WIP

private/minis-backend/src/main/kotlin/de/walamana/plugins/Security.kt

@@ -58,6 +58,8 @@ fun Payload.mid() = getClaim("id").asInt()
 
 
 object Security {
+    fun DEFAULT_EXPIRY() = Date(System.currentTimeMillis() + 1000*60*60);
+
     suspend fun authenticateUser(application: Application, username: String, password: String): Ministrant? {
         if(username == "admin") {
             val adminPw = application.environment.config.property("admin.password").getString()
@@ -97,6 +99,6 @@ object Security {
             .withIssuer(jwtEnv.issuer)
             .withClaim("username", ministrant.username)
             .withClaim("id", ministrant.id)
-            .withExpiresAt(Date(System.currentTimeMillis() + 1000*60*60))
+            .withExpiresAt(DEFAULT_EXPIRY())
             .sign(Algorithm.HMAC256(jwtEnv.secret))
 }

private/minis-backend/src/main/kotlin/de/walamana/views/AuthenticationView.kt

@@ -28,7 +28,7 @@ data class AuthenticationRequest(
 @Serializable
 data class AuthenticationResult(
     val success: Boolean,
-    val token: String? = null
+    val privileges: List<String>? = null,
 )
 
 @Serializable
@@ -54,8 +54,14 @@ fun Route.configureAuthenticationRoutes() {
             }
 
             val token = Security.createToken(jwtEnv, ministrant)
+            val expiry = Security.DEFAULT_EXPIRY().toGMTString()
 
-            call.respond(AuthenticationResult(true, token.toString()))
+            call.response.header(
+                "Set-Cookie",
+                "token=$token; HttpOnly; Expires=$expiry"
+            )
+
+            call.respond(AuthenticationResult(true, ministrant.privileges))
         }
 
         authenticate {
@@ -80,6 +86,7 @@ fun Route.configureAuthenticationRoutes() {
 
                 Security.setPassword(request.username, newPassword)
 
+
                 call.respond(hashMapOf("password" to newPassword))