@cosmicdrift/kumiko-dev-server 0.109.0 → 0.110.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.109.0",
+  "version": "0.110.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.109.0",
-    "@cosmicdrift/kumiko-framework": "0.109.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.110.0",
+    "@cosmicdrift/kumiko-framework": "0.110.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/run-dev-app.ts

@@ -29,7 +29,9 @@ import {
   patScopesFromFeature,
 } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import {
+  bindAutoRevokeFromFeature,
   createSessionCallbacks,
+  SESSIONS_FEATURE,
   type SessionCallbacks,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
@@ -463,6 +465,12 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
           db: stack.db,
           ...(expiresInMs !== undefined && { expiresInMs }),
         });
+        // Secure-by-default (symmetrisch zu runProdApp): Password-Change/
+        // -Reset mass-revoked die Sessions des Users ohne App-Opt-in.
+        const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
+        if (sessionsFeature) {
+          bindAutoRevokeFromFeature(sessionsFeature)?.(sessionCallbacks.sessionMassRevoker);
+        }
       }
       if (patFeature) {
         patResolver = createPatResolver({ db: stack.db, scopes: patScopesFromFeature(patFeature) });

package/src/run-prod-app.ts

@@ -61,6 +61,7 @@ import {
   SECRETS_FEATURE_NAME,
 } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import {
+  bindAutoRevokeFromFeature,
   createSessionCallbacks,
   SESSIONS_FEATURE,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
@@ -942,19 +943,20 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // sessionStrictMode=true: Prod-Sessions sollen nicht stillschweigend
   // von einem JWT-ohne-sid umgangen werden können. sessionMassRevoker
   // (4. callback aus createSessionCallbacks) ist nicht Teil der
-  // AuthRoutesConfig-Surface — der wird vom sessions-Feature selbst über
-  // die `autoRevokeOnPasswordChange`-Option konsumiert, nicht über die
-  // auth-routes.
+  // AuthRoutesConfig-Surface — der geht via bindAutoRevokeFromFeature ans
+  // sessions-Feature (Password-Change/-Reset revoked alle Sessions), nicht
+  // über die auth-routes.
   // Secure-by-default: if the sessions feature is mounted, server-side revocation +
-  // sessionStrictMode are wired automatically; `auth.sessions` only overrides the config,
-  // and `auth.sessions: false` is the explicit opt-out (back to stateless JWTs).
-  const sessionsFeatureMounted = features.some((f) => f.name === SESSIONS_FEATURE);
+  // sessionStrictMode + auto-revoke-on-password-change are wired automatically;
+  // `auth.sessions` only overrides the config, and `auth.sessions: false` is the
+  // explicit opt-out (back to stateless JWTs).
+  const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
   const sessionAuthFragment = shouldWireProdSessions(
     Boolean(effectiveAuth),
-    sessionsFeatureMounted,
+    sessionsFeature !== undefined,
     effectiveAuth?.sessions,
   )
-    ? buildProdSessionAuth(db, resolveProdSessionsConfig(effectiveAuth?.sessions))
+    ? buildProdSessionAuth(db, resolveProdSessionsConfig(effectiveAuth?.sessions), sessionsFeature)
     : undefined;
 
   // PAT opt-in: if the personal-access-tokens feature is mounted, wire its
@@ -1492,6 +1494,7 @@ export function staticCachePolicy(pathname: string): CachePolicy {
 function buildProdSessionAuth(
   db: import("@cosmicdrift/kumiko-framework/db").DbConnection,
   opts: ProdSessionsConfig,
+  sessionsFeature: import("@cosmicdrift/kumiko-framework/engine").FeatureDefinition | undefined,
 ): {
   readonly sessionCreator: ReturnType<typeof createSessionCallbacks>["sessionCreator"];
   readonly sessionRevoker: ReturnType<typeof createSessionCallbacks>["sessionRevoker"];
@@ -1502,6 +1505,11 @@ function buildProdSessionAuth(
     db,
     ...(opts.expiresInMs !== undefined && { expiresInMs: opts.expiresInMs }),
   });
+  // Secure-by-default: password-change/-reset mass-revokes the user's live
+  // sessions without the app opting in via autoRevokeOnPasswordChange.
+  if (sessionsFeature) {
+    bindAutoRevokeFromFeature(sessionsFeature)?.(cbs.sessionMassRevoker);
+  }
   return {
     sessionCreator: cbs.sessionCreator,
     sessionRevoker: cbs.sessionRevoker,