[FR] Invalidating generated tokens about paseto HOT 5 CLOSED

...
pub fn issue_token(id: Uuid) -> String {
    let current_date_time = Utc::now();
    let dt = current_date_time + chrono::Duration::days(1);
    paseto::tokens::PasetoBuilder::new()
        .set_encryption_key(&Vec::from(SETTINGS.secret.secret_key.as_bytes()))
        .set_expiration(&dt)
        .set_not_before(&Utc::now())
        .set_claim("id", serde_json::json!(id))
        .build()
        .expect("Failed to construct paseto token w/ builder!")
}
...

...
pub async fn verify_token(token: String) -> Result<Session, BackendError> {
    let token = paseto::tokens::validate_local_token(
        &token,
        None,
        &SETTINGS.secret.secret_key.as_bytes(),
        &paseto::tokens::TimeBackend::Chrono,
    )
    .map_err(|e| BackendError::CannotDecryptToken(format!("Paseto: {}", e)))?;

    serde_json::from_value::<Session>(token)
        .map_err(|e| BackendError::CannotDecryptToken(format!("Serde_json: {}", e)))
}
...

use hex;
use rand::{RngCore, OsRng};
use redis::{Commands, Connection};

/// Store the session key prefix as a const so it can't be typo'd anywhere it's used.
const SESSION_KEY_PREFIX: &str = "valid_session_key_for_{}";

pub fn issue_token(
  id: Uuid,
  redis_connection: &mut Connection,
) -> Result<String, BackendError> {
    // I just generate 128 bytes of random data for the session key
    // from something that is cryptographically secure (rand::CryptoRng)
    //
    // You don't necessarily need a random value, but you'll want something
    // that is sufficiently not able to be guessed (you don't want someone getting
    // an old token that is supposed to not be live, and being able to get a valid
    // token from that).
    let session_key: String = {
      let mut buff = [0_u8; 128];
      OsRng.fill_bytes(&mut buff);
      hex::encode(buff)
    };
    let _ = redis_connection.set(
      format!("{}{}", SESSION_KEY_PREFIX, session_key),
      // I just want to validate that the key exists to indicate the session is "live".
      String::new(),
      // "expirey" isn't needed for the key in the data store the token itself has it
      // but since redis has this feature built-in and we know a session can't last more
      // than 24 hours, why pay for storing it if it can't be used?
      //
      // plus it may help us if we ever forget to add an `exp` key to the token
      // itself due to a bug.
    ).exp(DAY_AS_SECONDS).map_err(BackendError::RedisError)?;
    let current_date_time = Utc::now();
    let dt = current_date_time + chrono::Duration::days(1);
    paseto::tokens::PasetoBuilder::new()
        .set_encryption_key(&Vec::from(SETTINGS.secret.secret_key.as_bytes()))
        .set_expiration(&dt)
        .set_not_before(&Utc::now())
        .set_claim("id", serde_json::json!(id))
        // We need the session key to validate the user hasn't logged out.
        .set_claim("session_key", serde_json::json!(session_key))
        .build()
        .map_err(BackendError::PasetoEncodeError)
}

pub fn logout(
  session: Session,
  redis_connection: &mut Connection,
) -> Result<(), BackendError> {
   redis_connection
     .del(format!("{}{}", SESSION_KEY_PREFIX, session.session_key))
     .map_err(BackendError::RedisError)?;
   // ... whatever i would need to do for logging out.
}

pub fn verify_token(token: String, redis_connection: &mut Connection) -> Result<Session, BackendError> {
    let token = paseto::tokens::validate_local_token(
        &token,
        None,
        &SETTINGS.secret.secret_key.as_bytes(),
        &paseto::tokens::TimeBackend::Chrono,
    )
    .map_err(|e| BackendError::CannotDecryptToken(format!("Paseto: {}", e)))?;
    let session = serde_json::from_value::<Session>(token)
        .map_err(|e| BackendError::CannotDecryptToken(format!("Serde_json: {}", e)))?;
    // Now we check that the key is still present!
    if redis_connection
      .get::<_, _, Option<String>>(
        format!("{}{}", SESSION_KEY_PREFIX, session.session_key)
      ).map_err(BackendError::RedisError)?.is_none() {
      return Err(BackendError::TokenLoggedOut);
    }
    return Ok(session);
}