Make session lookups also check for underlying row that the returned ID represents.

This commit is contained in:
Jennifer Taylor 2026-06-27 03:30:57 +00:00
parent ef64f15595
commit bb07a1e0bc
2 changed files with 11 additions and 2 deletions

View File

@ -140,7 +140,7 @@ class MachineData(BaseData):
def from_session(self, session: str) -> Optional[ArcadeID]:
"""
Given a previously-opened session, look up a user ID.
Given a previously-opened session, look up an arcade ID.
Parameters:
session - String identifying a session that was opened by create_session.
@ -151,6 +151,10 @@ class MachineData(BaseData):
arcadeid = self._from_session(session, "arcadeid")
if arcadeid is None:
return None
sql = "SELECT id FROM arcade WHERE id = :arcadeid LIMIT 1"
cursor = self.execute(sql, {"arcadeid": arcadeid})
if cursor.rowcount != 1:
return None
return ArcadeID(arcadeid)
def get_machine(self, pcbid: str) -> Optional[Machine]:
@ -570,7 +574,7 @@ class MachineData(BaseData):
def create_session(self, arcadeid: ArcadeID, expiration: int = (30 * 86400)) -> str:
"""
Given a user ID, create a session string.
Given an arcade ID, create a session string.
Parameters:
arcadeid - Arcade ID we wish to start a session for.

View File

@ -278,6 +278,11 @@ class UserData(BaseData):
userid = self._from_session(session, "userid")
if userid is None:
return None
sql = "SELECT id FROM user WHERE id = :userid LIMIT 1"
cursor = self.execute(sql, {"userid": userid})
if cursor.rowcount != 1:
return None
return UserID(userid)
def get_user(self, userid: UserID) -> Optional[User]: