Fix session status checking and handling

irmaserver/backend/api.go

@@ -97,7 +97,7 @@ func HandleProtocolMessage(
 		return
 	}
 
-	// However we return, if the session has been cancelled by any of the handlers
+	// However we return, if the session has been finished or cancelled by any of the handlers
 	// then we should inform the user by returning a SessionResult - but only if we have not
 	// already done this in the past, e.g. by a previous HTTP call handled by this function
 	defer func() {

irmaserver/backend/handle.go

@@ -20,17 +20,22 @@ func (session *session) handleDelete() {
 	session.markAlive()
 	// TODO const ProofStatusCancelled = irma.ProofStatus("CANCELLED") ?
 	session.result = &irmaserver.SessionResult{Token: session.token}
-	session.status = irmaserver.StatusCancelled
+	session.setStatus(irmaserver.StatusCancelled)
 }
 
 func (session *session) handleGetRequest(min, max *irma.ProtocolVersion) (irma.SessionRequest, *irma.RemoteError) {
+	if session.status != irmaserver.StatusInitialized {
+		return nil, getError(irmaserver.ErrorUnexpectedRequest, "Session already started")
+	}
+	session.markAlive()
+
 	var err error
 	if session.version, err = chooseProtocolVersion(min, max); err != nil {
 		return nil, session.fail(irmaserver.ErrorProtocolVersion, "")
 	}
-	session.markAlive()
-	session.status = irmaserver.StatusConnected
 	session.request.SetVersion(session.version)
+
+	session.setStatus(irmaserver.StatusConnected)
 	return session.request, nil
 }
 
@@ -38,21 +43,29 @@ func handleGetStatus(session *session) irmaserver.Status {
 	return session.status
 }
 
-func (session *session) handlePostSignature(signature *irma.SignedMessage) (irma.ProofStatus, *irma.RemoteError) {
+func (session *session) handlePostSignature(signature *irma.SignedMessage) (*irma.ProofStatus, *irma.RemoteError) {
+	if session.status != irmaserver.StatusConnected {
+		return nil, getError(irmaserver.ErrorUnexpectedRequest, "Session not yet started or already finished")
+	}
 	session.markAlive()
+
 	session.result.Signature = signature
 	session.result.Disclosed, session.result.Status = signature.Verify(
 		conf.IrmaConfiguration, session.request.(*irma.SignatureRequest))
-	session.finish()
-	return session.result.Status, nil
+	session.setStatus(irmaserver.StatusDone)
+	return &session.result.Status, nil
 }
 
-func (session *session) handlePostProofs(proofs gabi.ProofList) (irma.ProofStatus, *irma.RemoteError) {
+func (session *session) handlePostProofs(proofs gabi.ProofList) (*irma.ProofStatus, *irma.RemoteError) {
+	if session.status != irmaserver.StatusConnected {
+		return nil, getError(irmaserver.ErrorUnexpectedRequest, "Session not yet started or already finished")
+	}
 	session.markAlive()
+
 	session.result.Disclosed, session.result.Status = irma.ProofList(proofs).Verify(
 		conf.IrmaConfiguration, session.request.(*irma.DisclosureRequest))
-	session.finish()
-	return session.result.Status, nil
+	session.setStatus(irmaserver.StatusDone)
+	return &session.result.Status, nil
 }
 
 // Session helpers
@@ -61,17 +74,17 @@ func (session *session) finished() bool {
 	return session.status == irmaserver.StatusDone || session.status == irmaserver.StatusCancelled
 }
 
-func (session *session) finish() {
-	session.status = irmaserver.StatusDone
-}
-
 func (session *session) markAlive() {
 	session.lastActive = time.Now()
 }
 
+func (session *session) setStatus(status irmaserver.Status) {
+	session.status = status
+}
+
 func (session *session) fail(err irmaserver.Error, message string) *irma.RemoteError {
 	rerr := getError(err, message)
-	session.status = irmaserver.StatusCancelled
+	session.setStatus(irmaserver.StatusCancelled)
 	session.result = &irmaserver.SessionResult{Err: rerr, Token: session.token}
 	return rerr
 }

irmaserver/backend/issue.go

@@ -84,6 +84,11 @@ func (session *session) getProofP(commitments *gabi.IssueCommitmentMessage, sche
 }
 
 func (session *session) handlePostCommitments(commitments *gabi.IssueCommitmentMessage) ([]*gabi.IssueSignatureMessage, *irma.RemoteError) {
+	if session.status != irmaserver.StatusConnected {
+		return nil, getError(irmaserver.ErrorUnexpectedRequest, "Session not yet started or already finished")
+	}
+	session.markAlive()
+
 	request := session.request.(*irma.IssuanceRequest)
 	discloseCount := len(request.Disclose)
 	if len(commitments.Proofs) != len(request.Credentials)+discloseCount {
@@ -140,6 +145,6 @@ func (session *session) handlePostCommitments(commitments *gabi.IssueCommitmentM
 		sigs = append(sigs, sig)
 	}
 
-	session.finish()
+	session.setStatus(irmaserver.StatusDone)
 	return sigs, nil
 }

irmaserver/backend/sessions.go

@@ -19,8 +19,8 @@ type session struct {
 	token   string
 	version *irma.ProtocolVersion
 	request irma.SessionRequest
-	status  irmaserver.Status
 
+	status     irmaserver.Status
 	lastActive time.Time
 	returned   bool
 	result     *irmaserver.SessionResult
@@ -104,13 +104,13 @@ func newSession(action irma.Action, request irma.SessionRequest) *session {
 	s := &session{
 		action:     action,
 		request:    request,
-		status:     irmaserver.StatusInitialized,
 		lastActive: time.Now(),
 		token:      token,
 		result: &irmaserver.SessionResult{
 			Token: token,
 		},
 	}
+	s.setStatus(irmaserver.StatusInitialized)
 	nonce, _ := gabi.RandomBigInt(gabi.DefaultSystemParameters[2048].Lstatzk)
 	request.SetNonce(nonce)
 	request.SetContext(one)