From 5bf816860c6b2bfcb71462f02253093fdadc910e Mon Sep 17 00:00:00 2001
From: zkldi <20380519+zkldi@users.noreply.github.com>
Date: Sun, 2 Jan 2022 19:02:31 +0000
Subject: [PATCH 1/2] Dual logins should destroy the users session and recreate
 it.

---
 server/package.json                            |  2 +-
 server/src/lib/constants/version.ts            |  2 +-
 server/src/server/router/api/v1/auth/router.ts | 12 +++++-------
 3 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/server/package.json b/server/package.json
index a522d5940..db9c5b364 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "tachi-server",
-	"version": "2.0.27",
+	"version": "2.0.28",
 	"description": "A score tracking server.",
 	"main": "js/index.js",
 	"private": true,
diff --git a/server/src/lib/constants/version.ts b/server/src/lib/constants/version.ts
index 8c8b088a7..c18bc8e9a 100644
--- a/server/src/lib/constants/version.ts
+++ b/server/src/lib/constants/version.ts
@@ -4,7 +4,7 @@
 
 const MAJOR = 2;
 const MINOR = 0;
-const PATCH = 27;
+const PATCH = 28;
 
 // As is with all front-facing zkldi projects, the version names for tachi-server
 // are from an album I like. In this case, the album is Portishead - Dummy.
diff --git a/server/src/server/router/api/v1/auth/router.ts b/server/src/server/router/api/v1/auth/router.ts
index eda1eadf7..12a47ebe6 100644
--- a/server/src/server/router/api/v1/auth/router.ts
+++ b/server/src/server/router/api/v1/auth/router.ts
@@ -61,14 +61,12 @@ router.post(
 	),
 	async (req, res) => {
 		if (req.session.tachi?.user.id) {
-			logger.info(`Dual log-in attempted from ${req.session.tachi.user.id}`);
-			return res.status(409).json({
-				success: false,
-				description: `You are already logged in as someone.`,
-			});
+			// @ts-expect-error Type error with the @types/express-session library,
+			// i think.
+			req.session.destroy();
 		}
 
-		logger.verbose(`received login request with username ${req.body.username} (${req.ip})`);
+		logger.verbose(`Received login request with username ${req.body.username} (${req.ip})`);
 
 		/* istanbul ignore next */
 		if (Environment.nodeEnv === "production" || Environment.nodeEnv === "staging") {
@@ -85,7 +83,7 @@ router.post(
 
 			logger.verbose("Captcha validated!");
 		} else {
-			logger.verbose("Skipped captcha check because not in production.");
+			logger.warn("Skipped captcha check because not in production.");
 		}
 
 		const requestedUser = await GetUserCaseInsensitive(req.body.username);

From 11c989ca0b17fff856bf7bf3ffa4828550d6a80e Mon Sep 17 00:00:00 2001
From: zkldi <20380519+zkldi@users.noreply.github.com>
Date: Sun, 2 Jan 2022 19:59:48 +0000
Subject: [PATCH 2/2] Set the session to undefined, instead.

---
 server/src/server/router/api/v1/auth/router.test.ts | 5 +++--
 server/src/server/router/api/v1/auth/router.ts      | 4 +---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/server/src/server/router/api/v1/auth/router.test.ts b/server/src/server/router/api/v1/auth/router.test.ts
index 2d671e364..d6928acdd 100644
--- a/server/src/server/router/api/v1/auth/router.test.ts
+++ b/server/src/server/router/api/v1/auth/router.test.ts
@@ -33,7 +33,7 @@ t.test("POST /api/v1/auth/login", (t) => {
 		t.end();
 	});
 
-	t.test("Should return 409 if user already logged in", async (t) => {
+	t.test("Should return 200 if user already logged in", async (t) => {
 		const res = await mockApi.post("/api/v1/auth/login").send({
 			username: "test_zkldi",
 			"!password": "password",
@@ -51,7 +51,8 @@ t.test("POST /api/v1/auth/login", (t) => {
 			})
 			.set("Cookie", cookie);
 
-		t.equal(res2.status, 409);
+		// even if they have a login already going, just let them log in.
+		t.equal(res2.status, 200);
 
 		t.end();
 	});
diff --git a/server/src/server/router/api/v1/auth/router.ts b/server/src/server/router/api/v1/auth/router.ts
index 12a47ebe6..9eeeea0fb 100644
--- a/server/src/server/router/api/v1/auth/router.ts
+++ b/server/src/server/router/api/v1/auth/router.ts
@@ -61,9 +61,7 @@ router.post(
 	),
 	async (req, res) => {
 		if (req.session.tachi?.user.id) {
-			// @ts-expect-error Type error with the @types/express-session library,
-			// i think.
-			req.session.destroy();
+			req.session.tachi = undefined;
 		}
 
 		logger.verbose(`Received login request with username ${req.body.username} (${req.ip})`);