finalize sse login

* redirect and save the cookie
* supress a warning and redirect immediatly

web/assets/login-events.js

@@ -9,6 +9,7 @@ evtSource.onerror = (e) => {
     failed.textContent = "Warning: The connection to the server was interupted."
 }
 
+// TODO: change to some css-style progress indicator
 evtSource.addEventListener("ping", (e) => {
   ping.textContent = e.data;
 })
@@ -18,6 +19,6 @@ evtSource.addEventListener("failed", (e) => {
 })
 
 evtSource.addEventListener("success", (e) => {
-  console.log('trigger redirect!')
-  alert(e.data)
+  evtSource.close()
+  window.location = `/sse/finalize?token=${e.data}`
 })

web/handlers/auth/withssb.go

@@ -75,6 +75,7 @@ func NewWithSSBHandler(
 
 	m.HandleFunc("/sse/login", r.HTML("auth/withssb_server_start.tmpl", ssb.startWithServer))
 	m.HandleFunc("/sse/events", ssb.eventSource)
+	m.HandleFunc("/sse/finalize", ssb.finalizeCookie)
 
 	return &ssb
 }
@@ -154,22 +155,31 @@ func (h WithSSBHandler) login(w http.ResponseWriter, req *http.Request) (interfa
 		return nil, err
 	}
 
-	session, err := h.cookieStore.Get(req, siwssbSessionName)
-	if err != nil {
-		err = fmt.Errorf("sign-in with ssb: failed to load cookie session: %w", err)
-		return nil, err
-	}
-
-	session.Values[memberToken] = tok
-	session.Values[userTimeout] = time.Now().Add(lifetime)
-	if err := session.Save(req, w); err != nil {
-		err = fmt.Errorf("sign-in with ssb: failed to update cookie session: %w", err)
+	if err := h.saveCookie(w, req, tok); err != nil {
 		return nil, err
 	}
 
 	return "you are now logged in!", nil
 }
 
+func (h WithSSBHandler) saveCookie(w http.ResponseWriter, req *http.Request, token string) error {
+
+	session, err := h.cookieStore.Get(req, siwssbSessionName)
+	if err != nil {
+		err = fmt.Errorf("sign-in with ssb: failed to load cookie session: %w", err)
+		return err
+	}
+
+	session.Values[memberToken] = token
+	session.Values[userTimeout] = time.Now().Add(lifetime)
+	if err := session.Save(req, w); err != nil {
+		err = fmt.Errorf("sign-in with ssb: failed to update cookie session: %w", err)
+		return err
+	}
+
+	return nil
+}
+
 // custom sessionKey type to prevent collision
 type sessionKey uint
 
@@ -396,6 +406,7 @@ func (h WithSSBHandler) eventSource(w http.ResponseWriter, r *http.Request) {
 			sendServerEvent(w, evt)
 
 			logger.Log("event", "sent", "worked", update.Worked)
+			return
 		}
 		evtID++
 		flusher.Flush()
@@ -410,3 +421,18 @@ func sendServerEvent(w io.Writer, evt event) {
 	}
 	fmt.Fprint(w, "\n")
 }
+
+func (h WithSSBHandler) finalizeCookie(w http.ResponseWriter, r *http.Request) {
+	tok := r.URL.Query().Get("token")
+
+	if _, err := h.sessiondb.CheckToken(r.Context(), tok); err != nil {
+		http.Error(w, "invalid session token", http.StatusInternalServerError)
+		return
+	}
+
+	if err := h.saveCookie(w, r, tok); err != nil {
+		http.Error(w, "failed to save cookie", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+}

web/templates/auth/withssb_server_start.tmpl

@@ -5,7 +5,7 @@
       </div>
       <div>
         <img src="{{.QRCodeURI}}" alt="QR-Code to pass the challenge to an App" />
-        <a href="{{.SSBURI}}">{{i18n "GenericOpenLink"}}</a>
+        <a href="{{.SSBURI}}" target="_blank">{{i18n "GenericOpenLink"}}</a>
 
         <h3>Server events</h3>
         <p id="ping"></p>