@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/sessions/feature.ts

@@ -1,29 +1,77 @@
+import {
+  EXT_SESSION_STORE,
+  type SessionStore,
+  type SessionStoreProvider,
+} from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID, SessionQueries } from "./constants";
 import { cleanupJob } from "./handlers/cleanup.job";
+import { detailQuery } from "./handlers/detail.query";
 import { listQuery } from "./handlers/list.query";
 import { mineQuery } from "./handlers/mine.query";
 import { revokeWrite } from "./handlers/revoke.write";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write";
+import { SESSIONS_I18N } from "./i18n";
 import { userSessionEntity } from "./schema/user-session";
-import type { SessionMassRevoker } from "./session-callbacks";
+import {
+  createSessionCallbacks,
+  type SessionAllOthersRevoker,
+  type SessionMassRevoker,
+} from "./session-callbacks";
+import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event";
 
 export type SessionsFeatureOptions = {
-  // When wired, a successful update on the `user` entity that changes the
-  // `passwordHash` column triggers a mass-revoke of every live session for
-  // that user. Industry-standard "password-change signs you out everywhere"
-  // flow, including the session that did the change itself — the client has
+  // A successful update on the `user` entity that changes the `passwordHash`
+  // column triggers a mass-revoke of every live session for that user.
+  // Industry-standard "password-change signs you out everywhere" flow,
+  // including the session that did the change itself — the client has
   // to re-login after a password change.
   //
   // Runs as an afterCommit postSave hook: the password-change commits first,
   // then the sessions are revoked. Best-effort — if the mass-revoker throws,
   // the password change is NOT rolled back (a password change with a stale
   // session still wins over a user-visible error on the change itself).
+  //
+  // Default: run{Prod,Dev}App bind their own sessionMassRevoker via
+  // `bindAutoRevokeOnPasswordChange` (secure-by-default). Set this option
+  // only to supply a custom revoker — an explicit value wins over the
+  // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
+  // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
+  // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
+  readonly expiresInMs?: number;
 };
 
-// The sessions feature registers the read_user_sessions table (as an
+export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
+export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;
+
+// Reads the late-bind setter off a mounted sessions feature's exports.
+// run{Prod,Dev}App call it once the DB connection is concrete — the feature
+// itself is constructed in app run-config long before a db exists, so the
+// revoker can't be a constructor argument.
+export function bindAutoRevokeFromFeature(
+  feature: FeatureDefinition,
+): BindAutoRevokeOnPasswordChange | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
+    const { bindAutoRevokeOnPasswordChange } = exports as {
+      bindAutoRevokeOnPasswordChange: unknown;
+    };
+    if (typeof bindAutoRevokeOnPasswordChange === "function") {
+      // @cast-boundary exports-walk — feature.exports is untyped by design
+      return bindAutoRevokeOnPasswordChange as BindAutoRevokeOnPasswordChange;
+    }
+  }
+  return undefined;
+}
+
+// The sessions feature registers the store_user_sessions table (as an
 // unmanaged direct-write store, NOT an r.entity — see below) and the three
 // user-facing handlers (mine/revoke/revoke-all-others). It intentionally does NOT
 // export a sessionCreator/sessionRevoker here — those are produced by
@@ -41,7 +89,7 @@ export type SessionsFeatureOptions = {
 export function createSessionsFeature(options?: SessionsFeatureOptions): FeatureDefinition {
   return defineFeature("sessions", (r) => {
     r.describe(
-      "Tracks signed-in clients in the `read_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
+      "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
     );
     r.uiHints({
       displayLabel: "Sessions · Server-side Logout",
@@ -51,20 +99,56 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // sessionChecker reads read_users on every authenticated request (status
     // gate for locked accounts) — make that a boot-time dependency so a
     // sessions-without-user wiring fails validateBoot instead of 500ing live.
-    r.requires("user");
-    // read_user_sessions is a hot-path direct-write store: sessionCreator
+    // auth-foundation owns EXT_SESSION_STORE, which the useExtension below
+    // registers against.
+    r.requires("user", "auth-foundation");
+    // store_user_sessions is a hot-path direct-write store: sessionCreator
     // inserts and the revoke handlers update rows WITHOUT emitting lifecycle
     // events (the row columns ARE the audit trail). Registering it as
     // r.entity would make it a rebuildable implicit projection whose replay
     // finds zero session events and swaps an empty shadow over the live
     // table — wiping every active session on the next projection rebuild
-    // (#498/#494). r.unmanagedTable keeps the migration DDL but opts the
+    // (#498/#494). r.storeTable keeps the migration DDL but opts the
     // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
     // which are direct-write stores too.
-    r.unmanagedTable(buildEntityTableMeta("user-session", userSessionEntity), {
+    r.storeTable(buildEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }), {
       reason: "read_side.user_sessions_direct_write",
+      // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
+      piiEncryptedOnWrite: true,
     });
 
+    // Self-registers as auth-foundation's sessionStore provider (#1371) —
+    // wraps the same createSessionCallbacks() used by the manual
+    // buildServer({ auth: { ... } }) wiring above; a future issue (#1372)
+    // removes that manual wiring once the middleware resolves generically
+    // via resolveSessionStore().
+    r.useExtension(EXT_SESSION_STORE, "default", {
+      build: (deps): SessionStore => {
+        const callbacks = createSessionCallbacks({
+          db: deps.db,
+          ...(options?.expiresInMs !== undefined && { expiresInMs: options.expiresInMs }),
+        });
+        return {
+          creator: callbacks.sessionCreator,
+          revoker: callbacks.sessionRevoker,
+          checker: callbacks.sessionChecker,
+          massRevoker: callbacks.sessionMassRevoker,
+          revokeAllOthers: callbacks.sessionRevokeAllOthers,
+        };
+      },
+    } satisfies SessionStoreProvider);
+
+    // Custom domain-event for cross-instance access-invalidation (#1559).
+    // r.defineEvent registers the schema so ctx.unsafeAppendEvent (revoke,
+    // revoke-all-others) enforces it at append time. revoke-all-for-user
+    // appends via the low-level append() instead (needs to anchor on
+    // SYSTEM_TENANT_ID — see that handler for why) — append() does NOT
+    // consult the registry, so that callsite parses against
+    // sessionRevokedSchema explicitly, same guarantee via a different path.
+    // No projection: the payload IS the read, consumed directly off the
+    // event-store NOTIFY (#1560).
+    r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema);
+
     const handlers = {
       revoke: r.writeHandler(revokeWrite),
       revokeAllOthers: r.writeHandler(revokeAllOthersWrite),
@@ -75,6 +159,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     const queries = {
       mine: r.queryHandler(mineQuery),
       list: r.queryHandler(listQuery),
+      detail: r.queryHandler(detailQuery),
     };
 
     // Retention: chunked DELETE of expired/revoked rows. Manual trigger
@@ -93,20 +178,84 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // "the handler didn't touch this column", which is exactly the signal
     // we want to skip on. Works for both direct user:update calls and any
     // other handler that happens to write the column.
-    const autoRevoke = options?.autoRevokeOnPasswordChange;
-    if (autoRevoke) {
-      r.entityHook("postSave", "user", async (ctx) => {
-        // skip: brand-new user, no sessions can possibly exist yet. The
-        // initial passwordHash on a user:create would trip the second guard
-        // otherwise — every registration would do a mass-revoke roundtrip
-        // for a user who literally has no rows in user_sessions.
-        if (ctx.isNew) return;
-        // skip: handler didn't touch passwordHash, nothing to revoke
-        if (ctx.changes["passwordHash"] === undefined) return;
-        await autoRevoke(String(ctx.id));
-      });
-    }
+    let autoRevoke = options?.autoRevokeOnPasswordChange;
+    r.hook("postSave", { allOf: "user" }, async (ctx) => {
+      // skip: nothing bound — stateless-JWT deployments without a runtime
+      // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
+      if (!autoRevoke) return;
+      // skip: brand-new user, no sessions can possibly exist yet. The
+      // initial passwordHash on a user:create would trip the second guard
+      // otherwise — every registration would do a mass-revoke roundtrip
+      // for a user who literally has no rows in user_sessions.
+      if (ctx.isNew) return;
+      // skip: handler didn't touch passwordHash, nothing to revoke
+      if (ctx.changes["passwordHash"] === undefined) return;
+      await autoRevoke(String(ctx.id));
+    });
+
+    const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
+      // explicit constructor option wins over the runtime binding
+      autoRevoke ??= revoker;
+    };
+
+    r.translations({ keys: SESSIONS_I18N });
+
+    const listAccess = { roles: access.admin };
+
+    r.screen({
+      id: SESSION_LIST_SCREEN_ID,
+      type: "projectionList",
+      query: SessionQueries.list,
+      columns: [
+        { field: "id", label: "sessions.list.col.id" },
+        { field: "userId", label: "sessions.list.col.userId" },
+        { field: "createdAt", label: "sessions.list.col.createdAt" },
+        { field: "expiresAt", label: "sessions.list.col.expiresAt" },
+        { field: "revokedAt", label: "sessions.list.col.revokedAt" },
+      ],
+      rowActions: [
+        {
+          kind: "navigate",
+          id: "open",
+          label: "sessions.list.action.open",
+          screen: SESSION_DETAIL_SCREEN_ID,
+          entityId: "id",
+          rowClick: true,
+        },
+      ],
+      access: listAccess,
+    });
+    r.screen({
+      id: SESSION_DETAIL_SCREEN_ID,
+      type: "projectionDetail",
+      query: SessionQueries.detail,
+      listScreenId: SESSION_LIST_SCREEN_ID,
+      layout: {
+        sections: [
+          {
+            fields: ["id", "userId", "createdAt", "expiresAt", "revokedAt", "ip", "userAgent"],
+          },
+        ],
+      },
+      fieldLabels: {
+        id: "sessions.detail.field.id",
+        userId: "sessions.detail.field.userId",
+        createdAt: "sessions.detail.field.createdAt",
+        expiresAt: "sessions.detail.field.expiresAt",
+        revokedAt: "sessions.detail.field.revokedAt",
+        ip: "sessions.detail.field.ip",
+        userAgent: "sessions.detail.field.userAgent",
+      },
+      access: listAccess,
+    });
+    r.nav({
+      id: "session-list",
+      label: "sessions:nav.sessionList",
+      icon: "list",
+      screen: "sessions:screen:session-list",
+      order: 10,
+    });
 
-    return { handlers, queries };
+    return { handlers, queries, bindAutoRevokeOnPasswordChange };
   });
 }

package/src/sessions/handlers/detail.query.ts

@@ -0,0 +1,36 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
+import { userSessionTable } from "../schema/user-session";
+
+// Admin single-session inspector — mirrors list.query's decrypt handling for
+// the one-row case. ctx.db (TenantDb) applies tenant-scoping automatically.
+export const detailQuery = defineQueryHandler({
+  name: "user-session:detail",
+  schema: z.object({ id: z.uuid() }),
+  access: { roles: access.admin },
+  handler: async (query, ctx) => {
+    const row = await fetchOne<{
+      id: string;
+      userId: string;
+      createdAt: unknown;
+      expiresAt: unknown;
+      revokedAt: unknown;
+      ip: string | null;
+      userAgent: string | null;
+    }>(ctx.db, userSessionTable, { id: query.payload.id });
+    if (!row) return null;
+    return {
+      id: row.id,
+      userId: row.userId,
+      createdAt: row.createdAt,
+      expiresAt: row.expiresAt,
+      revokedAt: row.revokedAt,
+      ip: row.ip ? await decryptStoredPii(row.ip, "ip", "sessions:detail") : row.ip,
+      userAgent: row.userAgent
+        ? await decryptStoredPii(row.userAgent, "userAgent", "sessions:detail")
+        : row.userAgent,
+    };
+  },
+});

package/src/sessions/handlers/list.query.ts

@@ -1,6 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { userSessionTable } from "../schema/user-session";
 
 // Admin view of every session in the active tenant. ctx.db (TenantDb)
@@ -22,14 +23,18 @@ export const listQuery = defineQueryHandler({
     }>(ctx.db, userSessionTable, undefined, {
       orderBy: { col: "createdAt", direction: "desc" },
     });
-    return rows.map((r) => ({
-      id: r.id,
-      userId: r.userId,
-      createdAt: r.createdAt,
-      expiresAt: r.expiresAt,
-      revokedAt: r.revokedAt,
-      ip: r.ip,
-      userAgent: r.userAgent,
-    }));
+    return Promise.all(
+      rows.map(async (r) => ({
+        id: r.id,
+        userId: r.userId,
+        createdAt: r.createdAt,
+        expiresAt: r.expiresAt,
+        revokedAt: r.revokedAt,
+        ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:list") : r.ip,
+        userAgent: r.userAgent
+          ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:list")
+          : r.userAgent,
+      })),
+    );
   },
 });

package/src/sessions/handlers/mine.query.ts

@@ -1,6 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { userSessionTable } from "../schema/user-session";
 
 // "My live sessions" — the backing data for a devices/sessions UI. Returns
@@ -26,13 +27,17 @@ export const mineQuery = defineQueryHandler({
       },
     );
     const currentSid = query.user.sid;
-    return rows.map((r) => ({
-      id: r.id,
-      createdAt: r.createdAt,
-      expiresAt: r.expiresAt,
-      ip: r.ip,
-      userAgent: r.userAgent,
-      current: currentSid === r.id,
-    }));
+    return Promise.all(
+      rows.map(async (r) => ({
+        id: r.id,
+        createdAt: r.createdAt,
+        expiresAt: r.expiresAt,
+        ip: r.ip ? await decryptStoredPii(r.ip, "ip", "sessions:mine") : r.ip,
+        userAgent: r.userAgent
+          ? await decryptStoredPii(r.userAgent, "userAgent", "sessions:mine")
+          : r.userAgent,
+        current: currentSid === r.id,
+      })),
+    );
   },
 });

package/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -1,21 +1,28 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { append } from "@cosmicdrift/kumiko-framework/event-store";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { userSessionTable } from "../schema/user-session";
+import {
+  SESSION_REVOKED_AGGREGATE_TYPE,
+  SESSION_REVOKED_EVENT_QN,
+  sessionRevokedSchema,
+} from "../session-revoked-event";
 
 // Mass-revoke ALL live sessions for a target user — privileged-only.
-// Used by user-data-rights:restrict-account zur Account-Freeze
-// (DSGVO Art. 18) sowie potenziell anderen ops-flows ("ban user",
-// "compromised account"). Im Gegensatz zu revoke-all-others wird
-// die ggf. aufrufende Session ebenfalls revoked — Caller ist System
-// (cron/operator/cross-feature), nicht der Endnutzer selbst.
+// Used by user-data-rights:restrict-account for account-freeze (DSGVO
+// Art. 18) and potentially other ops flows ("ban user", "compromised
+// account"). Unlike revoke-all-others, the caller's own session (if any)
+// is revoked too — the caller is System (cron/operator/cross-feature),
+// not the end-user themselves.
 //
-// Tenant-scope: das userSession-Schema persistiert tenantId pro Row
-// (User kann mehrere Sessions in mehreren Tenants haben). Wir
-// revoken cross-tenant, weil "Account-Restriction" eine globale
-// User-Aussage ist (Forget-Pfad ist auch global, sieht User-Entity-
-// special-Doc). UPDATE filtert nur auf userId.
+// Tenant-scope: the userSession schema persists tenantId per row (a user
+// can have sessions in multiple tenants). We revoke cross-tenant because
+// "account restriction" is a global user-level statement (the forget path
+// is global too, see the User-Entity special doc). The UPDATE filters
+// only on userId.
 export const revokeAllForUserWrite = defineWriteHandler({
   name: "user-session:revoke-all-for-user",
   schema: z.object({
@@ -23,13 +30,45 @@ export const revokeAllForUserWrite = defineWriteHandler({
   }),
   access: { roles: access.privileged },
   handler: async (event, ctx) => {
-    const updated = await updateMany(
+    const updated = await updateMany<{ id: string }>(
       ctx.db.raw,
       userSessionTable,
       { revokedAt: Temporal.Now.instant() },
       { userId: event.payload.userId, revokedAt: null },
     );
 
+    // Lightweight append alongside the direct-write above (#1559) — see
+    // revoke.write.ts for why this isn't a lifecycle event on
+    // store_user_sessions. Uses the low-level append() (not
+    // ctx.unsafeAppendEvent) because this handler is deliberately
+    // cross-tenant: the privileged caller's own tenantId (what
+    // ctx.unsafeAppendEvent would bind to) has no relationship to the
+    // target user's session tenant(s). Anchored on SYSTEM_TENANT_ID
+    // instead, same as the jobs feature's cross-tenant run-lifecycle
+    // events (job-run-logger.ts) — a fresh aggregate per call, so no
+    // predecessor/version_conflict concerns.
+    //
+    // append() itself does NOT validate against the r.defineEvent-
+    // registered schema (that guarantee only comes from going through
+    // ctx.unsafeAppendEvent's dispatcher path). Mirrors job-run-logger.ts:
+    // parse explicitly before the raw append so a shape drift fails loudly
+    // here instead of landing unvalidated on the events table.
+    if (updated.length > 0) {
+      const payload = sessionRevokedSchema.parse({
+        userId: event.payload.userId,
+        sessionIds: updated.map((row) => row.id),
+      });
+      await append(ctx.db.raw, {
+        aggregateId: generateId(),
+        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+        tenantId: SYSTEM_TENANT_ID,
+        expectedVersion: 0,
+        type: SESSION_REVOKED_EVENT_QN,
+        payload,
+        metadata: { userId: event.user.id },
+      });
+    }
+
     return {
       isSuccess: true as const,
       data: { count: updated.length, userId: event.payload.userId },

package/src/sessions/handlers/revoke-all-others.write.ts

@@ -1,10 +1,12 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { SessionErrors } from "../constants";
 import { userSessionTable } from "../schema/user-session";
+import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN } from "../session-revoked-event";
 
 // "Sign out everywhere else" — keep the caller's current session, kill all
 // other live sessions for this user. Requires `user.sid` so "keep current"
@@ -25,13 +27,29 @@ export const revokeAllOthersWrite = defineWriteHandler({
       );
     }
 
-    const updated = await updateMany(
+    const updated = await updateMany<{ id: string }>(
       ctx.db,
       userSessionTable,
       { revokedAt: Temporal.Now.instant() },
       { userId: event.user.id, revokedAt: null, id: { ne: keepSid } },
     );
 
+    // Lightweight append alongside the direct-write above (#1559) — see
+    // revoke.write.ts for why this isn't a lifecycle event on
+    // store_user_sessions. Skipped when nothing was revoked (no other
+    // live sessions) — a spurious invalidation would be the failure mode.
+    if (updated.length > 0) {
+      await ctx.unsafeAppendEvent({
+        aggregateId: generateId(),
+        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+        type: SESSION_REVOKED_EVENT_QN,
+        payload: {
+          userId: event.user.id,
+          sessionIds: updated.map((row) => row.id),
+        },
+      });
+    }
+
     return { isSuccess: true, data: { count: updated.length } };
   },
 });

package/src/sessions/handlers/revoke.write.ts

@@ -1,10 +1,12 @@
 import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { SessionErrors } from "../constants";
 import { userSessionTable } from "../schema/user-session";
+import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN } from "../session-revoked-event";
 
 // Revoke a single session by id (= JWT jti). Three distinguishable outcomes:
 //
@@ -36,6 +38,17 @@ export const revokeWrite = defineWriteHandler({
     );
 
     if (updated.length > 0) {
+      // Lightweight append alongside the direct-write above (#1559) — NOT a
+      // lifecycle event for store_user_sessions (that table stays an
+      // unmanaged direct-write store, see feature.ts). Own aggregate id per
+      // revoke, no predecessor to satisfy, no version_conflict against a
+      // concurrent revoke on a different sid.
+      await ctx.unsafeAppendEvent({
+        aggregateId: generateId(),
+        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+        type: SESSION_REVOKED_EVENT_QN,
+        payload: { userId: event.user.id, sessionIds: [event.payload.id] },
+      });
       return { isSuccess: true, data: { id: event.payload.id } };
     }
 

package/src/sessions/i18n.ts

@@ -0,0 +1,23 @@
+// @runtime client
+// Server + client i18n for the sessions operator screens.
+
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const SESSIONS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:session-list.title": { de: "Sitzungen", en: "Sessions" },
+  "screen:session-detail.title": { de: "Sitzung", en: "Session" },
+  "sessions:nav.sessionList": { de: "Sitzungen", en: "Sessions" },
+  "sessions.list.col.id": { de: "ID", en: "ID" },
+  "sessions.list.col.userId": { de: "User-ID", en: "User ID" },
+  "sessions.list.col.createdAt": { de: "Erstellt", en: "Created" },
+  "sessions.list.col.expiresAt": { de: "Läuft ab", en: "Expires" },
+  "sessions.list.col.revokedAt": { de: "Widerrufen", en: "Revoked" },
+  "sessions.list.action.open": { de: "Details", en: "Details" },
+  "sessions.detail.field.id": { de: "ID", en: "ID" },
+  "sessions.detail.field.userId": { de: "User-ID", en: "User ID" },
+  "sessions.detail.field.createdAt": { de: "Erstellt", en: "Created" },
+  "sessions.detail.field.expiresAt": { de: "Läuft ab", en: "Expires" },
+  "sessions.detail.field.revokedAt": { de: "Widerrufen", en: "Revoked" },
+  "sessions.detail.field.ip": { de: "IP-Adresse", en: "IP address" },
+  "sessions.detail.field.userAgent": { de: "User-Agent", en: "User agent" },
+};

package/src/sessions/index.ts

@@ -6,8 +6,8 @@ export {
   SessionHandlers,
   SessionQueries,
 } from "./constants";
-export type { SessionsFeatureOptions } from "./feature";
-export { createSessionsFeature } from "./feature";
+export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature";
+export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature";
 export { userSessionEntity, userSessionTable } from "./schema/user-session";
 export type {
   SessionCallbacks,
@@ -15,3 +15,10 @@ export type {
   SessionMassRevoker,
 } from "./session-callbacks";
 export { createSessionCallbacks } from "./session-callbacks";
+export type { SessionRevokedPayload } from "./session-revoked-event";
+export {
+  SESSION_REVOKED_AGGREGATE_TYPE,
+  SESSION_REVOKED_EVENT_QN,
+  SESSION_REVOKED_EVENT_SHORT,
+  sessionRevokedSchema,
+} from "./session-revoked-event";

package/src/sessions/schema/user-session.ts

@@ -20,7 +20,7 @@ export const userSessionEntity = createEntity({
   // Entity-Key ist "user-session" (mit Dash), toTableName's snake-case-
   // Transform käme auf "read_user-sessions" → kein valides SQL ohne Quoting.
   // Deshalb expliziter Override auf den read_-konformen Namen.
-  table: "read_user_sessions",
+  table: "store_user_sessions",
   // sid-as-PK: the sessionCreator callback generates the UUID, returns it to
   // the framework; the framework stamps it as `jti`; here the same value is
   // the row primary key. Single source of truth for the identifier.
@@ -53,13 +53,17 @@ export const userSessionEntity = createEntity({
     revokedAt: createTimestampField({
       access: { write: access.privileged },
     }),
+    // Subject is the session's user, not the session row — a user-forget
+    // must shred these, so the key hangs off userId (sid-self would orphan).
     ip: createTextField({
       maxLength: 64,
       access: { write: access.privileged },
+      userOwned: { ownerField: "userId" },
     }),
     userAgent: createTextField({
       maxLength: 512,
       access: { write: access.privileged },
+      userOwned: { ownerField: "userId" },
     }),
   },
 });
@@ -70,4 +74,6 @@ export const userSessionEntity = createEntity({
 // handlers write it directly via ctx.db; the meta carries no executor-only
 // brand so those writes stay legal. See feature.ts for the rebuild-exclusion
 // rationale (#494/#498).
-export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity);
+export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity, {
+  source: "unmanaged",
+});