@getstrata/core 0.5.78 → 0.5.79

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @getstrata/core changelog
 
+## 0.5.79
+
+- `readSession()` returns `{ userId, issuedAt }` from the HMAC session cookie. `isSessionInvalidated(issuedAt, session_valid_after)` lets `SessionGuard` reject cookies issued before `AuthUserRecord.session_valid_after` (Jetstream logout-other-devices / password change).
+
 ## 0.5.78
 
 - OpenAPI treats `POST /auth/two-factor-challenge` as a public operation (no bearer), including when routes are registered under `API_PREFIX`.

package/dist/core/auth/sessionCookie.d.ts

@@ -4,11 +4,17 @@ declare const SESSION_REMEMBER_TTL_SECONDS: number;
 interface CreateSessionCookieOptions {
     remember?: boolean;
 }
+interface SignedSession {
+    userId: number;
+    issuedAt: number;
+}
 declare function sessionCookieName(): string;
 declare function sessionTtlSeconds(): number;
 declare function sessionRememberTtlSeconds(): number;
+declare function readSession(request: Request): SignedSession | null;
 declare function readSessionUserId(request: Request): number | null;
+declare function isSessionInvalidated(issuedAt: number, validAfter: Date | string | null | undefined): boolean;
 declare function createSessionCookie(userId: number, options?: CreateSessionCookieOptions): string;
 declare function clearSessionCookie(): string;
-export type { CreateSessionCookieOptions };
-export { clearSessionCookie, createSessionCookie, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };
+export type { CreateSessionCookieOptions, SignedSession };
+export { clearSessionCookie, createSessionCookie, isSessionInvalidated, readSession, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };

package/dist/core/contracts/authUserDirectory.d.ts

@@ -4,6 +4,7 @@ interface AuthUserRecord {
     email?: string | null;
     role: string;
     email_verified_at?: Date | string | null;
+    session_valid_after?: Date | string | null;
 }
 interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;

package/dist/entries/auth/sessionCookie.js

@@ -62,9 +62,9 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return userId;
+  return { userId, issuedAt };
 }
-function readSessionUserId(request) {
+function readSession(request) {
   const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
@@ -80,6 +80,19 @@ function readSessionUserId(request) {
   const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
   return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
 }
+function readSessionUserId(request) {
+  return readSession(request)?.userId ?? null;
+}
+function isSessionInvalidated(issuedAt, validAfter) {
+  if (!validAfter) {
+    return false;
+  }
+  const timestamp = validAfter instanceof Date ? validAfter.getTime() : Date.parse(String(validAfter));
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  return issuedAt < timestamp;
+}
 function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
@@ -97,6 +110,8 @@ export {
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
+  isSessionInvalidated,
+  readSession,
   readSessionUserId,
   sessionCookieName,
   sessionRememberTtlSeconds,

package/dist/entries/auth/sessionGuard.js

@@ -145,9 +145,9 @@ function readSignedSession(userIdRaw, issuedAtRaw, cookieSignature, ttlSeconds,
   if (!timingSafeEqual(expectedBuffer, actualBuffer)) {
     return null;
   }
-  return userId;
+  return { userId, issuedAt };
 }
-function readSessionUserId(request) {
+function readSession(request) {
   const cookieValue = readCookieValue(request, sessionCookieName());
   if (!cookieValue) {
     return null;
@@ -163,6 +163,19 @@ function readSessionUserId(request) {
   const [userIdRaw, issuedAtRaw, cookieSignature] = parts;
   return readSignedSession(String(userIdRaw), String(issuedAtRaw), cookieSignature, sessionTtlSeconds(), false);
 }
+function readSessionUserId(request) {
+  return readSession(request)?.userId ?? null;
+}
+function isSessionInvalidated(issuedAt, validAfter) {
+  if (!validAfter) {
+    return false;
+  }
+  const timestamp = validAfter instanceof Date ? validAfter.getTime() : Date.parse(String(validAfter));
+  if (!Number.isFinite(timestamp)) {
+    return false;
+  }
+  return issuedAt < timestamp;
+}
 function createSessionCookie(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
@@ -182,8 +195,8 @@ class SessionGuard {
     this.container = container;
   }
   async resolve(request) {
-    const userId = readSessionUserId(request);
-    if (!userId) {
+    const session = readSession(request);
+    if (!session) {
       return null;
     }
     const tokenService = resolveAuthUserDirectory(this.container);
@@ -191,7 +204,10 @@ class SessionGuard {
       return null;
     }
     try {
-      const user = await tokenService.findByIdOrThrow(userId);
+      const user = await tokenService.findByIdOrThrow(session.userId);
+      if (isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
+        return null;
+      }
       return {
         id: user.id,
         role: user.role,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.78",
+  "version": "0.5.79",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",