@livedesk/hub 0.1.57 → 0.1.59

package/src/http/hub-ui-session.js

@@ -34,33 +34,97 @@ function randomToken() {
   return crypto.randomBytes(32).toString('base64url');
 }
 
-export function createHubUiSessionAuthority({
-  ttlMs = HUB_UI_SESSION_TTL_MS,
-  maxSessions = 32,
-  now = () => Date.now()
-} = {}) {
-  const sessions = new Map();
+export function createHubUiSessionAuthority({
+  ttlMs = HUB_UI_SESSION_TTL_MS,
+  maxSessions = 32,
+  now = () => Date.now(),
+  onRevoke = () => {}
+} = {}) {
+  const sessions = new Map();
+
+  function dropSession(sessionId, reason) {
+    const session = sessions.get(sessionId);
+    if (!session) return null;
+    sessions.delete(sessionId);
+    try {
+      onRevoke({ sessionId, ...session }, String(reason || 'hub-ui-session-revoked'));
+    } catch {
+      // Revocation remains authoritative even if a best-effort socket cleanup
+      // listener fails. The next protected request still fails closed.
+    }
+    return session;
+  }
 
   function purgeExpired() {
-    const current = now();
-    for (const [sessionId, session] of sessions) {
-      if (session.expiresAt <= current) sessions.delete(sessionId);
-    }
-    while (sessions.size >= maxSessions) {
-      sessions.delete(sessions.keys().next().value);
+    const current = now();
+    for (const [sessionId, session] of sessions) {
+      if (session.expiresAt <= current
+        || (session.accessExpiresAt > 0 && session.accessExpiresAt <= current)) {
+        dropSession(sessionId, 'hub-ui-session-expired');
+      }
+    }
+    while (sessions.size >= maxSessions) {
+      dropSession(sessions.keys().next().value, 'hub-ui-session-capacity-evicted');
     }
   }
 
-  function issue(userId) {
-    const normalizedUserId = String(userId || '').trim();
-    if (!normalizedUserId) throw new Error('hub-ui-session-user-required');
-    purgeExpired();
-    const sessionId = randomToken();
-    const csrfToken = randomToken();
-    const expiresAt = now() + ttlMs;
-    sessions.set(sessionId, { userId: normalizedUserId, csrfToken, expiresAt });
-    return { sessionId, csrfToken, expiresAt };
-  }
+  function normalizedSessionAccess(userId, access = {}) {
+    const normalizedUserId = String(userId || '').trim();
+    if (!normalizedUserId) throw new Error('hub-ui-session-user-required');
+    const workspaceId = String(access.workspaceId || '').trim();
+    const workspaceKind = String(access.workspaceKind || 'personal').trim().toLowerCase();
+    const role = String(access.role || 'owner').trim().toLowerCase();
+    const entitlementStatus = String(access.entitlementStatus || 'active').trim().toLowerCase();
+    const membershipRevision = Math.max(0, Number(access.membershipRevision || 0));
+    const accessExpiresAt = Math.max(0, Number(access.accessExpiresAt || 0));
+    if (workspaceId && !['owner', 'operator'].includes(role)) {
+      throw new Error('hub-ui-session-workspace-role-invalid');
+    }
+    return {
+      userId: normalizedUserId,
+      workspaceId,
+      workspaceKind,
+      role,
+      plan: String(access.plan || 'free').trim().toLowerCase(),
+      entitlementStatus,
+      membershipRevision,
+      accessExpiresAt
+    };
+  }
+
+  function issue(userId, access = {}) {
+    const normalized = normalizedSessionAccess(userId, access);
+    purgeExpired();
+    const sessionId = randomToken();
+    const csrfToken = randomToken();
+    const expiresAt = now() + ttlMs;
+    sessions.set(sessionId, {
+      ...normalized,
+      csrfToken,
+      expiresAt
+    });
+    return { sessionId, csrfToken, expiresAt };
+  }
+
+  function renew(req, userId, access = {}) {
+    purgeExpired();
+    const sessionId = parseCookies(req?.headers?.cookie).get(HUB_UI_SESSION_COOKIE) || '';
+    const session = sessions.get(sessionId);
+    const normalized = normalizedSessionAccess(userId, access);
+    if (!session
+      || session.userId !== normalized.userId
+      || session.workspaceId !== normalized.workspaceId
+      || session.role !== normalized.role) {
+      return issue(userId, access);
+    }
+    const expiresAt = now() + ttlMs;
+    sessions.set(sessionId, {
+      ...session,
+      ...normalized,
+      expiresAt
+    });
+    return { sessionId, csrfToken: session.csrfToken, expiresAt, renewed: true };
+  }
 
   function authorize(req, currentUserId, {
     requireCsrf = !SAFE_HTTP_METHODS.has(String(req.method || 'GET').toUpperCase())
@@ -74,23 +138,82 @@ export function createHubUiSessionAuthority({
     if (!session) {
       return { ok: false, status: 401, error: 'hub-ui-session-expired' };
     }
-    const normalizedUserId = String(currentUserId || '').trim();
-    if (!normalizedUserId || session.userId !== normalizedUserId) {
-      sessions.delete(sessionId);
-      return { ok: false, status: 403, error: 'hub-ui-session-account-mismatch' };
+    const expected = currentUserId && typeof currentUserId === 'object'
+      ? currentUserId
+      : { userId: currentUserId };
+    const normalizedUserId = String(expected.userId || '').trim();
+    const expectedWorkspaceId = String(expected.workspaceId || '').trim();
+    const allowedRoles = new Set(Array.isArray(expected.allowedRoles)
+      ? expected.allowedRoles.map(role => String(role || '').trim().toLowerCase())
+      : ['owner', 'operator']);
+    const identityMismatch = expectedWorkspaceId
+      ? session.workspaceId !== expectedWorkspaceId || !allowedRoles.has(session.role)
+      : !normalizedUserId || session.userId !== normalizedUserId;
+    if (identityMismatch || (session.accessExpiresAt > 0 && session.accessExpiresAt <= now())) {
+      dropSession(sessionId, 'hub-ui-session-account-mismatch');
+      return { ok: false, status: 403, error: 'hub-ui-session-account-mismatch' };
     }
     if (requireCsrf && !secureEqual(req.headers?.['x-livedesk-csrf'], session.csrfToken)) {
       return { ok: false, status: 403, error: 'hub-ui-csrf-invalid' };
     }
-    return { ok: true, sessionId, userId: session.userId, expiresAt: session.expiresAt };
+    return {
+      ok: true,
+      sessionId,
+      userId: session.userId,
+      workspaceId: session.workspaceId,
+      workspaceKind: session.workspaceKind,
+      role: session.role,
+      plan: session.plan,
+      entitlementStatus: session.entitlementStatus,
+      membershipRevision: session.membershipRevision,
+      accessExpiresAt: session.accessExpiresAt,
+      expiresAt: session.expiresAt
+    };
   }
 
   return {
-    issue,
-    authorize,
-    revokeAll() {
-      sessions.clear();
-    },
+    issue,
+    renew,
+    authorize,
+    sessionDeadline(sessionId) {
+      purgeExpired();
+      const session = sessions.get(String(sessionId || ''));
+      if (!session) return 0;
+      return session.accessExpiresAt > 0
+        ? Math.min(session.expiresAt, session.accessExpiresAt)
+        : session.expiresAt;
+    },
+    revokeAll(reason = 'hub-ui-session-revoked-all') {
+      let revoked = 0;
+      for (const sessionId of [...sessions.keys()]) {
+        if (dropSession(sessionId, reason)) revoked += 1;
+      }
+      return revoked;
+    },
+    revokeWorkspaceMember(workspaceId, userId) {
+      const normalizedWorkspaceId = String(workspaceId || '').trim();
+      const normalizedUserId = String(userId || '').trim();
+      let revoked = 0;
+      for (const [sessionId, session] of sessions) {
+        if (session.workspaceId !== normalizedWorkspaceId || session.userId !== normalizedUserId) continue;
+        if (dropSession(sessionId, 'workspace-member-revoked')) revoked += 1;
+      }
+      return revoked;
+    },
+    revoke(req) {
+      const sessionId = parseCookies(req?.headers?.cookie).get(HUB_UI_SESSION_COOKIE) || '';
+      if (!sessionId) return null;
+      const session = dropSession(sessionId, 'hub-ui-session-signed-out');
+      return session ? {
+        sessionId,
+        userId: session.userId,
+        workspaceId: session.workspaceId,
+        workspaceKind: session.workspaceKind,
+        role: session.role,
+        plan: session.plan,
+        entitlementStatus: session.entitlementStatus
+      } : null;
+    },
     sessionCount: () => sessions.size
   };
 }