api: a stream opened with a token ends with it

A token was checked when a request came, and a stream answered to it (the dashboard's
events, a subscription's links and messages, the store's streams) then went on for as
long as the client kept it open: past the token's expiry, past its user's tokens being
revoked, its user disabled or removed, its session ended.

Now a middleware inside `login::bearer` (`login::streams_end`) ends a streaming answer
(`text/event-stream`, `application/x-ndjson`) to a request with a token at the token's
deadline, its expiry, or as soon as the document no longer takes it
(`token::still_taken`, the checks `verify` makes of the document, now its own
function): looked at when a change touches protocol data (the root, a switch, among
it), and when a session ends on the node itself in a swarm without a registry
(`AppState::session_ended`). No polling: a timer for the expiry, and the changes as
they come. The client reconnects with the token it has then; a refreshed token is a
new one, so a stream lasts a token's lifetime at most (12 hours by default).

`futures` is a dependency of every build now (for `take_until`), not only of libp2p's
and Tor's.

1 files changed, 3 insertions, 0 deletions

diff --git a/src/state/mod.rs b/src/state/mod.rs
index a2da643..2fbfd31 100644
--- a/src/state/mod.rs
+++ b/src/state/mod.rs
@@ -161,6 +161,9 @@ pub(crate) struct AppState {
     /// (`api::login::end_session`). This node refuses their tokens; others take them
     /// until they expire, and so does this one after a restart.
     pub(crate) ended_sessions: Arc<std::sync::Mutex<std::collections::BTreeMap<String, u64>>>,
+    /// Woken when a session ends on this node (`ended_sessions`): streams opened with
+    /// its tokens end (`api::login::streams_end`).
+    pub(crate) session_ended: Arc<tokio::sync::Notify>,
     pub(crate) token_lifetime: Duration,
     pub(crate) session_lifetime: Duration,
     /// How long a challenge to log in by key is valid, and how many logins by key a user