Merge pull request #21 from User-green/fix/csrf-restored-session

fix(auth): establish CSRF for restored sessions, prompt relogin if impossible

Author: findleyl

app/src/main/kotlin/org/astermail/android/auth/AuthRepository.kt

@@ -488,6 +488,15 @@ class AuthRepository @Inject constructor(
         return true
     }
 
+    suspend fun ensure_csrf_ready(): Boolean {
+        if (!_is_signed_in.value) return true
+        if (api_client.get_csrf() != null) return true
+        return when (try_refresh_session()) {
+            RefreshOutcome.Success -> api_client.get_csrf() != null
+            RefreshOutcome.AuthFailed, RefreshOutcome.Transient -> false
+        }
+    }
+
     fun has_stored_session(account_id: String): Boolean = session_snapshot_store.has(account_id)
 
     suspend fun change_password(current_password: String, new_password: String): Result<Unit> = runCatching {

app/src/main/kotlin/org/astermail/android/auth/auth_gate_view_model.kt

@@ -24,15 +24,20 @@ package org.astermail.android.auth
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import android.content.Context
+import android.widget.Toast
 import dagger.hilt.android.lifecycle.HiltViewModel
 import dagger.hilt.android.qualifiers.ApplicationContext
 import javax.inject.Inject
 import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull
+import org.astermail.android.BuildConfig
+import org.astermail.android.R
 import org.astermail.android.api.auth.AuthApi
 import org.astermail.android.security.LockdownStore
 
@@ -54,6 +59,21 @@ class AuthGateViewModel @Inject constructor(
         }
         _is_ready.value = true
         if (auth_repository.is_signed_in.value) {
+            viewModelScope.launch {
+                val csrf_ok = auth_repository.ensure_csrf_ready()
+                if (!csrf_ok) {
+                    if (BuildConfig.DEBUG) {
+                        android.util.Log.w("AuthGate", "CSRF token fetch failed on launch")
+                    }
+                    withContext(Dispatchers.Main) {
+                        Toast.makeText(
+                            context,
+                            context.getString(R.string.csrf_unavailable),
+                            Toast.LENGTH_LONG,
+                        ).show()
+                    }
+                }
+            }
             viewModelScope.launch {
                 try {
                     val info = withTimeoutOrNull(8_000L) { auth_api.me() }

app/src/main/res/values-ar/strings.xml

@@ -1299,6 +1299,7 @@
     <string name="pending_deletion_error">تعذّرت استعادة حسابك. يرجى المحاولة مرة أخرى.</string>
     <string name="pending_deletion_restored">مرحبًا بعودتك. تمت استعادة حسابك.</string>
     <string name="image_blocked_placeholder">[تم حظر الصورة]</string>
+    <string name="csrf_unavailable">هذه الجلسة معطوبة! يرجى تسجيل الدخول مرة أخرى.</string>
     <string name="received_on_prefix">تم الاستلام على %s</string>
     <string name="received_on_label">تم الاستلام على</string>
     <string name="auto_advance_label">بعد الأرشفة أو الحذف</string>

app/src/main/res/values-de/strings.xml

@@ -1292,6 +1292,7 @@
     <string name="pending_deletion_error">Ihr Konto konnte nicht wiederhergestellt werden. Bitte versuchen Sie es erneut.</string>
     <string name="pending_deletion_restored">Willkommen zurück. Ihr Konto wurde wiederhergestellt.</string>
     <string name="image_blocked_placeholder">[Bild blockiert]</string>
+    <string name="csrf_unavailable">Diese Sitzung ist fehlerhaft! Bitte melden Sie sich erneut an.</string>
     <string name="received_on_prefix">empfangen an %s</string>
     <string name="received_on_label">Empfangen an</string>
     <string name="auto_advance_label">Nach Archivieren oder Löschen</string>

app/src/main/res/values-es/strings.xml

@@ -1292,6 +1292,7 @@
     <string name="pending_deletion_error">No se pudo restaurar tu cuenta. Inténtalo de nuevo.</string>
     <string name="pending_deletion_restored">Bienvenido de nuevo. Tu cuenta ha sido restaurada.</string>
     <string name="image_blocked_placeholder">[Imagen bloqueada]</string>
+    <string name="csrf_unavailable">¡Esta sesión está dañada! Vuelve a iniciar sesión.</string>
     <string name="received_on_prefix">recibido en %s</string>
     <string name="received_on_label">Recibido en</string>
     <string name="auto_advance_label">Después de archivar o eliminar</string>

app/src/main/res/values-fr/strings.xml

@@ -1907,6 +1907,7 @@
     <string name="pending_deletion_error">Impossible de restaurer votre compte. Veuillez réessayer.</string>
     <string name="pending_deletion_restored">Bon retour. Votre compte a été restauré.</string>
     <string name="image_blocked_placeholder">[Image bloquée]</string>
+    <string name="csrf_unavailable">Cette session est corrompue ! Veuillez vous reconnecter.</string>
     <string name="received_on_prefix">reçu sur %s</string>
     <string name="received_on_label">Reçu sur</string>
     <string name="auto_advance_label">Après archivage ou suppression</string>

app/src/main/res/values-it/strings.xml

@@ -1291,6 +1291,7 @@
     <string name="pending_deletion_error">Impossibile ripristinare il tuo account. Riprova.</string>
     <string name="pending_deletion_restored">Bentornato. Il tuo account è stato ripristinato.</string>
     <string name="image_blocked_placeholder">[Immagine bloccata]</string>
+    <string name="csrf_unavailable">Questa sessione è danneggiata! Effettua nuovamente l\'accesso.</string>
     <string name="received_on_prefix">ricevuto su %s</string>
     <string name="received_on_label">Ricevuto su</string>
     <string name="auto_advance_label">Dopo l\'archiviazione o l\'eliminazione</string>

app/src/main/res/values-ja/strings.xml

@@ -1289,6 +1289,7 @@
     <string name="pending_deletion_error">アカウントを復元できませんでした。もう一度お試しください。</string>
     <string name="pending_deletion_restored">おかえりなさい。アカウントが復元されました。</string>
     <string name="image_blocked_placeholder">[画像はブロックされました]</string>
+    <string name="csrf_unavailable">このセッションは壊れています！もう一度ログインしてください。</string>
     <string name="received_on_prefix">%s で受信</string>
     <string name="received_on_label">受信アドレス</string>
     <string name="auto_advance_label">アーカイブまたは削除後</string>

app/src/main/res/values-ko/strings.xml

@@ -1289,6 +1289,7 @@
     <string name="pending_deletion_error">계정을 복원할 수 없습니다. 다시 시도해 주세요.</string>
     <string name="pending_deletion_restored">다시 오신 것을 환영합니다. 계정이 복원되었습니다.</string>
     <string name="image_blocked_placeholder">[이미지 차단됨]</string>
+    <string name="csrf_unavailable">이 세션이 손상되었습니다! 다시 로그인해 주세요.</string>
     <string name="received_on_prefix">%s(으)로 수신</string>
     <string name="received_on_label">수신 주소</string>
     <string name="auto_advance_label">보관 또는 삭제 후</string>

app/src/main/res/values-nl/strings.xml

@@ -1291,6 +1291,7 @@
     <string name="pending_deletion_error">Kan je account niet herstellen. Probeer het opnieuw.</string>
     <string name="pending_deletion_restored">Welkom terug. Je account is hersteld.</string>
     <string name="image_blocked_placeholder">[Afbeelding geblokkeerd]</string>
+    <string name="csrf_unavailable">Deze sessie is beschadigd! Log opnieuw in.</string>
     <string name="received_on_prefix">ontvangen op %s</string>
     <string name="received_on_label">Ontvangen op</string>
     <string name="auto_advance_label">Na archiveren of verwijderen</string>