@chidchanun/bcp 0.2.4 → 0.2.5

package/packages/server/src/auth.ts

@@ -9,6 +9,10 @@ import {
     type SessionClaims,
     type SessionCookieOptions,
 } from "./session.js";
+import type {
+    AuthSessionStore,
+    AuthSessionStoreRecord,
+} from "./auth-session-store.js";
 
 export interface AuthUser {
     id: string | number;
@@ -24,7 +28,10 @@ export interface AuthSession<
 }
 
 export interface AuthOptions
-extends SessionCookieOptions {}
+extends SessionCookieOptions {
+    store?: AuthSessionStore;
+    idleTimeout?: number;
+}
 
 export interface AuthLoginOptions<
     TData extends object = Record<string, never>
@@ -49,9 +56,18 @@ export interface AuthApi<
     logout(
         options?: AuthOptions
     ): Promise<void>;
+    logoutAll(
+        options?: AuthOptions
+    ): Promise<number>;
     rotateSession(
         options?: AuthOptions
     ): Promise<AuthSession<TUser, TData> | null>;
+    revokeSession(
+        sid: string
+    ): Promise<boolean>;
+    revokeUserSessions(
+        userId: string | number
+    ): Promise<number>;
 }
 
 interface AuthSessionPayload<
@@ -70,45 +86,82 @@ export async function auth<
     options: AuthOptions = {}
 ): Promise<AuthSession<TUser, TData> | null> {
     const session =
-        await readSession<
-            AuthSessionPayload<
-                TUser,
-                TData
-            >
+        await readSignedAuthSession<
+            TUser,
+            TData
         >(
-            options
+            toSessionCookieOptions(
+                options
+            )
         );
 
     if (!session) {
         return null;
     }
 
+    const idleTimeout =
+        resolveIdleTimeout(
+            options.idleTimeout
+        );
+    const store =
+        options.store;
+
     if (
-        typeof session.sid !==
-            "string" ||
-        session.sid.trim().length ===
-            0 ||
-        !isAuthUser(
-            session.user
-        )
+        idleTimeout !== undefined &&
+        !store
     ) {
+        throw new Error(
+            "BCP Auth: idleTimeout requires a server-side auth session store."
+        );
+    }
+
+    if (!store) {
+        return session;
+    }
+
+    const record =
+        await store.get(
+            session.sid
+        );
+
+    if (!record) {
         return null;
     }
 
+    const now =
+        currentUnixTime();
+    const userId =
+        serializeAuthUserId(
+            session.user.id
+        );
+
     if (
-        session.data !== undefined &&
-        !isPlainObject(
-            session.data
-        )
+        record.userId !== userId ||
+        record.revokedAt !== undefined &&
+        record.revokedAt !== null ||
+        record.expiresAt <= now
     ) {
         return null;
     }
 
-    return session as
-        AuthSession<
-            TUser,
-            TData
-        >;
+    if (
+        idleTimeout !== undefined &&
+        record.lastSeenAt +
+            idleTimeout <= now
+    ) {
+        await store.revoke(
+            session.sid,
+            now
+        );
+        return null;
+    }
+
+    await store.touch(
+        session.sid,
+        now
+    );
+
+    return session;
 }
 
 export async function getSession<
@@ -148,10 +201,27 @@ export async function login<
         );
     }
 
+    const idleTimeout =
+        resolveIdleTimeout(
+            options.idleTimeout
+        );
+
+    if (
+        idleTimeout !== undefined &&
+        !options.store
+    ) {
+        throw new Error(
+            "BCP Auth: idleTimeout requires a server-side auth session store."
+        );
+    }
+
     const {
         data,
-        ...sessionOptions
     } = options;
+    const sessionOptions =
+        toSessionCookieOptions(
+            options
+        );
     const payload:
         AuthSessionPayload<
             TUser,
@@ -173,7 +243,7 @@ export async function login<
     );
 
     const session =
-        await auth<
+        await readSignedAuthSession<
             TUser,
             TData
         >(
@@ -186,17 +256,74 @@ export async function login<
         );
     }
 
+    if (options.store) {
+        await options.store.set(
+            createStoreRecord(
+                session
+            )
+        );
+    }
+
     return session;
 }
 
 export async function logout(
     options: AuthOptions = {}
 ): Promise<void> {
+    if (options.store) {
+        const current =
+            await auth(
+                options
+            );
+
+        if (current) {
+            await options.store.revoke(
+                current.sid,
+                currentUnixTime()
+            );
+        }
+    }
+
     await destroySession(
-        options
+        toSessionCookieOptions(
+            options
+        )
     );
 }
 
+export async function logoutAll(
+    options: AuthOptions = {}
+): Promise<number> {
+    const store =
+        requireAuthSessionStore(
+            options.store,
+            "logoutAll"
+        );
+    const current =
+        await auth(
+            options
+        );
+    let revoked = 0;
+
+    if (current) {
+        revoked =
+            await store.revokeUser(
+                serializeAuthUserId(
+                    current.user.id
+                ),
+                currentUnixTime()
+            );
+    }
+
+    await destroySession(
+        toSessionCookieOptions(
+            options
+        )
+    );
+
+    return revoked;
+}
+
 export async function rotateSession<
     TUser extends AuthUser = AuthUser,
     TData extends object = Record<string, never>
@@ -215,26 +342,71 @@ export async function rotateSession<
         return null;
     }
 
-    return login<
-        TUser,
-        TData
-    >(
-        current.user,
-        {
-            ...options,
-            issuer:
-                options.issuer ??
-                current.iss,
-            audience:
-                options.audience ??
-                current.aud,
-            ...(current.data === undefined
-                ? {}
-                : {
-                    data:
-                        current.data,
-                }),
-        }
+    const rotated =
+        await login<
+            TUser,
+            TData
+        >(
+            current.user,
+            {
+                ...options,
+                issuer:
+                    options.issuer ??
+                    current.iss,
+                audience:
+                    options.audience ??
+                    current.aud,
+                ...(current.data === undefined
+                    ? {}
+                    : {
+                        data:
+                            current.data,
+                    }),
+            }
+        );
+
+    if (options.store) {
+        await options.store.revoke(
+            current.sid,
+            currentUnixTime()
+        );
+    }
+
+    return rotated;
+}
+
+export async function revokeSession(
+    sid: string,
+    store: AuthSessionStore
+): Promise<boolean> {
+    assertSessionId(
+        sid
+    );
+    assertAuthSessionStore(
+        store
+    );
+
+    return Boolean(
+        await store.revoke(
+            sid,
+            currentUnixTime()
+        )
+    );
+}
+
+export async function revokeUserSessions(
+    userId: string | number,
+    store: AuthSessionStore
+): Promise<number> {
+    assertAuthSessionStore(
+        store
+    );
+
+    return store.revokeUser(
+        serializeAuthUserId(
+            userId
+        ),
+        currentUnixTime()
     );
 }
 
@@ -297,6 +469,13 @@ export function createAuth<
                 ...defaults,
                 ...options,
             }),
+        logoutAll: (
+            options = {}
+        ) =>
+            logoutAll({
+                ...defaults,
+                ...options,
+            }),
         rotateSession: (
             options = {}
         ) =>
@@ -307,9 +486,218 @@ export function createAuth<
                 ...defaults,
                 ...options,
             }),
+        revokeSession: (
+            sid
+        ) =>
+            revokeSession(
+                sid,
+                requireAuthSessionStore(
+                    defaults.store,
+                    "revokeSession"
+                )
+            ),
+        revokeUserSessions: (
+            userId
+        ) =>
+            revokeUserSessions(
+                userId,
+                requireAuthSessionStore(
+                    defaults.store,
+                    "revokeUserSessions"
+                )
+            ),
+    };
+}
+
+async function readSignedAuthSession<
+    TUser extends AuthUser,
+    TData extends object
+>(
+    options: SessionCookieOptions
+): Promise<AuthSession<TUser, TData> | null> {
+    const session =
+        await readSession<
+            AuthSessionPayload<
+                TUser,
+                TData
+            >
+        >(
+            options
+        );
+
+    if (!session) {
+        return null;
+    }
+
+    if (
+        typeof session.sid !== "string" ||
+        session.sid.trim().length === 0 ||
+        !isAuthUser(
+            session.user
+        )
+    ) {
+        return null;
+    }
+
+    if (
+        session.data !== undefined &&
+        !isPlainObject(
+            session.data
+        )
+    ) {
+        return null;
+    }
+
+    return session as
+        AuthSession<
+            TUser,
+            TData
+        >;
+}
+
+function createStoreRecord<
+    TUser extends AuthUser,
+    TData extends object
+>(
+    session: AuthSession<
+        TUser,
+        TData
+    >
+): AuthSessionStoreRecord {
+    return {
+        sid:
+            session.sid,
+        userId:
+            serializeAuthUserId(
+                session.user.id
+            ),
+        createdAt:
+            session.iat,
+        expiresAt:
+            session.exp,
+        lastSeenAt:
+            session.iat,
+        revokedAt:
+            null,
     };
 }
 
+function toSessionCookieOptions(
+    options: AuthOptions
+): SessionCookieOptions {
+    const {
+        store: _store,
+        idleTimeout: _idleTimeout,
+        ...sessionOptions
+    } = options;
+
+    return sessionOptions;
+}
+
+function serializeAuthUserId(
+    value: string | number
+): string {
+    if (
+        typeof value === "string"
+    ) {
+        const normalized =
+            value.trim();
+
+        if (!normalized) {
+            throw new TypeError(
+                "BCP Auth: user id must not be empty."
+            );
+        }
+
+        return `string:${normalized}`;
+    }
+
+    if (
+        !Number.isFinite(
+            value
+        )
+    ) {
+        throw new TypeError(
+            "BCP Auth: numeric user id must be finite."
+        );
+    }
+
+    return `number:${value}`;
+}
+
+function resolveIdleTimeout(
+    value: number | undefined
+): number | undefined {
+    if (
+        value === undefined
+    ) {
+        return undefined;
+    }
+
+    if (
+        !Number.isFinite(
+            value
+        ) ||
+        value <= 0
+    ) {
+        throw new TypeError(
+            "BCP Auth: idleTimeout must be a positive finite number of seconds."
+        );
+    }
+
+    return Math.floor(
+        value
+    );
+}
+
+function requireAuthSessionStore(
+    store: AuthSessionStore | undefined,
+    operation: string
+): AuthSessionStore {
+    if (!store) {
+        throw new Error(
+            `BCP Auth: ${operation} requires a server-side auth session store.`
+        );
+    }
+
+    assertAuthSessionStore(
+        store
+    );
+
+    return store;
+}
+
+function assertAuthSessionStore(
+    store: AuthSessionStore
+): void {
+    if (
+        !store ||
+        typeof store !== "object" ||
+        typeof store.set !== "function" ||
+        typeof store.get !== "function" ||
+        typeof store.touch !== "function" ||
+        typeof store.revoke !== "function" ||
+        typeof store.revokeUser !== "function"
+    ) {
+        throw new TypeError(
+            "BCP Auth: session store must implement set, get, touch, revoke and revokeUser."
+        );
+    }
+}
+
+function assertSessionId(
+    sid: string
+): void {
+    if (
+        typeof sid !== "string" ||
+        sid.trim() === ""
+    ) {
+        throw new TypeError(
+            "BCP Auth: session id must be a non-empty string."
+        );
+    }
+}
+
 function assertAuthUser(
     value: unknown
 ): asserts value is AuthUser {
@@ -368,9 +756,14 @@ function isPlainObject(
         );
 
     return (
-        prototype ===
-            Object.prototype ||
-        prototype ===
-            null
+        prototype === Object.prototype ||
+        prototype === null
+    );
+}
+
+function currentUnixTime(): number {
+    return Math.floor(
+        Date.now() /
+        1000
     );
 }