@de-otio/trellis 0.4.0

package/dist/lib/session-awareness.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Session Awareness Module
+ *
+ * Provides session duration thresholds and nudge messages for age-tier-based
+ * screen time management.
+ */
+import type { AgeTier } from "@prisma/client";
+export interface Nudge {
+    type: "time_reminder" | "session_limit";
+    message: string;
+    sessionMinutes: number;
+}
+export interface SessionThresholds {
+    firstNudgeMinutes: number | null;
+    secondNudgeMinutes: number | null;
+    hardLimitMinutes: number | null;
+}
+/**
+ * Returns session duration thresholds for the given age tier.
+ *
+ * CHILD: first=15, second=25, hard=30
+ * TEEN: first=30, second=50, hard=null
+ * ADULT: first=60, second=null, hard=null
+ */
+export declare function getSessionThresholds(ageTier: AgeTier): SessionThresholds;
+/**
+ * Returns a nudge if the session duration exceeds any threshold for the age tier.
+ *
+ * Returns the highest applicable nudge:
+ * - session_limit if hard limit is exceeded (CHILD only)
+ * - time_reminder for first/second nudge thresholds
+ * - null if no threshold exceeded
+ */
+export declare function getSessionNudge(sessionDurationMinutes: number, ageTier: AgeTier): Nudge | null;
+//# sourceMappingURL=session-awareness.d.ts.map

package/dist/lib/session-awareness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-awareness.d.ts","sourceRoot":"","sources":["../../src/lib/session-awareness.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE9C,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,eAAe,GAAG,eAAe,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAqBxE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,sBAAsB,EAAE,MAAM,EAC9B,OAAO,EAAE,OAAO,GACf,KAAK,GAAG,IAAI,CAwCd"}

package/dist/lib/session-awareness.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Session Awareness Module
+ *
+ * Provides session duration thresholds and nudge messages for age-tier-based
+ * screen time management.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSessionThresholds = getSessionThresholds;
+exports.getSessionNudge = getSessionNudge;
+/**
+ * Returns session duration thresholds for the given age tier.
+ *
+ * CHILD: first=15, second=25, hard=30
+ * TEEN: first=30, second=50, hard=null
+ * ADULT: first=60, second=null, hard=null
+ */
+function getSessionThresholds(ageTier) {
+    switch (ageTier) {
+        case "CHILD":
+            return {
+                firstNudgeMinutes: 15,
+                secondNudgeMinutes: 25,
+                hardLimitMinutes: 30,
+            };
+        case "TEEN":
+            return {
+                firstNudgeMinutes: 30,
+                secondNudgeMinutes: 50,
+                hardLimitMinutes: null,
+            };
+        case "ADULT":
+            return {
+                firstNudgeMinutes: 60,
+                secondNudgeMinutes: null,
+                hardLimitMinutes: null,
+            };
+    }
+}
+/**
+ * Returns a nudge if the session duration exceeds any threshold for the age tier.
+ *
+ * Returns the highest applicable nudge:
+ * - session_limit if hard limit is exceeded (CHILD only)
+ * - time_reminder for first/second nudge thresholds
+ * - null if no threshold exceeded
+ */
+function getSessionNudge(sessionDurationMinutes, ageTier) {
+    const thresholds = getSessionThresholds(ageTier);
+    // Check hard limit first (highest priority)
+    if (thresholds.hardLimitMinutes !== null &&
+        sessionDurationMinutes >= thresholds.hardLimitMinutes) {
+        return {
+            type: "session_limit",
+            message: `You've reached your session limit of ${thresholds.hardLimitMinutes} minutes. Come back later!`,
+            sessionMinutes: sessionDurationMinutes,
+        };
+    }
+    // Check second nudge
+    if (thresholds.secondNudgeMinutes !== null &&
+        sessionDurationMinutes >= thresholds.secondNudgeMinutes) {
+        return {
+            type: "time_reminder",
+            message: `You've been browsing for ${sessionDurationMinutes} minutes. Time for a break.`,
+            sessionMinutes: sessionDurationMinutes,
+        };
+    }
+    // Check first nudge
+    if (thresholds.firstNudgeMinutes !== null &&
+        sessionDurationMinutes >= thresholds.firstNudgeMinutes) {
+        return {
+            type: "time_reminder",
+            message: `You've been browsing for ${sessionDurationMinutes} minutes. Consider taking a break!`,
+            sessionMinutes: sessionDurationMinutes,
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=session-awareness.js.map

package/dist/lib/session-awareness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-awareness.js","sourceRoot":"","sources":["../../src/lib/session-awareness.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAuBH,oDAqBC;AAUD,0CA2CC;AAjFD;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,EAAE;gBACtB,gBAAgB,EAAE,EAAE;aACrB,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,EAAE;gBACtB,gBAAgB,EAAE,IAAI;aACvB,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;aACvB,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAC7B,sBAA8B,EAC9B,OAAgB;IAEhB,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEjD,4CAA4C;IAC5C,IACE,UAAU,CAAC,gBAAgB,KAAK,IAAI;QACpC,sBAAsB,IAAI,UAAU,CAAC,gBAAgB,EACrD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,wCAAwC,UAAU,CAAC,gBAAgB,4BAA4B;YACxG,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,IACE,UAAU,CAAC,kBAAkB,KAAK,IAAI;QACtC,sBAAsB,IAAI,UAAU,CAAC,kBAAkB,EACvD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4BAA4B,sBAAsB,6BAA6B;YACxF,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,IACE,UAAU,CAAC,iBAAiB,KAAK,IAAI;QACrC,sBAAsB,IAAI,UAAU,CAAC,iBAAiB,EACtD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,4BAA4B,sBAAsB,oCAAoC;YAC/F,cAAc,EAAE,sBAAsB;SACvC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/session-config.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Session Configuration
+ *
+ * Provides configurable session timeout settings following security best practices.
+ * Reads from environment variables with sensible defaults.
+ */
+export interface SessionConfig {
+    /** Regular user session timeout in days (magic link authentication) */
+    userSessionTimeoutDays: number;
+    /** SSO session timeout in days (Microsoft Entra ID, SAML) */
+    ssoSessionTimeoutDays: number;
+    /** Dashboard/admin session timeout in hours (more secure) */
+    dashboardSessionTimeoutHours: number;
+    /** Session refresh threshold in hours (refresh when this much time remains) */
+    refreshThresholdHours: number;
+    /** Inactivity timeout in minutes (0 to disable) */
+    inactivityTimeoutMinutes: number;
+}
+/**
+ * Session Configuration Manager class
+ *
+ * Environment variables (with defaults):
+ * - SESSION_USER_TIMEOUT_DAYS (default: 90)
+ * - SESSION_SSO_TIMEOUT_DAYS (default: 7)
+ * - SESSION_DASHBOARD_TIMEOUT_HOURS (default: 24)
+ * - SESSION_REFRESH_THRESHOLD_HOURS (default: 1)
+ * - SESSION_INACTIVITY_TIMEOUT_MINUTES (default: 60)
+ */
+export declare class SessionConfigManager {
+    private config;
+    private logger;
+    constructor(env: {
+        [key: string]: any;
+    });
+    /**
+     * Load session configuration from environment variables
+     */
+    private loadConfig;
+    /**
+     * Get the current session configuration
+     */
+    getConfig(): SessionConfig;
+    /**
+     * Calculate session expiration timestamp
+     */
+    calculateSessionExpiration(sessionType: "user" | "sso" | "dashboard"): number;
+    /**
+     * Calculate cookie max-age in seconds
+     */
+    calculateCookieMaxAge(sessionType: "user" | "sso" | "dashboard"): number;
+    /**
+     * Check if session should be refreshed
+     */
+    shouldRefreshSession(sessionExpiresAt: number): boolean;
+    /**
+     * Check if session is expired
+     */
+    isSessionExpired(sessionExpiresAt: number): boolean;
+}
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+export declare function getSessionConfig(env: {
+    [key: string]: any;
+}): SessionConfig;
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+export declare function calculateSessionExpiration(config: SessionConfig, sessionType: "user" | "sso" | "dashboard"): number;
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+export declare function calculateCookieMaxAge(config: SessionConfig, sessionType: "user" | "sso" | "dashboard"): number;
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+export declare function shouldRefreshSession(sessionExpiresAt: number, config: SessionConfig): boolean;
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+export declare function isSessionExpired(sessionExpiresAt: number): boolean;
+//# sourceMappingURL=session-config.d.ts.map

package/dist/lib/session-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-config.d.ts","sourceRoot":"","sources":["../../src/lib/session-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,sBAAsB,EAAE,MAAM,CAAC;IAE/B,6DAA6D;IAC7D,qBAAqB,EAAE,MAAM,CAAC;IAE9B,6DAA6D;IAC7D,4BAA4B,EAAE,MAAM,CAAC;IAErC,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,CAAC;IAE9B,mDAAmD;IACnD,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE;IAKvC;;OAEG;IACH,OAAO,CAAC,UAAU;IAiDlB;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;OAEG;IACH,0BAA0B,CACxB,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,GACxC,MAAM;IAeT;;OAEG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,MAAM;IAaxE;;OAEG;IACH,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAQvD;;OAEG;IACH,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO;CAGpD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,GAAG,aAAa,CAE3E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,GACxC,MAAM,CAIR;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,GACxC,MAAM,CAIR;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,aAAa,GACpB,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAElE"}

package/dist/lib/session-config.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Session Configuration
+ *
+ * Provides configurable session timeout settings following security best practices.
+ * Reads from environment variables with sensible defaults.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionConfigManager = void 0;
+exports.getSessionConfig = getSessionConfig;
+exports.calculateSessionExpiration = calculateSessionExpiration;
+exports.calculateCookieMaxAge = calculateCookieMaxAge;
+exports.shouldRefreshSession = shouldRefreshSession;
+exports.isSessionExpired = isSessionExpired;
+const logger_1 = require("./logger");
+/**
+ * Session Configuration Manager class
+ *
+ * Environment variables (with defaults):
+ * - SESSION_USER_TIMEOUT_DAYS (default: 90)
+ * - SESSION_SSO_TIMEOUT_DAYS (default: 7)
+ * - SESSION_DASHBOARD_TIMEOUT_HOURS (default: 24)
+ * - SESSION_REFRESH_THRESHOLD_HOURS (default: 1)
+ * - SESSION_INACTIVITY_TIMEOUT_MINUTES (default: 60)
+ */
+class SessionConfigManager {
+    config;
+    logger;
+    constructor(env) {
+        this.logger = logger_1.Logger.getInstance(env);
+        this.config = this.loadConfig(env);
+    }
+    /**
+     * Load session configuration from environment variables
+     */
+    loadConfig(env) {
+        // Parse SESSION_CONFIG JSON if provided (from config.yaml)
+        let config = {};
+        if (env.SESSION_CONFIG) {
+            try {
+                const parsed = typeof env.SESSION_CONFIG === "string"
+                    ? JSON.parse(env.SESSION_CONFIG)
+                    : env.SESSION_CONFIG;
+                config = {
+                    userSessionTimeoutDays: parsed.USER_SESSION_TIMEOUT_DAYS,
+                    ssoSessionTimeoutDays: parsed.SSO_SESSION_TIMEOUT_DAYS,
+                    dashboardSessionTimeoutHours: parsed.DASHBOARD_SESSION_TIMEOUT_HOURS,
+                    refreshThresholdHours: parsed.REFRESH_THRESHOLD_HOURS,
+                    inactivityTimeoutMinutes: parsed.INACTIVITY_TIMEOUT_MINUTES,
+                };
+            }
+            catch (e) {
+                this.logger.warn("[SessionConfig] Failed to parse SESSION_CONFIG, using defaults");
+            }
+        }
+        // Fall back to individual env vars, then defaults
+        return {
+            userSessionTimeoutDays: config.userSessionTimeoutDays ??
+                parseInt(env.SESSION_USER_TIMEOUT_DAYS || "90", 10),
+            ssoSessionTimeoutDays: config.ssoSessionTimeoutDays ??
+                parseInt(env.SESSION_SSO_TIMEOUT_DAYS || "7", 10),
+            dashboardSessionTimeoutHours: config.dashboardSessionTimeoutHours ??
+                parseInt(env.SESSION_DASHBOARD_TIMEOUT_HOURS || "24", 10),
+            refreshThresholdHours: config.refreshThresholdHours ??
+                parseInt(env.SESSION_REFRESH_THRESHOLD_HOURS || "1", 10),
+            inactivityTimeoutMinutes: config.inactivityTimeoutMinutes ??
+                parseInt(env.SESSION_INACTIVITY_TIMEOUT_MINUTES || "60", 10),
+        };
+    }
+    /**
+     * Get the current session configuration
+     */
+    getConfig() {
+        return this.config;
+    }
+    /**
+     * Calculate session expiration timestamp
+     */
+    calculateSessionExpiration(sessionType) {
+        const now = Date.now();
+        switch (sessionType) {
+            case "user":
+                return now + this.config.userSessionTimeoutDays * 24 * 60 * 60 * 1000;
+            case "sso":
+                return now + this.config.ssoSessionTimeoutDays * 24 * 60 * 60 * 1000;
+            case "dashboard":
+                return now + this.config.dashboardSessionTimeoutHours * 60 * 60 * 1000;
+            default:
+                return now + this.config.userSessionTimeoutDays * 24 * 60 * 60 * 1000;
+        }
+    }
+    /**
+     * Calculate cookie max-age in seconds
+     */
+    calculateCookieMaxAge(sessionType) {
+        switch (sessionType) {
+            case "user":
+                return this.config.userSessionTimeoutDays * 24 * 60 * 60;
+            case "sso":
+                return this.config.ssoSessionTimeoutDays * 24 * 60 * 60;
+            case "dashboard":
+                return this.config.dashboardSessionTimeoutHours * 60 * 60;
+            default:
+                return this.config.userSessionTimeoutDays * 24 * 60 * 60;
+        }
+    }
+    /**
+     * Check if session should be refreshed
+     */
+    shouldRefreshSession(sessionExpiresAt) {
+        const now = Date.now();
+        const timeUntilExpiration = sessionExpiresAt - now;
+        const refreshThreshold = this.config.refreshThresholdHours * 60 * 60 * 1000;
+        return timeUntilExpiration > 0 && timeUntilExpiration < refreshThreshold;
+    }
+    /**
+     * Check if session is expired
+     */
+    isSessionExpired(sessionExpiresAt) {
+        return sessionExpiresAt < Date.now();
+    }
+}
+exports.SessionConfigManager = SessionConfigManager;
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+function getSessionConfig(env) {
+    return new SessionConfigManager(env).getConfig();
+}
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+function calculateSessionExpiration(config, sessionType) {
+    const manager = new SessionConfigManager({});
+    manager["config"] = config; // Set config directly for compatibility
+    return manager.calculateSessionExpiration(sessionType);
+}
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+function calculateCookieMaxAge(config, sessionType) {
+    const manager = new SessionConfigManager({});
+    manager["config"] = config; // Set config directly for compatibility
+    return manager.calculateCookieMaxAge(sessionType);
+}
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+function shouldRefreshSession(sessionExpiresAt, config) {
+    const manager = new SessionConfigManager({});
+    manager["config"] = config; // Set config directly for compatibility
+    return manager.shouldRefreshSession(sessionExpiresAt);
+}
+/**
+ * Legacy function for backward compatibility
+ * @deprecated Use new SessionConfigManager class instead
+ */
+function isSessionExpired(sessionExpiresAt) {
+    return sessionExpiresAt < Date.now();
+}
+//# sourceMappingURL=session-config.js.map

package/dist/lib/session-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-config.js","sourceRoot":"","sources":["../../src/lib/session-config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA8JH,4CAEC;AAMD,gEAOC;AAMD,sDAOC;AAMD,oDAOC;AAMD,4CAEC;AA7MD,qCAAkC;AAmBlC;;;;;;;;;GASG;AACH,MAAa,oBAAoB;IACvB,MAAM,CAAgB;IACtB,MAAM,CAAS;IAEvB,YAAY,GAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAA2B;QAC5C,2DAA2D;QAC3D,IAAI,MAAM,GAA2B,EAAE,CAAC;QAExC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;oBACpC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;oBAChC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;gBAEzB,MAAM,GAAG;oBACP,sBAAsB,EAAE,MAAM,CAAC,yBAAyB;oBACxD,qBAAqB,EAAE,MAAM,CAAC,wBAAwB;oBACtD,4BAA4B,EAAE,MAAM,CAAC,+BAA+B;oBACpE,qBAAqB,EAAE,MAAM,CAAC,uBAAuB;oBACrD,wBAAwB,EAAE,MAAM,CAAC,0BAA0B;iBAC5D,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,OAAO;YACL,sBAAsB,EACpB,MAAM,CAAC,sBAAsB;gBAC7B,QAAQ,CAAC,GAAG,CAAC,yBAAyB,IAAI,IAAI,EAAE,EAAE,CAAC;YAErD,qBAAqB,EACnB,MAAM,CAAC,qBAAqB;gBAC5B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,IAAI,GAAG,EAAE,EAAE,CAAC;YAEnD,4BAA4B,EAC1B,MAAM,CAAC,4BAA4B;gBACnC,QAAQ,CAAC,GAAG,CAAC,+BAA+B,IAAI,IAAI,EAAE,EAAE,CAAC;YAE3D,qBAAqB,EACnB,MAAM,CAAC,qBAAqB;gBAC5B,QAAQ,CAAC,GAAG,CAAC,+BAA+B,IAAI,GAAG,EAAE,EAAE,CAAC;YAE1D,wBAAwB,EACtB,MAAM,CAAC,wBAAwB;gBAC/B,QAAQ,CAAC,GAAG,CAAC,kCAAkC,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,0BAA0B,CACxB,WAAyC;QAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACxE,KAAK,KAAK;gBACR,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACvE,KAAK,WAAW;gBACd,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACzE;gBACE,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,WAAyC;QAC7D,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAC3D,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YAC1D,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,MAAM,CAAC,4BAA4B,GAAG,EAAE,GAAG,EAAE,CAAC;YAC5D;gBACE,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,gBAAwB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,GAAG,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAE5E,OAAO,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,GAAG,gBAAgB,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,gBAAwB;QACvC,OAAO,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;CACF;AAzHD,oDAyHC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,GAA2B;IAC1D,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CACxC,MAAqB,EACrB,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,MAAqB,EACrB,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,gBAAwB,EACxB,MAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,wCAAwC;IACpE,OAAO,OAAO,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,gBAAwB;IACvD,OAAO,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACvC,CAAC"}

package/dist/lib/session-manager.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Session Management
+ *
+ * Handles encrypted cookie-based session storage for authentication.
+ * Uses Supabase Auth.
+ */
+import type { AgeTier } from "@prisma/client";
+export type UserRole = "END_USER" | "B2B_PARTNER" | "PARTNER_ADMIN" | "INTERNAL" | "CONTENT_CREATOR" | "SUPER_ADMIN";
+export interface Session {
+    userId: string;
+    email: string;
+    role?: UserRole;
+    expiresAt: number;
+    csrfToken?: string;
+    csrfTokenCreatedAt?: number;
+    csrfTokenNeedsRotation?: boolean;
+    lastActivityAt?: number;
+    sessionType?: "user" | "sso" | "dashboard";
+    dataRegion: string;
+    profileContext: "primary" | "decoy";
+    contextId?: string;
+    mfaVerified?: boolean;
+    ageTier?: AgeTier;
+}
+/**
+ * Session Manager class for handling encrypted sessions
+ */
+export declare class SessionManager {
+    private static readonly COOKIE_NAME;
+    hadLegacySessionCookie: boolean;
+    hadInvalidSessionCookie: boolean;
+    /**
+     * Get session configuration from environment
+     */
+    private getSessionConfig;
+    /**
+     * Derive encryption key from secret using PBKDF2
+     * This provides proper key stretching and consistent key size
+     *
+     * Environment Variables:
+     * - SESSION_SALT: Custom salt for PBKDF2 (REQUIRED — must be set in environment)
+     */
+    private deriveKey;
+    /**
+     * Encrypt session data using Web Crypto API (AES-GCM)
+     */
+    encryptSession(data: string, secret: string, salt?: string): Promise<string>;
+    /**
+     * Decrypt session data
+     */
+    decryptSession(encryptedData: string, secret: string, salt?: string): Promise<string | null>;
+    /**
+     * Parse cookies from Cookie header with proper URL decoding
+     * Handles edge cases and malformed cookies securely
+     */
+    private parseCookies;
+    /**
+     * Get session from request
+     * Checks Authorization header first (for localStorage token), then falls back to cookie
+     * Checks expiration and inactivity timeout
+     *
+     * Supports dual-secret rotation: tries primary secret first, then fallback secret
+     * This enables zero-downtime secret rotation without invalidating existing sessions
+     */
+    getSession(request: Request, secret: string, env?: {
+        [key: string]: any;
+    }): Promise<Session | null>;
+    /**
+     * Set session cookie in response (alias for setSession)
+     */
+    setSessionCookie(response: Response, session: Session, secret: string, cookieDomain?: string, env?: {
+        [key: string]: any;
+    }): Promise<Response>;
+    /**
+     * Set session cookie in response
+     * Uses configurable session timeout based on session type
+     */
+    setSession(response: Response, session: Session, secret: string, cookieDomain?: string, env?: {
+        [key: string]: any;
+    }): Promise<Response>;
+    /**
+     * Clear session cookie (alias for clearSession)
+     */
+    clearSessionCookie(response: Response): Response;
+    /**
+     * Clear session cookie
+     * @param response - Response to add clear cookie headers to
+     * @param cookieDomain - Optional domain to clear cookie from (e.g., ".example.com" for cross-subdomain)
+     */
+    clearSession(response: Response, cookieDomain?: string): Response;
+    /**
+     * AUTH-5: Hash a session token for blocklist storage.
+     */
+    private hashToken;
+    /**
+     * AUTH-5: Revoke a session token by adding it to the blocklist.
+     * Call this on logout to prevent token reuse.
+     */
+    revokeSession(request: Request, env: {
+        [key: string]: any;
+    }): Promise<void>;
+}
+//# sourceMappingURL=session-manager.d.ts.map

package/dist/lib/session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/lib/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAG9C,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,aAAa,GACb,eAAe,GACf,UAAU,GACV,iBAAiB,GACjB,aAAa,CAAC;AAElB,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC;IAOnB,cAAc,EAAE,SAAS,GAAG,OAAO,CAAC;IAKpC,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,sBAAsB,UAAS;IAC/B,uBAAuB,UAAS;IAEvC;;OAEG;YACW,gBAAgB;IAM9B;;;;;;OAMG;YACW,SAAS;IAuCvB;;OAEG;IACG,cAAc,CAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAqBlB;;OAEG;IACG,cAAc,CAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAqBpB;;;;;;;OAOG;IACG,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC3B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAsR1B;;OAEG;IACG,gBAAgB,CACpB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC3B,OAAO,CAAC,QAAQ,CAAC;IAIpB;;;OAGG;IACG,UAAU,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,GAAG,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC3B,OAAO,CAAC,QAAQ,CAAC;IAqEpB;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ;IAIhD;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ;IAyBjE;;OAEG;YACW,SAAS;IAQvB;;;OAGG;IACG,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,GAC1B,OAAO,CAAC,IAAI,CAAC;CA0BjB"}