@fonderie/auth 7.18.0 → 7.19.1

package/brain/outcomes.md

@@ -145,7 +145,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | GET | `/_admin/users` | `async (ctx) => { const params = new URL(ctx.request.url).searchParams; const email = params.get('email')?.trim().toLowerCase(); if (email) { const user = await users.findByEmail(email); return user ? setApiResponse(HTTP.OK, 'USER', 'User', toAdminUserDTO(user)) : NOT_FOUND(); } const rawLimit = Number(params.get('limit') ?? 50); const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50; const cursorParam = params.get('cursor'); const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null; if (cursorParam && !cursor) return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'Invalid cursor'); const deleted = params.get('deleted') === '1' || params.get('deleted') === 'true'; const page = await users.list({ limit, ...(cursor ? { cursor } : {}), ...(deleted ? { deleted } : {}), }); return setApiResponse(HTTP.OK, 'USERS', 'Users', toAdminUserPageDTO(page)); }` |
 | GET | `/_admin/users/:id` | `async (ctx) => { // Read-only view: a soft-deleted account resolves (deletedAt set), so // an operator arriving from billing sees what happened to it. const user = await users.findByIdIncludingDeleted(idOf(ctx)); return user ? setApiResponse(HTTP.OK, 'USER', 'User', toAdminUserDTO(user)) : NOT_FOUND(); }` |
 | GET | `/_admin/users/:id/login-history` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); const params = new URL(ctx.request.url).searchParams; const rawLimit = Number(params.get('limit') ?? 50); const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), 200) : 50; const cursorParam = params.get('cursor'); const cursor = cursorParam ? decodeLoginCursor(cursorParam) : null; if (cursorParam && !cursor) return setApiResponse(HTTP.UNPROCESSABLE, 'INVALID_PARAMETER', 'Invalid cursor'); const page = await events.listByUser({ userId: idOf(ctx), limit, ...(cursor ? { cursor } : {}), }); return setApiResponse( HTTP.OK, 'LOGIN_HISTORY', 'Login history', toLoginHistoryPageDTO(page), ); }` |
-| DELETE | `/_admin/users/:id/sessions` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); await sessions.deleteByUser(idOf(ctx)); return setApiResponse(HTTP.OK, 'SESSIONS_REVOKED', 'All sessions revoked'); }` |
+| DELETE | `/_admin/users/:id/sessions` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); await sessions.deleteByUser(idOf(ctx)); await background(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: 'admin' } satisfies ISessionRevokedEvent)); return setApiResponse(HTTP.OK, 'SESSIONS_REVOKED', 'All sessions revoked'); }` |
 | GET | `/_admin/users/:id/sessions` | `async (ctx) => { if (!(await users.findById(idOf(ctx)))) return NOT_FOUND(); const rows = await sessions.listLiveByUser(idOf(ctx)); return setApiResponse( HTTP.OK, 'SESSIONS', 'Live sessions', rows.map((r) => toSessionDTO(r, null)), ); }` |
 | POST | `/_admin/users/:id/suspend` | `setSuspended(true)` |
 | POST | `/_admin/users/:id/unsuspend` | `setSuspended(false)` |

package/brain/signatures.md

@@ -52,6 +52,7 @@ new AuthModule(store: IStoreAdapter, config: IAuthConfig, bus?: EventBus | undef
   .name: "@fonderie/auth"
   .version: string
   .describeAdmin(): IAdminDescription
+  .describeEvents(): IEventCatalogEntry<unknown>[]
   .checkReadiness(): IReadinessProblem[]
   .install(app: IFonderieApp): void
 
@@ -267,7 +268,7 @@ interface IAdminUserDTO extends IUserDTO {
     createdAt: string;
 }
 
-function describeAuthAdminRoutes(store: IStoreAdapter): IAdminRoute[]
+function describeAuthAdminRoutes(store: IStoreAdapter, bus?: EventBus | undefined): IAdminRoute[]
 
 function toAdminUserDTO(user: IUser): IAdminUserDTO
 

package/dist/index.cjs

@@ -335,8 +335,10 @@ var EVENT_KEYS = {
   userPurged: "fonderie.user.purged",
   emailVerified: "fonderie.user.email_verified",
   passwordChanged: "fonderie.user.password_changed",
-  // A session the server revoked — today: a refresh token reused after its
-  // grace (theft signal). { userId, sessionId, reason }.
+  // Sessions the server revoked: { userId, sids (null = all), reason }. Reaches
+  // the user's devices live (@fonderie/sse) so a revoked device signs out at
+  // once. Reasons: 'terminated' (signed out from the devices list),
+  // 'password-changed', 'admin', 'refresh-reuse' (theft signal).
   sessionRevoked: "fonderie.session.revoked"
 };
 
@@ -1227,22 +1229,30 @@ var SessionModel = class {
   // Terminate one session by row id, scoped to its owner (a user can never
   // delete another user's session). Returns whether a row was removed.
   async terminateById(userId, id) {
+    return await this.terminateByIdReturningSid(userId, id) !== void 0;
+  }
+  /** Terminate one of the user's sessions; its sid (null if unbound), or undefined if none was removed. */
+  async terminateByIdReturningSid(userId, id) {
     const rows = await this.store.query(
-      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING id`,
+      `DELETE FROM fonderie_sessions WHERE id = $1 AND user_id = $2 RETURNING sid`,
       [id, userId]
     );
-    return rows.length > 0;
+    return rows.length ? rows[0]?.sid ?? null : void 0;
   }
   // Terminate all of a user's sessions except the current one (by sid).
   // Returns the number of sessions removed.
   async terminateOthers(userId, keepSid) {
+    return (await this.terminateOthersReturningSids(userId, keepSid)).length;
+  }
+  /** Terminate all of the user's sessions but `keepSid`; the sids removed. */
+  async terminateOthersReturningSids(userId, keepSid) {
     const rows = await this.store.query(
       `DELETE FROM fonderie_sessions
 			 WHERE user_id = $1 AND (sid IS DISTINCT FROM $2)
-			 RETURNING id`,
+			 RETURNING sid`,
       [userId, keepSid]
     );
-    return rows.length;
+    return rows.map((r) => r.sid);
   }
   async exists(token) {
     const rows = await this.store.query(
@@ -2117,7 +2127,7 @@ function authController(store, config, bus, locales = (0, import_core6.defineLoc
         if (found.kind === "reused") {
           await sessions.revokeById(found.row.id);
           await (0, import_core6.background)(
-            bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sessionId: found.row.id, reason: "refresh-reuse" })
+            bus?.emit(EVENT_KEYS.sessionRevoked, { userId: found.row.userId, sids: [found.row.sid], reason: "refresh-reuse" })
           );
           return (0, import_core6.setApiResponse)(import_core6.HTTP.UNAUTHORIZED, "TOKEN_REFRESH_FAILED", "Session expired or already revoked");
         }
@@ -2555,10 +2565,11 @@ function userController(store, config, bus) {
       if (!id) {
         return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
-      const removed = await sessions.terminateById(ctx.user.id, id);
-      if (!removed) {
+      const removed = await sessions.terminateByIdReturningSid(ctx.user.id, id);
+      if (removed === void 0) {
         return (0, import_core8.setApiResponse)(import_core8.HTTP.NOT_FOUND, "NOT_FOUND", "Session not found");
       }
+      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: [removed], reason: "terminated" }));
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSION_TERMINATED", "Session terminated.", { id });
     },
     terminateOtherSessions: async (ctx) => {
@@ -2570,7 +2581,9 @@ function userController(store, config, bus) {
           "Cannot terminate others without a current session context"
         );
       }
-      const count = await sessions.terminateOthers(ctx.user.id, currentSid);
+      const sids = await sessions.terminateOthersReturningSids(ctx.user.id, currentSid);
+      const count = sids.length;
+      if (count) await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids, reason: "terminated" }));
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "SESSIONS_TERMINATED", "Other sessions terminated.", { count });
     },
     updateProfile: async (ctx) => {
@@ -2732,6 +2745,7 @@ function userController(store, config, bus) {
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
       await sessions.deleteByUser(ctx.user.id);
+      await (0, import_core8.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: ctx.user.id, sids: null, reason: "password-changed" }));
       return (0, import_core8.setApiResponse)(import_core8.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     /**
@@ -3626,6 +3640,7 @@ function extractToken(request) {
 
 // src/admin.ts
 var import_core12 = require("@fonderie/core");
+var import_core13 = require("@fonderie/core");
 function toAdminUserDTO(user) {
   return {
     ...toUserDTO(user),
@@ -3642,7 +3657,7 @@ function toAdminUserPageDTO(page) {
 var ADMIN_PREFIX = "/_admin";
 var idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
 var NOT_FOUND = () => (0, import_core12.setApiResponse)(import_core12.HTTP.NOT_FOUND, "NOT_FOUND", "No such user");
-function adminRouteTable(store) {
+function adminRouteTable(store, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const events = new LoginEventModel(store);
@@ -3715,6 +3730,7 @@ function adminRouteTable(store) {
       async (ctx) => {
         if (!await users.findById(idOf(ctx))) return NOT_FOUND();
         await sessions.deleteByUser(idOf(ctx));
+        await (0, import_core13.background)(bus?.emit(EVENT_KEYS.sessionRevoked, { userId: idOf(ctx), sids: null, reason: "admin" }));
         return (0, import_core12.setApiResponse)(import_core12.HTTP.OK, "SESSIONS_REVOKED", "All sessions revoked");
       }
     ],
@@ -3747,8 +3763,8 @@ function adminRouteTable(store) {
     ["POST", "/_admin/users/:id/unsuspend", setSuspended(false)]
   ];
 }
-function describeAuthAdminRoutes(store) {
-  return adminRouteTable(store).map(([method, path, h]) => ({
+function describeAuthAdminRoutes(store, bus) {
+  return adminRouteTable(store, bus).map(([method, path, h]) => ({
     method,
     path: path.slice(ADMIN_PREFIX.length),
     handlers: [h]
@@ -3769,10 +3785,22 @@ var AuthModule = class {
   name = "@fonderie/auth";
   // Baked in at build time by tsup.base, so the operator's Modules page can
   // say what is actually deployed rather than 'not reported'.
-  version = "7.18.0";
+  version = "7.19.1";
   // Users, sessions, login history, suspend — only through @fonderie/admin.
   describeAdmin() {
-    return { routes: describeAuthAdminRoutes(this.store) };
+    return { routes: describeAuthAdminRoutes(this.store, this.bus) };
+  }
+  // Live sign-out (docs/SESSION-DESIGN.md, Phase 5): a revoked device hears it
+  // at once over @fonderie/sse — only the user it is about, ids only.
+  describeEvents() {
+    const revoked = {
+      type: EVENT_KEYS.sessionRevoked,
+      description: "Some of your sessions were signed out \u2014 sign out if this device is one of them",
+      audience: "user",
+      scope: (p) => ({ userId: p.userId }),
+      project: (p) => ({ sids: p.sids, reason: p.reason })
+    };
+    return [revoked];
   }
   // Report config problems for app.checkProductionReadiness() (data, not throw).
   checkReadiness() {
@@ -3788,7 +3816,7 @@ var AuthModule = class {
 };
 
 // src/templates.ts
-var import_core13 = require("@fonderie/core");
+var import_core14 = require("@fonderie/core");
 
 // src/templates.es.ts
 var ES_TEMPLATES = {
@@ -4265,7 +4293,7 @@ change your password \u2014 someone else may be able to sign in as you.`
 If you did this, you're all set. If not, contact support right away.`
   }
 };
-var DEFAULT_TEMPLATES = (0, import_core13.withTranslations)(EN_TEMPLATES, { fr: FR_TEMPLATES, es: ES_TEMPLATES });
+var DEFAULT_TEMPLATES = (0, import_core14.withTranslations)(EN_TEMPLATES, { fr: FR_TEMPLATES, es: ES_TEMPLATES });
 var SAMPLE_PAYLOADS = {
   [MESSAGE_KEYS.passwordRevoked]: { provider: "Google" },
   [MESSAGE_KEYS.oauthRegistration]: { provider: "Google", appName: "Fonderie" },