From d8ffa5b4b14dbbf01adee849d8aceaad3aa453e7 Mon Sep 17 00:00:00 2001
From: Shane Kilkelly <shane@kilkelly.me>
Date: Fri, 1 Jul 2016 11:24:46 +0100
Subject: [PATCH] set expiry on the user sessions set.

---
 .../Features/User/UserSessionsManager.coffee  | 35 +++++++++++++------
 .../app/coffee/infrastructure/Server.coffee   |  5 ++-
 2 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/services/web/app/coffee/Features/User/UserSessionsManager.coffee b/services/web/app/coffee/Features/User/UserSessionsManager.coffee
index 4804df004c..f808f7bceb 100644
--- a/services/web/app/coffee/Features/User/UserSessionsManager.coffee
+++ b/services/web/app/coffee/Features/User/UserSessionsManager.coffee
@@ -16,11 +16,14 @@ module.exports = UserSessionsManager =
 		logger.log {user_id: user._id, sessionId}, "onLogin handler"
 		sessionSetKey = UserSessionsManager._sessionSetKey(user)
 		value = UserSessionsManager._sessionKey sessionId
-		rclient.sadd sessionSetKey, value, (err, response) ->
-			if err
-				logger.err {err, user_id: user._id, sessionId}, "error while adding session key to UserSessions set"
-				return callback(err)
-			callback()
+		rclient.multi()
+			.sadd(sessionSetKey, value)
+			.expire(sessionSetKey, "#{Settings.cookieSessionLength}")
+			.exec (err, response) ->
+				if err
+					logger.err {err, user_id: user._id, sessionId}, "error while adding session key to UserSessions set"
+					return callback(err)
+				callback()
 
 	onLogout: (user, sessionId, callback=(err)-> ) ->
 		logger.log {user_id: user._id, sessionId}, "onLogout handler"
@@ -29,12 +32,24 @@ module.exports = UserSessionsManager =
 			return callback()
 		sessionSetKey = UserSessionsManager._sessionSetKey(user)
 		value = UserSessionsManager._sessionKey sessionId
-		rclient.srem sessionSetKey, value, (err, response) ->
-			if err
-				logger.err {err, user_id: user._id, sessionId}, "error while removing session key from UserSessions set"
-				return callback(err)
-			callback()
+		rclient.multi()
+			.srem(sessionSetKey, value)
+			.expire(sessionSetKey, "#{Settings.cookieSessionLength}")
+			.exec (err, response) ->
+				if err
+					logger.err {err, user_id: user._id, sessionId}, "error while removing session key from UserSessions set"
+					return callback(err)
+				callback()
 
 	revokeAllSessions: (user, callback=(err)->) ->
 		logger.log {user_id: user._id}, "revoking all existing sessions for user"
 		callback(null)
+
+	touch: (user, callback=(err)->) ->
+		if !user
+			return callback(null)
+		sessionSetKey = UserSessionsManager._sessionSetKey(user)
+		rclient.expire sessionSetKey, "#{Settings.cookieSessionLength}", (err, response) ->
+			if err
+				logger.err {err, user_id: user._id}, "error while updating ttl on UserSessions set"
+				return callback(err)
diff --git a/services/web/app/coffee/infrastructure/Server.coffee b/services/web/app/coffee/infrastructure/Server.coffee
index 11a3b5237e..b5b49d1329 100644
--- a/services/web/app/coffee/infrastructure/Server.coffee
+++ b/services/web/app/coffee/infrastructure/Server.coffee
@@ -31,6 +31,7 @@ translations = require("translations-sharelatex").setup(Settings.i18n)
 Modules = require "./Modules"
 
 ErrorController = require "../Features/Errors/ErrorController"
+UserSessionsManager = require "../Features/User/UserSessionsManager"
 
 metrics.mongodb.monitor(Path.resolve(__dirname + "/../../../node_modules/mongojs/node_modules/mongodb"), logger)
 metrics.mongodb.monitor(Path.resolve(__dirname + "/../../../node_modules/mongoose/node_modules/mongodb"), logger)
@@ -89,6 +90,8 @@ webRouter.use translations.setLangBasedOnDomainMiddlewear
 # Measure expiry from last request, not last login
 webRouter.use (req, res, next) ->
 	req.session.touch()
+	if req?.session?.user
+		UserSessionsManager.touch(req.session.user, (err)->)
 	next()
 
 webRouter.use ReferalConnect.use
@@ -114,7 +117,7 @@ app.use (req, res, next) ->
 
 apiRouter.get "/status", (req, res)->
 	res.send("web sharelatex is alive")
-	
+
 profiler = require "v8-profiler"
 apiRouter.get "/profile", (req, res) ->
 	time = parseInt(req.query.time || "1000")