Documentation
¶
Overview ¶
Package session provides authenticated HTTP primitives shared by all SJTU services.
A Session couples an http.Client with one identity's credentials. It is the only layer that manages response-body lifecycles and credential redaction: callers above this package never close a body themselves unless they explicitly asked for a stream, and secrets never reach logs.
Index ¶
- func ForgetSecret(value string)
- func Redact(s string) string
- func RegisterSecret(value string)
- type HTTPError
- type RedactingHandler
- type Session
- func (s *Session) ClearCookies(rawURL string, keep ...string)
- func (s *Session) Cookie(rawURL, name string) (string, bool)
- func (s *Session) DoJSON(ctx context.Context, method, rawURL string, out any) error
- func (s *Session) DoJSONHeader(ctx context.Context, method, rawURL string, out any) (http.Header, error)
- func (s *Session) DoJSONWith(ctx context.Context, method, rawURL string, header http.Header, out any) error
- func (s *Session) DoStream(ctx context.Context, method, rawURL string) (*http.Response, error)
- func (s *Session) GetHTML(ctx context.Context, rawURL string) ([]byte, string, error)
- func (s *Session) Jar() http.CookieJar
- func (s *Session) PostFormHTML(ctx context.Context, rawURL string, form url.Values) ([]byte, string, error)
- func (s *Session) PostFormRedirect(ctx context.Context, rawURL string, form url.Values) (string, error)
- func (s *Session) SeedCookie(name, value string, domains ...string)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ForgetSecret ¶
func ForgetSecret(value string)
ForgetSecret drops value from the redaction set, e.g. after logout.
func RegisterSecret ¶
func RegisterSecret(value string)
RegisterSecret adds value to the redaction set. Empty values are ignored: matching the empty string would corrupt every message. Call this whenever a credential is loaded, stored, or newly issued.
Types ¶
type HTTPError ¶
HTTPError describes a non-2xx response. The body excerpt is redacted before storage, so an HTTPError is always safe to log or print.
type RedactingHandler ¶
type RedactingHandler struct {
// contains filtered or unexported fields
}
RedactingHandler wraps an slog.Handler and redacts registered secrets from every message and attribute value before forwarding. Install it as the default logger at startup so no call site can leak credentials by mistake.
func NewRedactingHandler ¶
func NewRedactingHandler(inner slog.Handler) *RedactingHandler
NewRedactingHandler wraps inner with secret redaction.
func (*RedactingHandler) Handle ¶
Handle redacts the record's message and string attributes, then forwards.
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session is one identity's authenticated HTTP context. Exactly one of the credential fields is active: token sessions call the Canvas API with a bearer header and ignore cookies; cookie sessions carry a jar for the jAccount SSO domain family.
func NewCookies ¶
NewCookies builds a Session with a private, initially empty cookie jar. QR login depends on this isolation: a jar shared with an earlier authenticated session makes my.sjtu.edu.cn answer with the signed-in portal page instead of the login page, and no QR UUID can be extracted.
func NewToken ¶
NewToken builds a Session that authenticates every request with the given Canvas bearer token.
func (*Session) ClearCookies ¶ added in v0.6.0
ClearCookies expires every cookie that would be sent to rawURL — except the names in keep, which are credentials the session exists to carry. The jar offers no enumeration beyond "cookies for this URL", and deletion must match the planted (name, domain, path) triple, so each sent name is expired in all three shapes an origin can plant: host cookie, host-domain cookie, and parent-domain cookie. SSO chains re-run from a clean slate: stale session residue makes mlearning answer its forscan entry with an immediate 500 instead of starting the redirect chain.
func (*Session) DoJSON ¶
DoJSON performs a JSON request and fully manages the response body: the caller receives the value decoded into out, or an error, and never an open body. out may be nil for requests whose payload is irrelevant.
func (*Session) DoJSONHeader ¶
func (s *Session) DoJSONHeader(ctx context.Context, method, rawURL string, out any) (http.Header, error)
DoJSONHeader behaves like DoJSON but also returns the response headers, which Canvas list pagination needs for the Link header.
func (*Session) DoJSONWith ¶
func (s *Session) DoJSONWith(ctx context.Context, method, rawURL string, header http.Header, out any) error
DoJSONWith behaves like DoJSON but carries extra request headers; the v.sjtu.edu.cn API authenticates per-request with a jwt-token header.
func (*Session) DoStream ¶
DoStream performs a request whose body the CALLER must close. It is reserved for large or unbounded payloads (video download, live streams); everything else belongs in DoJSON.
func (*Session) GetHTML ¶
GetHTML fetches one HTML page, following redirects. It returns the body and the final URL after redirection, which form actions resolve against.
func (*Session) Jar ¶
Jar exposes the cookie jar for the WebSocket dialer, which needs it to attach the login session to its handshake. Nil on token sessions.
func (*Session) PostFormHTML ¶
func (s *Session) PostFormHTML(ctx context.Context, rawURL string, form url.Values) ([]byte, string, error)
PostFormHTML submits one form, following redirects, and returns the resulting page body and final URL.
func (*Session) PostFormRedirect ¶
func (s *Session) PostFormRedirect(ctx context.Context, rawURL string, form url.Values) (string, error)
PostFormRedirect submits one form WITHOUT following redirects and returns the raw Location header of the 3xx response. Any other status is an error. The LTI launch chain carries its token in that redirect, so following it would lose exactly the value being extracted.
func (*Session) SeedCookie ¶
SeedCookie plants a JAAuthCookie restored from the credential store. Each domain is passed as a bare host ("jaccount.sjtu.edu.cn").
Source Files