@lastshotlabs/bunshot 0.0.27 → 0.1.0

package/dist/packages/bunshot-auth/src/lib/session.js

@@ -0,0 +1,1211 @@
+import { DEFAULT_MAX_ENTRIES, hashToken, timingSafeEqual } from '../../../bunshot-core/src/index.js';
+import { DEFAULT_AUTH_CONFIG } from '../config/authConfig';
+// ---------------------------------------------------------------------------
+// TTL helpers
+// ---------------------------------------------------------------------------
+const DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7; // 7 days
+function getSessionTtlSeconds(cfg) {
+    return (cfg ?? DEFAULT_AUTH_CONFIG).sessionPolicy.absoluteTimeout ?? DEFAULT_SESSION_TTL_SECONDS;
+}
+function getSessionTtlMs(cfg) {
+    return getSessionTtlSeconds(cfg) * 1000;
+}
+function shouldPersistSessionMetadata(cfg) {
+    return (cfg ?? DEFAULT_AUTH_CONFIG).persistSessionMetadata;
+}
+function isIdleExpired(lastActiveAt, cfg) {
+    const idleTimeout = (cfg ?? DEFAULT_AUTH_CONFIG).sessionPolicy.idleTimeout;
+    if (!idleTimeout)
+        return false;
+    const idleSecs = (Date.now() - lastActiveAt) / 1000;
+    return idleSecs > idleTimeout;
+}
+export function createMemorySessionRepository() {
+    const sessions = new Map();
+    const userSessionIds = new Map();
+    const refreshTokenIndex = new Map();
+    function removeUserSessionId(userId, sessionId) {
+        const ids = userSessionIds.get(userId);
+        if (!ids)
+            return;
+        ids.delete(sessionId);
+        if (ids.size === 0) {
+            userSessionIds.delete(userId);
+        }
+    }
+    function purgeSessionImpl(sessionId) {
+        const entry = sessions.get(sessionId);
+        if (!entry)
+            return;
+        if (entry.refreshToken)
+            refreshTokenIndex.delete(entry.refreshToken);
+        if (entry.prevRefreshToken)
+            refreshTokenIndex.delete(entry.prevRefreshToken);
+        sessions.delete(sessionId);
+        removeUserSessionId(entry.userId, sessionId);
+    }
+    // Purge tombstoned sessions (token === null) whose natural TTL has passed.
+    // Called opportunistically on delete and on new-session creation so expired
+    // tombstones do not accumulate indefinitely in the in-memory dev store.
+    function sweepExpiredTombstones() {
+        const now = Date.now();
+        for (const [sessionId, s] of sessions) {
+            if (!s.token && s.expiresAt <= now) {
+                purgeSessionImpl(sessionId);
+            }
+        }
+    }
+    function deleteSessionImpl(sessionId, cfg) {
+        const entry = sessions.get(sessionId);
+        if (!entry)
+            return;
+        if (shouldPersistSessionMetadata(cfg)) {
+            if (entry.refreshToken)
+                refreshTokenIndex.delete(entry.refreshToken);
+            if (entry.prevRefreshToken)
+                refreshTokenIndex.delete(entry.prevRefreshToken);
+            entry.token = null;
+            entry.refreshToken = null;
+            entry.prevRefreshToken = null;
+            entry.prevTokenExpiresAt = null;
+            entry.refreshTokenPlain = null;
+            sweepExpiredTombstones();
+        }
+        else {
+            purgeSessionImpl(sessionId);
+        }
+    }
+    function trimSessionsToCapacity() {
+        sweepExpiredTombstones();
+        while (sessions.size >= DEFAULT_MAX_ENTRIES) {
+            const oldestSessionId = sessions.keys().next().value;
+            if (oldestSessionId === undefined)
+                break;
+            purgeSessionImpl(oldestSessionId);
+        }
+    }
+    function createSessionImpl(userId, token, sessionId, metadata, cfg) {
+        const now = Date.now();
+        const session = {
+            sessionId,
+            userId,
+            token,
+            createdAt: now,
+            lastActiveAt: now,
+            expiresAt: now + getSessionTtlMs(cfg),
+            ipAddress: metadata?.ipAddress,
+            userAgent: metadata?.userAgent,
+        };
+        trimSessionsToCapacity();
+        sessions.set(sessionId, session);
+        if (!userSessionIds.has(userId))
+            userSessionIds.set(userId, new Set());
+        userSessionIds.get(userId).add(sessionId);
+    }
+    return {
+        async createSession(userId, token, sessionId, metadata, cfg) {
+            createSessionImpl(userId, token, sessionId, metadata, cfg);
+        },
+        async atomicCreateSession(userId, token, sessionId, maxSessions, metadata, cfg) {
+            const now = Date.now();
+            const ids = userSessionIds.get(userId);
+            if (ids) {
+                let activeCount = 0;
+                let oldest = null;
+                for (const sid of ids) {
+                    const s = sessions.get(sid);
+                    if (s && s.token && s.expiresAt > now) {
+                        activeCount++;
+                        if (!oldest || s.createdAt < oldest.createdAt)
+                            oldest = s;
+                    }
+                }
+                while (activeCount >= maxSessions && oldest) {
+                    deleteSessionImpl(oldest.sessionId, cfg);
+                    activeCount--;
+                    oldest = null;
+                    for (const sid of ids) {
+                        const s = sessions.get(sid);
+                        if (s && s.token && s.expiresAt > now) {
+                            if (!oldest || s.createdAt < oldest.createdAt)
+                                oldest = s;
+                        }
+                    }
+                }
+            }
+            createSessionImpl(userId, token, sessionId, metadata, cfg);
+        },
+        async getSession(sessionId, cfg) {
+            const entry = sessions.get(sessionId);
+            if (!entry || !entry.token || entry.expiresAt <= Date.now())
+                return null;
+            if (isIdleExpired(entry.lastActiveAt, cfg)) {
+                deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            return entry.token;
+        },
+        async deleteSession(sessionId, cfg) {
+            deleteSessionImpl(sessionId, cfg);
+        },
+        async getUserSessions(userId, cfg) {
+            const ids = userSessionIds.get(userId);
+            if (!ids)
+                return [];
+            const now = Date.now();
+            const config = cfg ?? DEFAULT_AUTH_CONFIG;
+            const includeInactive = config.includeInactiveSessions;
+            const persist = config.persistSessionMetadata;
+            const results = [];
+            for (const sessionId of ids) {
+                const s = sessions.get(sessionId);
+                if (!s)
+                    continue;
+                const isActive = !!s.token && s.expiresAt > now;
+                if (!isActive && !persist)
+                    continue;
+                if (!isActive && !includeInactive)
+                    continue;
+                results.push({
+                    sessionId: s.sessionId,
+                    createdAt: s.createdAt,
+                    lastActiveAt: s.lastActiveAt,
+                    expiresAt: s.expiresAt,
+                    ipAddress: s.ipAddress,
+                    userAgent: s.userAgent,
+                    isActive,
+                });
+            }
+            return results;
+        },
+        async getActiveSessionCount(userId) {
+            const ids = userSessionIds.get(userId);
+            if (!ids)
+                return 0;
+            const now = Date.now();
+            let count = 0;
+            for (const sessionId of ids) {
+                const s = sessions.get(sessionId);
+                if (s && s.token && s.expiresAt > now)
+                    count++;
+            }
+            return count;
+        },
+        async evictOldestSession(userId, cfg) {
+            const ids = userSessionIds.get(userId);
+            if (!ids)
+                return;
+            const now = Date.now();
+            let oldest = null;
+            for (const sessionId of ids) {
+                const s = sessions.get(sessionId);
+                if (!s || !s.token || s.expiresAt <= now)
+                    continue;
+                if (!oldest || s.createdAt < oldest.createdAt)
+                    oldest = s;
+            }
+            if (oldest)
+                deleteSessionImpl(oldest.sessionId, cfg);
+        },
+        async updateSessionLastActive(sessionId) {
+            const entry = sessions.get(sessionId);
+            if (entry)
+                entry.lastActiveAt = Date.now();
+        },
+        async setRefreshToken(sessionId, refreshToken) {
+            const entry = sessions.get(sessionId);
+            if (!entry)
+                return;
+            const tokenHash = hashToken(refreshToken);
+            if (entry.refreshToken && entry.refreshToken !== tokenHash) {
+                refreshTokenIndex.delete(entry.refreshToken);
+            }
+            entry.refreshToken = tokenHash;
+            refreshTokenIndex.set(tokenHash, sessionId);
+        },
+        async getSessionByRefreshToken(refreshToken, cfg) {
+            const tokenHash = hashToken(refreshToken);
+            const sessionId = refreshTokenIndex.get(tokenHash);
+            if (!sessionId)
+                return null;
+            const entry = sessions.get(sessionId);
+            if (!entry)
+                return null;
+            if (isIdleExpired(entry.lastActiveAt, cfg)) {
+                deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            if (entry.refreshToken && timingSafeEqual(entry.refreshToken, tokenHash)) {
+                return { sessionId: entry.sessionId, userId: entry.userId, newRefreshToken: refreshToken };
+            }
+            if (entry.prevRefreshToken &&
+                timingSafeEqual(entry.prevRefreshToken, tokenHash) &&
+                entry.prevTokenExpiresAt &&
+                entry.prevTokenExpiresAt > Date.now()) {
+                return {
+                    sessionId: entry.sessionId,
+                    userId: entry.userId,
+                    newRefreshToken: entry.refreshTokenPlain ?? entry.refreshToken,
+                };
+            }
+            if (entry.prevRefreshToken && timingSafeEqual(entry.prevRefreshToken, tokenHash)) {
+                deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            return null;
+        },
+        async rotateRefreshToken(sessionId, newRefreshToken, newAccessToken, cfg) {
+            const entry = sessions.get(sessionId);
+            if (!entry)
+                return;
+            const graceSeconds = (cfg ?? DEFAULT_AUTH_CONFIG).refreshToken?.rotationGraceSeconds ?? 30;
+            const newHash = hashToken(newRefreshToken);
+            const oldHash = entry.refreshToken;
+            if (entry.prevRefreshToken && entry.prevRefreshToken !== oldHash) {
+                refreshTokenIndex.delete(entry.prevRefreshToken);
+            }
+            entry.prevRefreshToken = oldHash;
+            entry.prevTokenExpiresAt = Date.now() + graceSeconds * 1000;
+            entry.refreshToken = newHash;
+            entry.refreshTokenPlain = newRefreshToken;
+            entry.token = newAccessToken;
+            refreshTokenIndex.set(newHash, sessionId);
+        },
+        async getSessionFingerprint(sessionId) {
+            return sessions.get(sessionId)?.fingerprint ?? null;
+        },
+        async setSessionFingerprint(sessionId, fingerprint) {
+            const entry = sessions.get(sessionId);
+            if (entry)
+                entry.fingerprint = fingerprint;
+        },
+        async setMfaVerifiedAt(sessionId) {
+            const entry = sessions.get(sessionId);
+            if (entry)
+                entry.mfaVerifiedAt = Math.floor(Date.now() / 1000);
+        },
+        async getMfaVerifiedAt(sessionId) {
+            return sessions.get(sessionId)?.mfaVerifiedAt ?? null;
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// SQLite repository factory
+// ---------------------------------------------------------------------------
+export function createSqliteSessionRepository(db) {
+    let initialized = false;
+    function init() {
+        if (initialized)
+            return;
+        // Sessions table is created by sqliteAuth adapter's initSchema.
+        // Only create if it doesn't exist (standalone usage).
+        db.run(`CREATE TABLE IF NOT EXISTS sessions (
+      sessionId         TEXT PRIMARY KEY,
+      userId            TEXT NOT NULL,
+      token             TEXT,
+      createdAt         INTEGER NOT NULL,
+      lastActiveAt      INTEGER NOT NULL,
+      expiresAt         INTEGER NOT NULL,
+      ipAddress         TEXT,
+      userAgent         TEXT,
+      refreshToken      TEXT,
+      prevRefreshToken   TEXT,
+      prevTokenExpiresAt INTEGER,
+      fingerprint       TEXT,
+      mfaVerifiedAt     INTEGER,
+      refreshTokenPlain  TEXT
+    )`);
+        db.run('CREATE INDEX IF NOT EXISTS idx_sessions_userId ON sessions(userId)');
+        db.run('CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_refreshToken ON sessions(refreshToken) WHERE refreshToken IS NOT NULL');
+        initialized = true;
+    }
+    function deleteSessionImpl(sessionId, cfg) {
+        init();
+        if ((cfg ?? DEFAULT_AUTH_CONFIG).persistSessionMetadata) {
+            db.run('UPDATE sessions SET token = NULL, refreshToken = NULL, prevRefreshToken = NULL, prevTokenExpiresAt = NULL WHERE sessionId = ?', [sessionId]);
+        }
+        else {
+            db.run('DELETE FROM sessions WHERE sessionId = ?', [sessionId]);
+        }
+    }
+    return {
+        async createSession(userId, token, sessionId, metadata, cfg) {
+            init();
+            const now = Date.now();
+            const expiresAt = now + getSessionTtlMs(cfg);
+            db.run('INSERT INTO sessions (sessionId, userId, token, createdAt, lastActiveAt, expiresAt, ipAddress, userAgent) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', [
+                sessionId,
+                userId,
+                token,
+                now,
+                now,
+                expiresAt,
+                metadata?.ipAddress ?? null,
+                metadata?.userAgent ?? null,
+            ]);
+        },
+        async atomicCreateSession(userId, token, sessionId, maxSessions, metadata, cfg) {
+            init();
+            const now = Date.now();
+            const ttlMs = getSessionTtlMs(cfg);
+            const expiresAt = now + ttlMs;
+            db.transaction(() => {
+                const countRow = db
+                    .query('SELECT COUNT(*) AS count FROM sessions WHERE userId = ? AND token IS NOT NULL AND expiresAt > ?')
+                    .get(userId, now);
+                let activeCount = countRow?.count ?? 0;
+                while (activeCount >= maxSessions) {
+                    const oldest = db
+                        .query('SELECT sessionId FROM sessions WHERE userId = ? AND token IS NOT NULL AND expiresAt > ? ORDER BY createdAt ASC LIMIT 1')
+                        .get(userId, now);
+                    if (!oldest)
+                        break;
+                    deleteSessionImpl(oldest.sessionId, cfg);
+                    activeCount--;
+                }
+                db.run('INSERT INTO sessions (sessionId, userId, token, createdAt, lastActiveAt, expiresAt, ipAddress, userAgent) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', [
+                    sessionId,
+                    userId,
+                    token,
+                    now,
+                    now,
+                    expiresAt,
+                    metadata?.ipAddress ?? null,
+                    metadata?.userAgent ?? null,
+                ]);
+            })();
+        },
+        async getSession(sessionId, cfg) {
+            init();
+            const row = db
+                .query('SELECT token, lastActiveAt FROM sessions WHERE sessionId = ? AND expiresAt > ?')
+                .get(sessionId, Date.now());
+            if (!row || !row.token)
+                return null;
+            if (isIdleExpired(row.lastActiveAt, cfg)) {
+                deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            return row.token;
+        },
+        async deleteSession(sessionId, cfg) {
+            deleteSessionImpl(sessionId, cfg);
+        },
+        async getUserSessions(userId, cfg) {
+            init();
+            const now = Date.now();
+            const rows = db
+                .query('SELECT sessionId, token, createdAt, lastActiveAt, expiresAt, ipAddress, userAgent FROM sessions WHERE userId = ? ORDER BY createdAt ASC')
+                .all(userId);
+            const config = cfg ?? DEFAULT_AUTH_CONFIG;
+            const includeInactive = config.includeInactiveSessions;
+            const persist = config.persistSessionMetadata;
+            const results = [];
+            for (const row of rows) {
+                const isActive = !!row.token && row.expiresAt > now;
+                if (!isActive && !persist)
+                    continue;
+                if (!isActive && !includeInactive)
+                    continue;
+                results.push({
+                    sessionId: row.sessionId,
+                    createdAt: row.createdAt,
+                    lastActiveAt: row.lastActiveAt,
+                    expiresAt: row.expiresAt,
+                    ipAddress: row.ipAddress ?? undefined,
+                    userAgent: row.userAgent ?? undefined,
+                    isActive,
+                });
+            }
+            return results;
+        },
+        async getActiveSessionCount(userId) {
+            init();
+            const row = db
+                .query('SELECT COUNT(*) AS count FROM sessions WHERE userId = ? AND token IS NOT NULL AND expiresAt > ?')
+                .get(userId, Date.now());
+            return row?.count ?? 0;
+        },
+        async evictOldestSession(userId, cfg) {
+            init();
+            const now = Date.now();
+            const oldest = db
+                .query('SELECT sessionId FROM sessions WHERE userId = ? AND token IS NOT NULL AND expiresAt > ? ORDER BY createdAt ASC LIMIT 1')
+                .get(userId, now);
+            if (oldest)
+                deleteSessionImpl(oldest.sessionId, cfg);
+        },
+        async updateSessionLastActive(sessionId) {
+            init();
+            db.run('UPDATE sessions SET lastActiveAt = ? WHERE sessionId = ?', [Date.now(), sessionId]);
+        },
+        async setRefreshToken(sessionId, refreshToken) {
+            init();
+            const tokenHash = hashToken(refreshToken);
+            db.run('UPDATE sessions SET refreshToken = ? WHERE sessionId = ?', [tokenHash, sessionId]);
+        },
+        async getSessionByRefreshToken(refreshToken, cfg) {
+            init();
+            const tokenHash = hashToken(refreshToken);
+            let row = db
+                .query('SELECT sessionId, userId, refreshToken, lastActiveAt FROM sessions WHERE refreshToken = ?')
+                .get(tokenHash);
+            if (row) {
+                if (isIdleExpired(row.lastActiveAt, cfg)) {
+                    deleteSessionImpl(row.sessionId, cfg);
+                    return null;
+                }
+                return { sessionId: row.sessionId, userId: row.userId, newRefreshToken: refreshToken };
+            }
+            const graceRow = db
+                .query('SELECT sessionId, userId, refreshToken, refreshTokenPlain, prevTokenExpiresAt, lastActiveAt FROM sessions WHERE prevRefreshToken = ?')
+                .get(tokenHash);
+            if (!graceRow)
+                return null;
+            if (isIdleExpired(graceRow.lastActiveAt, cfg)) {
+                deleteSessionImpl(graceRow.sessionId, cfg);
+                return null;
+            }
+            if (graceRow.prevTokenExpiresAt && graceRow.prevTokenExpiresAt > Date.now()) {
+                return {
+                    sessionId: graceRow.sessionId,
+                    userId: graceRow.userId,
+                    newRefreshToken: graceRow.refreshTokenPlain ?? graceRow.refreshToken,
+                };
+            }
+            deleteSessionImpl(graceRow.sessionId, cfg);
+            return null;
+        },
+        async rotateRefreshToken(sessionId, newRefreshToken, newAccessToken, cfg) {
+            init();
+            const graceSeconds = (cfg ?? DEFAULT_AUTH_CONFIG).refreshToken?.rotationGraceSeconds ?? 30;
+            const prevTokenExpiresAt = Date.now() + graceSeconds * 1000;
+            const newHash = hashToken(newRefreshToken);
+            db.run('UPDATE sessions SET prevRefreshToken = refreshToken, prevTokenExpiresAt = ?, refreshToken = ?, refreshTokenPlain = ?, token = ? WHERE sessionId = ?', [prevTokenExpiresAt, newHash, newRefreshToken, newAccessToken, sessionId]);
+        },
+        async getSessionFingerprint(sessionId) {
+            init();
+            const row = db
+                .query('SELECT fingerprint FROM sessions WHERE sessionId = ?')
+                .get(sessionId);
+            return row?.fingerprint ?? null;
+        },
+        async setSessionFingerprint(sessionId, fingerprint) {
+            init();
+            db.run('UPDATE sessions SET fingerprint = ? WHERE sessionId = ?', [fingerprint, sessionId]);
+        },
+        async setMfaVerifiedAt(sessionId) {
+            init();
+            const now = Math.floor(Date.now() / 1000);
+            db.run('UPDATE sessions SET mfaVerifiedAt = ? WHERE sessionId = ?', [now, sessionId]);
+        },
+        async getMfaVerifiedAt(sessionId) {
+            init();
+            const row = db
+                .query('SELECT mfaVerifiedAt FROM sessions WHERE sessionId = ?')
+                .get(sessionId);
+            return row?.mfaVerifiedAt ?? null;
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Redis repository factory
+// ---------------------------------------------------------------------------
+export function createRedisSessionRepository(getRedis, appName) {
+    function sessionKey(sessionId) {
+        return `session:${appName}:${sessionId}`;
+    }
+    function userSessionsKey(userId) {
+        return `usersessions:${appName}:${userId}`;
+    }
+    function refreshTokenKey(refreshToken) {
+        return `refreshtoken:${appName}:${refreshToken}`;
+    }
+    // Lua script: atomic session field update
+    const UPDATE_FIELD_LUA = `
+local key = KEYS[1]
+local field = ARGV[1]
+local value = ARGV[2]
+local valueType = ARGV[3]
+local persist = ARGV[4] == "1"
+
+local raw = redis.call('GET', key)
+if not raw then return 0 end
+local rec = cjson.decode(raw)
+if valueType == "number" then
+  rec[field] = tonumber(value)
+else
+  rec[field] = value
+end
+if persist then
+  redis.call('SET', key, cjson.encode(rec))
+else
+  local ttl = redis.call('PTTL', key)
+  if ttl > 0 then
+    redis.call('SET', key, cjson.encode(rec), 'PX', ttl)
+  else
+    redis.call('SET', key, cjson.encode(rec))
+  end
+end
+return 1
+`;
+    const WRITE_SESSION_LUA = `
+local key = KEYS[1]
+local rawJson = ARGV[1]
+local persist = ARGV[2] == "1"
+
+if persist then
+  redis.call('SET', key, rawJson)
+else
+  local ttl = redis.call('PTTL', key)
+  if ttl > 0 then
+    redis.call('SET', key, rawJson, 'PX', ttl)
+  else
+    redis.call('SET', key, rawJson)
+  end
+end
+return 1
+`;
+    // Lua script: atomic session creation
+    const ATOMIC_CREATE_SESSION_LUA = `
+local userSessionsKey = KEYS[1]
+local newSessionKey = KEYS[2]
+local maxSessions = tonumber(ARGV[1])
+local sessionId = ARGV[2]
+local sessionJson = ARGV[3]
+local createdAt = tonumber(ARGV[4])
+local ttlSeconds = tonumber(ARGV[5])
+local persist = ARGV[6] == "1"
+
+local members = redis.call('ZRANGE', userSessionsKey, 0, -1)
+
+local activeCount = 0
+local activeSessions = {}
+for i, sid in ipairs(members) do
+  local keyPrefix = ARGV[7]
+  local sKey = keyPrefix .. sid
+  local raw = redis.call('GET', sKey)
+  if raw then
+    local rec = cjson.decode(raw)
+    if rec.token and rec.expiresAt > createdAt then
+      activeCount = activeCount + 1
+      table.insert(activeSessions, { sid = sid, key = sKey, createdAt = rec.createdAt })
+    end
+  else
+    redis.call('ZREM', userSessionsKey, sid)
+  end
+end
+
+table.sort(activeSessions, function(a, b) return a.createdAt < b.createdAt end)
+
+local evicted = 0
+while activeCount >= maxSessions and evicted < #activeSessions do
+  evicted = evicted + 1
+  local victim = activeSessions[evicted]
+  redis.call('DEL', victim.key)
+  redis.call('ZREM', userSessionsKey, victim.sid)
+  activeCount = activeCount - 1
+end
+
+if persist then
+  redis.call('SET', newSessionKey, sessionJson)
+else
+  redis.call('SET', newSessionKey, sessionJson, 'EX', ttlSeconds)
+end
+redis.call('ZADD', userSessionsKey, createdAt, sessionId)
+
+return evicted
+`;
+    async function updateSessionField(sessionId, field, value, persist, cfg) {
+        const redis = getRedis();
+        const key = sessionKey(sessionId);
+        const valueType = typeof value === 'number' ? 'number' : 'string';
+        const persistFlag = (persist ?? (cfg ?? DEFAULT_AUTH_CONFIG).persistSessionMetadata) ? '1' : '0';
+        const result = await redis.eval(UPDATE_FIELD_LUA, 1, key, field, String(value), valueType, persistFlag);
+        return result === 1;
+    }
+    async function writeSessionRecord(sessionId, record, cfg) {
+        const redis = getRedis();
+        const persistFlag = shouldPersistSessionMetadata(cfg) ? '1' : '0';
+        await redis.eval(WRITE_SESSION_LUA, 1, sessionKey(sessionId), JSON.stringify(record), persistFlag);
+    }
+    async function deleteSessionImpl(sessionId, cfg) {
+        const c = cfg ?? DEFAULT_AUTH_CONFIG;
+        const redis = getRedis();
+        const raw = await redis.get(sessionKey(sessionId));
+        if (!raw)
+            return;
+        const rec = JSON.parse(raw);
+        const persist = c.persistSessionMetadata;
+        if (rec.refreshToken)
+            await redis.del(refreshTokenKey(rec.refreshToken));
+        if (rec.prevRefreshToken)
+            await redis.del(refreshTokenKey(rec.prevRefreshToken));
+        if (persist) {
+            const updated = {
+                ...rec,
+                token: null,
+                refreshToken: null,
+                prevRefreshToken: null,
+                prevTokenExpiresAt: null,
+            };
+            await redis.set(sessionKey(sessionId), JSON.stringify(updated));
+        }
+        else {
+            await redis.del(sessionKey(sessionId));
+        }
+        if (!persist) {
+            await redis.zrem(userSessionsKey(rec.userId), sessionId);
+        }
+    }
+    async function getUserSessionsImpl(userId, cfg) {
+        const c = cfg ?? DEFAULT_AUTH_CONFIG;
+        const redis = getRedis();
+        const sessionIds = await redis.zrange(userSessionsKey(userId), 0, -1);
+        if (!sessionIds.length)
+            return [];
+        const now = Date.now();
+        const raws = await redis.mget(...sessionIds.map(sessionKey));
+        const results = [];
+        const toRemove = [];
+        for (let i = 0; i < sessionIds.length; i++) {
+            const raw = raws[i];
+            if (!raw) {
+                toRemove.push(sessionIds[i]);
+                continue;
+            }
+            const rec = JSON.parse(raw);
+            const isActive = !!rec.token && rec.expiresAt > now;
+            if (!isActive && !c.persistSessionMetadata) {
+                toRemove.push(sessionIds[i]);
+                continue;
+            }
+            if (!isActive && !c.includeInactiveSessions)
+                continue;
+            results.push({
+                sessionId: rec.sessionId,
+                createdAt: Number(rec.createdAt),
+                lastActiveAt: Number(rec.lastActiveAt),
+                expiresAt: Number(rec.expiresAt),
+                ipAddress: rec.ipAddress,
+                userAgent: rec.userAgent,
+                isActive,
+            });
+        }
+        if (toRemove.length) {
+            await redis.zrem(userSessionsKey(userId), ...toRemove);
+        }
+        return results;
+    }
+    return {
+        async createSession(userId, token, sessionId, metadata, cfg) {
+            const c = cfg ?? DEFAULT_AUTH_CONFIG;
+            const now = Date.now();
+            const ttlSeconds = getSessionTtlSeconds(c);
+            const expiresAt = now + getSessionTtlMs(c);
+            const record = JSON.stringify({
+                sessionId,
+                userId,
+                token,
+                createdAt: now,
+                lastActiveAt: now,
+                expiresAt,
+                ipAddress: metadata?.ipAddress,
+                userAgent: metadata?.userAgent,
+            });
+            const redis = getRedis();
+            const persist = c.persistSessionMetadata;
+            if (persist) {
+                await redis.set(sessionKey(sessionId), record);
+            }
+            else {
+                await redis.set(sessionKey(sessionId), record, 'EX', ttlSeconds);
+            }
+            await redis.zadd(userSessionsKey(userId), now, sessionId);
+        },
+        async atomicCreateSession(userId, token, sessionId, maxSessions, metadata, cfg) {
+            const c = cfg ?? DEFAULT_AUTH_CONFIG;
+            const now = Date.now();
+            const ttlSeconds = getSessionTtlSeconds(c);
+            const expiresAt = now + getSessionTtlMs(c);
+            const record = JSON.stringify({
+                sessionId,
+                userId,
+                token,
+                createdAt: now,
+                lastActiveAt: now,
+                expiresAt,
+                ipAddress: metadata?.ipAddress,
+                userAgent: metadata?.userAgent,
+            });
+            const redis = getRedis();
+            const persist = c.persistSessionMetadata;
+            const sessionKeyPrefix = `session:${appName}:`;
+            await redis.eval(ATOMIC_CREATE_SESSION_LUA, 2, userSessionsKey(userId), sessionKey(sessionId), maxSessions, sessionId, record, now, ttlSeconds, persist ? '1' : '0', sessionKeyPrefix);
+        },
+        async getSession(sessionId, cfg) {
+            const raw = await getRedis().get(sessionKey(sessionId));
+            if (!raw)
+                return null;
+            const rec = JSON.parse(raw);
+            if (!rec.token)
+                return null;
+            if (rec.expiresAt <= Date.now())
+                return null;
+            if (typeof rec.lastActiveAt === 'number' && isIdleExpired(rec.lastActiveAt, cfg)) {
+                await deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            return rec.token;
+        },
+        async deleteSession(sessionId, cfg) {
+            await deleteSessionImpl(sessionId, cfg);
+        },
+        async getUserSessions(userId, cfg) {
+            return getUserSessionsImpl(userId, cfg);
+        },
+        async getActiveSessionCount(userId, cfg) {
+            const sessions = await getUserSessionsImpl(userId, cfg);
+            return sessions.filter(s => s.isActive).length;
+        },
+        async evictOldestSession(userId, cfg) {
+            const redis = getRedis();
+            const sessionIds = await redis.zrange(userSessionsKey(userId), 0, -1);
+            const now = Date.now();
+            for (const sid of sessionIds) {
+                const raw = await redis.get(sessionKey(sid));
+                if (!raw) {
+                    await redis.zrem(userSessionsKey(userId), sid);
+                    continue;
+                }
+                const rec = JSON.parse(raw);
+                if (rec.token && rec.expiresAt > now) {
+                    await deleteSessionImpl(sid, cfg);
+                    return;
+                }
+            }
+        },
+        async updateSessionLastActive(sessionId, cfg) {
+            const c = cfg ?? DEFAULT_AUTH_CONFIG;
+            const now = Date.now();
+            const updated = await updateSessionField(sessionId, 'lastActiveAt', now, undefined, c);
+            if (!updated)
+                return;
+            if (!c.persistSessionMetadata) {
+                const redis = getRedis();
+                const raw = await redis.get(sessionKey(sessionId));
+                if (raw) {
+                    const rec = JSON.parse(raw);
+                    if (rec.expiresAt <= now) {
+                        await deleteSessionImpl(sessionId, c);
+                    }
+                }
+            }
+        },
+        async setRefreshToken(sessionId, refreshToken, cfg) {
+            const redis = getRedis();
+            const raw = await redis.get(sessionKey(sessionId));
+            if (!raw)
+                return;
+            const rec = JSON.parse(raw);
+            const tokenHash = hashToken(refreshToken);
+            const oldHash = typeof rec.refreshToken === 'string' ? rec.refreshToken : null;
+            rec.refreshToken = tokenHash;
+            const refreshExpiry = (cfg ?? DEFAULT_AUTH_CONFIG).refreshToken?.refreshTokenExpiry ?? 2_592_000;
+            await writeSessionRecord(sessionId, rec, cfg);
+            if (oldHash && oldHash !== tokenHash) {
+                await redis.del(refreshTokenKey(oldHash));
+            }
+            await redis.set(refreshTokenKey(tokenHash), sessionId, 'EX', refreshExpiry);
+        },
+        async getSessionByRefreshToken(refreshToken, cfg) {
+            const redis = getRedis();
+            const tokenHash = hashToken(refreshToken);
+            const sessionId = await redis.get(refreshTokenKey(tokenHash));
+            if (!sessionId)
+                return null;
+            const raw = await redis.get(sessionKey(sessionId));
+            if (!raw)
+                return null;
+            const rec = JSON.parse(raw);
+            if (typeof rec.lastActiveAt === 'number' && isIdleExpired(rec.lastActiveAt, cfg)) {
+                await deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            if (timingSafeEqual(rec.refreshToken ?? '', tokenHash)) {
+                return { sessionId: rec.sessionId, userId: rec.userId, newRefreshToken: refreshToken };
+            }
+            if (timingSafeEqual(rec.prevRefreshToken ?? '', tokenHash) &&
+                rec.prevTokenExpiresAt &&
+                rec.prevTokenExpiresAt > Date.now()) {
+                return {
+                    sessionId: rec.sessionId,
+                    userId: rec.userId,
+                    newRefreshToken: rec.refreshTokenPlain ?? rec.refreshToken,
+                };
+            }
+            if (timingSafeEqual(rec.prevRefreshToken ?? '', tokenHash)) {
+                await deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            return null;
+        },
+        async rotateRefreshToken(sessionId, newRefreshToken, newAccessToken, cfg) {
+            const c = cfg ?? DEFAULT_AUTH_CONFIG;
+            const redis = getRedis();
+            const raw = await redis.get(sessionKey(sessionId));
+            if (!raw)
+                return;
+            const rec = JSON.parse(raw);
+            const graceSeconds = c.refreshToken?.rotationGraceSeconds ?? 30;
+            const refreshExpiry = c.refreshToken?.refreshTokenExpiry ?? 2_592_000;
+            const newHash = hashToken(newRefreshToken);
+            const oldHash = rec.refreshToken;
+            const oldPrevHash = rec.prevRefreshToken;
+            rec.prevRefreshToken = oldHash;
+            rec.prevTokenExpiresAt = Date.now() + graceSeconds * 1000;
+            rec.refreshToken = newHash;
+            rec.refreshTokenPlain = newRefreshToken;
+            rec.token = newAccessToken;
+            await writeSessionRecord(sessionId, rec, c);
+            await redis.set(refreshTokenKey(newHash), sessionId, 'EX', refreshExpiry);
+            if (oldPrevHash && oldPrevHash !== oldHash) {
+                await redis.del(refreshTokenKey(oldPrevHash));
+            }
+            if (oldHash) {
+                const oldKeyTtl = Math.max(graceSeconds, 60);
+                await redis.expire(refreshTokenKey(oldHash), oldKeyTtl);
+            }
+        },
+        async getSessionFingerprint(sessionId) {
+            const redis = getRedis();
+            const raw = await redis.get(sessionKey(sessionId));
+            if (!raw)
+                return null;
+            const rec = JSON.parse(raw);
+            return rec.fingerprint ?? null;
+        },
+        async setSessionFingerprint(sessionId, fingerprint) {
+            await updateSessionField(sessionId, 'fingerprint', fingerprint);
+        },
+        async setMfaVerifiedAt(sessionId) {
+            const now = Math.floor(Date.now() / 1000);
+            await updateSessionField(sessionId, 'mfaVerifiedAt', now);
+        },
+        async getMfaVerifiedAt(sessionId) {
+            const redis = getRedis();
+            const raw = await redis.get(sessionKey(sessionId));
+            if (!raw)
+                return null;
+            const rec = JSON.parse(raw);
+            return rec.mfaVerifiedAt ?? null;
+        },
+    };
+}
+export function createMongoSessionRepository(conn, mg) {
+    function getSessionModel() {
+        if (conn.models['Session'])
+            return conn.models['Session'];
+        const { Schema } = mg;
+        const sessionSchema = new Schema({
+            sessionId: { type: String, required: true, unique: true },
+            userId: { type: String, required: true, index: true },
+            token: { type: String, default: null },
+            createdAt: { type: Date, required: true },
+            lastActiveAt: { type: Date, required: true },
+            expiresAt: { type: Date, required: true },
+            ipAddress: { type: String },
+            userAgent: { type: String },
+            refreshToken: { type: String, default: null },
+            prevRefreshToken: { type: String, default: null },
+            prevTokenExpiresAt: { type: Date, default: null },
+            refreshTokenPlain: { type: String, default: null },
+            fingerprint: { type: String, default: null },
+            mfaVerifiedAt: { type: Number, default: null },
+        }, { collection: 'sessions', timestamps: false });
+        sessionSchema.index({ refreshToken: 1 }, { unique: true, partialFilterExpression: { refreshToken: { $type: 'string' } } });
+        if (!DEFAULT_AUTH_CONFIG.persistSessionMetadata) {
+            sessionSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+        }
+        return conn.model('Session', sessionSchema);
+    }
+    function deleteSessionImpl(sessionId, cfg) {
+        const c = cfg ?? DEFAULT_AUTH_CONFIG;
+        const Session = getSessionModel();
+        if (c.persistSessionMetadata) {
+            return Session.updateOne({ sessionId }, {
+                $set: {
+                    token: null,
+                    refreshToken: null,
+                    prevRefreshToken: null,
+                    prevTokenExpiresAt: null,
+                },
+            }).then(() => { });
+        }
+        return Session.deleteOne({ sessionId }).then(() => { });
+    }
+    return {
+        async createSession(userId, token, sessionId, metadata, cfg) {
+            const now = new Date();
+            const expiresAt = new Date(Date.now() + getSessionTtlMs(cfg));
+            await getSessionModel().create({
+                sessionId,
+                userId,
+                token,
+                createdAt: now,
+                lastActiveAt: now,
+                expiresAt,
+                ipAddress: metadata?.ipAddress,
+                userAgent: metadata?.userAgent,
+            });
+        },
+        async atomicCreateSession(userId, token, sessionId, maxSessions, metadata, cfg) {
+            const c = cfg ?? DEFAULT_AUTH_CONFIG;
+            const session = await conn.startSession();
+            try {
+                await session.withTransaction(async () => {
+                    const Session = getSessionModel();
+                    const now = new Date();
+                    let activeCount = await Session.countDocuments({ userId, token: { $ne: null }, expiresAt: { $gt: now } }, { session });
+                    while (activeCount >= maxSessions) {
+                        const oldest = await Session.findOne({ userId, token: { $ne: null }, expiresAt: { $gt: now } }, 'sessionId', { session, sort: { createdAt: 1 } }).lean();
+                        if (!oldest)
+                            break;
+                        if (c.persistSessionMetadata) {
+                            await Session.updateOne({ sessionId: oldest.sessionId }, {
+                                $set: {
+                                    token: null,
+                                    refreshToken: null,
+                                    prevRefreshToken: null,
+                                    prevTokenExpiresAt: null,
+                                },
+                            }, { session });
+                        }
+                        else {
+                            await Session.deleteOne({ sessionId: oldest.sessionId }, { session });
+                        }
+                        activeCount--;
+                    }
+                    const expiresAt = new Date(Date.now() + getSessionTtlMs(c));
+                    await Session.create([
+                        {
+                            sessionId,
+                            userId,
+                            token,
+                            createdAt: now,
+                            lastActiveAt: now,
+                            expiresAt,
+                            ipAddress: metadata?.ipAddress,
+                            userAgent: metadata?.userAgent,
+                        },
+                    ], { session });
+                });
+            }
+            finally {
+                await session.endSession();
+            }
+        },
+        async getSession(sessionId, cfg) {
+            const doc = (await getSessionModel()
+                .findOne({ sessionId, expiresAt: { $gt: new Date() } }, 'token lastActiveAt')
+                .lean());
+            if (!doc?.token)
+                return null;
+            if (isIdleExpired(doc.lastActiveAt.getTime(), cfg)) {
+                await deleteSessionImpl(sessionId, cfg);
+                return null;
+            }
+            return doc.token;
+        },
+        async deleteSession(sessionId, cfg) {
+            await deleteSessionImpl(sessionId, cfg);
+        },
+        async getUserSessions(userId, cfg) {
+            const c = cfg ?? DEFAULT_AUTH_CONFIG;
+            const now = new Date();
+            const includeInactive = c.includeInactiveSessions;
+            const persist = c.persistSessionMetadata;
+            const query = { userId };
+            if (!includeInactive) {
+                query.token = { $ne: null };
+                query.expiresAt = { $gt: now };
+            }
+            const docs = await getSessionModel().find(query).lean();
+            const results = [];
+            for (const doc of docs) {
+                const isActive = !!doc.token && doc.expiresAt > now;
+                if (!isActive && !persist)
+                    continue;
+                if (!isActive && !includeInactive)
+                    continue;
+                results.push({
+                    sessionId: doc.sessionId,
+                    createdAt: doc.createdAt.getTime(),
+                    lastActiveAt: doc.lastActiveAt.getTime(),
+                    expiresAt: doc.expiresAt.getTime(),
+                    ipAddress: doc.ipAddress,
+                    userAgent: doc.userAgent,
+                    isActive,
+                });
+            }
+            return results;
+        },
+        async getActiveSessionCount(userId) {
+            const now = new Date();
+            return getSessionModel().countDocuments({
+                userId,
+                token: { $ne: null },
+                expiresAt: { $gt: now },
+            });
+        },
+        async evictOldestSession(userId, cfg) {
+            const now = new Date();
+            const oldest = await getSessionModel()
+                .findOne({ userId, token: { $ne: null }, expiresAt: { $gt: now } }, 'sessionId')
+                .sort({ createdAt: 1 })
+                .lean();
+            if (oldest)
+                await deleteSessionImpl(oldest.sessionId, cfg);
+        },
+        async updateSessionLastActive(sessionId) {
+            await getSessionModel().updateOne({ sessionId }, { $set: { lastActiveAt: new Date() } });
+        },
+        async setRefreshToken(sessionId, refreshToken) {
+            const tokenHash = hashToken(refreshToken);
+            await getSessionModel().updateOne({ sessionId }, { $set: { refreshToken: tokenHash } });
+        },
+        async getSessionByRefreshToken(refreshToken, cfg) {
+            const Session = getSessionModel();
+            const tokenHash = hashToken(refreshToken);
+            let doc = (await Session.findOne({ refreshToken: tokenHash }).lean());
+            if (doc) {
+                if (isIdleExpired(doc.lastActiveAt.getTime(), cfg)) {
+                    await deleteSessionImpl(doc.sessionId, cfg);
+                    return null;
+                }
+                return { sessionId: doc.sessionId, userId: doc.userId, newRefreshToken: refreshToken };
+            }
+            doc = (await Session.findOne({ prevRefreshToken: tokenHash }).lean());
+            if (!doc)
+                return null;
+            if (isIdleExpired(doc.lastActiveAt.getTime(), cfg)) {
+                await deleteSessionImpl(doc.sessionId, cfg);
+                return null;
+            }
+            if (doc.prevTokenExpiresAt && doc.prevTokenExpiresAt > new Date()) {
+                return {
+                    sessionId: doc.sessionId,
+                    userId: doc.userId,
+                    newRefreshToken: doc.refreshTokenPlain ?? doc.refreshToken,
+                };
+            }
+            await deleteSessionImpl(doc.sessionId, cfg);
+            return null;
+        },
+        async rotateRefreshToken(sessionId, newRefreshToken, newAccessToken, cfg) {
+            const graceSeconds = (cfg ?? DEFAULT_AUTH_CONFIG).refreshToken?.rotationGraceSeconds ?? 30;
+            const Session = getSessionModel();
+            const doc = await Session.findOne({ sessionId });
+            if (!doc)
+                return;
+            const newHash = hashToken(newRefreshToken);
+            doc.prevRefreshToken = doc.refreshToken;
+            doc.prevTokenExpiresAt = new Date(Date.now() + graceSeconds * 1000);
+            doc.refreshToken = newHash;
+            doc.refreshTokenPlain = newRefreshToken;
+            doc.token = newAccessToken;
+            await doc.save();
+        },
+        async getSessionFingerprint(sessionId) {
+            const doc = await getSessionModel().findOne({ sessionId }, 'fingerprint').lean();
+            return doc?.fingerprint ?? null;
+        },
+        async setSessionFingerprint(sessionId, fingerprint) {
+            await getSessionModel().updateOne({ sessionId }, { $set: { fingerprint } });
+        },
+        async setMfaVerifiedAt(sessionId) {
+            const now = Math.floor(Date.now() / 1000);
+            await getSessionModel().updateOne({ sessionId }, { $set: { mfaVerifiedAt: now } });
+        },
+        async getMfaVerifiedAt(sessionId) {
+            const doc = await getSessionModel().findOne({ sessionId }, 'mfaVerifiedAt').lean();
+            return doc?.mfaVerifiedAt ?? null;
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Factory map
+// ---------------------------------------------------------------------------
+export const sessionFactories = {
+    memory: () => createMemorySessionRepository(),
+    sqlite: infra => createSqliteSessionRepository(infra.getSqliteDb()),
+    redis: infra => createRedisSessionRepository(infra.getRedis, infra.appName),
+    mongo: infra => {
+        const { conn, mg } = infra.getMongo();
+        return createMongoSessionRepository(conn, mg);
+    },
+    postgres: () => {
+        throw new Error('[bunshot-auth] postgres store is not yet supported for session repository');
+    },
+};
+// ---------------------------------------------------------------------------
+// Public API — thin wrappers delegating to ISessionRepository
+//
+// Callers pass the repo directly (resolved in bootstrap via sessionFactories).
+// ---------------------------------------------------------------------------
+export const createSession = async (repo, userId, token, sessionId, metadata, config) => {
+    await repo.createSession(userId, token, sessionId, metadata, config);
+};
+export const atomicCreateSession = async (repo, userId, token, sessionId, maxSessions, metadata, config) => {
+    await repo.atomicCreateSession(userId, token, sessionId, maxSessions, metadata, config);
+};
+export const getSession = async (repo, sessionId, config) => {
+    const cfg = config ?? DEFAULT_AUTH_CONFIG;
+    return repo.getSession(sessionId, cfg);
+};
+export const deleteSession = async (repo, sessionId, config) => {
+    await repo.deleteSession(sessionId, config);
+};
+export const getUserSessions = async (repo, userId, config) => {
+    return repo.getUserSessions(userId, config);
+};
+export const getActiveSessionCount = async (repo, userId, config) => {
+    return repo.getActiveSessionCount(userId, config);
+};
+export const evictOldestSession = async (repo, userId, config) => {
+    await repo.evictOldestSession(userId, config);
+};
+export const deleteUserSessions = async (repo, userId, config) => {
+    const sessions = await repo.getUserSessions(userId, config);
+    await Promise.all(sessions.map(s => repo.deleteSession(s.sessionId, config)));
+};
+export const deleteOtherSessions = async (repo, userId, currentSessionId, config) => {
+    const sessions = await repo.getUserSessions(userId, config);
+    const others = sessions.filter(s => s.sessionId !== currentSessionId);
+    await Promise.all(others.map(s => repo.deleteSession(s.sessionId, config)));
+};
+export const updateSessionLastActive = async (repo, sessionId, config) => {
+    await repo.updateSessionLastActive(sessionId, config);
+};
+export const setRefreshToken = async (repo, sessionId, refreshToken, config) => {
+    await repo.setRefreshToken(sessionId, refreshToken, config);
+};
+export const getSessionByRefreshToken = async (repo, refreshToken, config) => {
+    return repo.getSessionByRefreshToken(refreshToken, config);
+};
+export const rotateRefreshToken = async (repo, sessionId, newRefreshToken, newAccessToken, config) => {
+    await repo.rotateRefreshToken(sessionId, newRefreshToken, newAccessToken, config);
+    await repo.updateSessionLastActive(sessionId, config);
+};
+export const getSessionFingerprint = async (repo, sessionId) => {
+    return repo.getSessionFingerprint(sessionId);
+};
+export const setSessionFingerprint = async (repo, sessionId, fingerprint) => {
+    await repo.setSessionFingerprint(sessionId, fingerprint);
+};
+export const setMfaVerifiedAt = async (repo, sessionId) => {
+    await repo.setMfaVerifiedAt(sessionId);
+};
+export const getMfaVerifiedAt = async (repo, sessionId) => {
+    return repo.getMfaVerifiedAt(sessionId);
+};