Validate main PHP sessions against user IDs

Signed-off-by: Sean Du <do4suki@gmail.com>

internal/session/login.go

@@ -19,3 +19,13 @@ func (ss *Session) SetAuthKey(authKey *loginmodel.AuthKey) {
 		return
 	}
 }
+
+func (ss *Session) IsAuthorizeTokenForUser(token string, userID int) (bool, error) {
+	if token == "" || userID <= 0 {
+		return false, nil
+	}
+
+	return ss.UserEng.Table(new(loginmodel.AuthKey)).
+		Where("authorize_token = ? AND user_id = ?", token, userID).
+		Exist()
+}

internal/session/session.go

@@ -53,15 +53,18 @@ func New(ctx *gin.Context) *Session {
 	ss.UserEng = db.UserEng.NewSession()
 	ss.UserEng.Begin()
 
-	userID := ctx.GetString("userid")
-	if userID != "" {
-		ss.UserPref = ss.GetUserPref(userID)
-		ss.UserID = ss.UserPref.UserID
-	}
-
 	return ss
 }
 
+func (ss *Session) LoadUser(userID string) {
+	ss.UserPref = ss.GetUserPref(userID)
+	ss.UserID = ss.UserPref.UserID
+}
+
+func (ss *Session) Done() bool {
+	return ss.done
+}
+
 func Get(ctx *gin.Context) *Session {
 	return ctx.MustGet("session").(*Session)
 }