WIP

hub/api/api.go

@@ -80,7 +80,11 @@ func (a *API) Session_Delete(sessionID string) error {
 	return nil
 }
 
-func (a *API) Session_Get(sessionID string) (*Session, error) {
+// Session_Get returns a snapshot copy of the session for sessionID (creating a
+// fresh one if absent/expired). Returning a value rather than the stored
+// pointer prevents callers from racing on the shared struct; mutations go
+// through Session_SignIn / Session_Delete under the lock.
+func (a *API) Session_Get(sessionID string) (Session, error) {
 	a.sessionsMu.Lock()
 	defer a.sessionsMu.Unlock()
 
@@ -91,13 +95,13 @@ func (a *API) Session_Get(sessionID string) (*Session, error) {
 				if timeSince(s.LastSeenAt) > 86400*7 {
 					s.LastSeenAt = time.Now().Unix()
 				}
-				return s, nil
+				return *s, nil
 			}
 			delete(a.sessions, sessionID)
 		}
 	}
 
-	return a.session_Create(), nil
+	return *a.session_Create(), nil
 }
 
 // caller must hold sessionsMu
@@ -111,7 +115,7 @@ func (a *API) session_Create() *Session {
 	return s
 }
 
-func (a *API) Session_SignIn(s *Session, pwd string) error {
+func (a *API) Session_SignIn(sessionID, pwd string) error {
 	conf, err := a.Config_Get()
 	if err != nil {
 		return err
@@ -120,8 +124,13 @@ func (a *API) Session_SignIn(s *Session, pwd string) error {
 		return ErrNotAuthorized
 	}
 	a.sessionsMu.Lock()
+	defer a.sessionsMu.Unlock()
+	s, ok := a.sessions[sessionID]
+	if !ok {
+		// Session expired or was evicted between fetch and sign-in.
+		return ErrNotAuthorized
+	}
 	s.SignedIn = true
-	a.sessionsMu.Unlock()
 	return nil
 }
 

hub/handler.go

@@ -30,7 +30,7 @@ func (app *App) handlePub(pattern string, fn handlerFunc) {
 			r.ParseForm()
 		}
 
-		if err := fn(s, w, r); err != nil {
+		if err := fn(&s, w, r); err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 		}
 	}

hub/handlers.go

@@ -33,7 +33,7 @@ func (a *App) _signinSubmit(s *api.Session, w http.ResponseWriter, r *http.Reque
 		return err
 	}
 
-	if err := a.api.Session_SignIn(s, pwd); err != nil {
+	if err := a.api.Session_SignIn(s.SessionID, pwd); err != nil {
 		return err
 	}