@blamejs/core 0.14.27 → 0.15.1

package/lib/session-stores.js

@@ -37,22 +37,50 @@
  *     b.session.useStore(sessionStore);
  */
 
+var frameworkSchema = require("./framework-schema");
 var localDbThin  = require("./local-db-thin");
+var sql          = require("./sql");
 var validateOpts = require("./validate-opts");
 
-var SESSION_SCHEMA_SQL = [
-  "CREATE TABLE IF NOT EXISTS _blamejs_sessions (",
-  '  "sidHash"      TEXT PRIMARY KEY,',
-  '  "userId"       TEXT,',
-  '  "userIdHash"   TEXT,',
-  '  "data"         TEXT,',
-  '  "createdAt"    INTEGER,',
-  '  "expiresAt"    INTEGER,',
-  '  "lastActivity" INTEGER',
-  ");",
-  'CREATE INDEX IF NOT EXISTS "_blamejs_sessions_userIdHash_idx" ON _blamejs_sessions ("userIdHash");',
-  'CREATE INDEX IF NOT EXISTS "_blamejs_sessions_expiresAt_idx"  ON _blamejs_sessions ("expiresAt");',
-].join("\n");
+// Logical session-table name — resolved through frameworkSchema.tableName
+// so a configured table prefix (b.frameworkSchema.setTablePrefix) is
+// honored. This isolated localDbThin file owns its own schema; the name
+// must agree with the main-DB / cluster-mode session table b.session
+// reads + the sealedFields registry key (db.js registers under the
+// logical name).
+var SESSION_LOGICAL = "_blamejs_sessions";   // allow:hand-rolled-sql — canonical logical table-name declaration
+
+// b.sql opts for this adapter's schema DDL + every statement b.session
+// builds against it. The localDbThin backend is a dedicated node:sqlite
+// file (always sqlite, independent of cluster mode — see local-db-thin.js),
+// so the dialect is the literal "sqlite": this store NEVER dispatches to an
+// external Postgres / MySQL backend. Making the dialect explicit (rather than
+// leaning on b.sql's "sqlite" default) keeps the quoting intent documented +
+// matches the cluster-routed data-layer files threading
+// clusterStorage.dialect() through the same opts seam.
+var SQL_OPTS = { dialect: "sqlite" };
+
+// CREATE TABLE + the two session-side indexes (userIdHash for
+// destroyAllForUser, expiresAt for purgeExpired), built through b.sql so
+// every identifier is quoted by construction and the table name resolves
+// through the configurable prefix. DDL binds no values, so each builder
+// returns { sql } only; the statements are joined for the adapter's
+// schemaSql.
+function _sessionSchemaSql() {
+  var table = frameworkSchema.tableName(SESSION_LOGICAL);
+  var create = sql.createTable(table, [
+    { name: "sidHash",      type: "text", primaryKey: true },
+    { name: "userId",       type: "text" },
+    { name: "userIdHash",   type: "text" },
+    { name: "data",         type: "text" },
+    { name: "createdAt",    type: "int" },
+    { name: "expiresAt",    type: "int" },
+    { name: "lastActivity", type: "int" },
+  ], SQL_OPTS).sql;
+  var idxUser = sql.createIndex(table + "_userIdHash_idx", table, ["userIdHash"], SQL_OPTS).sql;
+  var idxExp  = sql.createIndex(table + "_expiresAt_idx", table, ["expiresAt"], SQL_OPTS).sql;
+  return [create + ";", idxUser + ";", idxExp + ";"].join("\n");
+}
 
 /**
  * @primitive b.session.stores.localDbThin
@@ -99,7 +127,7 @@ function localDbThinStore(opts) {
   // logging out every user; operators wanting clear-on-corrupt opt in.
   var handle = localDbThin.thin({
     file:       opts.file,
-    schemaSql:  SESSION_SCHEMA_SQL,
+    schemaSql:  _sessionSchemaSql(),
     recovery:   opts.recovery || "refuse",
     pragmas:    opts.pragmas,
     audit:      opts.audit !== false,

package/lib/session.js

@@ -53,9 +53,11 @@ var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
 var { generateToken, sha3Hash } = require("./crypto");
 var cryptoField = require("./crypto-field");
+var frameworkSchema = require("./framework-schema");
 var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var safeJson = require("./safe-json");
+var sql = require("./sql");
 var { SessionError } = require("./framework-error");
 
 // vault is initialized at boot before sessions; lazyRequire keeps the
@@ -119,8 +121,33 @@ var SID_NAMESPACE  = "bj-session:";
 // behind the same helper.
 var SID_BYTES      = C.BYTES.bytes(32);
 
+// Logical session-table name. Two uses, deliberately distinct:
+//   - As the cryptoField registry key (sealRow / unsealRow / lookupHash),
+//     it stays the LOGICAL name — that is the key db.js registers the
+//     sealedFields + derivedHashes under, independent of any table prefix.
+//   - As the SQL table name, it is resolved through
+//     frameworkSchema.tableName(...) so a configured table prefix
+//     (b.frameworkSchema.setTablePrefix) is honored. The name is
+//     identity-mapped in LOCAL_TO_EXTERNAL, so clusterStorage's
+//     resolveTables leaves it untouched at dispatch.
+var SESSION_TABLE = "_blamejs_sessions";   // allow:hand-rolled-sql — canonical logical table-name + cryptoField registry key
+function _sessionSqlTable() { return frameworkSchema.tableName(SESSION_TABLE); }
+
+// b.sql opts for every session statement: thread the ACTIVE backend dialect
+// (clusterStorage.dialect() — "sqlite" single-node, "postgres" | "mysql" in
+// cluster mode) so the emitted identifier quoting and dialect idioms match
+// the backend the SQL dispatches to. b.sql defaults to "sqlite", which works
+// on Postgres only by accident (both double-quote identifiers) and emits the
+// wrong quoting + idioms on MySQL. The default store routes through
+// clusterStorage, and an operator localDbThin store is single-node sqlite —
+// in both single-node cases clusterStorage.dialect() resolves "sqlite", so
+// the opts agree with the store the SQL reaches. clusterStorage.execute (the
+// default store) still rewrites table names + translates `?` placeholders at
+// dispatch; this controls only the builder-side quoting + idiom selection.
+function _sessionSqlOpts() { return { dialect: clusterStorage.dialect() }; }
+
 // Column order used for INSERT — kept as a constant so the placeholders
-// list and the values list stay in sync. Must match _blamejs_sessions's
+// list and the values list stay in sync. Must match the session table's
 // schema in db.js (single-node) and framework-schema.js (cluster mode).
 var SESSION_COLS = ["sidHash", "userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity"];
 
@@ -167,7 +194,7 @@ function _unsealCookieToken(token) {
 // where not set). The cryptoField.sealRow call seals userId/data and
 // produces userIdHash from userId.
 function _sealForInsert(row) {
-  var sealed = cryptoField.sealRow("_blamejs_sessions", row);
+  var sealed = cryptoField.sealRow(SESSION_TABLE, row);
   for (var i = 0; i < SESSION_COLS.length; i++) {
     if (!(SESSION_COLS[i] in sealed)) sealed[SESSION_COLS[i]] = null;
   }
@@ -433,13 +460,13 @@ async function create(opts) {
     expiresAt:    expiresAt,
     lastActivity: nowMs,
   });
-  var values = SESSION_COLS.map(function (c) { return sealed[c]; });
-  var placeholders = SESSION_COLS.map(function () { return "?"; }).join(", ");
-  var quoted = SESSION_COLS.map(function (c) { return '"' + c + '"'; }).join(", ");
-  await _currentStore().execute(
-    "INSERT INTO _blamejs_sessions (" + quoted + ") VALUES (" + placeholders + ")",
-    values
-  );
+  var insertRow = {};
+  for (var ci = 0; ci < SESSION_COLS.length; ci++) insertRow[SESSION_COLS[ci]] = sealed[SESSION_COLS[ci]];
+  var built = sql.insert(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(SESSION_COLS)
+    .values(insertRow)
+    .toSql();
+  await _currentStore().execute(built.sql, built.params);
 
   return { token: _sealCookieToken(sid), expiresAt: expiresAt };
 }
@@ -496,11 +523,11 @@ async function verify(token, verifyOpts) {
   if (sid === null) return null;
   var sidHash = _hashSid(sid);
 
-  var row = await _currentStore().executeOne(
-    "SELECT sidHash, userId, userIdHash, data, createdAt, expiresAt, lastActivity " +
-    "FROM _blamejs_sessions WHERE sidHash = ?",
-    [sidHash]
-  );
+  var selBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["sidHash", "userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity"])
+    .where("sidHash", sidHash)
+    .toSql();
+  var row = await _currentStore().executeOne(selBuilt.sql, selBuilt.params);
   if (!row) return null;
   var nowMs = Date.now();
   if (Number(row.expiresAt) < nowMs) {
@@ -554,7 +581,7 @@ async function verify(token, verifyOpts) {
   // Unseal sealed columns (userId, data) using the cryptoField pipeline
   // so we return cleartext to the caller — same shape as the previous
   // db().from(...).first() path delivered.
-  var unsealed = cryptoField.unsealRow("_blamejs_sessions", row);
+  var unsealed = cryptoField.unsealRow(SESSION_TABLE, row);
   var data = null;
   var storedFingerprint = null;
   if (unsealed.data) {
@@ -679,10 +706,10 @@ async function destroy(token) {
 }
 
 async function _deleteBySidHash(sidHash) {
-  var result = await _currentStore().execute(
-    "DELETE FROM _blamejs_sessions WHERE sidHash = ?",
-    [sidHash]
-  );
+  var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
+    .where("sidHash", sidHash)
+    .toSql();
+  var result = await _currentStore().execute(built.sql, built.params);
   return (result.rowCount || 0) > 0;
 }
 
@@ -718,16 +745,23 @@ async function destroyAllForUser(userId) {
       true);
   }
   // userId is sealed; look up via derived userIdHash.
-  var lookup = cryptoField.lookupHash("_blamejs_sessions", "userId", userId);
+  var lookup = cryptoField.lookupHash(SESSION_TABLE, "userId", userId);
   if (!lookup) {
     throw _err("MISCONFIGURED",
-      "_blamejs_sessions schema is missing the userIdHash derived hash — framework misconfigured",
+      "the session table schema is missing the userIdHash derived hash — framework misconfigured",
       true);
   }
-  var result = await _currentStore().execute(
-    "DELETE FROM _blamejs_sessions WHERE userIdHash = ?",
-    [lookup.value]
-  );
+  // Dual-read across the keyed-MAC flip: a pre-v0.15.0 session row carries
+  // the legacy salted-sha3 userIdHash, so destroy must match both digests
+  // or it leaves un-migrated sessions for the user un-revoked.
+  var userHashes = [lookup.value];
+  if (lookup.legacyValue != null && lookup.legacyValue !== lookup.value) {
+    userHashes.push(lookup.legacyValue);
+  }
+  var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
+    .whereIn("userIdHash", userHashes)
+    .toSql();
+  var result = await _currentStore().execute(built.sql, built.params);
   return result.rowCount || 0;
 }
 
@@ -776,18 +810,20 @@ async function touch(token, opts) {
   if (opts.extendBy !== undefined && opts.extendBy !== null) {
     _validateTtl(opts.extendBy, "session.touch");
     var newExpires = nowMs + opts.extendBy;
-    var result = await _currentStore().execute(
-      "UPDATE _blamejs_sessions SET lastActivity = ?, expiresAt = ? " +
-      "WHERE sidHash = ? AND expiresAt >= ?",
-      [nowMs, newExpires, sidHash, nowMs]
-    );
+    var built = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+      .set({ lastActivity: nowMs, expiresAt: newExpires })
+      .where("sidHash", sidHash)
+      .where("expiresAt", ">=", nowMs)
+      .toSql();
+    var result = await _currentStore().execute(built.sql, built.params);
     return (result.rowCount || 0) > 0;
   }
-  var result2 = await _currentStore().execute(
-    "UPDATE _blamejs_sessions SET lastActivity = ? " +
-    "WHERE sidHash = ? AND expiresAt >= ?",
-    [nowMs, sidHash, nowMs]
-  );
+  var built2 = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+    .set({ lastActivity: nowMs })
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var result2 = await _currentStore().execute(built2.sql, built2.params);
   return (result2.rowCount || 0) > 0;
 }
 
@@ -844,31 +880,31 @@ async function rotate(oldToken, opts) {
     newExpires = nowMs + opts.ttlMs;
   }
 
-  var setParts = ['"sidHash" = ?', '"lastActivity" = ?'];
-  var setParams = [newSidHash, nowMs];
+  var setCols = { sidHash: newSidHash, lastActivity: nowMs };
 
   if (opts.data !== undefined) {
     var dataJson = opts.data ? JSON.stringify(opts.data) : null;
-    var sealedRow = cryptoField.sealRow("_blamejs_sessions", { data: dataJson });
-    setParts.push('"data" = ?');
-    setParams.push(sealedRow.data);
+    var sealedRow = cryptoField.sealRow(SESSION_TABLE, { data: dataJson });
+    setCols.data = sealedRow.data;
   }
   if (newExpires !== null) {
-    setParts.push('"expiresAt" = ?');
-    setParams.push(newExpires);
+    setCols.expiresAt = newExpires;
   }
 
-  var sql = "UPDATE _blamejs_sessions SET " + setParts.join(", ") +
-            " WHERE sidHash = ? AND expiresAt >= ?";
-  var params = setParams.concat([oldSidHash, nowMs]);
-  var result = await _currentStore().execute(sql, params);
+  var updBuilt = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+    .set(setCols)
+    .where("sidHash", oldSidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var result = await _currentStore().execute(updBuilt.sql, updBuilt.params);
   if ((result.rowCount || 0) === 0) return null;
 
   // Read the row's effective expiresAt to return — single source of truth.
-  var row = await _currentStore().executeOne(
-    'SELECT "expiresAt" FROM _blamejs_sessions WHERE sidHash = ?',
-    [newSidHash]
-  );
+  var rowBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["expiresAt"])
+    .where("sidHash", newSidHash)
+    .toSql();
+  var row = await _currentStore().executeOne(rowBuilt.sql, rowBuilt.params);
   var expiresAt = row ? Number(row.expiresAt) : null;
 
   // Audit emit — best-effort. The framework's audit chain logs the
@@ -949,17 +985,18 @@ async function updateData(token, data, opts) {
   // wins on the same sid, which is the right shape for cart-style
   // writes; operators needing strict serialization wrap with
   // b.resourceAccessLock.
-  var row = await _currentStore().executeOne(
-    'SELECT "userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity" ' +
-    'FROM _blamejs_sessions WHERE sidHash = ? AND expiresAt >= ?',
-    [sidHash, nowMs]
-  );
+  var selBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["userId", "userIdHash", "data", "createdAt", "expiresAt", "lastActivity"])
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var row = await _currentStore().executeOne(selBuilt.sql, selBuilt.params);
   if (!row) return false;
 
   // Recover the existing data + reserved fingerprint key (vault-
   // sealed at rest). Operators that want a fresh fingerprint also
   // call b.session.rotate; updateData preserves the binding.
-  var unsealed = cryptoField.unsealRow("_blamejs_sessions", row);
+  var unsealed = cryptoField.unsealRow(SESSION_TABLE, row);
   var existing = null;
   var storedFingerprint = null;
   if (unsealed.data) {
@@ -998,19 +1035,20 @@ async function updateData(token, data, opts) {
 
   // Re-seal the data column. cryptoField.sealRow handles the AAD
   // binding + sealedFields registration automatically.
-  var sealedRow = cryptoField.sealRow("_blamejs_sessions", {
+  var sealedRow = cryptoField.sealRow(SESSION_TABLE, {
     data: next ? JSON.stringify(next) : null,
   });
 
-  var setParts = ['"data" = ?'];
-  var setParams = [sealedRow.data];
+  var setCols = { data: sealedRow.data };
   if (opts.touchLastActivity !== false) {
-    setParts.push('"lastActivity" = ?');
-    setParams.push(nowMs);
+    setCols.lastActivity = nowMs;
   }
-  var sql = "UPDATE _blamejs_sessions SET " + setParts.join(", ") +
-            " WHERE sidHash = ? AND expiresAt >= ?";
-  var result = await _currentStore().execute(sql, setParams.concat([sidHash, nowMs]));
+  var updBuilt = sql.update(_sessionSqlTable(), _sessionSqlOpts())
+    .set(setCols)
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var result = await _currentStore().execute(updBuilt.sql, updBuilt.params);
   return (result.rowCount || 0) > 0;
 }
 
@@ -1040,10 +1078,10 @@ async function updateData(token, data, opts) {
  */
 async function purgeExpired() {
   cluster.requireLeader();
-  var result = await _currentStore().execute(
-    "DELETE FROM _blamejs_sessions WHERE expiresAt < ?",
-    [Date.now()]
-  );
+  var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
+    .where("expiresAt", "<", Date.now())
+    .toSql();
+  var result = await _currentStore().execute(built.sql, built.params);
   return result.rowCount || 0;
 }
 
@@ -1066,10 +1104,16 @@ async function purgeExpired() {
  *   // → 482
  */
 async function count() {
-  var row = await _currentStore().executeOne(
-    "SELECT COUNT(*) AS c FROM _blamejs_sessions WHERE expiresAt >= ?",
-    [Date.now()]
-  );
+  var built = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .count("*", "c")
+    .where("expiresAt", ">=", Date.now())
+    .toSql();
+  var row = await _currentStore().executeOne(built.sql, built.params);
+  // COUNT(*) aliased to `c` is not a framework-schema column, so
+  // clusterStorage.coerceRows does not touch it; node-postgres / mysql2
+  // hand a BIGINT count back as a decimal STRING. Number() at the read
+  // boundary keeps single-node sqlite (native number) and the cluster
+  // backends returning the same JS number.
   return row ? Number(row.c) : 0;
 }