@empline/preflight 1.0.20

package/dist/checks/auth/session-integrity-validation.js

@@ -0,0 +1,402 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Session Integrity Validation Preflight
+ *
+ * Ensures that session validation checks for user.id, not just user existence.
+ * This prevents corrupted/stale sessions (with empty user objects) from being
+ * treated as authenticated, which can cause:
+ * - Redirect loops on login pages
+ * - "Guest" users accessing protected pages
+ * - Prisma errors when user.id is undefined
+ *
+ * Required Patterns:
+ * 1. Login page redirect must check session.user.id, not just session.user
+ * 2. requireAuth helper must validate user.id exists
+ * 3. Session callback should handle missing token.id
+ *
+ * Usage:
+ *   pnpm tsx scripts/active/preflights/auth/session-integrity-validation.ts
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.blocking = exports.category = exports.description = exports.name = exports.id = void 0;
+exports.checkApiRoutePatterns = checkApiRoutePatterns;
+exports.checkLoginPageRedirect = checkLoginPageRedirect;
+exports.checkRequireAuthHelper = checkRequireAuthHelper;
+exports.checkSessionCallback = checkSessionCallback;
+// =============================================================================
+// METADATA
+// =============================================================================
+exports.id = "auth/session-integrity-validation";
+exports.name = "Session Integrity Validation";
+exports.description = "Ensures session validation checks user.id, not just user existence";
+exports.category = "auth";
+exports.blocking = true;
+exports.tags = ["auth", "security", "session", "validation"];
+// =============================================================================
+// IMPLEMENTATION
+// =============================================================================
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_js_1 = require("../../utils/console-chars.js");
+// Files to check
+const FILES_TO_CHECK = {
+    loginPage: "app/login/page.tsx",
+    authServerUtils: "lib/auth-server-utils.ts",
+    authLib: "lib/auth.ts",
+};
+/**
+ * Check that login page validates user.id before redirecting
+ */
+function checkLoginPageRedirect() {
+    const issues = [];
+    const filePath = FILES_TO_CHECK.loginPage;
+    if (!fs.existsSync(filePath)) {
+        issues.push({
+            file: filePath,
+            type: "file-not-found",
+            severity: "error",
+            message: "Login page not found",
+        });
+        return { name: "Login Page Session Check", passed: false, blocking: true, issues };
+    }
+    const content = fs.readFileSync(filePath, "utf8");
+    const lines = content.split("\n");
+    // Check for auth() call
+    if (!content.includes("await auth()")) {
+        issues.push({
+            file: filePath,
+            type: "missing-auth-call",
+            severity: "error",
+            message: "Login page missing auth() call for session check",
+            suggestion: "Add: const session = await auth();",
+        });
+    }
+    // Check for proper user.id validation (not just session?.user)
+    // BAD: if (session?.user) redirect(...)
+    // GOOD: if (session?.user && session.user.id) redirect(...)
+    const hasWeakCheck = /if\s*\(\s*session\?\.user\s*\)\s*\{?\s*redirect/.test(content);
+    const hasStrongCheck = /session\.user.*\.id|session\.user\s+as\s+\{[^}]*id/.test(content);
+    if (hasWeakCheck && !hasStrongCheck) {
+        // Find the line number
+        let lineNum = 0;
+        for (let i = 0; i < lines.length; i++) {
+            if (/if\s*\(\s*session\?\.user\s*\)/.test(lines[i])) {
+                lineNum = i + 1;
+                break;
+            }
+        }
+        issues.push({
+            file: filePath,
+            line: lineNum,
+            type: "weak-session-check",
+            severity: "error",
+            message: "Login page checks session?.user but not user.id - corrupted sessions will cause redirect loops",
+            suggestion: "Change to: if (session?.user && (session.user as { id?: string })?.id)",
+            snippet: lines[lineNum - 1]?.trim(),
+        });
+    }
+    // Verify redirect is present
+    if (!content.includes("redirect(")) {
+        issues.push({
+            file: filePath,
+            type: "missing-redirect",
+            severity: "error",
+            message: "Login page missing redirect() for authenticated users",
+        });
+    }
+    const hasErrors = issues.some((i) => i.severity === "error");
+    return {
+        name: "Login Page Session Check",
+        passed: !hasErrors,
+        blocking: true,
+        issues,
+    };
+}
+/**
+ * Check that requireAuth validates user.id
+ */
+function checkRequireAuthHelper() {
+    const issues = [];
+    const filePath = FILES_TO_CHECK.authServerUtils;
+    if (!fs.existsSync(filePath)) {
+        issues.push({
+            file: filePath,
+            type: "file-not-found",
+            severity: "error",
+            message: "Auth server utils not found",
+        });
+        return { name: "requireAuth Helper", passed: false, blocking: true, issues };
+    }
+    const content = fs.readFileSync(filePath, "utf8");
+    const lines = content.split("\n");
+    // Find requireAuth function
+    const requireAuthMatch = content.match(/export\s+async\s+function\s+requireAuth[\s\S]*?(?=export|$)/);
+    if (!requireAuthMatch) {
+        issues.push({
+            file: filePath,
+            type: "missing-function",
+            severity: "error",
+            message: "requireAuth function not found",
+        });
+        return { name: "requireAuth Helper", passed: false, blocking: true, issues };
+    }
+    const requireAuthBody = requireAuthMatch[0];
+    // Check for user.id validation
+    // BAD: if (!session?.user)
+    // GOOD: if (!session?.user || !session.user.id)
+    const hasWeakCheck = /if\s*\(\s*!session\?\.user\s*\)/.test(requireAuthBody);
+    const hasIdCheck = /\.user\)?\?\.id|user\s+as\s+SessionUser\)\?\.id|session\.user\.id/.test(requireAuthBody);
+    if (hasWeakCheck && !hasIdCheck) {
+        let lineNum = 0;
+        for (let i = 0; i < lines.length; i++) {
+            if (/if\s*\(\s*!session\?\.user\s*\)/.test(lines[i])) {
+                lineNum = i + 1;
+                break;
+            }
+        }
+        issues.push({
+            file: filePath,
+            line: lineNum,
+            type: "weak-session-check",
+            severity: "error",
+            message: "requireAuth checks !session?.user but not user.id - corrupted sessions will pass auth",
+            suggestion: "Change to: if (!session?.user || !(session.user as SessionUser)?.id)",
+        });
+    }
+    const hasErrors = issues.some((i) => i.severity === "error");
+    return {
+        name: "requireAuth Helper",
+        passed: !hasErrors,
+        blocking: true,
+        issues,
+    };
+}
+/**
+ * Check that session callback handles missing token.id
+ */
+function checkSessionCallback() {
+    const issues = [];
+    const filePath = FILES_TO_CHECK.authLib;
+    if (!fs.existsSync(filePath)) {
+        issues.push({
+            file: filePath,
+            type: "file-not-found",
+            severity: "error",
+            message: "Auth lib not found",
+        });
+        return { name: "Session Callback Validation", passed: false, blocking: true, issues };
+    }
+    const content = fs.readFileSync(filePath, "utf8");
+    // Find session callback
+    const sessionCallbackMatch = content.match(/async\s+session\s*\(\s*\{[^}]*session[^}]*token[^}]*\}[\s\S]*?\n\s{4}\},/);
+    if (!sessionCallbackMatch) {
+        issues.push({
+            file: filePath,
+            type: "missing-callback",
+            severity: "warning",
+            message: "Session callback not found or has unexpected format",
+        });
+        return { name: "Session Callback Validation", passed: true, blocking: false, issues };
+    }
+    const sessionCallbackBody = sessionCallbackMatch[0];
+    // Check for token.id validation that returns empty session
+    // GOOD: if (!token.id) { return { ...session, user: undefined } }
+    const hasTokenIdCheck = /if\s*\(\s*!token\.id\s*\)/.test(sessionCallbackBody);
+    const returnsEmptySession = /user:\s*undefined|session\.user\s*=\s*undefined/.test(sessionCallbackBody);
+    if (!hasTokenIdCheck) {
+        issues.push({
+            file: filePath,
+            type: "missing-token-validation",
+            severity: "warning",
+            message: "Session callback doesn't validate token.id - corrupted JWTs may create invalid sessions",
+            suggestion: "Add: if (!token.id) { return { ...session, user: undefined } as unknown as Session; }",
+        });
+    }
+    else if (!returnsEmptySession) {
+        issues.push({
+            file: filePath,
+            type: "incomplete-token-validation",
+            severity: "warning",
+            message: "Session callback checks token.id but doesn't clear user on failure",
+            suggestion: "Return session with user: undefined when token.id is missing",
+        });
+    }
+    const hasErrors = issues.some((i) => i.severity === "error");
+    return {
+        name: "Session Callback Validation",
+        passed: !hasErrors,
+        blocking: false, // Warning only - defense in depth
+        issues,
+    };
+}
+/**
+ * Check API routes use session?.user?.id pattern
+ */
+function checkApiRoutePatterns() {
+    const issues = [];
+    // Sample a few critical API routes
+    const apiRoutes = [
+        "lib/api/route-helpers.ts",
+        "lib/api/auth-guard.ts",
+    ];
+    for (const routePath of apiRoutes) {
+        if (!fs.existsSync(routePath))
+            continue;
+        const content = fs.readFileSync(routePath, "utf8");
+        // Check for proper pattern: session?.user?.id
+        const hasProperCheck = /session\?\.user\?\.id|!session\?\.user\?\.id/.test(content);
+        if (!hasProperCheck && content.includes("session")) {
+            issues.push({
+                file: routePath,
+                type: "missing-id-check",
+                severity: "warning",
+                message: "API helper may not validate session.user.id",
+                suggestion: "Ensure auth checks use: if (!session?.user?.id)",
+            });
+        }
+    }
+    return {
+        name: "API Route Auth Patterns",
+        passed: true, // Warnings only
+        blocking: false,
+        issues,
+    };
+}
+// OUTPUT
+function printResults(checks, verbose) {
+    console.log("\n🔐 SESSION INTEGRITY VALIDATION PREFLIGHT");
+    console.log(`${console_chars_js_1.box.doubleHorizontal}`.repeat(70));
+    let totalErrors = 0;
+    let totalWarnings = 0;
+    for (const check of checks) {
+        const icon = check.passed
+            ? `${console_chars_js_1.emoji.success}`
+            : check.blocking
+                ? `${console_chars_js_1.emoji.error}`
+                : `${console_chars_js_1.emoji.warning}`;
+        const issueCount = check.issues.length > 0 ? ` (${check.issues.length} issues)` : "";
+        console.log(`\n${icon} ${check.name}${issueCount}`);
+        if (check.issues.length > 0) {
+            const errors = check.issues.filter((i) => i.severity === "error");
+            const warnings = check.issues.filter((i) => i.severity === "warning");
+            totalErrors += errors.length;
+            totalWarnings += warnings.length;
+            if (errors.length > 0) {
+                console.log(`\n   ${console_chars_js_1.emoji.error} ERRORS (${errors.length}):`);
+                for (const issue of errors) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                    if (issue.snippet)
+                        console.log(`         Code: ${issue.snippet}`);
+                    if (issue.suggestion)
+                        console.log(`         ${console_chars_js_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+            if (warnings.length > 0 && verbose) {
+                console.log(`\n   ${console_chars_js_1.emoji.warning}  WARNINGS (${warnings.length}):`);
+                for (const issue of warnings) {
+                    console.log(`      ${issue.file}${issue.line ? `:${issue.line}` : ""}`);
+                    console.log(`         ${issue.message}`);
+                    if (issue.suggestion)
+                        console.log(`         ${console_chars_js_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+        }
+    }
+    console.log("\n" + `${console_chars_js_1.box.doubleHorizontal}`.repeat(70));
+    console.log(`${console_chars_js_1.emoji.chart} Summary: ${totalErrors} errors | ${totalWarnings} warnings`);
+    console.log(`${console_chars_js_1.box.doubleHorizontal}`.repeat(70));
+    const hasBlockingFailure = checks.some((c) => !c.passed && c.blocking);
+    if (hasBlockingFailure) {
+        console.log(`\n${console_chars_js_1.emoji.error} SESSION INTEGRITY CHECK FAILED - fix errors before deploying\n`);
+    }
+    else if (totalWarnings > 0) {
+        console.log(`\n${console_chars_js_1.emoji.warning}  SESSION INTEGRITY CHECK PASSED with warnings\n`);
+    }
+    else {
+        console.log(`\n${console_chars_js_1.emoji.success} SESSION INTEGRITY CHECK PASSED\n`);
+    }
+    console.log(`${console_chars_js_1.emoji.clipboard} Why This Matters:`);
+    console.log("   • Corrupted sessions have user object but no user.id");
+    console.log("   • Checking only session?.user treats corrupted sessions as valid");
+    console.log("   • This causes redirect loops, 'Guest' users, and Prisma errors");
+    console.log("   • Always validate session?.user?.id for proper authentication\n");
+    return hasBlockingFailure;
+}
+function writeFindings(checks) {
+    const findingsPath = process.env.PREFLIGHT_FINDINGS_PATH || process.env.PREFLIGHT_FINDINGS_FILE;
+    if (!findingsPath)
+        return;
+    const findings = [];
+    for (const check of checks) {
+        for (const issue of check.issues) {
+            findings.push({
+                message: issue.message,
+                level: issue.severity === "error" ? "error" : "warning",
+                file: issue.file,
+                startLine: issue.line,
+                code: issue.type,
+            });
+        }
+    }
+    try {
+        const dir = path.dirname(findingsPath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.writeFileSync(findingsPath, JSON.stringify({ findings }, null, 2));
+    }
+    catch {
+        // Ignore write errors
+    }
+}
+// MAIN
+async function main() {
+    const args = process.argv.slice(2);
+    const verbose = args.includes("--verbose") || args.includes("-v");
+    console.log(`\n${console_chars_js_1.emoji.search} Validating session integrity checks...`);
+    const checks = [];
+    checks.push(checkLoginPageRedirect());
+    checks.push(checkRequireAuthHelper());
+    checks.push(checkSessionCallback());
+    checks.push(checkApiRoutePatterns());
+    writeFindings(checks);
+    const failed = printResults(checks, verbose);
+    process.exit(failed ? 1 : 0);
+}
+main().catch(console.error);
+//# sourceMappingURL=session-integrity-validation.js.map

package/dist/checks/auth/session-integrity-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-integrity-validation.js","sourceRoot":"","sources":["../../../src/checks/auth/session-integrity-validation.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4aD,sDAAqB;AACrB,wDAAsB;AACtB,wDAAsB;AACtB,oDAAoB;AA7atB,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEnE,QAAA,EAAE,GAAG,mCAAmC,CAAC;AACzC,QAAA,IAAI,GAAG,8BAA8B,CAAC;AACtC,QAAA,WAAW,GAAG,oEAAoE,CAAC;AACnF,QAAA,QAAQ,GAAG,MAAM,CAAC;AAClB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAElE,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,uCAAyB;AACzB,2CAA6B;AAC7B,mEAA0D;AA2B1D,iBAAiB;AACjB,MAAM,cAAc,GAAG;IACrB,SAAS,EAAE,oBAAoB;IAC/B,eAAe,EAAE,0BAA0B;IAC3C,OAAO,EAAE,aAAa;CACvB,CAAC;AAGF;;GAEG;AACH,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC;IAE1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrF,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,wBAAwB;IACxB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,kDAAkD;YAC3D,UAAU,EAAE,oCAAoC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,wCAAwC;IACxC,4DAA4D;IAE5D,MAAM,YAAY,GAAG,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrF,MAAM,cAAc,GAAG,oDAAoD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1F,IAAI,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,uBAAuB;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gGAAgG;YACzG,UAAU,EAAE,wEAAwE;YACpF,OAAO,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,MAAM,EAAE,CAAC,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,eAAe,CAAC;IAEhD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,4BAA4B;IAC5B,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAEtG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAE5C,+BAA+B;IAC/B,2BAA2B;IAC3B,gDAAgD;IAChD,MAAM,YAAY,GAAG,iCAAiC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,mEAAmE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE7G,IAAI,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,uFAAuF;YAChG,UAAU,EAAE,sEAAsE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,CAAC,SAAS;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM;KACP,CAAC;AACJ,CAAC;AAGD;;GAEG;AACH,SAAS,oBAAoB;IAC3B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC;IAExC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAElD,wBAAwB;IACxB,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAEvH,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAEpD,2DAA2D;IAC3D,kEAAkE;IAClE,MAAM,eAAe,GAAG,2BAA2B,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,iDAAiD,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAExG,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,0BAA0B;YAChC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,yFAAyF;YAClG,UAAU,EAAE,uFAAuF;SACpG,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,oEAAoE;YAC7E,UAAU,EAAE,8DAA8D;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,CAAC,SAAS;QAClB,QAAQ,EAAE,KAAK,EAAE,kCAAkC;QACnD,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB;IAC5B,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,mCAAmC;IACnC,MAAM,SAAS,GAAG;QAChB,0BAA0B;QAC1B,uBAAuB;KACxB,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QAExC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAEnD,8CAA8C;QAC9C,MAAM,cAAc,GAAG,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEpF,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,6CAA6C;gBACtD,UAAU,EAAE,iDAAiD;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,IAAI,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC;AACJ,CAAC;AAGD,SAAS;AAET,SAAS,YAAY,CAAC,MAAqB,EAAE,OAAgB;IAC3D,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,sBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAElD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM;YACvB,CAAC,CAAC,GAAG,wBAAK,CAAC,OAAO,EAAE;YACpB,CAAC,CAAC,KAAK,CAAC,QAAQ;gBACd,CAAC,CAAC,GAAG,wBAAK,CAAC,KAAK,EAAE;gBAClB,CAAC,CAAC,GAAG,wBAAK,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC,CAAC;QAEpD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;YAEtE,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAC;YAEjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,wBAAK,CAAC,KAAK,YAAY,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,KAAK,CAAC,OAAO;wBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBAClE,IAAI,KAAK,CAAC,UAAU;wBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,wBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,QAAQ,wBAAK,CAAC,OAAO,eAAe,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;gBACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzC,IAAI,KAAK,CAAC,UAAU;wBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,wBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,sBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,wBAAK,CAAC,KAAK,aAAa,WAAW,aAAa,aAAa,WAAW,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,GAAG,sBAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAElD,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,wBAAK,CAAC,KAAK,iEAAiE,CAAC,CAAC;IACjG,CAAC;SAAM,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,wBAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,wBAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,wBAAK,CAAC,SAAS,oBAAoB,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAElF,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,MAAqB;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChG,IAAI,CAAC,YAAY;QAAE,OAAO;IAE1B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvD,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED,OAAO;AAEP,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,CAAC,KAAK,wBAAK,CAAC,MAAM,yCAAyC,CAAC,CAAC;IAExE,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAErC,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/checks/auth/session-security.d.ts

@@ -0,0 +1,67 @@
+#!/usr/bin/env tsx
+/**
+ * Session Security Preflight
+ *
+ * Validates authentication session security patterns to prevent:
+ * - Deleted users remaining logged in (zombie sessions)
+ * - Missing user existence validation in JWT callbacks
+ * - Stale session data after user deletion
+ * - Missing periodic revalidation of user status
+ *
+ * Critical Security Checks:
+ * 1. JWT callback must validate user existence periodically
+ * 2. Session callbacks should not blindly trust token data
+ * 3. User deletion should invalidate active sessions
+ *
+ * Usage:
+ *   pnpm preflight:session-security
+ *   pnpm preflight:session-security --verbose
+ */
+export declare const id = "auth/session-security";
+export declare const name = "Session Security";
+export declare const category = "auth";
+export declare const blocking = true;
+export declare const description = "Session Security Preflight";
+export declare const tags: string[];
+interface Issue {
+    file: string;
+    line?: number;
+    type: string;
+    severity: "error" | "warning" | "info";
+    message: string;
+    suggestion?: string;
+    code?: string;
+}
+interface CheckResult {
+    name: string;
+    passed: boolean;
+    blocking: boolean;
+    issues: Issue[];
+}
+/**
+ * Check 1: JWT Callback User Validation
+ *
+ * Ensures the JWT callback validates that users still exist in the database
+ * on subsequent requests (not just initial login).
+ */
+declare function checkJwtUserValidation(): Promise<CheckResult>;
+/**
+ * Check 2: Session Callback Security
+ *
+ * Ensures session callbacks don't blindly trust token data without validation.
+ */
+declare function checkSessionCallbackSecurity(): Promise<CheckResult>;
+/**
+ * Check 3: User Deletion Session Handling
+ *
+ * Checks if user deletion logic properly handles active sessions.
+ */
+declare function checkUserDeletionHandling(): Promise<CheckResult>;
+/**
+ * Check 4: Auth Configuration Security
+ *
+ * Validates auth configuration for security best practices.
+ */
+declare function checkAuthConfiguration(): Promise<CheckResult>;
+export { checkAuthConfiguration, checkJwtUserValidation, checkSessionCallbackSecurity, checkUserDeletionHandling, };
+//# sourceMappingURL=session-security.d.ts.map

package/dist/checks/auth/session-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-security.d.ts","sourceRoot":"","sources":["../../../src/checks/auth/session-security.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;GAiBG;AASH,eAAO,MAAM,EAAE,0BAA0B,CAAC;AAC1C,eAAO,MAAM,IAAI,qBAAqB,CAAC;AACvC,eAAO,MAAM,QAAQ,SAAS,CAAC;AAC/B,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,+BAA+B,CAAC;AACxD,eAAO,MAAM,IAAI,UAAsB,CAAC;AAgCxC,UAAU,KAAK;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAID;;;;;GAKG;AACH,iBAAe,sBAAsB,IAAI,OAAO,CAAC,WAAW,CAAC,CAkF5D;AAED;;;;GAIG;AACH,iBAAe,4BAA4B,IAAI,OAAO,CAAC,WAAW,CAAC,CA0ClE;AAED;;;;GAIG;AACH,iBAAe,yBAAyB,IAAI,OAAO,CAAC,WAAW,CAAC,CAwD/D;AAED;;;;GAIG;AACH,iBAAe,sBAAsB,IAAI,OAAO,CAAC,WAAW,CAAC,CAwD5D;AAoGD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,yBAAyB,GAC1B,CAAC"}