Storing session id in cookies, and db

modules/api/auth.middleware.js

@@ -1,48 +1,55 @@
 const logger = require('../../utils/logger.js')
 const dbtools = require('../../utils/dbtools.js')
 
-const usersDBName = 'users'
-
 const exceptions = [
   'favicon',
   '/login'
 ]
 
-// TODO: session
+// TODO: session table, dont store pw in cookie
 
 module.exports = function (options) {
   const { authDB } = options
 
   return function (req, res, next) {
-    logger.DebugLog(`AUTH: ${req.url}`, 'auth', 1)
     const isException = exceptions.some((exc) => {
       return req.url === exc
     })
 
     if (isException) {
+      logger.DebugLog(`EXCEPTION: ${req.url}`, 'auth', 1)
       next()
       return
     }
 
-    const user = GetUserByPW(authDB, req.cookies.pw)
+    const user = req.session.user || GetUserBySessionID(authDB, req.cookies.sessionID, req)
 
     if (user) {
+      logger.DebugLog(`ID #${user.id}: ${req.url}`, 'auth', 1)
       next()
     } else {
+      logger.DebugLog(`No user:${req.url}`, 'auth', 1)
       res.render('login')
     }
   }
 }
 
-function GetUserByPW (db, password) {
-  if (password === undefined) {
+function GetUserBySessionID (db, sessionID, req) {
+  logger.DebugLog(`Getting user from db`, 'auth', 2)
+  if (sessionID === undefined) {
     return
   }
 
-  const res = dbtools.Select(db, usersDBName, {
-    pw: password
-  })
-  if (res) {
-    return res[0]
+  const session = dbtools.Select(db, 'sessions', {
+    id: sessionID
+  })[0]
+
+  const user = dbtools.Select(db, 'users', {
+    id: session.userID
+  })[0]
+
+  if (user) {
+    req.session.user = user
+    return user
   }
 }