v0.11.0 harden persistence and prepare game replays

internal/server/storage/session.go

@@ -2,30 +2,23 @@ package storage
 
 import (
 	"fmt"
+	"log/slog"
 	"time"
 )
 
 // CreateSession creates or replaces the session for a user (single session per user)
 func (s *Store) CreateSession(record SessionRecord) error {
-	tx, err := s.db.Begin()
-	if err != nil {
-		return fmt.Errorf("failed to begin transaction: %w", err)
-	}
-	defer tx.Rollback()
-
-	// Delete any existing session for this user
-	deleteQuery := `DELETE FROM sessions WHERE user_id = ?`
-	if _, err := tx.Exec(deleteQuery, record.UserID); err != nil {
-		return fmt.Errorf("failed to delete existing session: %w", err)
-	}
-
-	// Insert new session
-	insertQuery := `INSERT INTO sessions (session_id, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)`
-	if _, err := tx.Exec(insertQuery, record.SessionID, record.UserID, record.CreatedAt, record.ExpiresAt); err != nil {
+	const query = `INSERT INTO sessions (session_id, user_id, created_at, expires_at)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT(user_id) DO UPDATE SET
+			session_id = excluded.session_id,
+			created_at = excluded.created_at,
+			expires_at = excluded.expires_at`
+	if _, err := s.db.Exec(query, record.SessionID, record.UserID, record.CreatedAt, record.ExpiresAt); err != nil {
 		return fmt.Errorf("failed to create session: %w", err)
 	}
-
-	return tx.Commit()
+	slog.Debug("storage session created", "user_id", record.UserID, "expires_at", record.ExpiresAt)
+	return nil
 }
 
 // GetSession retrieves a session by ID
@@ -60,6 +53,9 @@ func (s *Store) GetSessionByUserID(userID string) (*SessionRecord, error) {
 func (s *Store) DeleteSession(sessionID string) error {
 	query := `DELETE FROM sessions WHERE session_id = ?`
 	_, err := s.db.Exec(query, sessionID)
+	if err == nil {
+		slog.Debug("storage session deleted")
+	}
 	return err
 }
 
@@ -67,6 +63,9 @@ func (s *Store) DeleteSession(sessionID string) error {
 func (s *Store) DeleteSessionByUserID(userID string) error {
 	query := `DELETE FROM sessions WHERE user_id = ?`
 	_, err := s.db.Exec(query, userID)
+	if err == nil {
+		slog.Debug("storage user sessions deleted", "user_id", userID)
+	}
 	return err
 }
 
@@ -77,16 +76,38 @@ func (s *Store) DeleteExpiredSessions() (int64, error) {
 	if err != nil {
 		return 0, err
 	}
-	return result.RowsAffected()
+	deleted, err := result.RowsAffected()
+	if err == nil && deleted > 0 {
+		slog.Debug("storage expired sessions deleted", "count", deleted)
+	}
+	return deleted, err
 }
 
 // IsSessionValid checks if a session exists and is not expired
 func (s *Store) IsSessionValid(sessionID string) (bool, error) {
-	var count int
-	query := `SELECT COUNT(*) FROM sessions WHERE session_id = ? AND expires_at > ?`
-	err := s.db.QueryRow(query, sessionID, time.Now().UTC()).Scan(&count)
+	var valid bool
+	const query = `SELECT EXISTS(
+		SELECT 1 FROM sessions WHERE session_id = ? AND expires_at > ?
+	)`
+	err := s.db.QueryRow(query, sessionID, time.Now().UTC()).Scan(&valid)
 	if err != nil {
 		return false, err
 	}
-	return count > 0, nil
-}
+	return valid, nil
+}
+
+// IsSessionValidForUser verifies both expiry and the binding between a JWT
+// subject and its persisted session. Checking only the session ID would allow
+// a malformed server-issued token to authenticate as the wrong subject.
+func (s *Store) IsSessionValidForUser(sessionID, userID string) (bool, error) {
+	var valid bool
+	const query = `SELECT EXISTS(
+		SELECT 1 FROM sessions
+		WHERE session_id = ? AND user_id = ? AND expires_at > ?
+	)`
+	err := s.db.QueryRow(query, sessionID, userID, time.Now().UTC()).Scan(&valid)
+	if err != nil {
+		return false, err
+	}
+	return valid, nil
+}