@hed-hog/core 0.0.303 → 0.0.305

package/src/session/session.service.ts

@@ -2,7 +2,7 @@ import { getLocaleText } from '@hed-hog/api-locale';
 import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
 import { PrismaService } from '@hed-hog/api-prisma';
 import { HttpService } from '@nestjs/axios';
-import { BadRequestException, forwardRef, HttpException, HttpStatus, Inject, Injectable, NotFoundException, UnauthorizedException } from '@nestjs/common';
+import { BadRequestException, forwardRef, HttpException, HttpStatus, Inject, Injectable, Logger, NotFoundException, UnauthorizedException } from '@nestjs/common';
 import { firstValueFrom } from 'rxjs';
 import { SecurityService } from '../security/security.service';
 import { SettingService } from '../setting/setting.service';
@@ -22,6 +22,7 @@ type GeoIpResult = {
 
 @Injectable()
 export class SessionService {
+  private readonly logger = new Logger(SessionService.name);
 
   constructor(
     private prisma: PrismaService,
@@ -78,33 +79,102 @@ export class SessionService {
   }
 
   async refresh(locale: string, refreshToken: string, ipAddress: string, userAgent: string) {
+    if (!refreshToken) {
+      throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
     const hash = this.security.hashWithPepper(refreshToken);
     const session = await this.prisma.user_session.findFirst({
       where: {
         hash,
         revoked_at: null,
+        expires_at: {
+          gt: new Date(),
+        },
+      },
+      select: {
+        id: true,
+        user_id: true,
+        ip_address: true,
+        user_agent: true,
       },
-      select: { id: true, user_id: true },
     });
 
     if (!session) {
+      this.logger.warn(`Refresh rejected: session not found or expired for token hash prefix ${hash.slice(0, 8)}`);
       throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
     }
 
-    await this.prisma.user_session.update({
-      where: { id: session.id },
-      data: {
-        revoked_at: new Date(),
-      },
+    const settings = await this.setting.getSettingValues([
+      'refresh-token-expiration-minutes',
+      'max-concurrent-sessions',
+    ]);
+
+    const maxSessions = Number(settings['max-concurrent-sessions']) || 0;
+    if (maxSessions > 0) {
+      await this.enforceSessionLimit(session.user_id, maxSessions);
+    }
+
+    const nextRefreshToken = await this.token.createOpaqueToken();
+    const nextHash = this.security.hashWithPepper(nextRefreshToken);
+    const expiresAt = new Date(Date.now() + ((settings['refresh-token-expiration-minutes'] || 43200) * 60 * 1000));
+    const nextIpAddress = ipAddress?.trim() || session.ip_address || 'unknown';
+    const nextUserAgent = userAgent?.trim() || session.user_agent || 'unknown';
+
+    const { updateResult, newSession } = await this.prisma.$transaction(async (tx) => {
+      const updateResult = await tx.user_session.updateMany({
+        where: {
+          id: session.id,
+          revoked_at: null,
+        },
+        data: {
+          revoked_at: new Date(),
+        },
+      });
+
+      const newSession = await tx.user_session.create({
+        data: {
+          user_id: session.user_id,
+          ip_address: nextIpAddress,
+          user_agent: nextUserAgent,
+          expires_at: expiresAt,
+          hash: nextHash,
+        },
+      });
+
+      return { updateResult, newSession };
     });
 
-    return this.create(locale, session.user_id, ipAddress, userAgent);
+    if (updateResult.count === 0) {
+      this.logger.warn(`Refresh rejected: session ${session.id} already rotated`);
+      throw new UnauthorizedException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    return {
+      token: nextRefreshToken,
+      session: newSession,
+    };
   }
 
   async deleteRefreshTokenCookie(res, refreshToken: string) {
     await this.token.removeRefreshTokenCookie(res);
+
+    if (!refreshToken) {
+      return { count: 0, userId: null };
+    }
+
     const hash = this.security.hashWithPepper(refreshToken);
-    return this.prisma.user_session.updateMany({
+    const session = await this.prisma.user_session.findFirst({
+      where: {
+        revoked_at: null,
+        hash,
+      },
+      select: {
+        user_id: true,
+      },
+    });
+
+    const result = await this.prisma.user_session.updateMany({
       where: {
         revoked_at: null,
         hash,
@@ -113,6 +183,11 @@ export class SessionService {
         revoked_at: new Date(),
       },
     });
+
+    return {
+      count: result.count,
+      userId: session?.user_id ?? null,
+    };
   }
 
   async getUserSessions(paginationParams: PaginationDTO, userId: number, locale: string) {

package/src/setting/setting.service.ts

@@ -3,12 +3,12 @@ import { getLocaleText, LocaleService } from '@hed-hog/api-locale';
 import { PaginationDTO, PaginationService } from '@hed-hog/api-pagination';
 import { PrismaService, setting_type_0f055cd5ea_enum } from '@hed-hog/api-prisma';
 import {
-    BadRequestException,
-    forwardRef,
-    Inject,
-    Injectable,
-    Logger,
-    NotFoundException
+  BadRequestException,
+  forwardRef,
+  Inject,
+  Injectable,
+  Logger,
+  NotFoundException
 } from '@nestjs/common';
 import * as pako from 'pako';
 import { IntegrationDeveloperApiService } from '../integration/services/integration-developer-api.service';
@@ -882,7 +882,7 @@ export class SettingService {
       this.cachedSettings &&
       slugs.every(s => Object.prototype.hasOwnProperty.call(this.cachedSettings, s))
     ) {
-      this.logger.warn('Returning settings from cache');
+      this.logger.debug('Returning settings from cache');
 
       // Retorna apenas os slugs requisitados do cache
       const cached: Record<string, any> = {};
@@ -892,7 +892,7 @@ export class SettingService {
       return cached;
     }
 
-    this.logger.warn('Fetching settings from database');
+    this.logger.debug('Fetching settings from database');
 
     slug = Array.isArray(slug) ? slug : [slug];
 
@@ -972,7 +972,7 @@ export class SettingService {
   }
 
   setCache(value: Record<string, any>) {
-    this.logger.warn(`Setting settings cache with ${Object.keys(value).length} items`);
+    this.logger.debug(`Setting settings cache with ${Object.keys(value).length} items`);
     Object.keys(value).forEach(key => {
       this.cachedSettings[key] = value[key];
     });
@@ -980,7 +980,7 @@ export class SettingService {
   }
 
   clearCache() {
-    this.logger.warn('Clearing settings cache');
+    this.logger.debug('Clearing settings cache');
     this.cachedSettings = {};
   }
 

package/src/token/token.service.ts

@@ -70,20 +70,38 @@ export class TokenService {
     return this.security.randomOpaque(size);
   }
 
+  private normalizeCookieDomain(value?: string | null) {
+    const normalized = value?.trim();
+
+    if (!normalized) {
+      return undefined;
+    }
+
+    const host = normalized
+      .replace(/^https?:\/\//i, '')
+      .split('/')[0]
+      .split(':')[0]
+      .trim();
+
+    if (!host || host === 'localhost' || /^\d{1,3}(\.\d{1,3}){3}$/.test(host)) {
+      return undefined;
+    }
+
+    return host;
+  }
+
   private async getCookieDomain() {
+    const explicitDomain = this.normalizeCookieDomain(process.env.COOKIE_DOMAIN);
+
+    if (explicitDomain) {
+      return explicitDomain;
+    }
 
     const settings = await this.setting.getSettingValues([
-      'url'
+      'api-url'
     ]);
 
-    if (settings['url']) {
-      try {
-        return new URL(settings['url']).hostname;
-      } catch {
-        return process.env.COOKIE_DOMAIN;
-      }
-    }
-    return process.env.COOKIE_DOMAIN;
+    return this.normalizeCookieDomain(settings['api-url']);
   }
 
   async removeRefreshTokenCookie(res): Promise<void> {
@@ -92,7 +110,7 @@ export class TokenService {
     const isLocalhost = !domain || domain === 'localhost';
     const cookieOptions: any = {
       httpOnly: true,
-      sameSite: isLocalhost ? 'lax' : 'strict',
+      sameSite: isLocalhost ? 'lax' : 'none',
     };
     if (!isLocalhost) {
       cookieOptions.secure = true;
@@ -107,7 +125,7 @@ export class TokenService {
     const maxAge = expires_at.getTime() - Date.now();
     const cookieOptions: any = {
       httpOnly: true,
-      sameSite: isLocalhost ? 'lax' : 'strict',
+      sameSite: isLocalhost ? 'lax' : 'none',
       maxAge,
     };
     if (!isLocalhost) {

package/src/user/user.service.ts

@@ -2,11 +2,11 @@ import { getLocaleText } from '@hed-hog/api-locale';
 import { PaginationService } from '@hed-hog/api-pagination';
 import { PrismaService } from '@hed-hog/api-prisma';
 import {
-    BadRequestException,
-    Inject,
-    Injectable,
-    NotFoundException,
-    forwardRef,
+  BadRequestException,
+  Inject,
+  Injectable,
+  NotFoundException,
+  forwardRef,
 } from '@nestjs/common';
 import { ChallengeService } from '../challenge/challenge.service';
 import { DeleteDTO } from '../dto/delete.dto';
@@ -415,7 +415,11 @@ export class UserService {
   // Activity Tracking
   // ==========================================
 
-  async registerUserActivity(userId: number, action: string) {
+  async registerUserActivity(userId: number | null | undefined, action: string) {
+    if (!userId || !Number.isInteger(userId) || userId <= 0) {
+      return null;
+    }
+
     return this.prismaService.user_activity.create({
       data: {
         user_id: userId,