From 946302d9a29cbf5702da9e18a52b59864a18c69e Mon Sep 17 00:00:00 2001
From: Corey Hulen <corey@hulen.com>
Date: Thu, 21 Jul 2016 08:36:11 -0800
Subject: [PATCH] PLT-3691 Fixing mobile session (#3652)

* PLT-3691 Fixing mobile session

* Fixing unit tests
---
 api/user.go                     | 23 ++++++++++++++++++++++-
 model/session.go                |  6 +++++-
 store/sql_session_store.go      |  4 ++--
 store/sql_session_store_test.go |  4 ++--
 store/store.go                  |  2 +-
 5 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/api/user.go b/api/user.go
index 7dd24fe1be..8cc4ed8dd7 100644
--- a/api/user.go
+++ b/api/user.go
@@ -684,8 +684,29 @@ func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	sessionCache.Remove(c.Session.Token)
+	c.Session.SetExpireInDays(*utils.Cfg.ServiceSettings.SessionLengthMobileInDays)
 
-	if result := <-Srv.Store.Session().UpdateDeviceId(c.Session.Id, deviceId); result.Err != nil {
+	maxAge := *utils.Cfg.ServiceSettings.SessionLengthMobileInDays * 60 * 60 * 24
+
+	secure := false
+	if GetProtocol(r) == "https" {
+		secure = true
+	}
+
+	expiresAt := time.Unix(model.GetMillis()/1000+int64(maxAge), 0)
+	sessionCookie := &http.Cookie{
+		Name:     model.SESSION_COOKIE_TOKEN,
+		Value:    c.Session.Token,
+		Path:     "/",
+		MaxAge:   maxAge,
+		Expires:  expiresAt,
+		HttpOnly: true,
+		Secure:   secure,
+	}
+
+	http.SetCookie(w, sessionCookie)
+
+	if result := <-Srv.Store.Session().UpdateDeviceId(c.Session.Id, deviceId, c.Session.ExpiresAt); result.Err != nil {
 		c.Err = result.Err
 		return
 	}
diff --git a/model/session.go b/model/session.go
index 8a5eec74c5..ef51374dba 100644
--- a/model/session.go
+++ b/model/session.go
@@ -83,7 +83,11 @@ func (me *Session) IsExpired() bool {
 }
 
 func (me *Session) SetExpireInDays(days int) {
-	me.ExpiresAt = GetMillis() + (1000 * 60 * 60 * 24 * int64(days))
+	if me.CreateAt == 0 {
+		me.ExpiresAt = GetMillis() + (1000 * 60 * 60 * 24 * int64(days))
+	} else {
+		me.ExpiresAt = me.CreateAt + (1000 * 60 * 60 * 24 * int64(days))
+	}
 }
 
 func (me *Session) AddProp(key string, value string) {
diff --git a/store/sql_session_store.go b/store/sql_session_store.go
index 9ad3a5efa5..94694267c9 100644
--- a/store/sql_session_store.go
+++ b/store/sql_session_store.go
@@ -283,12 +283,12 @@ func (me SqlSessionStore) UpdateRoles(userId, roles string) StoreChannel {
 	return storeChannel
 }
 
-func (me SqlSessionStore) UpdateDeviceId(id, deviceId string) StoreChannel {
+func (me SqlSessionStore) UpdateDeviceId(id string, deviceId string, expiresAt int64) StoreChannel {
 	storeChannel := make(StoreChannel)
 
 	go func() {
 		result := StoreResult{}
-		if _, err := me.GetMaster().Exec("UPDATE Sessions SET DeviceId = :DeviceId WHERE Id = :Id", map[string]interface{}{"DeviceId": deviceId, "Id": id}); err != nil {
+		if _, err := me.GetMaster().Exec("UPDATE Sessions SET DeviceId = :DeviceId, ExpiresAt = :ExpiresAt WHERE Id = :Id", map[string]interface{}{"DeviceId": deviceId, "Id": id, "ExpiresAt": expiresAt}); err != nil {
 			result.Err = model.NewLocAppError("SqlSessionStore.UpdateDeviceId", "store.sql_session.update_device_id.app_error", nil, err.Error())
 		} else {
 			result.Data = deviceId
diff --git a/store/sql_session_store_test.go b/store/sql_session_store_test.go
index d7f07254d6..e64a350bac 100644
--- a/store/sql_session_store_test.go
+++ b/store/sql_session_store_test.go
@@ -156,7 +156,7 @@ func TestSessionUpdateDeviceId(t *testing.T) {
 	s1.UserId = model.NewId()
 	Must(store.Session().Save(&s1))
 
-	if rs1 := (<-store.Session().UpdateDeviceId(s1.Id, model.PUSH_NOTIFY_APPLE+":1234567890")); rs1.Err != nil {
+	if rs1 := (<-store.Session().UpdateDeviceId(s1.Id, model.PUSH_NOTIFY_APPLE+":1234567890", s1.ExpiresAt)); rs1.Err != nil {
 		t.Fatal(rs1.Err)
 	}
 
@@ -164,7 +164,7 @@ func TestSessionUpdateDeviceId(t *testing.T) {
 	s2.UserId = model.NewId()
 	Must(store.Session().Save(&s2))
 
-	if rs2 := (<-store.Session().UpdateDeviceId(s2.Id, model.PUSH_NOTIFY_APPLE+":1234567890")); rs2.Err != nil {
+	if rs2 := (<-store.Session().UpdateDeviceId(s2.Id, model.PUSH_NOTIFY_APPLE+":1234567890", s1.ExpiresAt)); rs2.Err != nil {
 		t.Fatal(rs2.Err)
 	}
 }
diff --git a/store/store.go b/store/store.go
index 8efec5e541..ac424a9447 100644
--- a/store/store.go
+++ b/store/store.go
@@ -163,7 +163,7 @@ type SessionStore interface {
 	PermanentDeleteSessionsByUser(teamId string) StoreChannel
 	UpdateLastActivityAt(sessionId string, time int64) StoreChannel
 	UpdateRoles(userId string, roles string) StoreChannel
-	UpdateDeviceId(id string, deviceId string) StoreChannel
+	UpdateDeviceId(id string, deviceId string, expiresAt int64) StoreChannel
 	AnalyticsSessionCount() StoreChannel
 }