport.authenticate('session'))
 
 router.get('/', (req, res) => {
   res.send('Hello API!')
@@ -15,10 +15,11 @@ router.get('/', (req, res) => {
 router.use('/auth', authRouter)
 router.use('/quests', quests)
 
-const authZone = Router()
-authZone.use('/sessions', sessions)
-authZone.use('/commands', commands)
-
-router.use(authZone)
+router.use('/sessions', authRequired, sessions)
+router.use(
+  '/commands',
+  passport.authenticate('jwt', { session: false }),
+  commands
+)
 
 export default router

server/src/api/socket.js

@@ -1,7 +1,8 @@
 import { Server } from 'socket.io'
 import { getAndStartContainer, attachContainer } from '../containers/docker.js'
 import Session from '../models/session.js'
-import { genJWT, verifyJWT } from '../utils/auth.js'
+import SessionMiddleware from '../middleware/session.js'
+import { genJWT } from '../utils/auth.js'
 
 const sessions = new Map()
 
@@ -27,6 +28,13 @@ export function pushToSession(sessionId, event, ...args) {
 
 async function connectClient(socket) {
   console.log('Connected to the client.')
+
+  const user = socket.request.session?.passport?.user
+  if (!user) {
+    socket.send('User not found.')
+    socket.disconnect()
+    return
+  }
   const sessionId = socket.handshake.query.session_id
   if (!sessionId) {
     socket.send('Session ID not found.')
@@ -36,7 +44,7 @@ async function connectClient(socket) {
 
   const session = await Session.findOne({
     _id: sessionId,
-    user: socket.user,
+    user,
     status: 'active',
   })
   if (!session) {
@@ -89,24 +97,7 @@ async function connectClient(socket) {
 export default (server) => {
   const io = new Server(server)
 
-  io.use(async (socket, next) => {
-    console.log('Authenticating...')
-    try {
-      const { token } = socket.handshake.auth
-      if (!token) {
-        next(new Error('Token not found.'))
-        return
-      }
-      const user = await verifyJWT(token)
-      // eslint-disable-next-line no-param-reassign
-      console.log(user)
-      socket.user = user
-      next()
-    } catch (err) {
-      console.error(err)
-      next(err)
-    }
-  })
+  io.engine.use(SessionMiddleware)
 
   io.on('connection', connectClient)
 }