@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/lib/session.js

@@ -53,9 +53,11 @@ var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
 var { generateToken, sha3Hash } = require("./crypto");
 var cryptoField = require("./crypto-field");
+var frameworkSchema = require("./framework-schema");
 var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var safeJson = require("./safe-json");
+var sql = require("./sql");
 var { SessionError } = require("./framework-error");
 
 // vault is initialized at boot before sessions; lazyRequire keeps the
@@ -119,8 +121,33 @@ var SID_NAMESPACE  = "bj-session:";
 // behind the same helper.
 var SID_BYTES      = C.BYTES.bytes(32);
 
+// Logical session-table name. Two uses, deliberately distinct:
+//   - As the cryptoField registry key (sealRow / unsealRow / lookupHash),
+//     it stays the LOGICAL name — that is the key db.js registers the
+//     sealedFields + derivedHashes under, independent of any table prefix.
+//   - As the SQL table name, it is resolved through
+//     frameworkSchema.tableName(...) so a configured table prefix
+//     (b.frameworkSchema.setTablePrefix) is honored. The name is
+//     identity-mapped in LOCAL_TO_EXTERNAL, so clusterStorage's
+//     resolveTables leaves it untouched at dispatch.
+var SESSION_TABLE = "_blamejs_sessions";   // allow:hand-rolled-sql — canonical logical table-name + cryptoField registry key
+function _sessionSqlTable() { return frameworkSchema.tableName(SESSION_TABLE); }
+
+// b.sql opts for every session statement: thread the ACTIVE backend dialect
+// (clusterStorage.dialect() — "sqlite" single-node, "postgres" | "mysql" in
+// cluster mode) so the emitted identifier quoting and dialect idioms match
+// the backend the SQL dispatches to. b.sql defaults to "sqlite", which works
+// on Postgres only by accident (both double-quote identifiers) and emits the
+// wrong quoting + idioms on MySQL. The default store routes through
+// clusterStorage, and an operator localDbThin store is single-node sqlite —
+// in both single-node cases clusterStorage.dialect() resolves "sqlite", so
+// the opts agree with the store the SQL reaches. clusterStorage.execute (the
+// default store) still rewrites table names + translates `?` placeholders at
+// dispatch; this controls only the builder-side quoting + idiom selection.
+function _sessionSqlOpts() { return { dialect: clusterStorage.dialect() }; }
+
 // Column order used for INSERT — kept as a constant so the placeholders
-// list and the values list stay in sync. Must match _blamejs_sessions's
+// list and the values list stay in sync. Must match the session table's
 // schema in db.js (single-node) and framework-schema.js (cluster mode).
 var SESSION_COLS = ["sidHash", "userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity"];
 
@@ -167,7 +194,7 @@ function _unsealCookieToken(token) {
 // where not set). The cryptoField.sealRow call seals userId/data and
 // produces userIdHash from userId.
 function _sealForInsert(row) {
-  var sealed = cryptoField.sealRow("_blamejs_sessions", row);
+  var sealed = cryptoField.sealRow(SESSION_TABLE, row);
   for (var i = 0; i < SESSION_COLS.length; i++) {
     if (!(SESSION_COLS[i] in sealed)) sealed[SESSION_COLS[i]] = null;
   }
@@ -433,13 +460,13 @@ async function create(opts) {
     expiresAt:    expiresAt,
     lastActivity: nowMs,
   });
-  var values = SESSION_COLS.map(function (c) { return sealed[c]; });
-  var placeholders = SESSION_COLS.map(function () { return "?"; }).join(", ");
-  var quoted = SESSION_COLS.map(function (c) { return '"' + c + '"'; }).join(", ");
-  await _currentStore().execute(
-    "INSERT INTO _blamejs_sessions (" + quoted + ") VALUES (" + placeholders + ")",
-    values
-  );
+  var insertRow = {};
+  for (var ci = 0; ci < SESSION_COLS.length; ci++) insertRow[SESSION_COLS[ci]] = sealed[SESSION_COLS[ci]];
+  var built = sql.insert(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(SESSION_COLS)
+    .values(insertRow)
+    .toSql();
+  await _currentStore().execute(built.sql, built.params);
 
   return { token: _sealCookieToken(sid), expiresAt: expiresAt };
 }
@@ -496,11 +523,11 @@ async function verify(token, verifyOpts) {
   if (sid === null) return null;
   var sidHash = _hashSid(sid);
 
-  var row = await _currentStore().executeOne(
-    "SELECT sidHash, userId, userIdHash, data, createdAt, expiresAt, lastActivity " +
-    "FROM _blamejs_sessions WHERE sidHash = ?",
-    [sidHash]
-  );
+  var selBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["sidHash", "userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity"])
+    .where("sidHash", sidHash)
+    .toSql();
+  var row = await _currentStore().executeOne(selBuilt.sql, selBuilt.params);
   if (!row) return null;
   var nowMs = Date.now();
   if (Number(row.expiresAt) < nowMs) {
@@ -554,7 +581,7 @@ async function verify(token, verifyOpts) {
   // Unseal sealed columns (userId, data) using the cryptoField pipeline
   // so we return cleartext to the caller — same shape as the previous
   // db().from(...).first() path delivered.
-  var unsealed = cryptoField.unsealRow("_blamejs_sessions", row);
+  var unsealed = cryptoField.unsealRow(SESSION_TABLE, row);
   var data = null;
   var storedFingerprint = null;
   if (unsealed.data) {
@@ -679,10 +706,10 @@ async function destroy(token) {
 }
 
 async function _deleteBySidHash(sidHash) {
-  var result = await _currentStore().execute(
-    "DELETE FROM _blamejs_sessions WHERE sidHash = ?",
-    [sidHash]
-  );
+  var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
+    .where("sidHash", sidHash)
+    .toSql();
+  var result = await _currentStore().execute(built.sql, built.params);
   return (result.rowCount || 0) > 0;
 }
 
@@ -718,16 +745,23 @@ async function destroyAllForUser(userId) {
       true);
   }
   // userId is sealed; look up via derived userIdHash.
-  var lookup = cryptoField.lookupHash("_blamejs_sessions", "userId", userId);
+  var lookup = cryptoField.lookupHash(SESSION_TABLE, "userId", userId);
   if (!lookup) {
     throw _err("MISCONFIGURED",
-      "_blamejs_sessions schema is missing the userIdHash derived hash — framework misconfigured",
+      "the session table schema is missing the userIdHash derived hash — framework misconfigured",
       true);
   }
-  var result = await _currentStore().execute(
-    "DELETE FROM _blamejs_sessions WHERE userIdHash = ?",
-    [lookup.value]
-  );
+  // Dual-read across the keyed-MAC flip: a pre-v0.15.0 session row carries
+  // the legacy salted-sha3 userIdHash, so destroy must match both digests
+  // or it leaves un-migrated sessions for the user un-revoked.
+  var userHashes = [lookup.value];
+  if (lookup.legacyValue != null && lookup.legacyValue !== lookup.value) {
+    userHashes.push(lookup.legacyValue);
+  }
+  var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
+    .whereIn("userIdHash", userHashes)
+    .toSql();
+  var result = await _currentStore().execute(built.sql, built.params);
   return result.rowCount || 0;
 }
 
@@ -776,18 +810,20 @@ async function touch(token, opts) {
   if (opts.extendBy !== undefined && opts.extendBy !== null) {
     _validateTtl(opts.extendBy, "session.touch");
     var newExpires = nowMs + opts.extendBy;
-    var result = await _currentStore().execute(
-      "UPDATE _blamejs_sessions SET lastActivity = ?, expiresAt = ? " +
-      "WHERE sidHash = ? AND expiresAt >= ?",
-      [nowMs, newExpires, sidHash, nowMs]
-    );
+    var built = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+      .set({ lastActivity: nowMs, expiresAt: newExpires })
+      .where("sidHash", sidHash)
+      .where("expiresAt", ">=", nowMs)
+      .toSql();
+    var result = await _currentStore().execute(built.sql, built.params);
     return (result.rowCount || 0) > 0;
   }
-  var result2 = await _currentStore().execute(
-    "UPDATE _blamejs_sessions SET lastActivity = ? " +
-    "WHERE sidHash = ? AND expiresAt >= ?",
-    [nowMs, sidHash, nowMs]
-  );
+  var built2 = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+    .set({ lastActivity: nowMs })
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var result2 = await _currentStore().execute(built2.sql, built2.params);
   return (result2.rowCount || 0) > 0;
 }
 
@@ -810,11 +846,20 @@ async function touch(token, opts) {
  * the new token verifies. Audit event `auth.session.rotate` fires
  * best-effort with `metadata.reason`.
  *
+ * Device binding: when the session was created with `{ req, fingerprintFields }`
+ * the bound fingerprint is keyed to the sid, so rotation re-keys it to the new
+ * sid from the live request. Pass the same `{ req, fingerprintFields }` to
+ * `rotate` — a fingerprint-bound session rotated without `req` throws, because
+ * the binding cannot follow the sid otherwise (it would silently break or make
+ * the next `verify` falsely report drift).
+ *
  * @opts
  *   {
- *     data?:   object,     // replacement session data (re-sealed)
- *     ttlMs?:  number,     // new TTL; if absent, existing expiresAt preserved
- *     reason?: string,     // audit metadata ("login", "mfa", "role-change")
+ *     data?:              object,     // replacement session data (re-sealed)
+ *     ttlMs?:             number,     // new TTL; if absent, existing expiresAt preserved
+ *     reason?:            string,     // audit metadata ("login", "mfa", "role-change")
+ *     req?:               IncomingMessage, // re-key the device fingerprint to the new sid
+ *     fingerprintFields?: Array<string|fn>, // default ["clientIp","userAgent","acceptLanguage"]
  *   }
  *
  * @example
@@ -844,31 +889,76 @@ async function rotate(oldToken, opts) {
     newExpires = nowMs + opts.ttlMs;
   }
 
-  var setParts = ['"sidHash" = ?', '"lastActivity" = ?'];
-  var setParams = [newSidHash, nowMs];
+  var setCols = { sidHash: newSidHash, lastActivity: nowMs };
+
+  // Re-key the device binding to the NEW sid. __bj_fingerprint is sid-keyed
+  // (_hashFingerprint(sid, inputs), so a stolen DB can't replay it); a rotated
+  // session that kept the old-sid hash would make verify(newToken, sameReq)
+  // recompute against the new sid and mismatch — a false fingerprintDrift
+  // (strict operators destroy the session on every rotation) or a silently
+  // broken binding. Read the live row to learn whether the session was bound
+  // and to carry its payload forward when opts.data is not supplied.
+  var fpFields = Array.isArray(opts.fingerprintFields) && opts.fingerprintFields.length > 0
+    ? opts.fingerprintFields : DEFAULT_FINGERPRINT_FIELDS;
+  var existingData = null;
+  var rotSelBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["data"])
+    .where("sidHash", oldSidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var existingRow = await _currentStore().executeOne(rotSelBuilt.sql, rotSelBuilt.params);
+  if (!existingRow) return null;   // unknown / expired old session
+  try {
+    var unsealedExisting = cryptoField.unsealRow(SESSION_TABLE, existingRow);
+    if (unsealedExisting.data) existingData = safeJson.parse(unsealedExisting.data);
+  } catch (_e) { existingData = null; }
+  var wasBound = existingData && typeof existingData === "object" &&
+                 typeof existingData.__bj_fingerprint === "string";
+
+  if (opts.data !== undefined || wasBound) {
+    // opts.data REPLACES the payload (documented rotate semantics); otherwise
+    // carry the existing payload forward. The reserved __bj_fingerprint is
+    // never copied verbatim (it is old-sid-keyed) — it is recomputed below.
+    var newDataObj;
+    if (opts.data !== undefined) {
+      newDataObj = (opts.data && typeof opts.data === "object") ? Object.assign({}, opts.data) : null;
+    } else {
+      newDataObj = (existingData && typeof existingData === "object") ? Object.assign({}, existingData) : null;
+    }
+    if (newDataObj) delete newDataObj.__bj_fingerprint;
+
+    if (wasBound) {
+      if (!opts.req) {
+        throw _err("ROTATE_FINGERPRINT_REQ_REQUIRED",
+          "session.rotate: this session is fingerprint-bound; pass { req, fingerprintFields } " +
+          "so the device binding can be re-keyed to the new session id", true);
+      }
+      if (!newDataObj) newDataObj = {};
+      newDataObj.__bj_fingerprint = _hashFingerprint(newSid, _buildFingerprintInputs(opts.req, fpFields));
+    }
 
-  if (opts.data !== undefined) {
-    var dataJson = opts.data ? JSON.stringify(opts.data) : null;
-    var sealedRow = cryptoField.sealRow("_blamejs_sessions", { data: dataJson });
-    setParts.push('"data" = ?');
-    setParams.push(sealedRow.data);
+    var dataJson = newDataObj ? JSON.stringify(newDataObj) : null;
+    var sealedRow = cryptoField.sealRow(SESSION_TABLE, { data: dataJson });
+    setCols.data = sealedRow.data;
   }
   if (newExpires !== null) {
-    setParts.push('"expiresAt" = ?');
-    setParams.push(newExpires);
+    setCols.expiresAt = newExpires;
   }
 
-  var sql = "UPDATE _blamejs_sessions SET " + setParts.join(", ") +
-            " WHERE sidHash = ? AND expiresAt >= ?";
-  var params = setParams.concat([oldSidHash, nowMs]);
-  var result = await _currentStore().execute(sql, params);
+  var updBuilt = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+    .set(setCols)
+    .where("sidHash", oldSidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var result = await _currentStore().execute(updBuilt.sql, updBuilt.params);
   if ((result.rowCount || 0) === 0) return null;
 
   // Read the row's effective expiresAt to return — single source of truth.
-  var row = await _currentStore().executeOne(
-    'SELECT "expiresAt" FROM _blamejs_sessions WHERE sidHash = ?',
-    [newSidHash]
-  );
+  var rowBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["expiresAt"])
+    .where("sidHash", newSidHash)
+    .toSql();
+  var row = await _currentStore().executeOne(rowBuilt.sql, rowBuilt.params);
   var expiresAt = row ? Number(row.expiresAt) : null;
 
   // Audit emit — best-effort. The framework's audit chain logs the
@@ -949,17 +1039,18 @@ async function updateData(token, data, opts) {
   // wins on the same sid, which is the right shape for cart-style
   // writes; operators needing strict serialization wrap with
   // b.resourceAccessLock.
-  var row = await _currentStore().executeOne(
-    'SELECT "userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity" ' +
-    'FROM _blamejs_sessions WHERE sidHash = ? AND expiresAt >= ?',
-    [sidHash, nowMs]
-  );
+  var selBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity"])
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var row = await _currentStore().executeOne(selBuilt.sql, selBuilt.params);
   if (!row) return false;
 
   // Recover the existing data + reserved fingerprint key (vault-
   // sealed at rest). Operators that want a fresh fingerprint also
   // call b.session.rotate; updateData preserves the binding.
-  var unsealed = cryptoField.unsealRow("_blamejs_sessions", row);
+  var unsealed = cryptoField.unsealRow(SESSION_TABLE, row);
   var existing = null;
   var storedFingerprint = null;
   if (unsealed.data) {
@@ -998,19 +1089,20 @@ async function updateData(token, data, opts) {
 
   // Re-seal the data column. cryptoField.sealRow handles the AAD
   // binding + sealedFields registration automatically.
-  var sealedRow = cryptoField.sealRow("_blamejs_sessions", {
+  var sealedRow = cryptoField.sealRow(SESSION_TABLE, {
     data: next ? JSON.stringify(next) : null,
   });
 
-  var setParts = ['"data" = ?'];
-  var setParams = [sealedRow.data];
+  var setCols = { data: sealedRow.data };
   if (opts.touchLastActivity !== false) {
-    setParts.push('"lastActivity" = ?');
-    setParams.push(nowMs);
+    setCols.lastActivity = nowMs;
   }
-  var sql = "UPDATE _blamejs_sessions SET " + setParts.join(", ") +
-            " WHERE sidHash = ? AND expiresAt >= ?";
-  var result = await _currentStore().execute(sql, setParams.concat([sidHash, nowMs]));
+  var updBuilt = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+    .set(setCols)
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var result = await _currentStore().execute(updBuilt.sql, updBuilt.params);
   return (result.rowCount || 0) > 0;
 }
 
@@ -1040,10 +1132,10 @@ async function updateData(token, data, opts) {
  */
 async function purgeExpired() {
   cluster.requireLeader();
-  var result = await _currentStore().execute(
-    "DELETE FROM _blamejs_sessions WHERE expiresAt < ?",
-    [Date.now()]
-  );
+  var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
+    .where("expiresAt", "<", Date.now())
+    .toSql();
+  var result = await _currentStore().execute(built.sql, built.params);
   return result.rowCount || 0;
 }
 
@@ -1066,10 +1158,16 @@ async function purgeExpired() {
  *   // → 482
  */
 async function count() {
-  var row = await _currentStore().executeOne(
-    "SELECT COUNT(*) AS c FROM _blamejs_sessions WHERE expiresAt >= ?",
-    [Date.now()]
-  );
+  var built = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .count("*", "c")
+    .where("expiresAt", ">=", Date.now())
+    .toSql();
+  var row = await _currentStore().executeOne(built.sql, built.params);
+  // COUNT(*) aliased to `c` is not a framework-schema column, so
+  // clusterStorage.coerceRows does not touch it; node-postgres / mysql2
+  // hand a BIGINT count back as a decimal STRING. Number() at the read
+  // boundary keeps single-node sqlite (native number) and the cluster
+  // backends returning the same JS number.
   return row ? Number(row.c) : 0;
 }