@lucaapp/service-utils 5.21.0 → 5.22.0

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export * from './lib/logger';
 export * from './lib/datetime';
 export * from './lib/proxy';
 export * from './lib/random';
+export * from './lib/sessionRevocation';
 export * from './lib/crypto';
 export * from './lib/phone';
 export * from './lib/http';

package/dist/index.js

@@ -30,6 +30,7 @@ __exportStar(require("./lib/logger"), exports);
 __exportStar(require("./lib/datetime"), exports);
 __exportStar(require("./lib/proxy"), exports);
 __exportStar(require("./lib/random"), exports);
+__exportStar(require("./lib/sessionRevocation"), exports);
 __exportStar(require("./lib/crypto"), exports);
 __exportStar(require("./lib/phone"), exports);
 __exportStar(require("./lib/http"), exports);

package/dist/lib/sessionRevocation/index.d.ts

@@ -0,0 +1,2 @@
+export * from './sessionRevocation';
+export * from './types';

package/dist/lib/sessionRevocation/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./sessionRevocation"), exports);
+__exportStar(require("./types"), exports);

package/dist/lib/sessionRevocation/sessionRevocation.d.ts

@@ -0,0 +1,7 @@
+import { IsOperatorTokenRevokedParams, IsRevokedOperatorJwtParams, RevokeOperatorTokensParams } from './types';
+export declare const OPERATOR_REVOCATION_KEY_PREFIX = "revoked:operator:";
+export declare const OPERATOR_REVOCATION_TTL_SECONDS: number;
+export declare const buildOperatorRevocationKey: (operatorUuid: string) => string;
+export declare const revokeOperatorTokens: ({ redis, logger, operatorUuid, }: RevokeOperatorTokensParams) => Promise<void>;
+export declare const isOperatorTokenRevoked: ({ redis, logger, operatorUuid, issuedAtSeconds, }: IsOperatorTokenRevokedParams) => Promise<boolean>;
+export declare const isRevokedOperatorJwt: ({ redis, logger, payload, operatorRole, }: IsRevokedOperatorJwtParams) => Promise<boolean>;

package/dist/lib/sessionRevocation/sessionRevocation.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRevokedOperatorJwt = exports.isOperatorTokenRevoked = exports.revokeOperatorTokens = exports.buildOperatorRevocationKey = exports.OPERATOR_REVOCATION_TTL_SECONDS = exports.OPERATOR_REVOCATION_KEY_PREFIX = void 0;
+exports.OPERATOR_REVOCATION_KEY_PREFIX = 'revoked:operator:';
+exports.OPERATOR_REVOCATION_TTL_SECONDS = 24 * 60 * 60;
+const REDIS_GET_TIMEOUT_MS = 50;
+const buildOperatorRevocationKey = (operatorUuid) => `${exports.OPERATOR_REVOCATION_KEY_PREFIX}${operatorUuid}`;
+exports.buildOperatorRevocationKey = buildOperatorRevocationKey;
+const nowInSeconds = () => Math.floor(Date.now() / 1000);
+const parseTimestamp = (raw) => {
+    if (raw === null)
+        return null;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) ? parsed : null;
+};
+const withTimeout = async (promise, timeoutMs) => {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error('redis revocation lookup timed out')), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+};
+const revokeOperatorTokens = async ({ redis, logger, operatorUuid, }) => {
+    try {
+        const key = (0, exports.buildOperatorRevocationKey)(operatorUuid);
+        const existing = parseTimestamp(await redis.get(key)) ?? 0;
+        const invalidatedAt = Math.max(existing, nowInSeconds());
+        await redis.setex(key, exports.OPERATOR_REVOCATION_TTL_SECONDS, String(invalidatedAt));
+    }
+    catch (error) {
+        logger.error(error, 'failed to write operator token revocation key');
+    }
+};
+exports.revokeOperatorTokens = revokeOperatorTokens;
+const isOperatorTokenRevoked = async ({ redis, logger, operatorUuid, issuedAtSeconds, }) => {
+    try {
+        const key = (0, exports.buildOperatorRevocationKey)(operatorUuid);
+        const invalidatedAt = parseTimestamp(await withTimeout(redis.get(key), REDIS_GET_TIMEOUT_MS));
+        if (invalidatedAt === null)
+            return false;
+        return issuedAtSeconds <= invalidatedAt;
+    }
+    catch (error) {
+        logger.warn(error, 'operator token revocation check failed open');
+        return false;
+    }
+};
+exports.isOperatorTokenRevoked = isOperatorTokenRevoked;
+const isRevokedOperatorJwt = async ({ redis, logger, payload, operatorRole, }) => {
+    if (payload.role !== operatorRole ||
+        typeof payload.sub !== 'string' ||
+        typeof payload.iat !== 'number') {
+        return false;
+    }
+    return (0, exports.isOperatorTokenRevoked)({
+        redis,
+        logger,
+        operatorUuid: payload.sub,
+        issuedAtSeconds: payload.iat,
+    });
+};
+exports.isRevokedOperatorJwt = isRevokedOperatorJwt;

package/dist/lib/sessionRevocation/types.d.ts

@@ -0,0 +1,27 @@
+import { Logger } from 'pino';
+export interface RevocationRedis {
+    get(key: string): Promise<string | null>;
+    setex(key: string, ttlSeconds: number, value: string): Promise<unknown>;
+}
+export interface RevocableJwtPayload {
+    role?: string;
+    sub?: string;
+    iat?: number;
+}
+export interface RevokeOperatorTokensParams {
+    redis: RevocationRedis;
+    logger: Logger;
+    operatorUuid: string;
+}
+export interface IsOperatorTokenRevokedParams {
+    redis: RevocationRedis;
+    logger: Logger;
+    operatorUuid: string;
+    issuedAtSeconds: number;
+}
+export interface IsRevokedOperatorJwtParams {
+    redis: RevocationRedis;
+    logger: Logger;
+    payload: RevocableJwtPayload;
+    operatorRole: string;
+}

package/dist/lib/sessionRevocation/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucaapp/service-utils",
-  "version": "5.21.0",
+  "version": "5.22.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [