@axhub/genie 0.2.8 → 0.2.10

package/server/middleware/auth.js

@@ -1,6 +1,8 @@
 import jwt from 'jsonwebtoken';
 import { userDb } from '../database/db.js';
 import { IS_PLATFORM } from '../constants/config.js';
+import { getLanSessionVersion } from '../lan-access/state.js';
+import { isLoopbackRequest } from '../lan-access/core.js';
 
 // Get JWT secret from environment or use default (for development)
 const JWT_SECRET = process.env.JWT_SECRET || 'claude-ui-dev-secret-change-in-production';
@@ -10,6 +12,37 @@ const PUBLIC_GET_ROUTE_PATTERNS = [
   /^\/api\/session-core\/providers(?:\/[^/]+)?\/?$/i,
 ];
 
+const DEFAULT_TOKEN_EXPIRY = '30d';
+
+function isSessionVersionAllowed(decodedToken, currentSessionVersion = getLanSessionVersion()) {
+  const expectedSessionVersion = Number.isInteger(currentSessionVersion) ? currentSessionVersion : 0;
+  const tokenSessionVersion = Number(decodedToken?.sessionVersion);
+
+  if (expectedSessionVersion <= 0) {
+    return tokenSessionVersion === 0 || Number.isNaN(tokenSessionVersion);
+  }
+
+  return Number.isInteger(tokenSessionVersion) && tokenSessionVersion === expectedSessionVersion;
+}
+
+function verifySignedToken(token, { expectedPurpose = null } = {}) {
+  const decoded = jwt.verify(token, JWT_SECRET);
+
+  if (expectedPurpose && decoded?.purpose !== expectedPurpose) {
+    const error = new Error('Invalid token purpose');
+    error.code = 'INVALID_TOKEN_PURPOSE';
+    throw error;
+  }
+
+  if (!isSessionVersionAllowed(decoded)) {
+    const error = new Error('Token session is no longer valid');
+    error.code = 'STALE_SESSION_VERSION';
+    throw error;
+  }
+
+  return decoded;
+}
+
 // Optional API key middleware
 const validateApiKey = (req, res, next) => {
   // Skip API key validation if not configured
@@ -36,17 +69,17 @@ const authenticateToken = async (req, res, next) => {
   }
 
   // Platform mode:  use single database user
-  if (IS_PLATFORM) {
+  if (IS_PLATFORM || isLoopbackRequest(req)) {
     try {
       const user = userDb.getFirstUser();
       if (!user) {
-        return res.status(500).json({ error: 'Platform mode: No user found in database' });
+        return res.status(500).json({ error: 'No default user found in database' });
       }
       req.user = user;
       return next();
     } catch (error) {
-      console.error('Platform mode error:', error);
-      return res.status(500).json({ error: 'Platform mode: Failed to fetch user' });
+      console.error('Local authentication bypass error:', error);
+      return res.status(500).json({ error: 'Failed to resolve local user' });
     }
   }
 
@@ -64,7 +97,7 @@ const authenticateToken = async (req, res, next) => {
   }
 
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
+    const decoded = verifySignedToken(token);
 
     // Verify user still exists and is active
     const user = userDb.getUserById(decoded.userId);
@@ -81,21 +114,29 @@ const authenticateToken = async (req, res, next) => {
 };
 
 // Generate JWT token (never expires)
-const generateToken = (user) => {
+const generateToken = (user, options = {}) => {
+  const {
+    expiresIn = DEFAULT_TOKEN_EXPIRY,
+    purpose = 'app',
+    sessionVersion = getLanSessionVersion(),
+  } = options;
+
   return jwt.sign(
-    { 
-      userId: user.id, 
-      username: user.username 
+    {
+      userId: user.id,
+      username: user.username,
+      purpose,
+      sessionVersion,
     },
-    JWT_SECRET
-    // No expiration - token lasts forever
+    JWT_SECRET,
+    expiresIn ? { expiresIn } : undefined
   );
 };
 
 // WebSocket authentication function
-const authenticateWebSocket = (token) => {
+const authenticateWebSocket = (token, request = null) => {
   // Platform mode: bypass token validation, return first user
-  if (IS_PLATFORM) {
+  if (IS_PLATFORM || isLoopbackRequest(request)) {
     try {
       const user = userDb.getFirstUser();
       if (user) {
@@ -114,7 +155,7 @@ const authenticateWebSocket = (token) => {
   }
 
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
+    const decoded = verifySignedToken(token);
     return decoded;
   } catch (error) {
     console.error('WebSocket token verification error:', error);
@@ -127,5 +168,7 @@ export {
   authenticateToken,
   generateToken,
   authenticateWebSocket,
+  isSessionVersionAllowed,
+  verifySignedToken,
   JWT_SECRET
 };