@livedesk/hub 0.1.41 → 0.1.43

package/src/http/hub-ui-session.js

@@ -1,119 +1,119 @@
-import crypto from 'node:crypto';
-
-export const HUB_UI_SESSION_COOKIE = 'livedesk_hub_ui';
-export const HUB_UI_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
-
-const SAFE_HTTP_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
-
-function secureEqual(left, right) {
-  const leftBuffer = Buffer.from(String(left || ''), 'utf8');
-  const rightBuffer = Buffer.from(String(right || ''), 'utf8');
-  return leftBuffer.length === rightBuffer.length
-    && leftBuffer.length > 0
-    && crypto.timingSafeEqual(leftBuffer, rightBuffer);
-}
-
-function parseCookies(value) {
-  const result = new Map();
-  for (const part of String(value || '').split(';')) {
-    const separator = part.indexOf('=');
-    if (separator <= 0) continue;
-    const key = part.slice(0, separator).trim();
-    const rawValue = part.slice(separator + 1).trim();
-    if (!key) continue;
-    try {
-      result.set(key, decodeURIComponent(rawValue));
-    } catch {
-      result.set(key, rawValue);
-    }
-  }
-  return result;
-}
-
-function randomToken() {
-  return crypto.randomBytes(32).toString('base64url');
-}
-
-export function createHubUiSessionAuthority({
-  ttlMs = HUB_UI_SESSION_TTL_MS,
-  maxSessions = 32,
-  now = () => Date.now()
-} = {}) {
-  const sessions = new Map();
-
-  function purgeExpired() {
-    const current = now();
-    for (const [sessionId, session] of sessions) {
-      if (session.expiresAt <= current) sessions.delete(sessionId);
-    }
-    while (sessions.size >= maxSessions) {
-      sessions.delete(sessions.keys().next().value);
-    }
-  }
-
-  function issue(userId) {
-    const normalizedUserId = String(userId || '').trim();
-    if (!normalizedUserId) throw new Error('hub-ui-session-user-required');
-    purgeExpired();
-    const sessionId = randomToken();
-    const csrfToken = randomToken();
-    const expiresAt = now() + ttlMs;
-    sessions.set(sessionId, { userId: normalizedUserId, csrfToken, expiresAt });
-    return { sessionId, csrfToken, expiresAt };
-  }
-
-  function authorize(req, currentUserId, {
-    requireCsrf = !SAFE_HTTP_METHODS.has(String(req.method || 'GET').toUpperCase())
-  } = {}) {
-    purgeExpired();
-    const sessionId = parseCookies(req.headers?.cookie).get(HUB_UI_SESSION_COOKIE) || '';
-    if (!sessionId) {
-      return { ok: false, status: 401, error: 'hub-ui-session-required' };
-    }
-    const session = sessions.get(sessionId);
-    if (!session) {
-      return { ok: false, status: 401, error: 'hub-ui-session-expired' };
-    }
-    const normalizedUserId = String(currentUserId || '').trim();
-    if (!normalizedUserId || session.userId !== normalizedUserId) {
-      sessions.delete(sessionId);
-      return { ok: false, status: 403, error: 'hub-ui-session-account-mismatch' };
-    }
-    if (requireCsrf && !secureEqual(req.headers?.['x-livedesk-csrf'], session.csrfToken)) {
-      return { ok: false, status: 403, error: 'hub-ui-csrf-invalid' };
-    }
-    return { ok: true, sessionId, userId: session.userId, expiresAt: session.expiresAt };
-  }
-
-  return {
-    issue,
-    authorize,
-    revokeAll() {
-      sessions.clear();
-    },
-    sessionCount: () => sessions.size
-  };
-}
-
-export function serializeHubUiSessionCookie(sessionId, expiresAt, { secure = false } = {}) {
-  const maxAgeSeconds = Math.max(1, Math.floor((Number(expiresAt || 0) - Date.now()) / 1000));
-  return [
-    `${HUB_UI_SESSION_COOKIE}=${encodeURIComponent(String(sessionId || ''))}`,
-    'Path=/',
-    'HttpOnly',
-    'SameSite=Strict',
-    `Max-Age=${maxAgeSeconds}`,
-    secure ? 'Secure' : ''
-  ].filter(Boolean).join('; ');
-}
-
-export function clearHubUiSessionCookie({ secure = false } = {}) {
-  return [
-    `${HUB_UI_SESSION_COOKIE}=`,
-    'Path=/',
-    'HttpOnly',
-    'SameSite=Strict',
-    'Max-Age=0',
-    secure ? 'Secure' : ''
-  ].filter(Boolean).join('; ');
-}
+import crypto from 'node:crypto';
+
+export const HUB_UI_SESSION_COOKIE = 'livedesk_hub_ui';
+export const HUB_UI_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+
+const SAFE_HTTP_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+function secureEqual(left, right) {
+  const leftBuffer = Buffer.from(String(left || ''), 'utf8');
+  const rightBuffer = Buffer.from(String(right || ''), 'utf8');
+  return leftBuffer.length === rightBuffer.length
+    && leftBuffer.length > 0
+    && crypto.timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+function parseCookies(value) {
+  const result = new Map();
+  for (const part of String(value || '').split(';')) {
+    const separator = part.indexOf('=');
+    if (separator <= 0) continue;
+    const key = part.slice(0, separator).trim();
+    const rawValue = part.slice(separator + 1).trim();
+    if (!key) continue;
+    try {
+      result.set(key, decodeURIComponent(rawValue));
+    } catch {
+      result.set(key, rawValue);
+    }
+  }
+  return result;
+}
+
+function randomToken() {
+  return crypto.randomBytes(32).toString('base64url');
+}
+
+export function createHubUiSessionAuthority({
+  ttlMs = HUB_UI_SESSION_TTL_MS,
+  maxSessions = 32,
+  now = () => Date.now()
+} = {}) {
+  const sessions = new Map();
+
+  function purgeExpired() {
+    const current = now();
+    for (const [sessionId, session] of sessions) {
+      if (session.expiresAt <= current) sessions.delete(sessionId);
+    }
+    while (sessions.size >= maxSessions) {
+      sessions.delete(sessions.keys().next().value);
+    }
+  }
+
+  function issue(userId) {
+    const normalizedUserId = String(userId || '').trim();
+    if (!normalizedUserId) throw new Error('hub-ui-session-user-required');
+    purgeExpired();
+    const sessionId = randomToken();
+    const csrfToken = randomToken();
+    const expiresAt = now() + ttlMs;
+    sessions.set(sessionId, { userId: normalizedUserId, csrfToken, expiresAt });
+    return { sessionId, csrfToken, expiresAt };
+  }
+
+  function authorize(req, currentUserId, {
+    requireCsrf = !SAFE_HTTP_METHODS.has(String(req.method || 'GET').toUpperCase())
+  } = {}) {
+    purgeExpired();
+    const sessionId = parseCookies(req.headers?.cookie).get(HUB_UI_SESSION_COOKIE) || '';
+    if (!sessionId) {
+      return { ok: false, status: 401, error: 'hub-ui-session-required' };
+    }
+    const session = sessions.get(sessionId);
+    if (!session) {
+      return { ok: false, status: 401, error: 'hub-ui-session-expired' };
+    }
+    const normalizedUserId = String(currentUserId || '').trim();
+    if (!normalizedUserId || session.userId !== normalizedUserId) {
+      sessions.delete(sessionId);
+      return { ok: false, status: 403, error: 'hub-ui-session-account-mismatch' };
+    }
+    if (requireCsrf && !secureEqual(req.headers?.['x-livedesk-csrf'], session.csrfToken)) {
+      return { ok: false, status: 403, error: 'hub-ui-csrf-invalid' };
+    }
+    return { ok: true, sessionId, userId: session.userId, expiresAt: session.expiresAt };
+  }
+
+  return {
+    issue,
+    authorize,
+    revokeAll() {
+      sessions.clear();
+    },
+    sessionCount: () => sessions.size
+  };
+}
+
+export function serializeHubUiSessionCookie(sessionId, expiresAt, { secure = false } = {}) {
+  const maxAgeSeconds = Math.max(1, Math.floor((Number(expiresAt || 0) - Date.now()) / 1000));
+  return [
+    `${HUB_UI_SESSION_COOKIE}=${encodeURIComponent(String(sessionId || ''))}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Strict',
+    `Max-Age=${maxAgeSeconds}`,
+    secure ? 'Secure' : ''
+  ].filter(Boolean).join('; ');
+}
+
+export function clearHubUiSessionCookie({ secure = false } = {}) {
+  return [
+    `${HUB_UI_SESSION_COOKIE}=`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Strict',
+    'Max-Age=0',
+    secure ? 'Secure' : ''
+  ].filter(Boolean).join('; ');
+}