Super-frpc/backend
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat(session): add session removal endpoint and refactor session management

Browse Source 
- Implement new `/sessionMgr/remove` endpoint for superusers to remove sessions
- Refactor session and token management to use sessionTokenMap for better tracking
- Update session cleanup logic to handle both tokens and sessions
- Add documentation for new API endpoint in docs/api.md
- Modify logout handler to use new session removal approach
This commit is contained in:
NanamiAdmin
2026-03-06 19:22:52 +08:00
parent f07b89842a
commit 8b9a757bea
6 changed files with 166 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -2
View File
@@ -38,7 +38,7 @@ Create a `config.json` file in the project root:
## Build
```bash
go build -o super-frpc
go build -o super-frpc.exe
```
For Linux:
@@ -60,7 +60,7 @@ For detailed API documentation, please see [docs/api.md](docs/api.md)
- [x] Add Windows boot service support
- [x] Add session list API
- [ ] Add session management API
- [x] Add session management API
- [ ] Add codes per file documentation
- [ ] Add user config modify API
database.go
+9
View File
@@ -313,6 +313,15 @@ func DBQueryUsers() ([]User, error) { // List all users
return users, nil
}
func DBQuerySpecificUser(userID int) (User, error) { // Query user by ID
var user User
err := db.QueryRow("SELECT userID, username, type FROM userLogin WHERE userID = ?", userID).Scan(&user.UserID, &user.Username, &user.Type)
if err != nil {
return user, fmt.Errorf("failed to query user: %w", err)
}
return user, nil
}
func DBAddFrpcInstance(instance FrpcInstance) error {
_, err := frpcDB.Exec("INSERT INTO frpcInstances (userID, name, serverAddr, serverPort, auth_method, bootAtStart, runUser, configPath, createdAt) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
instance.UserID, instance.Name, instance.ServerAddr, instance.ServerPort, instance.AuthMethod, instance.BootAtStart, instance.RunUser, instance.ConfigPath, time.Now().Format(time.RFC3339))
docs/api.md
+42
View File
@@ -299,6 +299,48 @@ X-Timestamp: 1704067200000
---
## Remove Session
**Endpoint**: `/sessionMgr/remove`
**Method**: POST
**Content-Type**: application/json
**Auth Required**: Yes (token)
**Permission Level**: Superuser
**Request Headers**:
```
X-Token: your_token
X-Timestamp: 1704067200000
```
**Request Body**:
```json
{
"sessionID": "session-5f4dcc3b5aa765d61d8327deb882cf99-1704067200000"
}
```
| Header | Type | Required | Description |
|--------|------|----------|-------------|
| X-Token | string | Yes | Authentication token |
| X-Timestamp | int64 | Yes | Client timestamp in milliseconds |
| Field | Type | Required | Description |
|-------|------|----------|-------------|
| sessionID | string | Yes | Session ID to remove |
**Response**:
```json
{
"success": true,
"message": "Session removed successfully"
}
```
> **Note**: This endpoint requires superuser permission. It removes a session by its sessionID and also removes the associated token, forcing the user to re-login.
---
## Create frpc Instance
**Endpoint:** `/frpcAct/instanceMgr/create`
router.go
+1
View File
@@ -18,6 +18,7 @@ func setupRoutes() {
// http.HandleFunc("/userMgr/modify", ModifyUserHandler)
http.HandleFunc("/sessionMgr/list", ListActiveSessionsHandler)
http.HandleFunc("/sessionMgr/remove", RemoveSessionHandler)
http.HandleFunc("/frpcAct/instanceMgr/create", CreateInstanceHandler)
http.HandleFunc("/frpcAct/instanceMgr/list", ListInstancesHandler)
session.go
+34 -20
View File
@@ -21,7 +21,7 @@ type TokenInfo struct {
}
var (
tokenMap = make(map[int]*TokenInfo)
tokenMap = make(map[int]*TokenInfo) // userID -> TokenInfo
tokenMux sync.RWMutex
tokenTTL = time.Hour
)
@@ -34,11 +34,16 @@ type Session struct {
}
var (
sessionMap = make(map[string]*Session)
sessionMap = make(map[string]*Session) // sessionID -> Session
sessionMux sync.RWMutex
sessionTTL = time.Hour
)
var (
sessionTokenMap = make(map[string]string) // sessionID -> token
sessionTokenMux sync.RWMutex
)
func GenerateToken(userID int) (string, error) {
randomBytes := make([]byte, 32)
_, err := rand.Read(randomBytes)
@@ -144,7 +149,15 @@ func CleanupExpiredTokens() {
if time.Since(tokenInfo.CreatedAt) > tokenTTL {
delete(tokenMap, userID)
postLog.Debug(fmt.Sprintf("[CleanupExpiredTokens] Removed expired token for userID %d: %s", userID, tokenInfo.Token))
RemoveSession(userID, "")
sessionTokenMux.Lock()
for sessionID, sessionToken := range sessionTokenMap {
if sessionToken == tokenInfo.Token {
delete(sessionTokenMap, sessionID)
delete(sessionMap, sessionID)
postLog.Debug(fmt.Sprintf("[CleanupExpiredTokens] Removed expired session %s for userID %d", sessionID, userID))
}
}
sessionTokenMux.Unlock()
}
}
}
@@ -153,9 +166,13 @@ func CleanupExpiredSessions() {
sessionMux.Lock()
defer sessionMux.Unlock()
sessionTokenMux.Lock()
defer sessionTokenMux.Unlock()
for sessionID, session := range sessionMap {
if time.Now().After(session.ExpireAt) {
delete(sessionMap, sessionID)
delete(sessionTokenMap, sessionID)
postLog.Debug(fmt.Sprintf("[CleanupExpiredSessions] Removed expired session %s for user [%d]%s", sessionID, session.UserID, session.Username))
}
}
@@ -271,35 +288,32 @@ func JoinSession(userID int, userName string, token string) error {
}
sessionMap[sessionID] = session
sessionTokenMap[sessionID] = token
postLog.Debug(fmt.Sprintf("[JoinSession] User [%d]%s joined session %s with token %s", userID, userName, sessionID, token))
return nil
}
func RemoveSession(userID int, token string) error {
func RemoveSession(sessionID string) error {
sessionMux.Lock()
defer sessionMux.Unlock()
var sessionIDToRemove string
for sessionID, session := range sessionMap {
if session.UserID == userID {
sessionIDToRemove = sessionID
break
}
session, exists := sessionMap[sessionID]
if !exists {
return fmt.Errorf("Session not found: %s", sessionID)
}
if sessionIDToRemove != "" {
delete(sessionMap, sessionIDToRemove)
postLog.Info(fmt.Sprintf("[RemoveSession] Removed session %s for user [%d]%s", sessionIDToRemove, userID, GetUsernameByID(userID)))
_, exists = sessionTokenMap[sessionID]
if !exists {
delete(sessionMap, sessionID)
return fmt.Errorf("Token not found for session: %s", sessionID)
}
tokenMux.Lock()
defer tokenMux.Unlock()
delete(sessionMap, sessionID)
delete(sessionTokenMap, sessionID)
if tokenInfo, exists := tokenMap[userID]; exists {
if tokenInfo.Token == token || token == "" {
delete(tokenMap, userID)
postLog.Info(fmt.Sprintf("[RemoveSession] Removed token for user [%d]%s", userID, GetUsernameByID(userID)))
}
if tokenInfo, exists := tokenMap[session.UserID]; exists {
DeleteTokenInfo(session.UserID)
postLog.Info(fmt.Sprintf("[RemoveSession] Removed session '%s': '[%d]%s'", sessionID, tokenInfo.UserID, GetUsernameByID(tokenInfo.UserID)))
}
return nil
userAct.go
+78 -1
View File
@@ -28,6 +28,10 @@ type RemoveUserRequest struct {
TargetUserID int `json:"targetUserID"`
}
type RemoveSessionRequest struct {
SessionID string `json:"sessionID"`
}
func RegisterHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
@@ -195,7 +199,23 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
return
}
if err := RemoveSession(userID, r.Header.Get("X-Token")); err != nil {
sessionTokenMux.RLock()
sessionID := ""
for sid, token := range sessionTokenMap {
if token == r.Header.Get("X-Token") {
sessionID = sid
break
}
}
sessionTokenMux.RUnlock()
if sessionID == "" {
SendErrorResponse(w, http.StatusNotFound, "Session not found for token")
postLog.Warning(fmt.Sprintf("[LogoutHandler] Session not found for token from user [%d]%s", userID, GetUsernameByID(userID)))
return
}
if err := RemoveSession(sessionID); err != nil {
SendErrorResponse(w, http.StatusInternalServerError, "Failed to logout")
postLog.Error(fmt.Sprintf("[LogoutHandler] Failed to logout user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
@@ -205,6 +225,63 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
postLog.Info(fmt.Sprintf("[LogoutHandler] User [%d]%s Logout successful", userID, GetUsernameByID(userID)))
}
func RemoveSessionHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid request method: %s", r.Method))
return
}
if !ValidateTimeStamp(r.Header) {
SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
postLog.Warning("[RemoveSessionHandler] Invalid or missing X-Timestamp in header")
return
}
body, err := io.ReadAll(r.Body)
if err != nil {
SendErrorResponse(w, http.StatusBadRequest, "Failed to read request body")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Failed to read request body: %v", err))
return
}
defer r.Body.Close()
var req RemoveSessionRequest
if err := json.Unmarshal(body, &req); err != nil {
SendErrorResponse(w, http.StatusBadRequest, "Invalid request format")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid request format: %v", err))
return
}
if req.SessionID == "" {
SendErrorResponse(w, http.StatusBadRequest, "SessionID is required")
postLog.Warning("[RemoveSessionHandler] SessionID is empty")
return
}
userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
if err != nil {
SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Invalid or missing token: %v", err))
return
}
if err := CheckPermission(userID, "superuser"); err != nil {
SendErrorResponse(w, http.StatusForbidden, "Permission denied")
postLog.Warning(fmt.Sprintf("[RemoveSessionHandler] Permission denied for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
return
}
if err := RemoveSession(req.SessionID); err != nil {
SendErrorResponse(w, http.StatusInternalServerError, fmt.Sprintf("Failed to remove session: %v", err))
postLog.Error(fmt.Sprintf("[RemoveSessionHandler] Failed to remove session %s: %v", req.SessionID, err))
return
}
postLog.Info(fmt.Sprintf("[RemoveSessionHandler] User [%d]%s removed session %s", userID, GetUsernameByID(userID), req.SessionID))
SendSuccessResponse(w, "Session removed successfully", nil)
}
func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost {
SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")