@getstrata/core 0.5.77 → 0.5.79

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 0.5.79
+
+- `readSession()` returns `{ userId, issuedAt }` from the HMAC session cookie. `isSessionInvalidated(issuedAt, session_valid_after)` lets `SessionGuard` reject cookies issued before `AuthUserRecord.session_valid_after` (Jetstream logout-other-devices / password change).
+
+## 0.5.78
+
+- OpenAPI treats `POST /auth/two-factor-challenge` as a public operation (no bearer), including when routes are registered under `API_PREFIX`.
+
 ## 0.5.77
 
 - `@getstrata/core/security/recoveryCodes` (`generateRecoveryCodes`, `hashRecoveryCode`, `recoveryCodeMatches`). Fortify-style one-time MFA backup codes (`abcd-efgh`).

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.79 && git push origin v0.5.79`
+2. Tag a release: `git tag v0.5.80 && git push origin v0.5.80`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/auth/sessionCookie.d.ts

@@ -4,11 +4,17 @@ declare const SESSION_REMEMBER_TTL_SECONDS: number;
 interface CreateSessionCookieOptions {
     remember?: boolean;
 }
+interface SignedSession {
+    userId: number;
+    issuedAt: number;
+}
 declare function sessionCookieName(): string;
 declare function sessionTtlSeconds(): number;
 declare function sessionRememberTtlSeconds(): number;
+declare function readSession(request: Request): SignedSession | null;
 declare function readSessionUserId(request: Request): number | null;
+declare function isSessionInvalidated(issuedAt: number, validAfter: Date | string | null | undefined): boolean;
 declare function createSessionCookie(userId: number, options?: CreateSessionCookieOptions): string;
 declare function clearSessionCookie(): string;
-export type { CreateSessionCookieOptions };
-export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };
+export type { CreateSessionCookieOptions, SignedSession };
+export { clearSessionCookie, createSessionCookie, isSessionInvalidated, readSession, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };

package/dist/core/contracts/authUserDirectory.d.ts

@@ -4,6 +4,7 @@ interface AuthUserRecord {
     email?: string | null;
     role: string;
     email_verified_at?: Date | string | null;
+    session_valid_after?: Date | string | null;
 }
 interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;

package/dist/entries/auth/sessionCookie.js

@@ -62,9 +62,9 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return userId;
+  return { userId, issuedAt };
 }
-function readSessionUserId(request) {
+function readSession(request) {
   const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
@@ -80,6 +80,19 @@ function readSessionUserId(request) {
   const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
   return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
 }
+function readSessionUserId(request) {
+  return readSession(request)?.userId ?? null;
+}
+function isSessionInvalidated(issuedAt, validAfter) {
+  if (!validAfter) {
+    return false;
+  }
+  const timestamp = validAfter instanceof Date ? validAfter.getTime() : Date.parse(String(validAfter));
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  return issuedAt < timestamp;
+}
 function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
@@ -97,6 +110,8 @@ export {
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
+  isSessionInvalidated,
+  readSession,
   readSessionUserId,
   sessionCookieName,
   sessionRememberTtlSeconds,

package/dist/entries/auth/sessionGuard.js

@@ -145,9 +145,9 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return userId;
+  return { userId, issuedAt };
 }
-function readSessionUserId(request) {
+function readSession(request) {
   const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
@@ -163,6 +163,19 @@ function readSessionUserId(request) {
   const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
   return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
 }
+function readSessionUserId(request) {
+  return readSession(request)?.userId ?? null;
+}
+function isSessionInvalidated(issuedAt, validAfter) {
+  if (!validAfter) {
+    return false;
+  }
+  const timestamp = validAfter instanceof Date ? validAfter.getTime() : Date.parse(String(validAfter));
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  return issuedAt < timestamp;
+}
 function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
@@ -182,8 +195,8 @@ class SessionGuard {
     this.container = container;
   }
   async resolve(request) {
-    const userId = readSessionUserId(request);
-    if (!userId) {
+    const session = readSession(request);
+    if (!session) {
       return null;
     }
     const tokenService = resolveAuthUserDirectory(this.container);
@@ -191,7 +204,10 @@ class SessionGuard {
       return null;
     }
     try {
-      const user = await tokenService.findByIdOrThrow(userId);
+      const user = await tokenService.findByIdOrThrow(session.userId);
+      if (isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
+        return null;
+      }
       return {
         id: user.id,
         role: user.role,

package/dist/entries/jobs/dispatchWebhookJob.js

@@ -2,6 +2,7 @@
 // ../../src/modules/webhook/dispatchWebhookJob.ts
 import { createHmac } from "crypto";
 import { repositoryConnection as db } from "@getstrata/core/database/repositoryConnection";
+import { BadRequestError } from "@getstrata/core/errors/http";
 import { Job } from "@getstrata/core/queue";
 import { webhookSignatureHeader } from "@getstrata/core/runtime/appKeyPrefix";
 import { safeFetch } from "@getstrata/core/security/safeFetch";
@@ -39,10 +40,10 @@ class DispatchWebhookJob extends Job {
     const signature = createHmac("sha256", webhook.secret).update(body).digest("hex");
     const allowHttp = (process.env.APP_ENV ?? "local") !== "production";
     const signatureHeader = webhookSignatureHeader();
-    assertSafeOutboundUrl(webhook.url, { allowHttp });
     let responseStatus = null;
     let errorMessage = null;
     try {
+      assertSafeOutboundUrl(webhook.url, { allowHttp });
       const response = await safeFetch(webhook.url, {
         method: "POST",
         headers: {
@@ -67,6 +68,9 @@ class DispatchWebhookJob extends Job {
           ${errorMessage}
         )
       `;
+      if (error instanceof BadRequestError) {
+        return;
+      }
       return error instanceof Error ? error : new Error(errorMessage);
     }
     await db`

package/dist/entries/openapi/generator.js

@@ -51,6 +51,7 @@ function sdkClientClassName() {
 var PUBLIC_ROUTE_DESCRIPTIONS = {
   "GET /auth/me": "Current authenticated user",
   "POST /auth/login": "Login with email and password",
+  "POST /auth/two-factor-challenge": "Complete two-factor login challenge",
   "POST /auth/register": "Register with name, email, and password",
   "POST /auth/forgot-password": "Request a password reset email",
   "POST /auth/reset-password": "Reset password with email and token",
@@ -99,7 +100,7 @@ function toRelativeApiPath(path) {
 }
 function requiresBearerAuth(path, method) {
   const relative = toRelativeApiPath(path);
-  if (relative.startsWith("/auth/login") || relative.startsWith("/auth/register") || relative.startsWith("/auth/forgot-password") || relative.startsWith("/auth/reset-password") || relative.startsWith("/auth/email/verification-notification") || relative.startsWith("/auth/oauth")) {
+  if (relative.startsWith("/auth/login") || relative.startsWith("/auth/two-factor-challenge") || relative.startsWith("/auth/register") || relative.startsWith("/auth/forgot-password") || relative.startsWith("/auth/reset-password") || relative.startsWith("/auth/email/verification-notification") || relative.startsWith("/auth/oauth")) {
     return false;
   }
   if (relative.startsWith("/scim/") || relative.startsWith("/billing/webhooks/") || path.startsWith("/scim/") || path.startsWith("/billing/webhooks/")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.77",
+  "version": "0.5.79",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",