File Coverage

blib/lib/Plack/Middleware/Session/Simple/JWSCookie.pm

Criterion	Covered	Total	%
statement	44	83	53.0
branch	9	46	19.5
condition	7	56	12.5
subroutine	11	14	78.5
pod	1	3	33.3
total	72	202	35.6

package Plack::Middleware::Session::Simple::JWSCookie;
use 5.008001;
use strict;
use warnings;

our $VERSION = "0.01";

use parent qw(Plack::Middleware::Session::Simple);
use Digest::SHA1 qw//;
use Cookie::Baker;
use Plack::Util;
use Scalar::Util qw/blessed/;
use JSON::WebToken qw/encode_jwt decode_jwt/;
use Plack::Util::Accessor qw/
    alg
    secret
/;

sub prepare_app {
    my $self = shift;

    my $store = $self->store;
    die('store require get, set and remove method.')
        unless blessed $store
            && $store->can('get')
            && $store->can('set')
            && $store->can('remove');

    $self->cookie_name('simple_session') unless $self->cookie_name;
    $self->path('/') unless defined $self->path;
    $self->keep_empty(1) unless defined $self->keep_empty;

    if ( !$self->sid_generator ) {
        $self->sid_generator(sub{
            Digest::SHA1::sha1_hex(rand() . $$ . {} . time)
        });
    }
    if ( !$self->sid_validator ) {
        $self->sid_validator(
            qr/\A[0-9a-f]{40}\Z/
        );
    }

    # secret & alg
    unless ($self->secret && $self->alg) {
        $self->alg('none');
        $self->secret(undef);
    } else {
        # support only HMAC Signature
        die "Plack::Middleware::Session::Cookie::JWS supports only HMAC Signatures"
            unless ($self->alg eq 'HS256' || $self->alg eq 'HS384' || $self->alg eq 'HS512');
    }
}

sub get_session {
    my ($self, $env) = @_;
    my $cookie = crush_cookie($env->{HTTP_COOKIE} || '')->{$self->{cookie_name}};
    return unless defined $cookie;
    my $payload;
    eval {
        $payload = decode_jwt($cookie, $self->secret, 0);
    };
    return if ($@ || !$payload->{id});

    my $id = $payload->{id};
    return unless $id =~ $self->{sid_validator};

    my $session = $self->{store}->get($id) or return;
    $session = $self->{serializer}->[1]->($session) if $self->{serializer};
    return ($id, $session);
}

sub finalize {
    my ($self, $env, $res, $session) = @_;
    my $options = $env->{'psgix.session.options'};
    my $new_session = delete $options->{new_session};

    my $need_store;
    if ( ($new_session && $self->{keep_empty} && ! $session->has_key )
             || $session->[1] || $options->{expire} || $options->{change_id}) {
        $need_store = 1;
    }
    $need_store = 0 if $options->{no_store};

    my $set_cookie;
    if ( ($new_session && $self->{keep_empty} && ! $session->has_key )
             || ($new_session && $session->[1] )
             || $options->{expire} || $options->{change_id}) {
        $set_cookie = 1;
    }

    if ( $need_store ) {
        if ($options->{expire}) {
            $self->{store}->remove($options->{id});
        } elsif ($options->{change_id}) {
            $self->{store}->remove($options->{id});
            $options->{id} = $self->{sid_generator}->();
            my $val = $session->[0];
            $val = $self->{serializer}->[0]->($val) if $self->{serializer};
            $self->{store}->set($options->{id}, $val);
        } else {
            my $val = $session->[0];
            $val = $self->{serializer}->[0]->($val) if $self->{serializer};
            $self->{store}->set($options->{id}, $val);
        }
    }

    if ( $set_cookie ) {
        my $jws = encode_jwt({ id => $options->{id} }, $self->secret, $self->alg);
        if ($options->{expire}) {
            $self->_set_cookie(
                $jws, $res, %$options, expires => 'now');
        } else {
            $self->_set_cookie(
                $jws, $res, %$options);
        }
    }
}

1;

__END__