Move SQL queries out of API authentication middleware by oliver3 · Pull Request #2857 · kiesraad/abacus

oliver3 · 2026-02-05T10:47:22Z

Extract a session_repo from the authentication middleware, in six acts:

Move the whole session module to the repository, because it contains mostly database queries
Remove use of axum and cookie from the repo, by moving the extractor and the get_cookie() method back to the middleware
Replace the api AuthenticationError with sqlx::Error in the repo (and split create and save, actually for the next step)
Rename Session::new() to Session::create() and use that in combination with session_repo::save() instead of the session_repo::create(), to be able to split the responsibility of calculating session lifetime and saving to the database
Move the Session::create() and its helpers to the middleware, remove lifetime calculation from extend_session()
Remove use of RequestSessionData (with cookie and ip address) from the repo by replacing it with SessionIdentifier containing strings

This results in a session_repo that contains all the database queries for the session, but without any knowledge of axum, cookies, or lifetime calculations.

…ry and include util file

…tion

…ert fields to String

github-actions · 2026-02-05T10:49:53Z

Sigrid maintainability feedback

⚠️ Your code did not improve towards your objective of 3.5 stars.

Show details

Sigrid compared your code against the baseline of 2026-02-05.

👍 What went well?

You fixed or improved 9 refactoring candidates.

Risk	System property	Location
🔴	Duplication (Fixed)	backend/src/api/authentication.rs line 331-343 backend/src/api/user.rs line 120-131
🔴	Duplication (Fixed)	backend/src/api/middleware/authentication/session.rs line 120-127 backend/src/api/middleware/authentication/session.rs line 268-275
🔴	Duplication (Fixed)	backend/src/api/user.rs line 189-201 backend/src/api/user.rs line 249-261
🔴	Duplication (Fixed)	backend/src/api/middleware/authentication/session.rs line 33-41 backend/src/api/middleware/authentication/role.rs line 185-193
🔴	Duplication (Fixed)	backend/src/api/middleware/authentication/session.rs line 121-126 backend/src/api/middleware/authentication/session.rs line 154-159 backend/src/api/middleware/authentication/session.rs line 187-192
🔴	Duplication (Fixed)	backend/src/api/user.rs line 232-240 backend/src/api/user.rs line 171-179 backend/src/api/user.rs line 135-143
🔴	Duplication (Fixed)	backend/src/api/middleware/authentication/session.rs line 150-161 backend/src/api/middleware/authentication/session.rs line 183-194
🟡	Unit Size (Improved)	backend/src/api/middleware/authentication/middleware.rs inject_user(State<SqlitePool>,Request<Body>)
⚫️		+ 1 more

👎 What could be better?

Unfortunately, 20 refactoring candidates were introduced or got worse.

Risk	System property	Location
🔴	Duplication (Introduced)	backend/src/repository/session_repo.rs line 105-119 backend/src/repository/session_repo.rs line 139-152
🔴	Duplication (Introduced)	backend/src/repository/session_repo.rs line 73-80 backend/src/repository/session_repo.rs line 226-233
🔴	Duplication (Introduced)	backend/src/api/user.rs line 192-204 backend/src/api/user.rs line 252-264
🔴	Duplication (Introduced)	backend/src/api/user.rs line 123-134 backend/src/api/authentication.rs line 336-348
🔴	Duplication (Introduced)	backend/src/api/user.rs line 235-243 backend/src/api/user.rs line 174-182 backend/src/api/user.rs line 138-146
🔴	Duplication (Introduced)	backend/src/api/middleware/authentication/role.rs line 185-193 backend/src/api/middleware/authentication/session.rs line 14-22
🔴	Duplication (Introduced)	backend/src/repository/session_repo.rs line 74-79 backend/src/repository/session_repo.rs line 112-117 backend/src/repository/session_repo.rs line 145-150
🔴	Duplication (Introduced)	backend/src/repository/session_repo.rs line 13-18 backend/src/repository/session_repo.rs line 23-28
⚫️		+ 12 more

📚 Remaining technical debt

9 refactoring candidates didn't get better or worse, but are still present in the code you touched.

View this system in Sigrid to explore your technical debt

⭐️ Sigrid ratings

System property	System on 2026-02-05	Before changes	New/changed code
Volume	3.4	N/A	N/A
Duplication	3.7	3.1	3.0
Unit Size	2.2	3.7	2.8
Unit Complexity	3.2	4.4	4.4
Unit Interfacing	3.0	0.9	1.1
Module Coupling	3.4	5.5	2.5
Component Independence	2.0	N/A	N/A
Component Entanglement	2.4	N/A	N/A
Maintainability	2.9	4.0	3.0

💬 Did you find this feedback helpful?

We would like to know your thoughts to make Sigrid better.
Your username will remain confidential throughout the process.

✅ Yes, these findings are useful
🔸 The findings are false positives
🔹 These findings are not important to me

View this system in Sigrid

codecov · 2026-02-05T10:56:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.38%. Comparing base (b6ba7d8) to head (b3f0bf2).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2857      +/-   ##
==========================================
+ Coverage   91.32%   91.38%   +0.05%     
==========================================
  Files         378      379       +1     
  Lines       17541    17646     +105     
  Branches     1987     1987              
==========================================
+ Hits        16020    16125     +105     
+ Misses       1424     1423       -1     
- Partials       97       98       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Lionqueen94 · 2026-02-05T12:47:35Z

The session repo needs to be added to sigrid

backend/src/api/middleware/authentication/session.rs

backend/src/repository/session_repo.rs

oliver3 · 2026-02-05T13:06:40Z

The session repo needs to be added to sigrid

Thanks 😅 added in d343135

backend/src/api/middleware/authentication/util.rs

github-actions · 2026-02-05T14:04:50Z

PDF Diff Summary

Comparing against base branch: main

File	Status
model-n-10-2.pdf	✅ No changes
model-na-14-2-bijlage1.pdf	✅ No changes
model-na-14-2.pdf	✅ No changes
model-na-31-2-bijlage1.pdf	✅ No changes
model-na-31-2-inlegvel.pdf	✅ No changes
model-na-31-2.pdf	✅ No changes
model-p-2a.pdf	✅ No changes

Lionqueen94

Looks good to me 👍

oliver3 added 6 commits February 4, 2026 17:18

Move authentication session module as session_repo module to reposito…

9c4e775

…ry and include util file

Move session extractor and get_cookie() back to middleware

7c79d66

Remove api AuthenticationError from session_repo, split-off save func…

ecfe834

…tion

Separate session create and save

fedb66f

Move session create and SESSION_LIFE_TIME to middleware

1e40798

Move RequestSessionData as SessionIdentifier to session_repo and conv…

18ee3e6

…ert fields to String

oliver3 requested review from Lionqueen94, praseodym and stacktraceghost February 5, 2026 10:47

oliver3 self-assigned this Feb 5, 2026

oliver3 requested a review from a team as a code owner February 5, 2026 10:47

oliver3 added the backend Issues or pull requests that relate to the backend label Feb 5, 2026

oliver3 deployed to test February 5, 2026 10:55 — with GitHub Actions View deployment

praseodym reviewed Feb 5, 2026

View reviewed changes

backend/src/api/middleware/authentication/session.rs Outdated Show resolved Hide resolved

praseodym reviewed Feb 5, 2026

View reviewed changes

backend/src/repository/session_repo.rs Outdated Show resolved Hide resolved

Add session_repo to Sigrid components

d343135

oliver3 deployed to test February 5, 2026 13:10 — with GitHub Actions View deployment

Revert unnecessary cookie clone

06bf1bc

praseodym reviewed Feb 5, 2026

View reviewed changes

backend/src/api/middleware/authentication/util.rs Outdated Show resolved Hide resolved

oliver3 added 2 commits February 5, 2026 15:01

Use pub(crate) when possible

8b59322

Remove empty util file

b3f0bf2

oliver3 deployed to test February 5, 2026 14:10 — with GitHub Actions View deployment

oliver3 requested a review from praseodym February 5, 2026 14:34

oliver3 added this to Abacus Development Feb 5, 2026

github-project-automation bot moved this to Options in Abacus Development Feb 5, 2026

oliver3 moved this from Options to In Progress in Abacus Development Feb 5, 2026

Lionqueen94 approved these changes Feb 5, 2026

View reviewed changes

stacktraceghost approved these changes Feb 5, 2026

View reviewed changes

praseodym added this pull request to the merge queue Feb 5, 2026

Merged via the queue into main with commit 1e34853 Feb 5, 2026
19 of 20 checks passed

praseodym deleted the session-repo branch February 5, 2026 21:22

github-project-automation bot moved this from In Progress to Done in Abacus Development Feb 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Move SQL queries out of API authentication middleware#2857

Move SQL queries out of API authentication middleware#2857
praseodym merged 10 commits intomainfrom
session-repo

oliver3 commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026 •

edited

Loading

👍 What went well?

👎 What could be better?

📚 Remaining technical debt

⭐️ Sigrid ratings

💬 Did you find this feedback helpful?

Uh oh!

codecov bot commented Feb 5, 2026 •

edited

Loading

Uh oh!

Lionqueen94 commented Feb 5, 2026

Uh oh!

Uh oh!

Uh oh!

oliver3 commented Feb 5, 2026

Uh oh!

Uh oh!

github-actions bot commented Feb 5, 2026

Uh oh!

Lionqueen94 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

oliver3 commented Feb 5, 2026

Uh oh!

github-actions bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sigrid maintainability feedback

👍 What went well?

👎 What could be better?

📚 Remaining technical debt

⭐️ Sigrid ratings

💬 Did you find this feedback helpful?

Uh oh!

codecov bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Lionqueen94 commented Feb 5, 2026

Uh oh!

Uh oh!

Uh oh!

oliver3 commented Feb 5, 2026

Uh oh!

Uh oh!

github-actions bot commented Feb 5, 2026

PDF Diff Summary

Uh oh!

Lionqueen94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Feb 5, 2026 •

edited

Loading

codecov bot commented Feb 5, 2026 •

edited

Loading