api/common.go

@@ -73,6 +73,20 @@ func tokenFromRequest(r *http.Request) ([]byte, error) {
 	return token, nil
 }
 
+func usernameFromRequest(r *http.Request) (string, error) {
+	token, err := tokenFromRequest(r)
+	if err != nil {
+		return "", err
+	}
+
+	username, err := db.FetchUsernameFromToken(token)
+	if err != nil {
+		return "", fmt.Errorf("failed to validate token: %s", err)
+	}
+
+	return username, nil
+}
+
 func uuidFromRequest(r *http.Request) ([]byte, error) {
 	token, err := tokenFromRequest(r)
 	if err != nil {

api/endpoints.go

@@ -39,15 +39,15 @@ import (
 // account
 
 func handleAccountInfo(w http.ResponseWriter, r *http.Request) {
-	uuid, err := uuidFromRequest(r)
+	username, err := usernameFromRequest(r)
 	if err != nil {
 		httpError(w, r, err, http.StatusBadRequest)
 		return
 	}
 
-	username, err := db.FetchUsernameFromUUID(uuid)
+	uuid, err := uuidFromRequest(r) // lazy
 	if err != nil {
-		httpError(w, r, err, http.StatusInternalServerError)
+		httpError(w, r, err, http.StatusBadRequest)
 		return
 	}
 

db/account.go

@@ -18,6 +18,7 @@
 package db
 
 import (
+	"database/sql"
 	"fmt"
 	"slices"
 
@@ -185,6 +186,16 @@ func DeleteClaimedAccountCompensations(uuid []byte) error {
 	return nil
 }
 
+func FetchUsernameFromToken(token []byte) (string, error) {
+	var username string
+	err := handle.QueryRow("SELECT a.username FROM accounts a JOIN sessions s ON s.uuid = a.uuid WHERE s.token = ? AND s.expire > UTC_TIMESTAMP()", token).Scan(&username)
+	if err != nil {
+		return "", err
+	}
+
+	return username, nil
+}
+
 func FetchAccountKeySaltFromUsername(username string) ([]byte, []byte, error) {
 	var key, salt []byte
 	err := handle.QueryRow("SELECT hash, salt FROM accounts WHERE username = ?", username).Scan(&key, &salt)
@@ -234,8 +245,12 @@ func UpdateActiveSession(uuid []byte, token []byte) error {
 
 func FetchUUIDFromToken(token []byte) ([]byte, error) {
 	var uuid []byte
-	err := handle.QueryRow("SELECT uuid FROM sessions WHERE token = ?", token).Scan(&uuid)
+	err := handle.QueryRow("SELECT uuid FROM sessions WHERE token = ? AND expire > UTC_TIMESTAMP()", token).Scan(&uuid)
 	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, err
+		}
+
 		return nil, err
 	}
 
@@ -250,13 +265,3 @@ func RemoveSessionFromToken(token []byte) error {
 
 	return nil
 }
-
-func FetchUsernameFromUUID(uuid []byte) (string, error) {
-	var username string
-	err := handle.QueryRow("SELECT username FROM accounts WHERE uuid = ?", uuid).Scan(&username)
-	if err != nil {
-		return "", err
-	}
-
-	return username, nil
-}