From 4bca09435335528bbce1e8f4579fbaa9d6150ed1 Mon Sep 17 00:00:00 2001
From: Vitaly Takmazov
Date: Sun, 21 Jan 2024 16:06:54 +0300
Subject: Delete login hash on logout

---
 src/main/java/com/juick/config/SecurityConfig.java   | 14 ++++++++++++--
 src/main/java/com/juick/service/UserService.java     |  2 ++
 src/main/java/com/juick/service/UserServiceImpl.java |  6 ++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

(limited to 'src/main/java')

diff --git a/src/main/java/com/juick/config/SecurityConfig.java b/src/main/java/com/juick/config/SecurityConfig.java
index c557ab4e..030cdcc2 100644
--- a/src/main/java/com/juick/config/SecurityConfig.java
+++ b/src/main/java/com/juick/config/SecurityConfig.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2023, Juick
+ * Copyright (C) 2008-2024, Juick
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -19,7 +19,6 @@ package com.juick.config;
 
 import com.juick.ActivityPubManager;
 import com.juick.KeystoreManager;
-import com.juick.service.ActivityPubService;
 import com.juick.service.UserService;
 import com.juick.service.security.HTTPSignatureAuthenticationFilter;
 import com.juick.service.security.HashParamAuthenticationFilter;
@@ -42,6 +41,7 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.jwt.JwtDecoder;
 import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
@@ -268,6 +268,16 @@ public class SecurityConfig {
                         .invalidateHttpSession(true)
                         .clearAuthentication(true)
                         .logoutSuccessUrl("/login")
+                        .addLogoutHandler((request, response, authentication) -> {
+                            var auth = SecurityContextHolder.getContext().getAuthentication();
+                            if (auth != null) {
+                                var principal = auth.getPrincipal();
+                                if (principal instanceof JuickUser) {
+                                    var user = ((JuickUser) principal).getUser();
+                                    userService.logout(user.getUid());
+                                }
+                            }
+                        })
                         .deleteCookies("hash", COOKIE_NAME))
                 .formLogin(form -> form.loginPage("/login")
                         .usernameParameter("username")
diff --git a/src/main/java/com/juick/service/UserService.java b/src/main/java/com/juick/service/UserService.java
index 9313bba9..6f7cb58f 100644
--- a/src/main/java/com/juick/service/UserService.java
+++ b/src/main/java/com/juick/service/UserService.java
@@ -122,6 +122,8 @@ public interface UserService {
 
     List<String> getEmails(User user);
 
+    void logout(int uid);
+
     boolean deleteJID(int uid, String jid);
 
     boolean unauthJID(int uid, String jid);
diff --git a/src/main/java/com/juick/service/UserServiceImpl.java b/src/main/java/com/juick/service/UserServiceImpl.java
index 2f03c5bf..812a4e8b 100644
--- a/src/main/java/com/juick/service/UserServiceImpl.java
+++ b/src/main/java/com/juick/service/UserServiceImpl.java
@@ -594,6 +594,12 @@ public class UserServiceImpl extends BaseJdbcService implements UserService {
         return getJdbcTemplate().queryForList("SELECT email FROM emails WHERE user_id=?", String.class, user.getUid());
     }
 
+    @Transactional
+    @Override
+    public void logout(int uid) {
+        getJdbcTemplate().update("DELETE FROM logins WHERE user_id=?", uid);
+    }
+
     @Transactional
     @Override
     public boolean deleteJID(int uid, String jid) {
-- 
cgit v1.2.3