internal/api/session_get.go - develop - githubmirror/photoprism

internal/api/session_get.go
85 строк2 KB
Ömer Duran
API: Set Cache-Control no-store on the session response
05 июн 2026, 22:03
05 июн 2026, 22:03ce5e10f
package api

import (
	"net/http"

	"github.com/gin-gonic/gin"

	"github.com/photoprism/photoprism/internal/auth/acl"
	"github.com/photoprism/photoprism/internal/photoprism/get"
	"github.com/photoprism/photoprism/pkg/clean"
	"github.com/photoprism/photoprism/pkg/http/header"
	"github.com/photoprism/photoprism/pkg/rnd"
)

// GetSession returns session data for the current or specified session.
//
//	@Summary	get the current session or a session by id
//	@Tags		Authentication
//	@Produce	json
//	@Param		id				path		string	false	"session id"
//	@Success	200				{object}	gin.H
//	@Failure	401,403,404,429	{object}	i18n.Response
//	@Router		/api/v1/session [get]
//	@Router		/api/v1/session/{id} [get]
//	@Router		/api/v1/sessions/{id} [get]
func GetSession(router *gin.RouterGroup) {
	getSessionHandler := func(c *gin.Context) {
		// Prevent CDNs from caching this endpoint.
		if header.IsCdn(c.Request) {
			AbortNotFound(c)
			return
		}

		// Disable caching: the response carries the auth token and, on the Portal,
		// refreshes the OP session cookie.
		c.Header(header.CacheControl, header.CacheControlNoStore)

		id := clean.ID(c.Param("id"))

		if id != "" && !rnd.IsSessionID(id) {
			// Abort if session id is provided but invalid.
			AbortBadRequest(c)
			return
		}

		conf := get.Config()

		// Require session management or view access.
		s := AuthAny(c, acl.ResourceSessions, acl.Permissions{acl.ActionManage, acl.ActionView})

		// Validate the resolved session.
		switch {
		case s.Abort(c):
			return
		case s.Expired(), s.ID == "":
			AbortUnauthorized(c)
			return
		case s.Invalid(), id != "" && s.ID != id && !conf.Public():
			AbortForbidden(c)
			return
		}

		// Get auth token from headers.
		authToken := AuthToken(c)

		// On the Portal (OIDC OP), refresh the narrowly-scoped session cookie so the
		// short-lived signed session reference stays available to /api/v1/oauth/authorize.
		if conf.Portal() && authToken != "" {
			SetOIDCSessionCookie(c, s, OIDCSessionCookiePath(conf), conf.SiteHttps())
		}

		// Update user information.
		s.RefreshUser()

		// Response includes user data, session data, and client config values.
		response := GetSessionResponse(authToken, s, get.Config().ClientSession(s))

		// Return JSON response.
		c.JSON(http.StatusOK, response)
	}

	router.GET("/session", getSessionHandler)
	router.GET("/session/:id", getSessionHandler)
	router.GET("/sessions/:id", getSessionHandler)
}