@7365admin1/core 3.48.1-staging.205 → 3.48.1-staging.206

package/.changeset/revoke-sessions-when-access-is-taken-away.md

@@ -0,0 +1,63 @@
+---
+"@7365admin1/core": minor
+---
+
+Make revoking somebody's access actually end their session.
+
+A session in this product is an opaque `sid` whose only record of truth is a
+Redis key `sid:<sid>` holding a copy of the user document. `requireAuth`
+authenticates a request by finding that key and nothing else — it never reads
+the database — and it re-`EXPIRE`s the key to four hours on every request, so a
+session that is in use never ages out on its own.
+
+**Signing out was never the problem.** `logout()` deletes the key, so a
+signed-out session is refused; that half already worked. Every other way access
+is taken away did not.
+
+**Suspending somebody changed a column and nothing else.**
+`suspendResidentById` writes `users.status = "suspended"` through
+`updateUserFieldById`, which cleared the user-document cache and left the
+`sid:` key untouched. The person carried on working, and every request they made
+pushed the four-hour expiry out another four hours. On top of that,
+`refreshToken()` minted a **brand new** session through `issueSession` with no
+account-status check at all — the mobile refresh token is seven days and
+rotating, so a suspended account's phone could keep issuing itself fresh
+sessions indefinitely. Suspension was not a delay, it was a no-op for anyone
+already signed in.
+
+**Two of the statuses the product writes were never refused at sign-in either.**
+Both `login()`s checked `suspended` and `pending` only, so `rejected` (written by
+`reviewPerson`, whose email is the one that hides the login link) and `deleted`
+(`UserStatus.DELETED`, the soft-delete marker) could sign in fresh with a
+password.
+
+The fix is the two halves of that, at the two choke points that already exist:
+
+- **Minting refuses a non-live account** — `assertAccountLive` in `issueSession`
+  in both auth services, which is the one place every sign-in path in this
+  package goes through (login and mobile refresh, v1 and v2), for the same
+  reason `assertOrganizationNotSuspended` lives there.
+- **Revoking destroys what already exists** — `revokeAccountAccess` from
+  `updateUserFieldById`, the only path in either user repository that writes
+  `users.status`. It deletes every `sid:` key the person holds and every refresh
+  token in `tokens`, so nothing can mint a replacement.
+
+Finding every session a person holds needs an index: `users.sid` only ever
+remembers the most recent sign-in, v2 never writes it, and nothing reads it — a
+fix built on that column would revoke the phone and leave the browser signed in.
+The index is a Redis set (`user-sessions:<userId>`), so there is no schema
+change and no migration; `users.sid` stays as the fallback that catches v1
+sessions minted before the set existed.
+
+The blocking statuses are `suspended`, `pending`, `rejected` and `deleted`, as a
+deny-list — `status` is optional on the model and legacy rows carry `""` or no
+field at all, and an allow-list would lock every one of them out. `resubmit` is
+deliberately live: that email keeps the login link, because resubmitting the
+application is done signed in.
+
+Nothing is logged out by deploying this — no existing session is touched, and
+the two sign-in messages for `suspended` and `pending` are unchanged, because
+`login()` still checks those two itself before minting. What changes for a
+signed-in user is only that a `rejected` or soft-deleted account can no longer
+obtain a session, and that a suspension now takes effect at once rather than
+never.

package/dist/index.d.ts

@@ -67,6 +67,7 @@ declare function useSessionRepo(): {
         token: string;
     }>;
     revokeFamily: (familyId: string, session?: ClientSession) => Promise<void>;
+    revokeAllForUser: (userId: string | ObjectId, session?: ClientSession) => Promise<void>;
 };
 
 declare function useAuthService(): {
@@ -993,8 +994,8 @@ declare const TPrice: z.ZodObject<{
     updatedAt: z.ZodOptional<z.ZodDate>;
     deletedAt: z.ZodOptional<z.ZodDate>;
 }, "strip", z.ZodTypeAny, {
-    name: string;
     type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+    name: string;
     value: number;
     _id?: ObjectId | undefined;
     createdAt?: Date | undefined;
@@ -1016,8 +1017,8 @@ declare const TPrice: z.ZodObject<{
 type TPrice = z.infer<typeof TPrice>;
 declare function usePriceModel(db: Db): {
     createPrice: (value: Pick<TPrice, "type" | "name" | "value">) => {
-        name: string;
         type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+        name: string;
         value: number;
         _id?: ObjectId | undefined;
         createdAt?: Date | undefined;
@@ -1037,8 +1038,8 @@ declare function usePriceModel(db: Db): {
         saleValue?: number | undefined;
         saleExpiry?: Date | undefined;
     }, {
-        name: string;
         type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+        name: string;
         value: number;
         _id?: ObjectId | undefined;
         createdAt?: Date | undefined;
@@ -1048,8 +1049,8 @@ declare function usePriceModel(db: Db): {
         saleExpiry?: Date | undefined;
     }>;
     collection: Collection<{
-        name: string;
         type: "other" | "one-time-payment" | "monthly-subscription" | "yearly-subscription";
+        name: string;
         value: number;
         _id?: ObjectId | undefined;
         createdAt?: Date | undefined;
@@ -1226,8 +1227,8 @@ declare const TInvoice: z.ZodObject<{
     createdAt: z.ZodOptional<z.ZodDefault<z.ZodDate>>;
     updatedAt: z.ZodOptional<z.ZodDate>;
 }, "strip", z.ZodTypeAny, {
-    status: "pending" | "cancelled" | "paid" | "overdue";
     type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+    status: "pending" | "cancelled" | "paid" | "overdue";
     items: {
         description: string;
         total: number;
@@ -1263,8 +1264,8 @@ declare const TInvoice: z.ZodObject<{
     dueDate: Date;
     _id?: string | ObjectId | undefined;
     createdAt?: Date | undefined;
-    status?: "pending" | "cancelled" | "paid" | "overdue" | undefined;
     type?: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment" | undefined;
+    status?: "pending" | "cancelled" | "paid" | "overdue" | undefined;
     updatedAt?: Date | undefined;
     metadata?: {
         description?: string | undefined;
@@ -1280,8 +1281,8 @@ type TInvoice = z.infer<typeof TInvoice>;
 declare function useInvoiceModel(db: Db): {
     createInvoice: (data: TInvoice) => TInvoice;
     collection: Collection<{
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -1312,8 +1313,8 @@ declare function useInvoiceRepo(): {
     createUniqueIndex: () => Promise<void>;
     add: (value: TInvoice, session?: ClientSession) => Promise<void>;
     getByDueDate: (dueDate: Date, status?: TInvoice["status"]) => Promise<{
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -1348,8 +1349,8 @@ declare function useInvoiceRepo(): {
         pages: number;
         pageRange: string;
     } | {
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -1374,8 +1375,8 @@ declare function useInvoiceRepo(): {
         descriptions?: string | undefined;
     }>;
     getOverdueInvoices: (BATCH_SIZE?: number) => Promise<{
-        status: "pending" | "cancelled" | "paid" | "overdue";
         type: "other" | "organization-subscription" | "affiliate-subscription" | "one-time-payment";
+        status: "pending" | "cancelled" | "paid" | "overdue";
         items: {
             description: string;
             total: number;
@@ -9860,8 +9861,8 @@ declare function useUserRepoV2(): {
     createTextIndex: () => Promise<void>;
     createUniqueIndex: () => Promise<void>;
     createUser: (value: TUser, session?: ClientSession) => Promise<ObjectId>;
-    getUserByEmail: (email: string) => Promise<TUser | mongodb.WithId<bson.Document> | null>;
-    getUserByEmailStatus: (email: string) => Promise<TUser | mongodb.WithId<bson.Document> | null>;
+    getUserByEmail: (email: string) => Promise<mongodb.WithId<bson.Document> | TUser | null>;
+    getUserByEmailStatus: (email: string) => Promise<mongodb.WithId<bson.Document> | TUser | null>;
     getUserById: (id: string | ObjectId) => Promise<TUser>;
     getUsers: ({ search, page, limit, sort, type, status, }: {
         search?: string | undefined;