From 5ea7c6d8290bba9c291c6e47500a86a228cf4d50 Mon Sep 17 00:00:00 2001
From: Amy Gale Ruth Bowersox <amy@erbosoft.com>
Date: Sat, 20 Sep 2025 17:33:03 -0600
Subject: [PATCH] store only UID in session vars, not complete user

---
 database/user.go  | 8 +-------
 ui/amcontext.go   | 6 +++++-
 ui/session_mgr.go | 2 +-
 3 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/database/user.go b/database/user.go
index 4285450..0c299e2 100644
--- a/database/user.go
+++ b/database/user.go
@@ -10,7 +10,6 @@
 package database
 
 import (
-	"encoding/gob"
 	"fmt"
 	"time"
 )
@@ -35,11 +34,6 @@ type User struct {
 	DOB          *time.Time `db:"dob"`
 }
 
-// init registers data types from this module.
-func init() {
-	gob.Register(User{})
-}
-
 /* AmGetUser returns a reference to the specified user.
  * Parameters:
  *     uid - The UID of the user.
@@ -59,7 +53,7 @@ func AmGetUser(uid int32) (*User, error) {
 	return &(rc[0]), err
 }
 
-/* AmGetAmonUser returns a reference to the anonymous user.
+/* AmGetAnonUser returns a reference to the anonymous user.
  * Returns:
  *     Pointer to User containing anonymous user data, or nil
  *     Standard Go error status
diff --git a/ui/amcontext.go b/ui/amcontext.go
index e93de89..cfd6acf 100644
--- a/ui/amcontext.go
+++ b/ui/amcontext.go
@@ -49,7 +49,11 @@ type amContext struct {
 
 // CurrentUser returns the current user from the session.
 func (c *amContext) CurrentUser() *database.User {
-	return c.session.Values["user"].(*database.User)
+	u, err := database.AmGetUser(c.session.Values["user_id"].(int32))
+	if err != nil {
+		log.Errorf("unable to retrieve current user")
+	}
+	return u
 }
 
 // RC returns the HTTP result code for the current operation.
diff --git a/ui/session_mgr.go b/ui/session_mgr.go
index 90be4da..b301d5f 100644
--- a/ui/session_mgr.go
+++ b/ui/session_mgr.go
@@ -31,7 +31,7 @@ func SetupAmSession(session *sessions.Session) {
 	session.Values["temp"] = "Active"
 	u, err := database.AmGetAnonUser()
 	if err == nil {
-		session.Values["user"] = u
+		session.Values["user_id"] = u.Uid
 	} else {
 		log.Errorf("Unable to load anon user: %v", err)
 	}