net/http/session

import net.http
import net.http.session
import net.router

func login(ctx: i64):
    if http.Form(ctx, "user") != "sara" or http.Form(ctx, "password") != "open sesame":
        http.SetStatus(ctx, 401)
        http.Text(ctx, "wrong user or password")
        ret
    end
    mut s := session.Start(ctx)
    session.Regenerate(ctx, s)
    session.SetValue(s, "user", "sara")
    session.Save(s)
    http.Redirect(ctx, "/me")
end

func me(ctx: i64):
    s := session.Start(ctx)
    if not session.HasValue(s, "user"):
        http.SetStatus(ctx, 401)
        http.Text(ctx, "please log in")
        ret
    end
    http.Text(ctx, "hello " + session.Value(s, "user"))
end

func logout(ctx: i64):
    session.End(ctx)
    http.Text(ctx, "logged out")
end

func main:
    mut r := router.NewRouter()
    router.Post(r, "/login", login)
    router.Get(r, "/me", me)
    router.Post(r, "/logout", logout)
    mut srv := http.NewServer(19770)
    http.Use(srv, r)
    _ := http.RunBackground(srv)
    base := "http://127.0.0.1:19770"
    mut browser := http.NewClient()
    browser.SetHeader("Content-Type", "application/x-www-form-urlencoded")
    println http.Body(browser.Get(base + "/me"))
    bad := browser.Post(base + "/login", "user=sara&password=guess")
    println http.Status(bad), http.Body(bad)
    ok := browser.Post(base + "/login", "user=sara&password=open+sesame")
    println http.Status(ok), http.GetHeader(ok, "location")
    println http.Body(browser.Get(base + "/me"))
    println http.Body(browser.Post(base + "/logout", ""))
    println http.Body(browser.Get(base + "/me"))
end

import net.http
import net.http.session
import net.router

func form(ctx: i64):
    mut s := session.Start(ctx)
    token := session.CSRFToken(s)
    session.Save(s)
    http.Html(ctx, `<form method="post" action="/email"><input type="hidden" name="csrf" value="` + token + `"><input name="email"></form>`)
end

func change_email(ctx: i64):
    s := session.Start(ctx)
    if not session.CSRFVerify(s, http.Form(ctx, "csrf")):
        http.SetStatus(ctx, 403)
        http.Text(ctx, "the form has expired, reload the page")
        ret
    end
    http.Text(ctx, "email changed to " + http.Form(ctx, "email"))
end

func token_in(html: str): str:
    start := html.find(`value="`) + 7
    rest := html.substr(start, html.len() - start)
    ret rest.substr(0, rest.find(`"`))
end

func main:
    mut r := router.NewRouter()
    router.Get(r, "/email", form)
    router.Post(r, "/email", change_email)
    mut srv := http.NewServer(19771)
    http.Use(srv, r)
    _ := http.RunBackground(srv)
    url := "http://127.0.0.1:19771/email"
    mut browser := http.NewClient()
    browser.SetHeader("Content-Type", "application/x-www-form-urlencoded")
    token := token_in(http.Body(browser.Get(url)))
    println "token length:", token.len()
    forged := browser.Post(url, "email=evil%40example.com")
    println http.Status(forged), http.Body(forged)
    real := browser.Post(url, "csrf=" + token + "&email=sara%40example.com")
    println http.Status(real), http.Body(real)
end

import net.http
import net.http.session
import net.router
import conv
import str

func add(ctx: i64):
    item := str.Clone(http.Param(ctx, "item"))
    mut s := session.Start(ctx)
    mut count := 0
    if session.HasValue(s, item):
        count = conv.Atoi(session.Value(s, item))
    end
    session.SetValue(s, item, "" + (count + 1))
    session.Save(s)
    http.Text(ctx, "added " + item)
end

func cart(ctx: i64):
    s := session.Start(ctx)
    mut text := ""
    each item in ["tea", "bread", "cheese"]:
        if session.HasValue(s, item):
            text = text + (text == "" ? "" : ", ") + item + " x" + session.Value(s, item)
        end
    end
    http.Text(ctx, text == "" ? "the cart is empty" : text)
end

func empty(ctx: i64):
    mut s := session.Start(ctx)
    session.ClearValues(s)
    session.Save(s)
    http.Text(ctx, "emptied")
end

func main:
    mut r := router.NewRouter()
    router.Post(r, "/cart/:item", add)
    router.Get(r, "/cart", cart)
    router.Delete(r, "/cart", empty)
    mut srv := http.NewServer(19772)
    http.Use(srv, r)
    _ := http.RunBackground(srv)
    base := "http://127.0.0.1:19772/cart"
    mut sara := http.NewClient()
    mut reza := http.NewClient()
    _ := sara.Post(base + "/tea", "")
    _ := sara.Post(base + "/tea", "")
    _ := sara.Post(base + "/bread", "")
    _ := reza.Post(base + "/cheese", "")
    println "sara:", http.Body(sara.Get(base))
    println "reza:", http.Body(reza.Get(base))
    println http.Body(sara.Delete(base))
    println "sara:", http.Body(sara.Get(base))
    println "reza:", http.Body(reza.Get(base))
end

import net.http
import net.http.session
import net.router
import str

func hello(ctx: i64):
    s := session.Start(ctx)
    http.Text(ctx, "session " + (s.id.len() > 0))
end

func main:
    session.Configure("shop_sid", 1800, true, "Strict")
    mut r := router.NewRouter()
    router.Get(r, "/", hello)
    mut srv := http.NewServer(19773)
    http.Use(srv, r)
    _ := http.RunBackground(srv)
    res := http.Get("http://127.0.0.1:19773/")
    println http.Body(res)
    line := http.SetCookieLines(res).get(0)
    each part in str.Split(line, "; "):
        if part.starts_with("shop_sid="):
            println "shop_sid=<random id>"
        else not part.starts_with("Expires="):
            println part
        end
    end
    mut s := session.New()
    session.SetValue(s, "theme", "dark")
    session.Save(s)
    println "kept for", s.max_age, "seconds"
    println "removed now:", session.CleanupExpired()
    session.Destroy(s.id)
    mut found := true
    _ := session.Get(s.id, found)
    println "after Destroy:", found
end