fix: decrypt session before setting cookies in auth flows

[0x0elliot]

this was stupid on my part. i never tested login itself, i was too concerned about existing users not getting locked out. testing properly this time (the attached session is an invalid one)

Checklist to test for myself:

• Login request
• Registration flow
• SSO flows
• Existing logged in user flow
• Make sure that GetUser and HandleApiAuthentication returns unencrypted user API and session tokens

[0x0elliot]

this PR still makes me nervous. anything auth related does. please run through it once again.

[frikky]

Fix merge conflicts so I can try it out properly please :)

I can also recommend splitting the Session problem and API key as they are separate.

And yes, this HAS to work with old sessions AND hashed ones. Same for old apikeys AND hashed apikeys.

Etc.

[frikky]

@yashsinghcodes ping

[yashsinghcodes]

shouldn't we still handle this? In case somehow the Encryption fails we will have a log on it for debugging.

[0x0elliot]

why can't i see what line you have commented on. can you point out the code block for me?

[0x0elliot]

Fix merge conflicts so I can try it out properly please :)

I can also recommend splitting the Session problem and API key as they are separate.

And yes, this HAS to work with old sessions AND hashed ones. Same for old apikeys AND hashed apikeys.

Etc.

Done @frikky

[frikky]

Fix merge conflicts so I can try it out properly please :)
I can also recommend splitting the Session problem and API key as they are separate.
And yes, this HAS to work with old sessions AND hashed ones. Same for old apikeys AND hashed apikeys.
Etc.

Done @frikky

@yashsinghcodes I want your go-ahead before I spend time on this again. Review both apikeys and sessions, for new users AND existing ones, as to see if absolutely anything breaks.