1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
//! Deprecated cookie-based session authentication.
//!
//! This is the legacy authentication flow, superseded by grant bearer auth (see [`super::grant`]).
//! It authenticates requests by matching a session cookie against the `sessions` database table.
//!
//! # How it works
//!
//! ## Signup / Signin
//!
//! 1. The client sends a signed [`AuthToken`](pubky_common::auth::AuthToken) in the request body.
//! 2. The server verifies the token signature and extracts the client's public key.
//! 3. For signup: a new user row is created (rejected with 409 if the user already exists).
//! For signin: the user must already exist.
//! 4. A session secret is generated — 16 random bytes encoded as a 26-character
//! base32 (Crockford) string — and stored in the `sessions` table.
//! 5. A cookie is set on the response:
//! - **Name**: the user's public key in z32 format (`pubkey.z32()`).
//! - **Value**: the session secret.
//! - **Max-Age**: 365 days, `HttpOnly`.
//! - **Secure** / **SameSite=None**: enabled when the host is a pkarr key or FQDN;
//! disabled for localhost / plain IP (development).
//!
//! ## Authenticating subsequent requests
//!
//! The [`CookieAuthenticationMiddleware`](middleware::CookieAuthenticationMiddleware) runs
//! as a Tower layer on every request. It:
//!
//! 1. Skips if an [`AuthSession`](super::session::AuthSession) was already set by the
//! grant middleware (Bearer tokens take priority).
//! 2. Reads the cookie whose name matches the request's public key.
//! 3. Looks up the secret in the `sessions` table and verifies the owning user matches.
//! 4. On success, inserts `AuthSession::Cookie` into the request extensions so downstream
//! handlers can access the authenticated session.
//!
//! ## Signout
//!
//! Deletes the session row from the database and sends a removal cookie.
pub
pub