mirror of
https://github.com/TryGhost/Ghost.git
synced 2024-12-21 18:01:36 +03:00
62ee693310
refs https://github.com/TryGhost/Team/issues/756 When running the tests it was possible for this middleware to be instantiated before the settings cache, resulting in an undefined 'session_secret' setting being passed. This would cause tests to fail. Tracking this down proved difficult, so the fix was made here, by instantiating the express-session middleware only once a request needs to use it, we can be confident that Ghost has completely started.
50 lines
1.6 KiB
JavaScript
50 lines
1.6 KiB
JavaScript
const util = require('util');
|
|
const session = require('express-session');
|
|
const constants = require('@tryghost/constants');
|
|
const config = require('../../../../shared/config');
|
|
const settingsCache = require('../../../../shared/settings-cache');
|
|
const models = require('../../../models');
|
|
const urlUtils = require('../../../../shared/url-utils');
|
|
|
|
const SessionStore = require('./store');
|
|
const sessionStore = new SessionStore(models.Session);
|
|
|
|
let unoExpressSessionMiddleware;
|
|
|
|
function getExpressSessionMiddleware() {
|
|
if (!unoExpressSessionMiddleware) {
|
|
unoExpressSessionMiddleware = session({
|
|
store: sessionStore,
|
|
secret: settingsCache.get('session_secret'),
|
|
resave: false,
|
|
saveUninitialized: false,
|
|
name: 'ghost-admin-api-session',
|
|
cookie: {
|
|
maxAge: constants.SIX_MONTH_MS,
|
|
httpOnly: true,
|
|
path: urlUtils.getSubdir() + '/ghost',
|
|
sameSite: 'lax',
|
|
secure: urlUtils.isSSL(config.get('url'))
|
|
}
|
|
});
|
|
}
|
|
return unoExpressSessionMiddleware;
|
|
}
|
|
|
|
module.exports.getSession = async function getSession(req, res) {
|
|
if (req.session) {
|
|
return req.session;
|
|
}
|
|
const expressSessionMiddleware = getExpressSessionMiddleware();
|
|
return new Promise((resolve, reject) => {
|
|
expressSessionMiddleware(req, res, function (err) {
|
|
if (err) {
|
|
return reject(err);
|
|
}
|
|
resolve(req.session);
|
|
});
|
|
});
|
|
};
|
|
|
|
module.exports.deleteAllSessions = util.promisify(sessionStore.clear.bind(sessionStore));
|