Auth Beyond Tokens
Implementing Session Lifecycle

func AuthMiddleware() gin.HandlerFunc {
  return func(c *gin.Context) {
    ctx := c.Request.Context()

    // Extract session ID from cookie
    sessionID := utils.GetSessionIDFromContext(c)
    if sessionID == "" {
      response.Error(c, http.StatusUnauthorized, "Missing session ID")
      c.Abort()
      return
    }

    // Fetch session metadata from Redis
    meta, err := utils.GetSessionDataBySID(ctx, sessionID)
    if err != nil || meta == nil {
      // If session exists but fetching fails, clear session and remove from user's session set
      if meta != nil {
        if err := utils.ClearSession(ctx, sessionID); err != nil {
          log.Printf("warn: failed to clear session %s: %v", sessionID, err)
        }
        if err := utils.ClearSessionFromUserSessions(ctx, meta.UserID, sessionID); err != nil {
          log.Printf("warn: failed to remove session %s from user %d: %v", sessionID, meta.UserID, err)
        }
      }

      // Delete the cookie and return unauthorized
      utils.DeleteCookie(c)
      response.Error(c, http.StatusUnauthorized, "Your session has expired. Please log in again.")
      c.Abort()
      return
    }

    // Inject session info and user ID into context for downstream handlers
    c.Set("session", meta)
    c.Set("uid", meta.UserID)

    c.Next()
  }
}

func RefreshSession() gin.HandlerFunc {
  return func(c *gin.Context) {
    ctx := c.Request.Context()

    // Extract session ID from cookie
    sessionID := utils.GetSessionIDFromContext(c)
    if sessionID != "" {
      // Refresh session TTL in Redis
      if err := utils.RefreshSessionTTL(ctx, sessionID); err == nil {
        // Update the cookie in the user's browser to keep it in sync
        utils.RefreshCookie(c, sessionID)
      }
    }

    // Continue to next middleware or handler
    c.Next()
  }
}
  

func RefreshSessionTTL(ctx context.Context, sessionID string) error {
	meta, err := GetSessionDataBySID(ctx, sessionID)
	if err != nil || meta == nil {
		return errors.New("invalid session ID")
	}

	now := time.Now()

	// 1. Update TTL of session:<sid>
	sessionKey := RedisSessionKey(sessionID)
	if err := db.RedisClient.Expire(ctx, sessionKey, time.Duration(constants.SessionSlideAge)*time.Second).Err(); err != nil {
		return fmt.Errorf("failed to refresh session TTL: %w", err)
	}

	// 2. Update score in user_sessions:<uid>
	userKey := RedisUserSessionsKey(meta.UserID)
	if err := db.RedisClient.ZAdd(ctx, userKey, redis.Z{Score: float64(now.Unix()), Member: sessionID}).Err(); err != nil {
		return fmt.Errorf("failed to update session score in user set: %w", err)
	}

	// 3. Update LastAccessedAt in session metadata
	meta.LastAccessedAt = now
	if err := SetSession(ctx, sessionKey, *meta, time.Duration(constants.SessionSlideAge)*time.Second); err != nil {
		return fmt.Errorf("failed to update session metadata: %w", err)
	}

	return nil
}

// Refresh cookie expiry
func RefreshCookie(c *gin.Context, sessionID string) {
	http.SetCookie(c.Writer, &http.Cookie{
		Name:     constants.SessionCookieName,
		Value:    sessionID,
		Path:     "/",
		HttpOnly: true,
		Secure:   true,
		MaxAge:   constants.SessionSlideAge,
		SameSite: http.SameSiteNoneMode,
	})
}

func CleanupUserExpiredSessions(userID uint) error {
	ctx := context.Background()
	userKey := RedisUserSessionsKey(userID)

	// Fetch all session IDs for the user
	sessionIDs, err := db.RedisClient.ZRange(ctx, userKey, 0, -1).Result()
	if err != nil {
		return fmt.Errorf("failed to fetch user sessions: %w", err)
	}

	for _, sid := range sessionIDs {
		sessionKey := RedisSessionKey(sid)

		// Check if the session key still exists
		exists, err := db.RedisClient.Exists(ctx, sessionKey).Result()
		if err != nil {
			continue // ignore errors and continue cleanup
		}

		// Remove expired sessions from user's set
		if exists == 0 {
			_ = db.RedisClient.ZRem(ctx, userKey, sid).Err()
		}
	}

	return nil
}

func PruneExcessSessions(ctx context.Context, userID uint) error {
	userKey := RedisUserSessionsKey(userID)

	// Get the number of active sessions
	length, err := db.RedisClient.ZCard(ctx, userKey).Result()
	if err != nil {
		return fmt.Errorf("failed to get session count: %w", err)
	}

	if length > int64(constants.MaxUserSessions) {
		excessSessions := length - int64(constants.MaxUserSessions)

		// Fetch the oldest sessions to remove
		oldSessions, err := db.RedisClient.ZRange(ctx, userKey, 0, excessSessions-1).Result()
		if err != nil {
			return fmt.Errorf("failed to prune excess sessions: %w", err)
		}

		for _, oldID := range oldSessions {
			// Remove session ID from user's session set
			if err := ClearSessionFromUserSessions(ctx, userID, oldID); err != nil {
				log.Printf("warn: failed to unlink session %s from user %v: %v", oldID, userID, err)
			}
			// Delete session key from Redis
			if err := ClearSession(ctx, oldID); err != nil {
				log.Printf("warn: failed to delete session %s: %v", oldID, err)
			}
		}
	}

	return nil
}

func DeleteCookie(c *gin.Context) {
	http.SetCookie(c.Writer, &http.Cookie{
		Name:     constants.SessionCookieName,
		Value:    "",
		Path:     "/",
		HttpOnly: true,
		Secure:   true,
		MaxAge:   -1,
		SameSite: http.SameSiteNoneMode,
		Expires:  time.Unix(0, 0), // set expiration in the past
	})
}

func ClearSession(ctx context.Context, sessionID string) error {
	sessionKey := RedisSessionKey(sessionID)
	if err := db.RedisClient.Del(ctx, sessionKey).Err(); err != nil {
		return fmt.Errorf("failed to delete session %s: %w", sessionKey, err)
	}
	return nil
}

func ClearSessionFromUserSessions(ctx context.Context, userID uint, sessionID string) error {
	userKey := RedisUserSessionsKey(userID)
	if err := db.RedisClient.ZRem(ctx, userKey, sessionID).Err(); err != nil {
		return fmt.Errorf("failed to remove session %s from user %d sessions: %w", sessionID, userID, err)
	}
	return nil
}

func LogoutSession(c *gin.Context) error {
	ctx := c.Request.Context()

	// Retrieve session metadata from request context
	session, err := GetSessionFromContext(c)
	if err != nil {
		return fmt.Errorf("failed to retrieve session from context: %w", err)
	}

	// Delete session data from Redis
	if err := ClearSession(ctx, session.SID); err != nil {
		return fmt.Errorf("failed to delete session %s: %w", session.SID, err)
	}

	// Remove session ID from user's active session set
	if err := ClearSessionFromUserSessions(ctx, session.UserID, session.SID); err != nil {
		log.Printf("warn: failed to remove session %s from user %d sessions: %v", session.SID, session.UserID, err)
	}

	// Delete the session cookie from the browser
	DeleteCookie(c)
	return nil
}