refactor(http): improve session handling (#1293)

Author: innocenzi

packages/core/src/AppConfig.php

@@ -13,6 +13,8 @@ final class AppConfig
     public string $baseUri;
 
     public function __construct(
+        public ?string $name = null,
+
         ?Environment $environment = null,
 
         ?string $baseUri = null,
@@ -26,7 +28,6 @@ public function __construct(
         public array $insightsProviders = [],
     ) {
         $this->environment = $environment ?? Environment::fromEnv();
-
         $this->baseUri = $baseUri ?? env('BASE_URI') ?? '';
     }
 }

packages/core/src/Config/app.config.php

@@ -4,4 +4,9 @@
 
 use Tempest\Core\AppConfig;
 
-return new AppConfig();
+use function Tempest\env;
+
+return new AppConfig(
+    name: env('APPLICATION_NAME'),
+    baseUri: env('BASE_URI'),
+);

packages/http/src/Cookie/CookieManager.php

@@ -29,7 +29,12 @@ public function get(string $key): ?Cookie
 
     public function set(string $key, string $value, DateTimeInterface|int|null $expiresAt = null): Cookie
     {
-        $cookie = $this->get($key) ?? new Cookie(key: $key);
+        $cookie = $this->get($key) ?? new Cookie(
+            key: $key,
+            secure: true,
+            httpOnly: true,
+            sameSite: SameSite::LAX,
+        );
 
         $cookie->value = $value;
         $cookie->expiresAt = $expiresAt ?? $cookie->expiresAt;

packages/http/src/Cookie/SameSite.php

@@ -4,9 +4,25 @@
 
 namespace Tempest\Http\Cookie;
 
+/**
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value
+ */
 enum SameSite: string
 {
+    /**
+     * Send the cookie only for requests originating from the same site that set the cookie.
+     */
     case STRICT = 'Strict';
+
+    /**
+     * Send the cookie for requests originating from the same site that set the cookie, and for cross-site requests that meet both of the following criteria:
+     * - The request is a top-level navigation: this essentially means that the request causes the URL shown in the browser's address bar to change.
+     * - The request uses a safe method: in particular, this excludes `POST`, `PUT`, and `DELETE`.
+     */
     case LAX = 'Lax';
+
+    /**
+     * Send the cookie with both cross-site and same-site requests. The `Secure` attribute must also be set when using this value.
+     */
     case NONE = 'None';
 }

packages/http/src/Session/CleanupSessionsCommand.php

@@ -8,6 +8,7 @@
 use Tempest\Console\ConsoleCommand;
 use Tempest\Console\Schedule;
 use Tempest\Console\Scheduler\Every;
+use Tempest\EventBus\EventBus;
 
 use function Tempest\listen;
 

packages/http/src/Session/Config/FileSessionConfig.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Tempest\Http\Session\Config;
+
+use Tempest\Container\Container;
+use Tempest\DateTime\Duration;
+use Tempest\Http\Session\Managers\FileSessionManager;
+use Tempest\Http\Session\Resolvers\CookieSessionIdResolver;
+use Tempest\Http\Session\SessionConfig;
+
+final class FileSessionConfig implements SessionConfig
+{
+    public function __construct(
+        /**
+         * Path to the sessions storage directory, relative to the internal storage.
+         */
+        public string $path,
+
+        public Duration $expiration,
+
+        public string $sessionIdResolver = CookieSessionIdResolver::class,
+    ) {}
+
+    public function createManager(Container $container): FileSessionManager
+    {
+        return $container->get(FileSessionManager::class);
+    }
+}

packages/http/src/Session/Config/session.config.php

@@ -0,0 +1,9 @@
+<?php
+
+use Tempest\DateTime\Duration;
+use Tempest\Http\Session\Config\FileSessionConfig;
+
+return new FileSessionConfig(
+    path: 'sessions',
+    expiration: Duration::hours(2),
+);

packages/http/src/Session/Managers/FileSessionManager.php

@@ -62,7 +62,7 @@ public function isValid(SessionId $id): bool
         }
 
         return $this->clock->now()->before(
-            other: $session->createdAt->plusSeconds($this->sessionConfig->expirationInSeconds),
+            other: $session->createdAt->plus($this->sessionConfig->expiration),
         );
     }
 

packages/http/src/Session/Resolvers/CookieSessionIdResolver.php

@@ -6,32 +6,46 @@
 
 use Symfony\Component\Uid\Uuid;
 use Tempest\Clock\Clock;
+use Tempest\Core\AppConfig;
+use Tempest\Http\Cookie\Cookie;
 use Tempest\Http\Cookie\CookieManager;
-use Tempest\Http\Session\Session;
+use Tempest\Http\Cookie\SameSite;
 use Tempest\Http\Session\SessionConfig;
 use Tempest\Http\Session\SessionId;
 use Tempest\Http\Session\SessionIdResolver;
 
+use function Tempest\Support\str;
+
 final readonly class CookieSessionIdResolver implements SessionIdResolver
 {
     public function __construct(
+        private AppConfig $appConfig,
         private CookieManager $cookies,
         private SessionConfig $sessionConfig,
         private Clock $clock,
     ) {}
 
     public function resolve(): SessionId
     {
-        $id = $this->cookies->get(Session::ID)->value ?? null;
+        $sessionKey = str($this->appConfig->name ?? 'tempest')
+            ->snake()
+            ->append('_session_id')
+            ->toString();
+
+        $id = $this->cookies->get($sessionKey)->value ?? null;
 
         if (! $id) {
             $id = (string) Uuid::v4();
 
-            $this->cookies->set(
-                key: Session::ID,
+            $this->cookies->add(new Cookie(
+                key: $sessionKey,
                 value: $id,
-                expiresAt: $this->clock->now()->plusSeconds($this->sessionConfig->expirationInSeconds),
-            );
+                path: '/',
+                secure: true,
+                httpOnly: true,
+                expiresAt: $this->clock->now()->plus($this->sessionConfig->expiration),
+                sameSite: SameSite::LAX,
+            ));
         }
 
         return new SessionId($id);

packages/http/src/Session/Resolvers/HeaderSessionIdResolver.php

@@ -5,21 +5,27 @@
 namespace Tempest\Http\Session\Resolvers;
 
 use Symfony\Component\Uid\Uuid;
+use Tempest\Core\AppConfig;
 use Tempest\Http\Request;
-use Tempest\Http\Session\Session;
 use Tempest\Http\Session\SessionId;
 use Tempest\Http\Session\SessionIdResolver;
 
 final readonly class HeaderSessionIdResolver implements SessionIdResolver
 {
     public function __construct(
+        private AppConfig $appConfig,
         private Request $request,
     ) {}
 
     public function resolve(): SessionId
     {
-        $id = $this->request->headers[Session::ID] ?? null;
+        $sessionKey = str($this->appConfig->name ?? 'tempest')
+            ->snake()
+            ->append('_session_id')
+            ->toString();
 
-        return new SessionId($id ?? ((string) Uuid::v4()));
+        return new SessionId(
+            id: $this->request->headers[$sessionKey] ?? Uuid::v4()->toString(),
+        );
     }
 }