@efa-one/sdk 1.16.1 → 1.17.0

package/README.md

@@ -144,6 +144,14 @@ run under it. Dependabot is configured to never propose a TypeScript major.
 
 SemVer. Consuming apps pull new versions with `npm update @efa-one/sdk`.
 
+**Kernel compatibility — 1.17.0 needs an up-to-date kernel.** Since 1.17.0 the
+`app_session` cookie is bound to the kernel session and `requireAuth` checks it
+live via the kernel endpoint `GET /api/internal/sessions/:jti/status`. Against a
+kernel without that endpoint, every authenticated request fails closed with
+`503 Session service unavailable`. Roll out the kernel first, then apps on 1.17.
+Sessions issued by an older SDK are rejected once (401) and renewed on the next
+iframe load.
+
 ## License
 
 [Apache-2.0](./LICENSE) — permissive with a patent grant, so customers and partners

package/backend/auth.d.ts

@@ -9,6 +9,7 @@ export interface JwtPayload {
     iat: number;
     exp: number;
     forcePasswordChange?: boolean;
+    jti?: string;
 }
 export interface SessionPayload {
     sub: string;
@@ -17,6 +18,8 @@ export interface SessionPayload {
     email: string | null;
     language?: string;
     tenant: string;
+    kernelJti?: string;
+    kernelIat?: number;
 }
 export interface AuthRequest extends Request {
     user?: SessionPayload;

package/backend/auth.js

@@ -14,8 +14,11 @@ exports.createExchangeRouter = createExchangeRouter;
 const express_1 = require("express");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const permissionClient_1 = require("./permissionClient");
+const sessionStatusClient_1 = require("./sessionStatusClient");
 const JWT_ISSUER = 'converge';
 const JWT_AUDIENCE = 'converge';
+const KERNEL_JTI_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+const KERNEL_SUB_RE = /^[A-Za-z0-9._:@-]{1,128}$/;
 function getPlatformPublicKey() {
     const s = process.env.JWT_PUBLIC_KEY;
     if (!s)
@@ -31,14 +34,14 @@ function getSessionSecret() {
 function getCookieName() {
     return process.env.APP_SESSION_COOKIE_NAME || 'app_session';
 }
-function setSessionCookie(res, token) {
+function setSessionCookie(res, token, maxAgeMs) {
     const secure = process.env.COOKIE_SECURE
         ? ['1', 'true', 'yes', 'on'].includes(process.env.COOKIE_SECURE.toLowerCase())
         : process.env.NODE_ENV === 'production';
     res.cookie(getCookieName(), token, {
         httpOnly: true,
         sameSite: 'lax',
-        maxAge: 8 * 60 * 60 * 1000,
+        maxAge: maxAgeMs,
         secure,
         path: '/',
     });
@@ -49,14 +52,36 @@ function requireAuth(req, res, next) {
         res.status(401).json({ error: 'Not authenticated' });
         return;
     }
+    let payload;
     try {
-        const payload = jsonwebtoken_1.default.verify(token, getSessionSecret(), { algorithms: ['HS256'] });
-        req.user = payload;
-        next();
+        payload = jsonwebtoken_1.default.verify(token, getSessionSecret(), { algorithms: ['HS256'] });
     }
     catch {
         res.status(401).json({ error: 'Session invalid or expired' });
+        return;
+    }
+    const { kernelJti, kernelIat, exp } = payload;
+    if (typeof kernelJti !== 'string' || !kernelJti || typeof kernelIat !== 'number' || typeof exp !== 'number') {
+        res.status(401).json({ error: 'Session invalid or expired' });
+        return;
     }
+    const verified = payload;
+    (0, sessionStatusClient_1.getSessionStatus)({
+        convergeId: verified.convergeId,
+        jti: kernelJti,
+        iat: kernelIat,
+        exp,
+    }).then((status) => {
+        if (!status.active) {
+            res.status(401).json({ error: 'Session revoked' });
+            return;
+        }
+        req.user = verified;
+        next();
+    }, (err) => {
+        console.error(JSON.stringify({ level: 'error', msg: 'requireAuth: session status lookup failed', err: String(err) }));
+        res.status(503).json({ error: 'Session service unavailable' });
+    });
 }
 function requireAdmin(req, res, next) {
     requireAuth(req, res, () => {
@@ -177,6 +202,17 @@ function createExchangeRouter(pool) {
             res.status(401).json({ error: 'Invalid or expired platform token' });
             return;
         }
+        if (typeof convergePayload.jti !== 'string' || !KERNEL_JTI_RE.test(convergePayload.jti) ||
+            typeof convergePayload.sub !== 'string' || !KERNEL_SUB_RE.test(convergePayload.sub) ||
+            !Number.isInteger(convergePayload.iat) || !Number.isInteger(convergePayload.exp)) {
+            res.status(401).json({ error: 'Invalid or expired platform token' });
+            return;
+        }
+        const remainingSec = convergePayload.exp - Math.floor(Date.now() / 1000);
+        if (remainingSec <= 0) {
+            res.status(401).json({ error: 'Invalid or expired platform token' });
+            return;
+        }
         try {
             const { rows } = await pool.query(`INSERT INTO app_users (converge_id, email, name, last_seen_at)
          VALUES ($1, $2, $3, NOW())
@@ -197,9 +233,11 @@ function createExchangeRouter(pool) {
                 email: convergePayload.email ?? null,
                 language: convergePayload.language,
                 tenant: convergePayload.tenant,
+                kernelJti: convergePayload.jti,
+                kernelIat: convergePayload.iat,
             };
-            const sessionToken = jsonwebtoken_1.default.sign(sessionPayload, getSessionSecret(), { algorithm: 'HS256', expiresIn: '8h' });
-            setSessionCookie(res, sessionToken);
+            const sessionToken = jsonwebtoken_1.default.sign(sessionPayload, getSessionSecret(), { algorithm: 'HS256', expiresIn: remainingSec });
+            setSessionCookie(res, sessionToken, remainingSec * 1000);
             res.json({
                 user: {
                     id: appUser.id,

package/backend/index.d.ts

@@ -6,6 +6,7 @@ export * from './mail';
 export * from './notifications';
 export * from './permissions';
 export * from './permissionClient';
+export * from './sessionStatusClient';
 export * from './permissionCheck';
 export * from './customPermissions';
 export * from './serviceClient';

package/backend/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./mail"), exports);
 __exportStar(require("./notifications"), exports);
 __exportStar(require("./permissions"), exports);
 __exportStar(require("./permissionClient"), exports);
+__exportStar(require("./sessionStatusClient"), exports);
 __exportStar(require("./permissionCheck"), exports);
 __exportStar(require("./customPermissions"), exports);
 __exportStar(require("./serviceClient"), exports);

package/backend/sessionStatusClient.d.ts

@@ -0,0 +1,14 @@
+export type SessionInactiveReason = 'server_restarted' | 'session_revoked';
+export interface SessionStatus {
+    active: boolean;
+    reason?: SessionInactiveReason;
+}
+export interface SessionRef {
+    convergeId: string;
+    jti: string;
+    iat: number;
+    exp: number;
+}
+export declare function getSessionStatus(ref: SessionRef): Promise<SessionStatus>;
+export declare function clearSessionStatusCache(): void;
+export declare function sessionStatusCacheSize(): number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efa-one/sdk",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "Offizielles SDK für efa-one-Apps: Auth/Session, Service-Discovery, Gateway-Client, Audit/Reporting/Mail/Notifications, Permission- und Capability-Registrierung sowie das Frontend-IPC-/i18n-Toolkit.",
   "license": "Apache-2.0",
   "type": "commonjs",