From ccad5f6a3a5f9b997d47a7359144d70175ee278b Mon Sep 17 00:00:00 2001
From: ferreo <harderthanfire@gmail.com>
Date: Tue, 30 Jul 2024 20:51:17 +0100
Subject: [PATCH] Fix auth

---
 handlers/auth/isloggedin.go | 16 +++++++++++++++-
 middleware/auth.go          |  4 ----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/handlers/auth/isloggedin.go b/handlers/auth/isloggedin.go
index f057c1e..18a6fc8 100644
--- a/handlers/auth/isloggedin.go
+++ b/handlers/auth/isloggedin.go
@@ -2,14 +2,28 @@ package handlers_auth
 
 import (
 	"brunel/auth"
+	"strings"
 
 	"github.com/gofiber/fiber/v2"
 )
 
 func IsLoggedIn(c *fiber.Ctx) error {
-	ok, _ := auth.CheckSessionToken(c.Cookies("pt"))
+
+	tokenPlusUsername := c.Cookies("pt")
+	if tokenPlusUsername == "" {
+		return c.Status(fiber.StatusUnauthorized).SendString("Unauthorized")
+	}
+
+	split := strings.Split(tokenPlusUsername, ":")
+	token := split[0]
+	username := split[1]
+	ok, suser := auth.CheckSessionToken(token)
 	if !ok {
 		return c.Status(fiber.StatusUnauthorized).SendString("Unauthorized")
 	}
+	if suser != username {
+		return c.Status(fiber.StatusUnauthorized).SendString("Unauthorized")
+	}
+
 	return c.Status(fiber.StatusOK).SendString("Logged in")
 }
diff --git a/middleware/auth.go b/middleware/auth.go
index e9410c4..532a14a 100644
--- a/middleware/auth.go
+++ b/middleware/auth.go
@@ -2,7 +2,6 @@ package middleware
 
 import (
 	"brunel/auth"
-	"fmt"
 	"strings"
 
 	"github.com/gofiber/fiber/v2"
@@ -11,7 +10,6 @@ import (
 func NewAuth() fiber.Handler {
 	return func(c *fiber.Ctx) error {
 		tokenPlusUsername := c.Cookies("pt")
-		fmt.Println("cookie", tokenPlusUsername)
 		if tokenPlusUsername == "" {
 			return c.Status(fiber.StatusUnauthorized).SendString("Unauthorized")
 		}
@@ -21,11 +19,9 @@ func NewAuth() fiber.Handler {
 		username := split[1]
 		ok, suser := auth.CheckSessionToken(token)
 		if !ok {
-			fmt.Println("not ok")
 			return c.Status(fiber.StatusUnauthorized).SendString("Unauthorized")
 		}
 		if suser != username {
-			fmt.Println("not suser")
 			return c.Status(fiber.StatusUnauthorized).SendString("Unauthorized")
 		}