- Fixed simultaneous logins of same user on different devices.

will invalidate older ones.

- Fixed simultaneous logins of same user on different devices.
will invalidate older ones.
Miguel Barão
1 parent 9f52cf60
Showing 4 changed files with 27 additions and 21 deletions Show diff stats
BUGS.md
learnapp.py
serve.py
templates/topic.html
 # BUGS
-- esta a permitir 2 logins em simultaneo do mesmo user. fica tudo baralhado...
 - shift-enter não está a funcionar
 - falha intermitent no file handler quando o browser envia 2 GET requests ao mesmo tempo (porquê?)
 - nos topicos learn.yaml, qd falha acrescenta no fim. nao faz sentido.
@@ -34,6 +33,7 @@
 # FIXED
+- esta a permitir 2 logins em simultaneo do mesmo user. fica tudo baralhado se mxerem em simultaneo...
 - errar no ultimo topico nao mostra solucao?
 - quando a pergunta devolve comments, este é apresentado, mas fica persistente nas tentativas seguintes. devia ser limpo apos a segunda submissao.
 - na definicao dos topicos, indicar:
@@ -73,22 +73,22 @@ class LearnApp(object):
     # login
     # ------------------------------------------------------------------------
     async def login(self, uid, try_pw):
-        if uid.startswith('l'):  # remove prefix 'l'
-            uid = uid[1:]
-
         with self.db_session() as s:
             try:
                 name, password = s.query(Student.name, Student.password).filter_by(id=uid).one()
             except:
-                logger.info(f'User "{uid}" does not exist!')
+                logger.info(f'User "{uid}" does not exist')
                 return False
         pw_ok = await check_password(try_pw, password)  # async bcrypt
+        
         if pw_ok:
             if uid in self.online:
-                logger.warning(f'User "{uid}" already logged in, overwriting state')
+                logger.warning(f'User "{uid}" already logged in, overwriting')
+                counter = self.online[uid]['counter']
             else:
-                logger.info(f'User "{uid}" logged in successfully')
+                logger.info(f'User "{uid}" logged in')
+                counter = 0
             with self.db_session() as s:
                 tt = s.query(StudentTopic).filter_by(student_id=uid)
@@ -102,10 +102,11 @@ class LearnApp(object):
                 'number': uid,
                 'name': name,
                 'state': StudentKnowledge(deps=self.deps, factory=self.factory, state=state),
+                'counter': counter + 1,  # counts simultaneous logins
                 }
         else:
-            logger.info(f'User "{uid}" wrong password!')
+            logger.info(f'User "{uid}" wrong password')
         return pw_ok
@@ -313,6 +314,10 @@ class LearnApp(object):
     # ========================================================================
     # ------------------------------------------------------------------------
+    def get_login_counter(self, uid):
+        return self.online[uid]['counter']
+
+    # ------------------------------------------------------------------------
     def get_student_name(self, uid):
         return self.online[uid].get('name', '')
@@ -75,13 +75,12 @@ class BaseHandler(tornado.web.RequestHandler):
         return self.application.learn
     def get_current_user(self):
-        cookie = self.get_secure_cookie("user")
+        cookie = self.get_secure_cookie('user')
         if cookie:
-            user = cookie.decode('utf-8')
-            return user
-            # FIXME if the cookie exists but user is not in learn.online, this will force new login and store new (duplicate?) cookie. is this correct??
-            # if user in self.learn.online:
-            #     return user
+            counter = self.get_secure_cookie('counter')
+            uid = cookie.decode('utf-8')
+            if counter.decode('utf-8') == str(self.learn.get_login_counter(uid)):
+                return uid
 # ----------------------------------------------------------------------------
 # /auth/login  and  /auth/logout
@@ -97,10 +96,11 @@ class LoginHandler(BaseHandler):
         login_ok = await self.learn.login(uid, pw)
         if login_ok:
-            self.set_secure_cookie("user", str(uid), expires_days=30)
-            self.redirect(self.get_argument("next", "/"))
+            self.set_secure_cookie('user', uid)  # expires_days=30
+            self.set_secure_cookie('counter', str(self.learn.get_login_counter(uid)))
+            self.redirect('/')
         else:
-            self.render("login.html", error='Número ou senha incorrectos')
+            self.render('login.html', error='Número ou senha incorrectos')
 # ----------------------------------------------------------------------------
@@ -108,7 +108,8 @@ class LogoutHandler(BaseHandler):
     @tornado.web.authenticated
     def get(self):
         self.clear_cookie('user')
-        self.redirect(self.get_argument('next', '/'))
+        self.clear_cookie('counter')
+        self.redirect('/')
     def on_finish(self):
         self.learn.logout(self.current_user)
@@ -309,7 +310,7 @@ class QuestionHandler(BaseHandler):
                 }
         else:
-            logger.error(f'Unknown action: {action}')
+            logging.error(f'Unknown action: {action}')
         self.write(response)
@@ -78,7 +78,7 @@
 	<!-- <div class="container"> -->
 	<div class="row">
-	<div class="col col-9">
+	<div class="col col-lg-9">
 			<div class="my-5" id="content">
 				<form action="/question" method="post" id="question_form" autocomplete="off">
 					{% module xsrf_form_html() %}
@@ -91,7 +91,7 @@
 			</div>
 	</div> <!-- col -->
-	<div class="col col-3">
+	<div class="col col-lg-3">
 		<button class="btn btn-primary btn-lg btn-block my-5" id="submit" data-toggle="tooltip" data-placement="right" title="Shift-Enter">Responder</button>
 		<div id="right" style="display: none">
	@@ -78,7 +78,7 @@		@@ -78,7 +78,7 @@
78		78
79	<!-- <div class="container"> -->	79	<!-- <div class="container"> -->
80	<div class="row">	80	<div class="row">
81	- <div class="col col-9">	81	+ <div class="col col-lg-9">
82	<div class="my-5" id="content">	82	<div class="my-5" id="content">
83	<form action="/question" method="post" id="question_form" autocomplete="off">	83	<form action="/question" method="post" id="question_form" autocomplete="off">
84	{% module xsrf_form_html() %}	84	{% module xsrf_form_html() %}
	@@ -91,7 +91,7 @@		@@ -91,7 +91,7 @@
91	</div>	91	</div>
92		92
93	</div> <!-- col -->	93	</div> <!-- col -->
94	- <div class="col col-3">	94	+ <div class="col col-lg-3">
95	<button class="btn btn-primary btn-lg btn-block my-5" id="submit" data-toggle="tooltip" data-placement="right" title="Shift-Enter">Responder</button>	95	<button class="btn btn-primary btn-lg btn-block my-5" id="submit" data-toggle="tooltip" data-placement="right" title="Shift-Enter">Responder</button>
96		96
97	<div id="right" style="display: none">	97	<div id="right" style="display: none">