Session.cpp

Go to the documentation of this file.

#include <dcl/Config.h>
 
#ifdef __WINNT__
#include <windows.h>
#endif
 
#include <time.h>
 
#include <dcl/Numeric.h>
#include <dcl/MD5.h>
#include <dcl/Files.h>
 
#include "User.h"
#include "Session.h"
 
#if __DCL_HAVE_THIS_FILE__
#undef __THIS_FILE__
static const char_t __THIS_FILE__[] = __T("fastpage/Session.cpp");
#endif
 
__DCL_BEGIN_NAMESPACE
 
const wchar_t* Session::SESSION_COOKIE_NAME = L"dclhscsid";
 
String Session::toString(uint64_t n)
{
    wchar_t sz[21];
    sz[20] = L'\0';
    int i = 20;
 
    do {
        i--;
        unsigned int r = (unsigned int)(n % 62);
        if (r <= 9)
            sz[i] = r + L'0';
        else if (10 <= r && r <= 35)
            sz[i] = r - 10 + L'A';
        else
            sz[i] = r - 36 + L'a';
 
        n /= 62;
    } while(n);
 
    String str(&sz[i], 20 - i);
    return str;
}
 
Session::Session(
    HttpServletContextEx& ctx,
    SQLQuery& q,
    int nServiceUserID
) : __ctx(ctx), __query(q)
{
    __nUserID = GUEST_USER_ID;
    __nRoleID = GUEST_ROLE_ID;
 
    __nSiteUserID = SYSTEM_USER_ID;
    __nMemberRoleID = GUEST_ROLE_ID;
 
    __nServiceUserID = nServiceUserID;
}
 
String Session::create(SQLQuery& q, int nUserID)
{
    // Guest 세션의 생성
    StringBuilder strRemoteAddr = __ctx.remoteAddr();
    strRemoteAddr += L":" + String::valueOf(__ctx.remotePort());
    String str = strRemoteAddr.toString()
        + DateTime::getCurrentLocalTime().toString();
 
    uint64_t ui64[2];
    MD5 md;
    md.update(str.data(), str.length() * sizeof(wchar_t));
    md.final((byte_t*)ui64);
/*
    String strSessionID = UInt64::toString(ui64[0], 32);
    strSessionID += UInt64::toString(ui64[1], 32);
*/
    StringBuilder strSessionID = toString(ui64[0]);
    strSessionID += toString(ui64[1]);
 
//  String strSessionID = MD5::final(str);
 
    HttpSetCookie cookie(
        SESSION_COOKIE_NAME,
        strSessionID,
        0, //time(NULL) + 365 * 24 * 60 * 60,
        L"/"//Files::dirname(__ctx.path())
    );
 
    __ctx.addHeader(cookie);
 
    q.prepare(L""
        "INSERT INTO DCL_SESSION(SESSION_ID, USER_ID, REMOTE_ADDR, LAST_ACCESS)"
        "\n  VALUES(:SESSION_ID, :USER_ID, :REMOTE_ADDR, CURRENT_TIMESTAMP)"
    );
    q.params()[0].setValue(strSessionID);
    q.params()[1].setValue(nUserID);
    q.params()[2].setValue(strRemoteAddr);
 
    q.execute();
 
    return strSessionID;
}
 
void Session::check()
{
    // Guest 세션에서 검사를 시작한다.
    __DCL_ASSERT(__nUserID == GUEST_USER_ID);
 
    SQLQuery& q = __query;
 
    ListedStringToStringMap::ConstIterator it =
        __ctx.__cookieMap.find(SESSION_COOKIE_NAME);
    if (it == __ctx.__cookieMap.end()) {
        // Guest session
        __strSessionID = create(q, __nUserID); 
    }
    else {
        String strSessionID = (*it).value;
        // 세션이 유효한지 확인
        String sql = L""
            "SELECT S.USER_ID, U.USER_NAME, U.ROLE_ID, R.ROLE_NAME"
            "\n FROM DCL_SESSION AS S"
            "\n  INNER JOIN DCL_USER AS U ON (S.USER_ID = U.USER_ID)"
            "\n  INNER JOIN DCL_ROLE AS R ON (U.ROLE_ID = R.ROLE_ID)"
            "\n WHERE SESSION_ID = \'" + strSessionID + L'\'';
        __DCL_TRACE1(L"%ls\n", sql.data());
        q.execute(sql);
 
        q.fetch();
        if (q.eof()) {
            // 세션이 유효하지 않다. 새로운 Guest 세션을 생성한다.
            __strSessionID = create(q, __nUserID);
        }
        else {
            __strSessionID = strSessionID;
            __nUserID = q.fields()[0].asInteger();
            if (__nUserID != GUEST_USER_ID)
            {
                if (!q.fields()[1].isNull())
                    __strUserName = q.fields()[1].asString();
            }
            __nRoleID = __nMemberRoleID = q.fields()[2].asInteger();
            __strRoleName = q.fields()[3].asString();
 
            q.execute(L""
                "UPDATE DCL_SESSION "
                "\n SET LAST_ACCESS = CURRENT_TIMESTAMP "
                "\n WHERE SESSION_ID = \'" + __strSessionID + L'\''
            );
            q.execute(L""
                "UPDATE DCL_USER SET"
                "\n LAST_USE = CURRENT_TIMESTAMP"
                "\n WHERE USER_ID = " + String::valueOf(__nUserID)
            );
        }
    }
}
 
bool Session::login(const String& strSignID, const String& strPassword)
{
    __DCL_ASSERT(!__strSessionID.isEmpty());
 
    int nUserID = GUEST_USER_ID;
    SQLQuery& q = __query;
 
    q.prepare(L""
        "SELECT USER_ID, PASSWORD FROM DCL_USER "
        "   WHERE SIGN_ID = :SIGN_ID"
    );
    q.params().byName(L"SIGN_ID").setValue(strSignID);
    q.execute();
    q.fetch();
    if (q.eof())
        return false;
 
    if (q.fields().at(1).isNull()) {
        return false;
    }
 
    String password = q.fields()[1].asString();
    if (!(password.isEmpty() && strPassword.isEmpty())) {
        //      if (MD5::final(strInputPassword) != strPassword)
        if (strPassword != password)
            return false;
    }
 
    String strUserID = q.fields()[0].asString();
 
    q.execute(L""
        "UPDATE DCL_USER SET"
        "\n LAST_SIGNIN = CURRENT_TIMESTAMP, LAST_USE = CURRENT_TIMESTAMP"
        "\n WHERE USER_ID = " + strUserID
    );
 
    q.execute(L""
        "UPDATE DCL_SESSION SET USER_ID = " + strUserID + L""
        "   WHERE SESSION_ID = \'" + __strSessionID + L"\'"
    );
 
    // MySQL에서 UPDATE되는 값이 동일하면 UPDATE되지 않아서
    // affectedRows가 0이 된다.
    //  __DCL_ASSERT(q.affectedRows() > 0);
 
    return true;
}
 
void Session::logout()
{
    __DCL_ASSERT(!__strSessionID.isEmpty());
 
    if (__nUserID == GUEST_USER_ID)
        return;
 
    SQLQuery& q = __query;
    q.execute(L""
        "UPDATE DCL_SESSION SET USER_ID = " + String::valueOf(GUEST_USER_ID) + L""
        "   WHERE SESSION_ID = \'" + __strSessionID + L"\'"
    );
}
 
bool Session::getMemberRole(int nServiceUserID)
{
    SQLQuery& q = __query;
    q.execute(L""
        "SELECT ROLE_ID"
        "\n FROM DCL_USER_MEMBER"
        "\n WHERE USER_ID = " + String::valueOf(nServiceUserID) + L""
        "\n  AND MEMBER_ID = " + String::valueOf(__nUserID)
    );
    q.fetch();
    if (q.eof())
        return false;
 
    __nMemberRoleID = q.fields()[0].asInteger();
 
    return true;
}
 
__DCL_END_NAMESPACE