Add session expiry renewal flow

2026-07-18 15:53:11 -05:00
parent 8c349314ad
commit a232e18c46
14 changed files with 575 additions and 21 deletions
@@ -1,6 +1,17 @@
 extends Node

 signal auth_changed
+signal session_warning(seconds_remaining: int)
+signal session_countdown_changed(seconds_remaining: int)
+signal session_refresh_started
+signal session_refreshed
+signal session_refresh_failed(message: String, terminal: bool)
+signal session_expired(reason: String)
+
+const EndpointConfig := preload("res://scripts/autoload/api_endpoint_config.gd")
+const DEFAULT_AUTH_BASE_URL := "https://pauth.ranaze.com/api/Auth"
+const WARNING_SECONDS := 120
+const REFRESH_TIMEOUT_SECONDS := 20.0

 var is_logged_in := false
 var username := ""
@@ -8,22 +19,208 @@ var role := ""
 var access_token := ""
 var refresh_token := ""
 var expires_at := ""
+var expiration_unix := 0.0
+var refresh_in_progress := false
+var warning_active := false
+var auth_base_url := DEFAULT_AUTH_BASE_URL
+var expiry_timer: Timer
+var refresh_request: HTTPRequest
+var session_revision := 0
+var refresh_revision := -1
+
+
+func _ready() -> void:
+	auth_base_url = EndpointConfig.resolve(
+		str(ProjectSettings.get_setting("step3/auth_api_base_url", DEFAULT_AUTH_BASE_URL)),
+		"/api/Auth")
+	expiry_timer = Timer.new()
+	expiry_timer.wait_time = 1.0
+	expiry_timer.timeout.connect(_evaluate_expiry)
+	add_child(expiry_timer)
+	refresh_request = HTTPRequest.new()
+	refresh_request.timeout = REFRESH_TIMEOUT_SECONDS
+	refresh_request.request_completed.connect(_on_refresh_completed)
+	add_child(refresh_request)

 func set_session(new_username: String, token: String, new_refresh_token: String = "", new_role: String = "", token_expiration: String = "") -> void:
+	session_revision += 1
 	is_logged_in = not token.is_empty()
 	username = new_username
 	access_token = token
 	refresh_token = new_refresh_token
 	role = new_role
 	expires_at = token_expiration
+	expiration_unix = _parse_expiration(token_expiration, token)
+	refresh_in_progress = false
+	refresh_revision = -1
+	warning_active = false
+	if is_logged_in and expiration_unix > 0.0:
+		expiry_timer.start()
+	else:
+		expiry_timer.stop()
 	auth_changed.emit()
+	if is_logged_in:
+		_evaluate_expiry.call_deferred()


 func clear_session() -> void:
+	_clear_session_fields()
+	auth_changed.emit()
+
+
+func expire_session(reason: String = "expired") -> void:
+	if not is_logged_in and access_token.is_empty():
+		return
+	_clear_session_fields()
+	auth_changed.emit()
+	session_expired.emit(reason)
+
+
+func request_session_refresh() -> void:
+	if refresh_in_progress or not is_logged_in:
+		return
+	if refresh_token.is_empty() or username.is_empty():
+		expire_session("refresh_unavailable")
+		return
+	refresh_in_progress = true
+	refresh_revision = session_revision
+	session_refresh_started.emit()
+	var headers := PackedStringArray(["Content-Type: application/json"])
+	var payload := JSON.stringify({"username": username, "refreshToken": refresh_token})
+	var error := refresh_request.request(
+		"%s/refresh" % auth_base_url.rstrip("/"),
+		headers,
+		HTTPClient.METHOD_POST,
+		payload)
+	if error != OK:
+		refresh_in_progress = false
+		refresh_revision = -1
+		session_refresh_failed.emit("Unable to contact the authentication service. Check your connection and try again.", false)
+		_evaluate_expiry()
+
+
+func can_send_authenticated_request() -> bool:
+	if not is_logged_in or access_token.is_empty():
+		return false
+	if expiration_unix <= 0.0 or Time.get_unix_time_from_system() < expiration_unix:
+		return true
+	if not refresh_in_progress:
+		expire_session("expired")
+	return false
+
+
+func handle_unauthorized(token_used: String = "") -> void:
+	if not is_logged_in:
+		return
+	if not token_used.is_empty() and token_used != access_token:
+		return
+	expire_session("unauthorized")
+
+
+func seconds_until_expiry() -> int:
+	if expiration_unix <= 0.0:
+		return 0
+	return maxi(0, int(ceil(expiration_unix - Time.get_unix_time_from_system())))
+
+
+func _evaluate_expiry() -> void:
+	if not is_logged_in or expiration_unix <= 0.0:
+		return
+	var remaining := seconds_until_expiry()
+	if remaining <= 0:
+		if refresh_in_progress:
+			if warning_active:
+				session_countdown_changed.emit(0)
+			return
+		expire_session("expired")
+		return
+	if remaining <= WARNING_SECONDS:
+		if not warning_active:
+			warning_active = true
+			session_warning.emit(remaining)
+		session_countdown_changed.emit(remaining)
+
+
+func _on_refresh_completed(result: int, response_code: int, _headers: PackedStringArray, body: PackedByteArray) -> void:
+	var completed_revision := refresh_revision
+	refresh_in_progress = false
+	refresh_revision = -1
+	if completed_revision != session_revision or not is_logged_in:
+		return
+	var succeeded := result == HTTPRequest.RESULT_SUCCESS and response_code >= 200 and response_code < 300
+	if not succeeded:
+		var terminal := response_code in [400, 401, 403] or seconds_until_expiry() <= 0
+		var message := "Unable to renew the session. Check your connection and try again."
+		if terminal:
+			message = "Your session could not be renewed. Please sign in again."
+		session_refresh_failed.emit(message, terminal)
+		if terminal:
+			expire_session("refresh_failed")
+		else:
+			_evaluate_expiry()
+		return
+	var parsed: Variant = JSON.parse_string(body.get_string_from_utf8())
+	if typeof(parsed) != TYPE_DICTIONARY:
+		session_refresh_failed.emit("The authentication service returned an invalid response.", true)
+		expire_session("refresh_failed")
+		return
+	var new_access_token := str(parsed.get("accessToken", ""))
+	var new_expiration := str(parsed.get("exp", ""))
+	var new_expiration_unix := _parse_expiration(new_expiration, new_access_token)
+	if new_access_token.is_empty() or new_expiration_unix <= Time.get_unix_time_from_system():
+		session_refresh_failed.emit("The authentication service returned an invalid session.", true)
+		expire_session("refresh_failed")
+		return
+	access_token = new_access_token
+	expires_at = new_expiration
+	expiration_unix = new_expiration_unix
+	warning_active = false
+	session_revision += 1
+	expiry_timer.start()
+	auth_changed.emit()
+	session_refreshed.emit()
+
+
+func _clear_session_fields() -> void:
+	session_revision += 1
+	if refresh_request != null and refresh_request.get_http_client_status() != HTTPClient.STATUS_DISCONNECTED:
+		refresh_request.cancel_request()
+	if expiry_timer != null:
+		expiry_timer.stop()
 	is_logged_in = false
 	username = ""
 	role = ""
 	access_token = ""
 	refresh_token = ""
 	expires_at = ""
-	auth_changed.emit()
+	expiration_unix = 0.0
+	refresh_in_progress = false
+	refresh_revision = -1
+	warning_active = false
+
+
+func _parse_expiration(value: String, token: String = "") -> float:
+	var cleaned := value.strip_edges()
+	if not cleaned.is_empty() and cleaned != "<null>":
+		if cleaned.is_valid_float():
+			var numeric := float(cleaned)
+			return numeric / 1000.0 if numeric > 100000000000.0 else numeric
+		var iso_value := cleaned.trim_suffix("Z")
+		var parsed_iso := Time.get_unix_time_from_datetime_string(iso_value)
+		if parsed_iso > 0:
+			return float(parsed_iso)
+	return _expiration_from_jwt(token)
+
+
+func _expiration_from_jwt(token: String) -> float:
+	var segments := token.split(".")
+	if segments.size() < 2:
+		return 0.0
+	var encoded := str(segments[1]).replace("-", "+").replace("_", "/")
+	while encoded.length() % 4 != 0:
+		encoded += "="
+	var payload_text := Marshalls.base64_to_raw(encoded).get_string_from_utf8()
+	var payload: Variant = JSON.parse_string(payload_text)
+	if typeof(payload) != TYPE_DICTIONARY:
+		return 0.0
+	return float(payload.get("exp", 0.0))