Don't put a JWT in core.user.

git-svn-id: https://www.unprompted.com/svn/projects/tildefriends/trunk@4348 ed5197a5-7fde-0310-b194-c3ffbd925b24

core/app.js

@@ -61,8 +61,7 @@ function socket(request, response, client) {
 	let process;
 	let options = {};
 	let credentials = auth.query(request.headers);
-	let refresh_token = credentials?.refresh?.token;
+	let refresh = auth.make_refresh(credentials);
-	let refresh_interval = credentials?.refresh?.interval;
 
 	response.onClose = async function() {
 		if (process && process.task) {
@@ -198,9 +197,9 @@ function socket(request, response, client) {
 		}
 	}
 
-	if (refresh_token) {
+	if (refresh) {
 		return {
-			'Set-Cookie': `session=${refresh_token}; path=/; Max-Age=${refresh_interval}; Secure; SameSite=Strict`,
+			'Set-Cookie': `session=${refresh.token}; path=/; Max-Age=${refresh.interval}; Secure; SameSite=Strict`,
 		};
 	}
 }

core/auth.js

@@ -260,12 +260,17 @@ function query(headers) {
 		return {
 			session: entry,
 			permissions: autologin ? getPermissionsForUser(autologin) : getPermissions(session),
-			refresh: {
-				token: makeJwt({name: entry.name}),
-				interval: kRefreshInterval,
-			}, 
 		};
 	}
 }
 
-export { handler, query };
+function make_refresh(credentials) {
+	if (credentials?.session?.name) {
+		return {
+			token: makeJwt({name: credentials.session.name}),
+			interval: kRefreshInterval,
+		};
+	}
+}
+
+export { handler, query, make_refresh };