[MM-19473] Fix data race on user login (#12870)

* Avoid writes to App.Session outside the app layer

* Fix merge

* Remove unneeded else condition

web/saml.go

@@ -87,7 +87,8 @@ func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 	c.LogAudit("attempt")
 
 	action := relayProps["action"]
-	if user, err := samlInterface.DoLogin(encodedXML, relayProps); err != nil {
+	user, err := samlInterface.DoLogin(encodedXML, relayProps)
+	if err != nil {
 		c.LogAudit("fail")
 
 		if action == model.OAUTH_ACTION_MOBILE {
@@ -98,64 +99,62 @@ func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
 			c.Err.StatusCode = http.StatusFound
 		}
 		return
-	} else {
-		if err := c.App.CheckUserAllAuthenticationCriteria(user, ""); err != nil {
-			c.Err = err
-			c.Err.StatusCode = http.StatusFound
-			return
-		}
+	}
 
-		switch action {
-		case model.OAUTH_ACTION_SIGNUP:
-			teamId := relayProps["team_id"]
-			if len(teamId) > 0 {
-				c.App.Srv.Go(func() {
-					if err := c.App.AddUserToTeamByTeamId(teamId, user); err != nil {
-						mlog.Error(err.Error())
-					} else {
-						c.App.AddDirectChannels(teamId, user)
-					}
-				})
-			}
-		case model.OAUTH_ACTION_EMAIL_TO_SSO:
-			if err := c.App.RevokeAllSessions(user.Id); err != nil {
-				c.Err = err
-				return
-			}
-			c.LogAuditWithUserId(user.Id, "Revoked all sessions for user")
+	if err = c.App.CheckUserAllAuthenticationCriteria(user, ""); err != nil {
+		c.Err = err
+		c.Err.StatusCode = http.StatusFound
+		return
+	}
+
+	switch action {
+	case model.OAUTH_ACTION_SIGNUP:
+		teamId := relayProps["team_id"]
+		if len(teamId) > 0 {
 			c.App.Srv.Go(func() {
-				if err := c.App.SendSignInChangeEmail(user.Email, strings.Title(model.USER_AUTH_SERVICE_SAML)+" SSO", user.Locale, c.App.GetSiteURL()); err != nil {
+				if err = c.App.AddUserToTeamByTeamId(teamId, user); err != nil {
 					mlog.Error(err.Error())
+				} else {
+					c.App.AddDirectChannels(teamId, user)
 				}
 			})
 		}
-
-		c.LogAuditWithUserId(user.Id, "obtained user")
-
-		session, err := c.App.DoLogin(w, r, user, "")
-		if err != nil {
+	case model.OAUTH_ACTION_EMAIL_TO_SSO:
+		if err = c.App.RevokeAllSessions(user.Id); err != nil {
 			c.Err = err
 			return
 		}
+		c.LogAuditWithUserId(user.Id, "Revoked all sessions for user")
+		c.App.Srv.Go(func() {
+			if err = c.App.SendSignInChangeEmail(user.Email, strings.Title(model.USER_AUTH_SERVICE_SAML)+" SSO", user.Locale, c.App.GetSiteURL()); err != nil {
+				mlog.Error(err.Error())
+			}
+		})
+	}
 
-		c.LogAuditWithUserId(user.Id, "success")
+	c.LogAuditWithUserId(user.Id, "obtained user")
 
-		c.App.AttachSessionCookies(w, r, session)
+	err = c.App.DoLogin(w, r, user, "")
+	if err != nil {
+		c.Err = err
+		return
+	}
 
-		c.App.Session = *session
+	c.LogAuditWithUserId(user.Id, "success")
 
-		if val, ok := relayProps["redirect_to"]; ok {
-			http.Redirect(w, r, c.GetSiteURLHeader()+val, http.StatusFound)
-			return
-		}
+	c.App.AttachSessionCookies(w, r)
 
-		switch action {
-		case model.OAUTH_ACTION_MOBILE:
-			ReturnStatusOK(w)
-		case model.OAUTH_ACTION_EMAIL_TO_SSO:
-			http.Redirect(w, r, c.GetSiteURLHeader()+"/login?extra=signin_change", http.StatusFound)
-		default:
-			http.Redirect(w, r, c.GetSiteURLHeader(), http.StatusFound)
-		}
+	if val, ok := relayProps["redirect_to"]; ok {
+		http.Redirect(w, r, c.GetSiteURLHeader()+val, http.StatusFound)
+		return
+	}
+
+	switch action {
+	case model.OAUTH_ACTION_MOBILE:
+		ReturnStatusOK(w)
+	case model.OAUTH_ACTION_EMAIL_TO_SSO:
+		http.Redirect(w, r, c.GetSiteURLHeader()+"/login?extra=signin_change", http.StatusFound)
+	default:
+		http.Redirect(w, r, c.GetSiteURLHeader(), http.StatusFound)
 	}
 }