@nestjs/authentication 0.1.4 → 0.1.5

package/dist/interfaces/session-store.interface.d.ts

@@ -70,9 +70,17 @@ export interface SessionStore {
     deleteSession(id: string): Promise<boolean>;
     /**
      * The user's sessions, in any order (`[]` when none), expired ones included.
-     * Without `extra`: they feed "your sessions" pages.
+     * Without `extra`: they feed "your sessions" pages, and
+     * `SessionService.revokeAll()` reads them back after it deletes, so read
+     * what was just written and deleted: the primary, not a replica that lags.
      */
     listUserSessions(userId: string): Promise<SessionRecord[]>;
-    /** Deletes every session of the user ("sign out everywhere"). */
+    /**
+     * Deletes every session of the user ("sign out everywhere"): a plain
+     * `DELETE … WHERE user_id = ?`. It may miss a session a rotation writes
+     * while it runs (at Read Committed, its snapshot predates the new row), so
+     * `SessionService.revokeAll()` reads the user's sessions back with
+     * `listUserSessions()` and deletes again until none is left.
+     */
     deleteUserSessions(userId: string): Promise<void>;
 }

package/dist/mfa/mfa.service.js

@@ -238,7 +238,9 @@ let MfaService = MfaService_1 = class MfaService {
         const issuer = this.options?.issuer ?? 'NestJS';
         const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(accountName)}`;
         const params = new URLSearchParams({ secret, issuer, algorithm: 'SHA1', digits: String(DIGITS), period: String(PERIOD) });
-        return `otpauth://totp/${label}?${params}`;
+        // The key URI format encodes as RFC 3986, where `+` is a plus sign: a space is `%20`, as in the label.
+        // URLSearchParams writes a space as `+`, and a literal `+` as `%2B`, so each `+` left is a space.
+        return `otpauth://totp/${label}?${params.toString().replaceAll('+', '%20')}`;
     }
     /** `opened` is undefined when the secret could not be decrypted: fail closed, not counted against the user. */
     async check(userId, opened, code) {

package/dist/session/session.service.d.ts

@@ -60,8 +60,9 @@ export declare class SessionService {
      * `absoluteTtl` from its creation, in place of its `mfa.pendingTtl`.
      * Resolves `null` when the session was gone by the time it was replaced:
      * revoked (a sign-out everywhere, a password reset) or rotated by another
-     * request, which leaves no new session behind. The session's `extra` is
-     * not carried over.
+     * request, which leaves no new session behind. A rotation that wins while
+     * `revokeAll()` is under way still resolves its new session, which that
+     * `revokeAll()` then ends. The session's `extra` is not carried over.
      */
     rotate(session: SessionRecord, changes?: Pick<Partial<SessionRecord>, 'mfa' | 'metadata'>): Promise<IssuedSession | null>;
     /**
@@ -72,7 +73,12 @@ export declare class SessionService {
     revoke(sessionId: string, { userId }: {
         userId: string;
     }): Promise<boolean>;
-    /** Ends every session of a user, optionally keeping one (`except`: its id). */
+    /**
+     * Ends every session of a user, optionally keeping one (`except`: its id).
+     * Resolves once a read of the user's sessions finds none left but the kept
+     * one, and rejects when the store still lists others after five rounds of
+     * deletes.
+     */
     revokeAll(userId: string, { except }?: {
         except?: string;
     }): Promise<void>;

package/dist/session/session.service.js

@@ -20,6 +20,12 @@ import { durationOr, hasExpired } from '../utils/duration.util.js';
 import { AuthenticationEvents } from '../events/authentication-events.service.js';
 import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { assertCookieAttributes, defaultCookieName, readCookie, serializeCookie } from './cookies.util.js';
+/**
+ * The rounds of deletes `revokeAll()` makes before it gives up. A round past the first takes a
+ * rotation that won during the one before; more than a few take a store that keeps listing what it
+ * deleted.
+ */
+const REVOKE_ROUNDS = 5;
 /**
  * Server-side sessions: opaque 256-bit tokens in an `HttpOnly` cookie,
  * stored by their SHA-256.
@@ -109,15 +115,17 @@ let SessionService = SessionService_1 = class SessionService {
      * `absoluteTtl` from its creation, in place of its `mfa.pendingTtl`.
      * Resolves `null` when the session was gone by the time it was replaced:
      * revoked (a sign-out everywhere, a password reset) or rotated by another
-     * request, which leaves no new session behind. The session's `extra` is
-     * not carried over.
+     * request, which leaves no new session behind. A rotation that wins while
+     * `revokeAll()` is under way still resolves its new session, which that
+     * `revokeAll()` then ends. The session's `extra` is not carried over.
      */
     async rotate(session, changes = {}) {
         const { id: _, extra: _extra, ...rest } = session;
         const verifying = session.mfa === 'pending' && changes.mfa === 'verified';
         // The new session first, then the old one, which must still be there to delete: if a revocation
         // took it meanwhile (deleting the user's sessions, this new one included, or not yet), or another
-        // rotation did, this one lost, and its new session must not outlive the old.
+        // rotation did, this one lost, and its new session must not outlive the old. A revocation still
+        // under way when this one wins reads the user's sessions back, and ends the new one.
         const issued = await this.issue({
             ...rest,
             ...changes,
@@ -144,15 +152,44 @@ let SessionService = SessionService_1 = class SessionService {
         this.events.emit({ type: 'sign-out', userId, sessionId: record.id });
         return true;
     }
-    /** Ends every session of a user, optionally keeping one (`except`: its id). */
+    /**
+     * Ends every session of a user, optionally keeping one (`except`: its id).
+     * Resolves once a read of the user's sessions finds none left but the kept
+     * one, and rejects when the store still lists others after five rounds of
+     * deletes.
+     */
     async revokeAll(userId, { except } = {}) {
         const store = this.storage.sessions;
-        if (!except) {
-            return store.deleteUserSessions(userId);
+        const others = async () => (await store.listUserSessions(userId)).filter((session) => session.id !== except);
+        // A rotation writes its new session, then deletes the old one. One that does both while the
+        // delete below is under way wins (the old session was still there), and the delete can miss its
+        // new session: a list read before it was written, or one `DELETE … WHERE user_id = ?` at
+        // PostgreSQL's Read Committed, whose snapshot predates the new row and which skips the old one
+        // the rotation deleted meanwhile. That `DELETE` removes nothing, so its row count can't tell.
+        // Instead, a statement of its own reads the sessions back, and the deletes repeat until it finds
+        // none. A read that finds none has seen every rotation that won against this revocation: each
+        // wrote its new session before it deleted the old one, which was gone by the time of that read.
+        let left = except ? await others() : [];
+        if (except && left.length === 0) {
+            return;
         }
-        for (const session of await store.listUserSessions(userId)) {
-            if (session.id !== except) {
-                await store.deleteSession(session.id);
+        for (let round = 1;; round++) {
+            if (except) {
+                for (const session of left) {
+                    await store.deleteSession(session.id);
+                }
+            }
+            else {
+                await store.deleteUserSessions(userId);
+            }
+            left = await others();
+            if (left.length === 0) {
+                return;
+            }
+            if (round === REVOKE_ROUNDS) {
+                throw new Error(`SessionService.revokeAll(): ${left.length} ${left.length === 1 ? 'session' : 'sessions'} of user ${userId} ` +
+                    `still listed after ${REVOKE_ROUNDS} rounds of deletes. listUserSessions() must read what was just deleted ` +
+                    '(the primary, not a replica that lags), and deleteUserSessions() must delete every session of the user.');
             }
         }
     }

package/package.json

@@ -1,7 +1,22 @@
 {
   "name": "@nestjs/authentication",
-  "version": "0.1.4",
-  "description": "Nest - modern, fast, powerful node.js web framework (@authentication)",
+  "version": "0.1.5",
+  "description": "Authentication for NestJS: sign-in with passwords, Google and magic links, server-side sessions, JWT bearer tokens, two-factor and API keys.",
+  "keywords": [
+    "nestjs",
+    "nest",
+    "authentication",
+    "auth",
+    "login",
+    "sign-in",
+    "session",
+    "jwt",
+    "oauth",
+    "magic-link",
+    "two-factor",
+    "2fa",
+    "api-keys"
+  ],
   "author": "Kamil Mysliwiec",
   "license": "MIT",
   "url": "https://github.com/nestjs/authentication#readme",
@@ -46,7 +61,7 @@
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-socket": "0.2.11",
     "@nestjs/apollo": "14.0.1",
-    "@nestjs/authorization": "0.1.1",
+    "@nestjs/authorization": "0.1.2",
     "@nestjs/common": "12.3.3",
     "@nestjs/core": "12.3.3",
     "@nestjs/drizzle": "0.0.2",
@@ -78,7 +93,7 @@
     "supertest": "7.3.1",
     "typeorm": "1.1.2",
     "typescript": "7.0.2",
-    "vite": "8.3.5",
+    "vite": "8.3.6",
     "vitest": "5.1.0",
     "ws": "8.22.1"
   },