tenseleyflow/shithub / c42837e

Browse files

Add Pre2FAUserID to session for password-OK-but-2FA-pending state

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
c42837e64b03e07062a33f5dd53a3c2dcc54ec35
Parents
9f24a0e
Tree
0b93498

1 changed file

StatusFile+-
M internal/auth/session/session.go 7 6
internal/auth/session/session.gomodified
@@ -28,12 +28,13 @@ const DefaultMaxAge = 30 * 24 * time.Hour
2828
 // Session is the data carried in a cookie. The shape is intentionally
2929
 // small; anything that doesn't fit a few hundred bytes belongs server-side.
3030
 type Session struct {
31
-	UserID    int64             `json:"uid,omitempty"`
32
-	CSRFToken string            `json:"csrf,omitempty"`
33
-	Theme     string            `json:"theme,omitempty"`
34
-	Flashes   []string          `json:"flashes,omitempty"`
35
-	Extras    map[string]string `json:"extras,omitempty"`
36
-	IssuedAt  int64             `json:"iat,omitempty"`
31
+	UserID       int64             `json:"uid,omitempty"`
32
+	Pre2FAUserID int64             `json:"p2,omitempty"` // set after password OK, before TOTP step
33
+	CSRFToken    string            `json:"csrf,omitempty"`
34
+	Theme        string            `json:"theme,omitempty"`
35
+	Flashes      []string          `json:"flashes,omitempty"`
36
+	Extras       map[string]string `json:"extras,omitempty"`
37
+	IssuedAt     int64             `json:"iat,omitempty"`
3738
 }
3839
3940
 // IsAnonymous returns true when no user is bound to the session.