From d745531a14f84ab3e811e3c886f10e24c532e51e Mon Sep 17 00:00:00 2001
From: wancat <wancat@wancat.cc>
Date: Sun, 17 Sep 2023 12:48:50 +0800
Subject: [PATCH] feat: update swagger, secure cookie

---
 server/src/api/controllers/authController.js |  4 +++-
 server/src/config.js                         |  3 ++-
 server/src/middleware/session.js             |  4 ++++
 server/src/utils/auth.js                     |  2 +-
 server/swagger.yaml                          | 17 ++++++++++++++++-
 5 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/server/src/api/controllers/authController.js b/server/src/api/controllers/authController.js
index 7968354..5fe8b2d 100644
--- a/server/src/api/controllers/authController.js
+++ b/server/src/api/controllers/authController.js
@@ -118,7 +118,9 @@ export function logout(req, res) {
       })
       return
     }
-    res.redirect('/login')
+    res.status(200).json({
+      message: 'logged out',
+    })
   })
 }
 
diff --git a/server/src/config.js b/server/src/config.js
index 9190ade..1bda384 100644
--- a/server/src/config.js
+++ b/server/src/config.js
@@ -8,5 +8,6 @@ export default {
   dockerNetwork: get('DOCKER_NETWORK', 'linux-odyssey-players'),
   isProduction: process.env.NODE_ENV === 'production',
   hostPwd: get('HOST_PWD', ''),
-  expiry: get('EXPIRY', 1000 * 60 * 60),
+  containerExpiry: get('EXPIRY', 1000 * 60 * 60),
+  sessionMaxAge: get('SESSION_MAX_AGE', 1000 * 60 * 60 * 24 * 7),
 }
diff --git a/server/src/middleware/session.js b/server/src/middleware/session.js
index fe216be..d118bb1 100644
--- a/server/src/middleware/session.js
+++ b/server/src/middleware/session.js
@@ -7,8 +7,12 @@ export default session({
   secret: config.jwtSecret,
   resave: false,
   saveUninitialized: false,
+  rolling: true,
   cookie: {
     httpOnly: true,
+    secure: config.isProduction,
+    sameSite: 'strict',
+    maxAge: config.sessionMaxAge,
   },
   store: MongoStore.create({
     mongoUrl: config.db,
diff --git a/server/src/utils/auth.js b/server/src/utils/auth.js
index fde5770..fc8478d 100644
--- a/server/src/utils/auth.js
+++ b/server/src/utils/auth.js
@@ -24,7 +24,7 @@ export function genJWT(payload) {
     jwt.sign(
       payload,
       config.jwtSecret,
-      { expiresIn: config.expiry },
+      { expiresIn: config.containerExpiry },
       (err, token) => {
         if (err) {
           reject(err)
diff --git a/server/swagger.yaml b/server/swagger.yaml
index 6cd6147..c3c6bb7 100644
--- a/server/swagger.yaml
+++ b/server/swagger.yaml
@@ -285,7 +285,7 @@ paths:
                     type: string
                     example: Logged out successfully
 
-  /auth/check:
+  /auth/check-username:
     get:
       summary: Check if the username is already taken
       parameters:
@@ -319,6 +319,21 @@ paths:
                     type: string
                     example: Username is already taken
 
+  /auth/check-session:
+    get:
+      summary: Check if the session is valid
+      responses:
+        '200':
+          description: Result
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  loggedIn:
+                    type: boolean
+                    example: true
+
   /quests:
     get:
       summary: Get quests list