Merged
Conversation
…ssions The HMAC cookie signing required COOKIE_SECRET env var which wasn't set, breaking all login attempts. Replaced with server-side operator_sessions table (following adminSessions pattern) that also enables session transfer: when an operator logs in from a new machine, old sessions are deleted, automatically logging out the previous machine. https://claude.ai/code/session_01Rf47gNAgM7jDstC4bvffzw
Contributor
|
Caution Review failedThe pull request is closed. 📝 WalkthroughWalkthroughReplaces HMAC-based cookie signing with a token-backed operator session system. Introduces an Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Server as Server (start/+server.ts)
participant Auth as Auth Module
participant DB as operator_sessions Table
Client->>Server: POST /api/shifts/start
Server->>Auth: createOperatorSession(operatorId)
Auth->>DB: INSERT token with operatorId
DB-->>Auth: Return session token
Auth-->>Server: Session token
Server->>Client: Set operatorSession cookie with token
Client->>Server: Subsequent request with operatorSession cookie
Server->>Auth: getVerifiedOperatorId(cookies)
Auth->>DB: SELECT operatorId WHERE token = cookie
DB-->>Auth: operatorId or null
Auth-->>Server: Verified operatorId or null
alt Session valid
Server->>Server: Process request
else Session invalid
Server->>Client: Delete operatorSession cookie
end
sequenceDiagram
participant Client
participant Server as Server (logout endpoint)
participant Auth as Auth Module
participant DB as operator_sessions Table
Client->>Server: POST /api/shifts/logout
Server->>Auth: getVerifiedOperatorId(cookies)
Auth->>DB: SELECT operatorId WHERE token = cookie
DB-->>Auth: operatorId or null
alt operatorId exists
Auth-->>Server: Return operatorId
Server->>Auth: deleteOperatorSessions(operatorId)
Auth->>DB: DELETE all sessions WHERE operatorId
DB-->>Auth: Sessions deleted
else operatorId null
Auth-->>Server: Return null
end
Server->>Client: Delete operatorSession cookie
Server->>Client: Return success
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly Related PRs
Poem
✨ Finishing touches
🧪 Generate unit tests (beta)
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit