fix: add TTL to sessions

examples/basic-auth-hook.js

@@ -21,12 +21,6 @@ function basicAuthentication(app) {
             .set({ 'WWW-Authenticate': 'Basic realm="example"' })
             .end('access denied');
     });
-
-    app.use((req, res, next) => {
-        // Updates active sessions every hour
-        req.session.nowInHours = Math.floor(Date.now() / 3600e3);
-        next();
-    });
 }
 
 module.exports = basicAuthentication;

lib/middleware/no-authentication.js

@@ -4,7 +4,7 @@ const User = require('../user');
 
 function noneAuthentication(basePath = '', app) {
     app.use(`${basePath}/api/admin/`, (req, res, next) => {
-        req.user = new User({ email: 'none@unknown.com' });
+        req.user = new User({ username: 'unknown' });
         next();
     });
 }

lib/middleware/no-authentication.test.js

@@ -24,6 +24,6 @@ test('should add dummy user object to all requests', t => {
         .get('/api/admin/test')
         .expect(200)
         .expect(res => {
-            t.true(res.body.email === 'none@unknown.com');
+            t.true(res.body.username === 'unknown');
         });
 });

lib/middleware/session.js

@@ -3,11 +3,21 @@
 const cookieSession = require('cookie-session');
 
 module.exports = function(config) {
-    return cookieSession({
+    const sessionMiddleware = cookieSession({
         name: 'unleash-session',
         keys: [config.secret],
         maxAge: config.sessionAge,
         secureProxy: !!config.secureHeaders,
         path: config.baseUriPath === '' ? '/' : config.baseUriPath,
     });
+
+    const extendTTL = (req, res, next) => {
+        // Updates active sessions every hour
+        req.session.nowInHours = Math.floor(Date.now() / 3600e3);
+        next();
+    };
+
+    return (req, res, next) => {
+        sessionMiddleware(req, res, () => extendTTL(req, res, next));
+    };
 };

lib/middleware/simple-authentication.js

@@ -35,12 +35,6 @@ function unsecureAuthentication(basePath = '', app) {
             )
             .end();
     });
-
-    app.use((req, res, next) => {
-        // Updates active sessions every hour
-        req.session.nowInHours = Math.floor(Date.now() / 3600e3);
-        next();
-    });
 }
 
 module.exports = unsecureAuthentication;

test/e2e/api/admin/feature.e2e.test.js

@@ -96,7 +96,7 @@ test.serial('creates new feature toggle with createdBy unknown', async t => {
         strategies: [{ name: 'default' }],
     });
     await request.get('/api/admin/events').expect(res => {
-        t.true(res.body.events[0].createdBy === 'none@unknown.com');
+        t.is(res.body.events[0].createdBy, 'unknown');
     });
 });