@getstrata/core 0.5.85 → 0.5.87

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getstrata/core changelog
 
+## 0.5.87
+
+- `AuthUserDirectory.hasActiveBrowserSession?(userId, issuedAt)` is optional. `SessionGuard` calls it after `session_valid_after` and rejects the HMAC cookie when it returns false so WorkHub can revoke a single browser session by deleting the `sessions` row.
+
+## 0.5.86
+
+- `createSessionCookieDetails()` returns the HMAC session header plus `issuedAt` / `ttlSeconds` so apps can persist Jetstream browser-session rows without changing the cookie format.
+
 ## 0.5.85
 
 - `applicationRegistry` prefers the latest `Symbol.for("@getstrata/applicationContext")` on `globalThis` so a stale module-local context cannot hide the bootstrapped app after `build:framework`.

package/README.md

@@ -82,7 +82,7 @@ import type { Migration } from "@getstrata/core/database/migrations/types";
 Package name: **`@getstrata/core`** (npm org [`@getstrata`](https://www.npmjs.com/org/getstrata)).
 
 1. Add `NPM_TOKEN` to GitHub repository secrets.
-2. Tag a release: `git tag v0.5.85 && git push origin v0.5.85`
+2. Tag a release: `git tag v0.5.92 && git push origin v0.5.92`
 3. [Release workflow](../../.github/workflows/release.yml) builds and runs `npm publish --access public`.
 
 Previously published as `@eyk-workhub/framework@0.1.0`, deprecated in favor of this package.

package/dist/core/auth/sessionCookie.d.ts

@@ -14,7 +14,14 @@ declare function sessionRememberTtlSeconds(): number;
 declare function readSession(request: Request): SignedSession | null;
 declare function readSessionUserId(request: Request): number | null;
 declare function isSessionInvalidated(issuedAt: number, validAfter: Date | string | null | undefined): boolean;
+interface SessionCookieDetails {
+    header: string;
+    userId: number;
+    issuedAt: number;
+    ttlSeconds: number;
+}
+declare function createSessionCookieDetails(userId: number, options?: CreateSessionCookieOptions): SessionCookieDetails;
 declare function createSessionCookie(userId: number, options?: CreateSessionCookieOptions): string;
 declare function clearSessionCookie(): string;
-export type { CreateSessionCookieOptions, SignedSession };
-export { clearSessionCookie, createSessionCookie, isSessionInvalidated, readSession, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };
+export type { CreateSessionCookieOptions, SessionCookieDetails, SignedSession };
+export { clearSessionCookie, createSessionCookie, createSessionCookieDetails, isSessionInvalidated, readSession, readSessionUserId, SESSION_COOKIE, SESSION_REMEMBER_TTL_SECONDS, SESSION_TTL_SECONDS, sessionCookieName, sessionRememberTtlSeconds, sessionTtlSeconds, };

package/dist/core/contracts/authUserDirectory.d.ts

@@ -9,5 +9,6 @@ interface AuthUserRecord {
 interface AuthUserDirectory {
     resolveUserFromToken(token: string): Promise<AuthUser | null>;
     findByIdOrThrow(id: number): Promise<AuthUserRecord>;
+    hasActiveBrowserSession?(userId: number, issuedAt: number): Promise<boolean>;
 }
 export type { AuthUserDirectory, AuthUserRecord };

package/dist/entries/auth/sessionCookie.js

@@ -149,12 +149,20 @@ function isSessionInvalidated(issuedAt, validAfter) {
   }
   return issuedAt < timestamp;
 }
-function createSessionCookie(userId, options = {}) {
+function createSessionCookieDetails(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
   const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`;
+  return {
+    header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
+    userId,
+    issuedAt,
+    ttlSeconds
+  };
+}
+function createSessionCookie(userId, options = {}) {
+  return createSessionCookieDetails(userId, options).header;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
@@ -166,6 +174,7 @@ export {
   SESSION_TTL_SECONDS,
   clearSessionCookie,
   createSessionCookie,
+  createSessionCookieDetails,
   isSessionInvalidated,
   readSession,
   readSessionUserId,

package/dist/entries/auth/sessionGuard.js

@@ -234,12 +234,20 @@ function isSessionInvalidated(issuedAt, validAfter) {
   }
   return issuedAt < timestamp;
 }
-function createSessionCookie(userId, options = {}) {
+function createSessionCookieDetails(userId, options = {}) {
   const issuedAt = Date.now();
   const ttlSeconds = options.remember ? sessionRememberTtlSeconds() : sessionTtlSeconds();
   const value = options.remember ? signSession(userId, issuedAt, ttlSeconds) : signSession(userId, issuedAt);
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
-  return `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`;
+  return {
+    header: `${sessionCookieName()}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}${secure}`,
+    userId,
+    issuedAt,
+    ttlSeconds
+  };
+}
+function createSessionCookie(userId, options = {}) {
+  return createSessionCookieDetails(userId, options).header;
 }
 function clearSessionCookie() {
   const secure = process.env.APP_ENV === "production" ? "; Secure" : "";
@@ -266,6 +274,12 @@ class SessionGuard {
       if (isSessionInvalidated(session.issuedAt, user.session_valid_after)) {
         return null;
       }
+      if (typeof tokenService.hasActiveBrowserSession === "function") {
+        const active = await tokenService.hasActiveBrowserSession(session.userId, session.issuedAt);
+        if (!active) {
+          return null;
+        }
+      }
       return {
         id: user.id,
         role: user.role,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.5.85",
+  "version": "0.5.87",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",