chore: Refactor getting the session

Author: marienfressinaud

src/auth/CurrentUser.php

@@ -146,6 +146,14 @@ public static function authenticate(string $session_token, string $scope): ?mode
         return $user;
     }
 
+    /**
+     * Return whether the user is logged-in or not.
+     */
+    public static function isLoggedIn(): bool
+    {
+        return self::$instance !== null && self::$session !== null;
+    }
+
     /**
      * Return the logged-in user if any.
      */
@@ -172,10 +180,17 @@ public static function require(): models\User
     }
 
     /**
-     * Return the current session if any.
+     * Return the current session.
+     *
+     * @throws MissingCurrentUserError
+     *     If the user is not logged-in.
      */
-    public static function session(): ?models\Session
+    public static function session(): models\Session
     {
+        if (!self::$session) {
+            throw new MissingCurrentUserError('Session does not exist.');
+        }
+
         return self::$session;
     }
 
@@ -190,11 +205,6 @@ public static function session(): ?models\Session
     public static function requireConfirmedPassword(): void
     {
         $session = self::session();
-
-        if (!$session) {
-            throw new MissingCurrentUserError();
-        }
-
         if (!$session->isPasswordConfirmed()) {
             throw new PasswordNotConfirmedError();
         }

src/controllers/my/Security.php

@@ -82,7 +82,6 @@ public function update(Request $request): Response
                 models\Token::delete($user->reset_token);
             }
             $session = auth\CurrentUser::session();
-            assert($session !== null);
             models\Session::deleteByUserId($user->id, $session->id);
         }
 
@@ -147,8 +146,6 @@ public function confirm(Request $request): Response
         }
 
         $session = auth\CurrentUser::session();
-        assert($session !== null);
-
         $session->confirmPassword();
 
         return Response::found($form->redirect_to);

src/controllers/my/Sessions.php

@@ -33,7 +33,6 @@ public function index(Request $request): Response
         auth\CurrentUser::requireConfirmedPassword();
 
         $session = auth\CurrentUser::session();
-        assert($session !== null);
 
         $sessions = models\Session::listBy([
             'user_id' => $user->id,
@@ -86,7 +85,6 @@ public function delete(Request $request): Response
         $response = Response::redirect('sessions');
 
         $current_session = auth\CurrentUser::session();
-        assert($current_session !== null);
 
         if ($session->id === $current_session->id) {
             auth\CurrentUser::deleteSession();

src/forms/BaseForm.php

@@ -26,8 +26,8 @@ public function csrfErrorMessage(): string
 
     public function csrfSessionId(): string
     {
-        $session = auth\CurrentUser::session();
-        if ($session) {
+        if (auth\CurrentUser::isLoggedIn()) {
+            $session = auth\CurrentUser::session();
             return $session->id;
         } else {
             return $this->_csrfSessionId();

tests/auth/CurrentUserTest.php

@@ -78,7 +78,6 @@ public function testAuthenticate(): void
         $this->assertNotNull($current_user);
         $this->assertSame($user->id, $current_user->id);
         $current_session = CurrentUser::session();
-        $this->assertNotNull($current_session);
         $this->assertSame($session->id, $current_session->id);
     }
 
@@ -98,8 +97,6 @@ public function testAuthenticateDoesNotLogInIfTokenIsExpired(): void
 
         $current_user = CurrentUser::get();
         $this->assertNull($current_user);
-        $current_session = CurrentUser::session();
-        $this->assertNull($current_session);
     }
 
     public function testAuthenticateDoesNotLogInIfTokenIsInvalidated(): void
@@ -119,8 +116,6 @@ public function testAuthenticateDoesNotLogInIfTokenIsInvalidated(): void
 
         $current_user = CurrentUser::get();
         $this->assertNull($current_user);
-        $current_session = CurrentUser::session();
-        $this->assertNull($current_session);
     }
 
     public function testAuthenticateDoesNotLogInIfScopeDoesNotMatch(): void
@@ -139,8 +134,6 @@ public function testAuthenticateDoesNotLogInIfScopeDoesNotMatch(): void
 
         $current_user = CurrentUser::get();
         $this->assertNull($current_user);
-        $current_session = CurrentUser::session();
-        $this->assertNull($current_session);
     }
 
     public function testAuthenticateFailsWithSupportUser(): void

tests/controllers/api/v1/SessionsTest.php

@@ -34,7 +34,6 @@ public function testCreateCreatesASessionAndReturnsAToken(): void
         $current_user = auth\CurrentUser::get();
         $session = auth\CurrentUser::session();
         $this->assertNotNull($current_user);
-        $this->assertNotNull($session);
         $this->assertSame($user->id, $current_user->id);
         $this->assertSame($app_name, $session->name);
         $this->assertApiResponse($response, [
@@ -63,9 +62,7 @@ public function testCreateFailsIfAppNameIsMissing(): void
 
         $this->assertResponseCode($response, 400);
         $current_user = auth\CurrentUser::get();
-        $session = auth\CurrentUser::session();
         $this->assertNull($current_user);
-        $this->assertNull($session);
         $this->assertApiError(
             $response,
             'app_name',
@@ -94,9 +91,7 @@ public function testCreateFailsIfEmailIsInvalid(): void
 
         $this->assertResponseCode($response, 400);
         $current_user = auth\CurrentUser::get();
-        $session = auth\CurrentUser::session();
         $this->assertNull($current_user);
-        $this->assertNull($session);
         $this->assertApiError(
             $response,
             '@base',
@@ -125,9 +120,7 @@ public function testCreateFailsIfPasswordIsInvalid(): void
 
         $this->assertResponseCode($response, 400);
         $current_user = auth\CurrentUser::get();
-        $session = auth\CurrentUser::session();
         $this->assertNull($current_user);
-        $this->assertNull($session);
         $this->assertApiError(
             $response,
             '@base',
@@ -140,8 +133,6 @@ public function testDeleteInvalidatesCurrentSession(): void
         $user = $this->login();
         $session = auth\CurrentUser::session();
 
-        $this->assertNotNull($session);
-
         $response = $this->apiRun('DELETE', '/api/v1/session');
 
         $this->assertResponseCode($response, 200);

tests/controllers/my/SecurityTest.php

@@ -156,7 +156,6 @@ public function testUpdateDeletesExistingSessionsExceptCurrentOne(): void
             'user_id' => $user->id,
         ]);
 
-        $this->assertNotNull($current_session);
         $this->assertSame(2, models\Session::count());
 
         $response = $this->appRun('POST', '/my/security', [
@@ -421,7 +420,6 @@ public function testConfirmSetsConfirmedPasswordAtAndRedirects(): void
 
         $this->assertResponseCode($response, 302, '/my/security');
         $session = auth\CurrentUser::session();
-        $this->assertNotNull($session);
         $now = \Minz\Time::now();
         $this->assertEquals($now, $session->confirmed_password_at);
     }
@@ -461,7 +459,6 @@ public function testConfirmFailsIfCsrfIsInvalid(): void
         $this->assertResponseContains($response, 'A security verification failed');
         $this->assertResponseTemplateName($response, 'my/security/confirmation.phtml');
         $session = auth\CurrentUser::session();
-        $this->assertNotNull($session);
         $this->assertNull($session->confirmed_password_at);
     }
 
@@ -483,7 +480,6 @@ public function testConfirmFailsIfPasswordIsInvalid(): void
         $this->assertResponseContains($response, 'The password is incorrect.');
         $this->assertResponseTemplateName($response, 'my/security/confirmation.phtml');
         $session = auth\CurrentUser::session();
-        $this->assertNotNull($session);
         $this->assertNull($session->confirmed_password_at);
     }
 }

tests/controllers/my/SessionsTest.php

@@ -89,8 +89,6 @@ public function testDeleteLogsOutIfGivenSessionIsCurrentSession(): void
         $user = $this->login(confirmed_password_at: $confirmed_at);
         $session = auth\CurrentUser::session();
 
-        $this->assertNotNull($session);
-
         $response = $this->appRun('POST', "/my/sessions/{$session->id}/deletion", [
             'csrf_token' => $this->csrfToken(forms\security\DeleteSession::class),
         ]);