@camstack/server 1.2.486 → 1.2.487

package/dist/api/core/auth-sessions.procedures.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshResultSchema = exports.LoginSessionSchema = void 0;
+exports.createSessionProcedures = createSessionProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const session_mint_js_1 = require("../../auth/session-mint.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+/** One login session as the UI lists it. */
+exports.LoginSessionSchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    userId: zod_1.z.string(),
+    method: zod_1.z.string(),
+    refreshable: zod_1.z.boolean(),
+    createdAt: zod_1.z.number(),
+    lastUsedAt: zod_1.z.number(),
+    expiresAt: zod_1.z.number(),
+    client: zod_1.z.string().nullable(),
+    ip: zod_1.z.string().nullable(),
+    /** The session this request was made with. */
+    current: zod_1.z.boolean(),
+});
+/** What a refresh returns: a new access token and the rotated refresh token. */
+exports.RefreshResultSchema = zod_1.z.object({
+    token: zod_1.z.string(),
+    refreshToken: zod_1.z.string(),
+    expiresAt: zod_1.z.number(),
+    sessionId: zod_1.z.string(),
+    sessionExpiresAt: zod_1.z.number(),
+    user: zod_1.z.object({ id: zod_1.z.string(), username: zod_1.z.string(), isAdmin: zod_1.z.boolean() }),
+});
+function requireSessions(registry) {
+    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+    if (internal === null) {
+        throw new server_1.TRPCError({
+            code: 'PRECONDITION_FAILED',
+            message: 'Login sessions are not available',
+        });
+    }
+    return internal.sessions;
+}
+/** Real user sessions only — a scoped or share token has no login session to manage. */
+function assertLoginSession(user) {
+    if (user.isScoped === true || user.shareView !== undefined || user.adminTokenId !== undefined) {
+        throw new server_1.TRPCError({ code: 'FORBIDDEN', message: 'Requires a signed-in user session' });
+    }
+}
+function createSessionProcedures(deps) {
+    const list = (userId, currentId) => {
+        const sessions = requireSessions(deps.registry);
+        const rows = userId === null ? sessions.listActive() : sessions.listForUser(userId);
+        return rows.map((row) => ({
+            id: row.id,
+            userId: row.userId,
+            method: row.method,
+            refreshable: row.refreshable,
+            createdAt: row.createdAt,
+            lastUsedAt: row.lastUsedAt,
+            expiresAt: row.expiresAt,
+            client: row.client,
+            ip: row.ip,
+            current: row.id === currentId,
+        }));
+    };
+    return {
+        /**
+         * PUBLIC — swap a refresh token for a new access token and a rotated
+         * refresh token; the session's expiry slides. A rotated-out token
+         * presented again (outside a short grace) is treated as stolen and ends
+         * the session. Any refusal is a 401: the client signs in again.
+         */
+        refreshSession: deps.credentialProcedure
+            .input(zod_1.z.object({ refreshToken: zod_1.z.string().min(1).max(512) }))
+            .output(exports.RefreshResultSchema)
+            .mutation(async ({ input }) => {
+            try {
+                const minted = await deps.minter.refresh(input.refreshToken);
+                if (minted.refreshToken === undefined ||
+                    minted.sessionId === undefined ||
+                    minted.expiresAt === undefined ||
+                    minted.sessionExpiresAt === undefined) {
+                    throw new session_mint_js_1.SessionRefreshRefusedError('unknown');
+                }
+                return {
+                    token: minted.token,
+                    refreshToken: minted.refreshToken,
+                    expiresAt: minted.expiresAt,
+                    sessionId: minted.sessionId,
+                    sessionExpiresAt: minted.sessionExpiresAt,
+                    user: minted.user,
+                };
+            }
+            catch (error) {
+                if (error instanceof session_mint_js_1.SessionRefreshRefusedError ||
+                    error instanceof session_mint_js_1.SessionUserGoneError) {
+                    throw new server_1.TRPCError({
+                        code: 'UNAUTHORIZED',
+                        message: 'Session expired — sign in again',
+                    });
+                }
+                throw error;
+            }
+        }),
+        /**
+         * End the caller's session on the server (its access and refresh tokens
+         * stop working at once). `everywhere: true` ends every session of the
+         * user, and their pre-session tokens.
+         */
+        logout: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ everywhere: zod_1.z.boolean().optional() }).optional())
+            .output(zod_1.z.object({ success: zod_1.z.literal(true), revoked: zod_1.z.number() }))
+            .mutation(async ({ ctx, input }) => {
+            assertLoginSession(ctx.user);
+            const sessions = requireSessions(deps.registry);
+            if (input?.everywhere === true) {
+                const revoked = await sessions.revokeAllForUser(ctx.user.id, {
+                    reason: 'logout-everywhere',
+                });
+                return { success: true, revoked };
+            }
+            const sessionId = ctx.user.sessionId;
+            const revoked = sessionId === undefined ? false : await sessions.revoke(sessionId, 'logout');
+            return { success: true, revoked: revoked ? 1 : 0 };
+        }),
+        /** The caller's live sessions, newest first; `current` marks this one. */
+        listOwnSessions: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(exports.LoginSessionSchema))
+            .query(({ ctx }) => {
+            assertLoginSession(ctx.user);
+            return list(ctx.user.id, ctx.user.sessionId);
+        }),
+        /** End one of the caller's own sessions (another device). */
+        revokeOwnSession: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            assertLoginSession(ctx.user);
+            const sessions = requireSessions(deps.registry);
+            const check = sessions.check(input.id);
+            if (check.state !== 'active' || check.session.userId !== ctx.user.id) {
+                return { success: false };
+            }
+            return { success: await sessions.revoke(input.id, 'revoked-by-user') };
+        }),
+        /** ADMIN — live sessions of one user, or of everyone. */
+        listSessions: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ userId: zod_1.z.string().min(1).optional() }).optional())
+            .output(zod_1.z.array(exports.LoginSessionSchema))
+            .query(({ ctx, input }) => list(input?.userId ?? null, ctx.user.sessionId)),
+        /** ADMIN — end one session, or every session of a user. */
+        revokeSessions: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.union([zod_1.z.object({ id: zod_1.z.string().min(1) }), zod_1.z.object({ userId: zod_1.z.string().min(1) })]))
+            .output(zod_1.z.object({ revoked: zod_1.z.number() }))
+            .mutation(async ({ input }) => {
+            const sessions = requireSessions(deps.registry);
+            if ('id' in input) {
+                return { revoked: (await sessions.revoke(input.id, 'revoked-by-admin')) ? 1 : 0 };
+            }
+            return {
+                revoked: await sessions.revokeAllForUser(input.userId, { reason: 'revoked-by-admin' }),
+            };
+        }),
+    };
+}