@dudousxd/nestjs-media-dashboard 0.8.0 → 0.9.0

package/dist/server/index.cjs

@@ -75,6 +75,9 @@ function resolveConsoleAuth(options) {
     } : {},
     ...options.login ? {
       login: options.login
+    } : {},
+    ...options.revalidate ? {
+      revalidate: options.revalidate
     } : {}
   };
 }
@@ -349,14 +352,16 @@ var MediaConsoleGuard = class {
     this.auth = auth;
     this.cookiePath = cookiePath;
   }
-  canActivate(context) {
+  async canActivate(context) {
     if (!this.auth) return true;
     const http = context.switchToHttp();
     const request = http.getRequest();
     const session = this.verifyRequestSession(request);
     if (!session) throw new import_common.UnauthorizedException();
     attachSession(request, session);
-    this.maybeRenew(http.getResponse(), request, session);
+    if (!await this.maybeRenew(http.getResponse(), request, session)) {
+      throw new import_common.UnauthorizedException();
+    }
     return true;
   }
   verifyRequestSession(request) {
@@ -368,26 +373,46 @@ var MediaConsoleGuard = class {
     });
   }
   /**
-  * Sliding renewal: when a valid cookie is past half its TTL, re-issue a fresh one so active users
-  * never get logged out mid-session. Appends a new Set-Cookie (preserving any others already set).
+  * Sliding renewal + revalidation: when a valid cookie is past half its TTL, re-issue a fresh one
+  * so active users never get logged out mid-session — but first let the host's `revalidate` hook
+  * re-check the user, so a deactivated or demoted operator loses access instead of riding a
+  * self-renewing cookie. Returns `false` when the session was revoked (cookie already cleared).
   */
-  maybeRenew(response, request, session) {
-    if (!this.auth) return;
+  async maybeRenew(response, request, session) {
+    if (!this.auth) return true;
     const now = Date.now();
-    if (now - session.iat <= this.auth.ttlMs / 2) return;
-    issueSessionCookie({
+    if (now - session.iat <= this.auth.ttlMs / 2) return true;
+    const user = {
       id: session.sub,
       ...session.name !== void 0 ? {
         name: session.name
       } : {},
       roles: session.roles
-    }, {
+    };
+    if (this.auth.revalidate) {
+      let allowed;
+      try {
+        allowed = await this.auth.revalidate(user);
+      } catch {
+        allowed = false;
+      }
+      if (!allowed) {
+        clearSessionCookie({
+          cookiePath: this.cookiePath ?? "/",
+          request,
+          response
+        });
+        return false;
+      }
+    }
+    issueSessionCookie(user, {
       auth: this.auth,
       cookiePath: this.cookiePath ?? "/",
       request,
       response,
       now
     });
+    return true;
   }
 };
 MediaConsoleGuard = _ts_decorate([