@dudousxd/nestjs-media-dashboard 0.7.2 → 0.9.0

package/dist/server/index.d.ts

@@ -13,6 +13,13 @@ interface ConsoleSessionUser {
 type SessionHook = (request: unknown) => Promise<ConsoleSessionUser | null> | ConsoleSessionUser | null;
 /** Host hook for Mode B — validates submitted credentials from the built-in login screen. */
 type LoginHook = (username: string, password: string) => Promise<ConsoleSessionUser | null> | ConsoleSessionUser | null;
+/**
+ * Re-checks a LIVE session when the cookie is slid forward. Runs at most once per `ttl/2` per
+ * session, so a DB round-trip here is cheap. Return `false` to revoke (the cookie is cleared and
+ * the request denied). Distinct from `session`: that hook reads the host's auth off a fresh
+ * request, which a console XHR does not carry — this one receives the already-minted session.
+ */
+type RevalidateHook = (session: ConsoleSessionUser) => Promise<boolean> | boolean;
 /** Author-facing `auth` option on `MediaDashboardModule.forRoot`. Mirrors telescope's dashboardAuth. */
 interface ConsoleAuthOptions {
     /** REQUIRED HMAC-SHA256 signing key. Missing/empty => boot error (fail closed). */
@@ -23,6 +30,8 @@ interface ConsoleAuthOptions {
     session?: SessionHook;
     /** Mode B: validate credentials from the built-in login screen. */
     login?: LoginHook;
+    /** Re-checks the session on sliding renewal. Not a mode — it cannot mint a session on its own. */
+    revalidate?: RevalidateHook;
 }
 
 interface MediaDashboardOptions {
@@ -46,7 +55,8 @@ interface MediaDashboardOptions {
      * Gate the console (SPA + API) behind a built-in session-cookie login, telescope-style. Omit to
      * leave the console open (front it with your own guard). When set, the SPA renders a login screen
      * until a valid cookie exists; supply a `login(username, password)` and/or `session(request)`
-     * hook that returns a session user (or `null` to deny) — see {@link ConsoleAuthOptions}.
+     * hook that returns a session user (or `null` to deny), and optionally a `revalidate(session)`
+     * hook that re-checks the user when the cookie is slid forward — see {@link ConsoleAuthOptions}.
      */
     auth?: ConsoleAuthOptions;
     /**

package/dist/server/index.js

@@ -42,6 +42,9 @@ function resolveConsoleAuth(options) {
     } : {},
     ...options.login ? {
       login: options.login
+    } : {},
+    ...options.revalidate ? {
+      revalidate: options.revalidate
     } : {}
   };
 }
@@ -316,14 +319,16 @@ var MediaConsoleGuard = class {
     this.auth = auth;
     this.cookiePath = cookiePath;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
     const http = context.switchToHttp();
     const request = http.getRequest();
     const session = this.verifyRequestSession(request);
     if (!session) throw new UnauthorizedException();
     attachSession(request, session);
-    this.maybeRenew(http.getResponse(), request, session);
+    if (!await this.maybeRenew(http.getResponse(), request, session)) {
+      throw new UnauthorizedException();
+    }
     return true;
   }
   verifyRequestSession(request) {
@@ -335,26 +340,46 @@ var MediaConsoleGuard = class {
     });
   }
   /**
-  * Sliding renewal: when a valid cookie is past half its TTL, re-issue a fresh one so active users
-  * never get logged out mid-session. Appends a new Set-Cookie (preserving any others already set).
+  * Sliding renewal + revalidation: when a valid cookie is past half its TTL, re-issue a fresh one
+  * so active users never get logged out mid-session — but first let the host's `revalidate` hook
+  * re-check the user, so a deactivated or demoted operator loses access instead of riding a
+  * self-renewing cookie. Returns `false` when the session was revoked (cookie already cleared).
   */
-  maybeRenew(response, request, session) {
-    if (!this.auth) return;
+  async maybeRenew(response, request, session) {
+    if (!this.auth) return true;
     const now = Date.now();
-    if (now - session.iat <= this.auth.ttlMs / 2) return;
-    issueSessionCookie({
+    if (now - session.iat <= this.auth.ttlMs / 2) return true;
+    const user = {
       id: session.sub,
       ...session.name !== void 0 ? {
         name: session.name
       } : {},
       roles: session.roles
-    }, {
+    };
+    if (this.auth.revalidate) {
+      let allowed;
+      try {
+        allowed = await this.auth.revalidate(user);
+      } catch {
+        allowed = false;
+      }
+      if (!allowed) {
+        clearSessionCookie({
+          cookiePath: this.cookiePath ?? "/",
+          request,
+          response
+        });
+        return false;
+      }
+    }
+    issueSessionCookie(user, {
       auth: this.auth,
       cookiePath: this.cookiePath ?? "/",
       request,
       response,
       now
     });
+    return true;
   }
 };
 MediaConsoleGuard = _ts_decorate([