feuerwerk/api/lib/SessionStore.php

<?php
declare(strict_types=1);

/**
 * Logins, kept as one file per session in `data/sessions/`, named after the SHA-256 of the token
 * the browser holds in its cookie – so the file on disk cannot be replayed as a token.
 *
 * Deliberately not PHP's own session handler: those expire after `session.gc_maxlifetime`
 * (24 minutes by default), and a login here has to outlive a deployment and a night, since
 * `npm run build` replaces the editor under the very tab that is signed in.
 */
final class SessionStore
{
    /** How long a login lasts without being used; every request that finds it pushes it out again. */
    public const LIFETIME_SECONDS = 30 * 24 * 60 * 60;

    public const COOKIE = 'feuerwerk_session';

    public function __construct(private readonly string $dir) {}

    /** Starts a session for `$username` and returns the token for the cookie. */
    public function create(string $username): string
    {
        $this->sweep();
        $token = bin2hex(random_bytes(32));
        $this->write($token, ['username' => $username, 'createdAt' => time(), 'seenAt' => time()]);
        return $token;
    }

    /** The user behind a token, or null when it is unknown or has expired. */
    public function user(string $token): ?string
    {
        $path = $this->path($token);
        if ($path === null || !is_file($path)) {
            return null;
        }
        $raw = file_get_contents($path);
        $data = $raw === false ? null : json_decode($raw, true);
        if (!is_array($data) || !is_string($data['username'] ?? null) || !is_int($data['seenAt'] ?? null)) {
            return null;
        }
        if (time() - $data['seenAt'] > self::LIFETIME_SECONDS) {
            @unlink($path);
            return null;
        }
        // Touched at most once an hour: every request rewriting the file would cost a write per
        // autosave, and the lifetime is measured in weeks.
        if (time() - $data['seenAt'] > 3600) {
            $data['seenAt'] = time();
            $this->write($token, $data);
        }
        return $data['username'];
    }

    public function destroy(string $token): void
    {
        $path = $this->path($token);
        if ($path !== null) {
            @unlink($path);
        }
    }

    /**
     * Ends every login of `$username` but the one behind `$keep` – what a password change does, so
     * that a session started with the old password cannot outlive it. Returns how many were ended.
     */
    public function destroyAllFor(string $username, string $keep = ''): int
    {
        $keepPath = $keep === '' ? null : $this->path($keep);
        $ended = 0;
        foreach (glob($this->dir . '/*.json') ?: [] as $file) {
            if ($file === $keepPath) {
                continue;
            }
            $raw = file_get_contents($file);
            $data = $raw === false ? null : json_decode($raw, true);
            if (is_array($data) && strcasecmp((string) ($data['username'] ?? ''), $username) === 0) {
                @unlink($file);
                $ended++;
            }
        }
        return $ended;
    }

    /** Throws out what has timed out, so the directory does not grow with every login. */
    private function sweep(): void
    {
        foreach (glob($this->dir . '/*.json') ?: [] as $file) {
            if (time() - (int) @filemtime($file) > self::LIFETIME_SECONDS) {
                @unlink($file);
            }
        }
    }

    private function path(string $token): ?string
    {
        if (!preg_match('/^[a-f0-9]{64}$/', $token)) {
            return null;
        }
        return $this->dir . '/' . hash('sha256', $token) . '.json';
    }

    private function write(string $token, array $data): void
    {
        if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
            throw new RuntimeException("Cannot create session directory {$this->dir}");
        }
        $path = $this->path($token);
        if ($path === null) {
            throw new RuntimeException('Invalid session token');
        }
        $json = json_encode($data, JSON_UNESCAPED_SLASHES);
        if ($json === false) {
            throw new RuntimeException('Cannot encode session');
        }
        // Replaced rather than rewritten in place: a request reading it meanwhile would find it
        // empty, and an empty session is a signed-out one.
        AtomicFile::write($path, $json, AtomicFile::HIDDEN, 'session file');
    }
}