add more stuff

src/main/kotlin/com/restapi/Main.kt

@@ -5,12 +5,15 @@ import com.restapi.config.*
 import com.restapi.config.AppConfig.Companion.appConfig
 import com.restapi.config.Auth.validateAuthToken
 import com.restapi.controllers.Entities
+import com.restapi.domain.AnonSession
 import com.restapi.domain.DataNotFoundException
+import com.restapi.domain.Session
 import com.restapi.domain.Session.currentTenant
 import com.restapi.domain.Session.currentUser
 import com.restapi.domain.Session.objectMapper
 import com.restapi.domain.Session.setAuthorizedUser
 import com.restapi.domain.Session.signPayload
+import com.restapi.domain.TenantModel
 import io.ebean.DataIntegrityException
 import io.ebean.DuplicateKeyException
 import io.javalin.Javalin
@@ -60,6 +63,43 @@ fun main(args: Array<String>) {
         }
         .routes {
             path("/auth") {
+                get("/session") {
+                    //a simple session to keep track of anon users
+                    val at = it.getAuthHeader()
+                    val tenant = Session.database.find(TenantModel::class.java)
+                        .where()
+                        .eq("domain",it.host())
+                        .findOne() ?: throw UnauthorizedResponse()
+
+                    if(at == null){
+                        //new session
+                        val s = AnonSession().apply {
+                            sessionId = UUID.randomUUID().toString()
+                            firstSeenAt = LocalDateTime.now()
+                            lastSeenAt = LocalDateTime.now()
+                            tenantId = tenant.name
+                            headerMap = it.headerMap()
+                        }
+                        Session.database.save(s)
+                        it.json(s)
+                    } else {
+                        val s = Session.database.find(AnonSession::class.java)
+                            .where()
+                            .eq("sessionId", at)
+                            .findOne() ?: throw UnauthorizedResponse()
+
+
+                        Session.database.save(
+                            s.apply {
+                                lastSeenAt = LocalDateTime.now()
+                                headerMap = it.headerMap()
+                            }
+                        )
+
+                        it.json(s)
+                    }
+
+                }
                 get("/endpoint", Auth::endPoint)
                 get("/init", Auth::init)
                 get("/code", Auth::code)
@@ -74,10 +114,10 @@ fun main(args: Array<String>) {
                     TimeUnit.MINUTES
                 )
 
-                val authToken = ctx.header("Authorization")
-                    ?.replace("Bearer ", "")
-                    ?.replace("Bearer: ", "")
-                    ?.trim() ?: throw UnauthorizedResponse()
+                val authToken = ctx.getAuthHeader() ?: throw UnauthorizedResponse()
+
+
+                //there are 2 scenarios, 1) auth user for admin 2) non user for flow, we need to handle both
 
                 setAuthorizedUser(validateAuthToken(authToken = authToken))
 
@@ -96,11 +136,12 @@ fun main(args: Array<String>) {
                 it.header("X-Signature", signPayload(outEncoded))
 
                 if (appConfig.enforcePayloadEncryption()) {
-                    //todo:, encrypt and set the response back to user
+                    //todo: encrypt and send the response back to user
                 }
 
             }
             path("/api") {
+
                 post("/audit/{action}") {
                     logger.warn("User ${currentUser()} of tenant ${currentTenant()} has performed ${it.pathParam("action")} @ ${LocalDateTime.now()}")
                     it.json(mapOf("status" to true))
@@ -132,3 +173,8 @@ fun main(args: Array<String>) {
         .start(appConfig.portNumber())
 }
 
+private fun Context.getAuthHeader() = header("Authorization")
+    ?.replace("Bearer ", "")
+    ?.replace("Bearer: ", "")
+    ?.trim()
+