@payez/next-mvp 4.8.1 → 4.8.3

package/src/api-handlers/admin/sessions.ts

@@ -1,327 +1,341 @@
-/**
- * Admin Sessions API Handler
- *
- * Provides admin-level access to login sessions using service account credentials.
- * Used by SessionsTab component.
- *
- * @version 1.0
- * @requires Admin role (vibe_app_admin or payez_admin)
- */
-
-import { NextRequest, NextResponse } from 'next/server';
-import { getSession } from '../../server/auth';
-import { getStartupIDPConfig } from '../../lib/startup-init';
-import { resolveClientKey } from '../../lib/client-key';
-import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
-import { randomUUID } from 'crypto';
-
-interface VibeRequestOptions {
-  method: 'GET' | 'POST' | 'PUT' | 'DELETE';
-  body?: unknown;
-}
-
-/**
- * Check if the current user has admin role
- */
-async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean; userId?: number; error?: NextResponse }> {
-  const session = await getSession(request) as any;
-
-  if (!session?.user) {
-    return {
-      isAdmin: false,
-      error: NextResponse.json(
-        { success: false, error: 'Please sign in' },
-        { status: 401 }
-      ),
-    };
-  }
-
-  const userRoles = (session.user?.roles as string[]) || [];
-  const hasAdminRole = ADMIN_ROLES.some(role => userRoles.includes(role));
-
-  if (!hasAdminRole) {
-    return {
-      isAdmin: false,
-      error: NextResponse.json(
-        { success: false, error: 'Admin access required' },
-        { status: 403 }
-      ),
-    };
-  }
-
-  return { isAdmin: true, userId: session.user?.id };
-}
-
-/**
- * Make a service account request to Vibe (admin mode)
- */
-async function vibeServiceRequest<T = unknown>(
-  endpoint: string,
-  options: VibeRequestOptions
-): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
-  // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
-  // exception text. Failures return a fixed message + correlationId; the same id is on the
-  // server log line, which carries status + bodyLength only (PAY-1424).
-  const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
-  const clientId = process.env.VIBE_CLIENT_ID;
-  const signingKey = process.env.VIBE_HMAC_KEY;
-
-  if (!idpUrl || !clientId || !signingKey) {
-    return { ok: false, status: 500, data: null, error: 'Vibe not configured' };
-  }
-
-  const timestamp = Math.floor(Date.now() / 1000);
-  const stringToSign = `${timestamp}|${options.method}|${endpoint}`;
-
-  const crypto = await import('crypto');
-  const signature = crypto
-    .createHmac('sha256', Buffer.from(signingKey, 'base64'))
-    .update(stringToSign)
-    .digest('base64');
-
-  const proxyUrl = `${idpUrl}/api/vibe/proxy`;
-
-  // Get the client slug from startup config for multi-client admin support
-  const idpConfig = getStartupIDPConfig();
-  const idpClientId = resolveClientKey(idpConfig, 'admin/sessions').key;
-
-  try {
-    const res = await fetch(proxyUrl, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'X-Vibe-Client-Id': clientId,
-        'X-Vibe-Timestamp': String(timestamp),
-        'X-Vibe-Signature': signature,
-        ...(idpClientId && { 'X-Client-Id': idpClientId }),
-      },
-      body: JSON.stringify({
-        endpoint,
-        method: options.method,
-        data: options.body ?? null,
-      }),
-      cache: 'no-store',
-    });
-
-    if (res.status === 204) {
-      return { ok: true, status: 204, data: null };
-    }
-
-    if (!res.ok) {
-      const errorText = await res.text();
-      const correlationId = randomUUID();
-      console.error(`[admin/sessions] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
-      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
-    }
-
-    const body = await res.json();
-    return { ok: true, status: res.status, data: body };
-  } catch (error) {
-    const correlationId = randomUUID();
-    console.error(`[admin/sessions] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
-    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
-  }
-}
-
-// Country code to flag emoji mapping
-function getCountryFlag(countryCode: string): string {
-  if (!countryCode || countryCode.length !== 2) return '';
-  const codePoints = countryCode
-    .toUpperCase()
-    .split('')
-    .map(char => 127397 + char.charCodeAt(0));
-  return String.fromCodePoint(...codePoints);
-}
-
-export interface AdminSessionsHandlerConfig {
-}
-
-/**
- * GET /api/admin/sessions - List sessions
- * POST /api/admin/sessions - Stats, revoke actions
- */
-export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
-  return {
-    async GET(request: NextRequest) {
-      const adminCheck = await checkAdminRole(request);
-      if (adminCheck.error) return adminCheck.error;
-
-      const { searchParams } = new URL(request.url);
-      const status = searchParams.get('status');
-      const email = searchParams.get('email');
-
-      // Build query for login_sessions table
-      const queryBody: any = {
-        page: 1,
-        pageSize: 100,
-        orderBy: 'created_at',
-        orderDirection: 'desc',
-      };
-
-      // Build filter conditions
-      const conditions: any[] = [];
-      if (status && status !== 'all') {
-        conditions.push({ field: 'status', operator: 'eq', value: status });
-      }
-      if (email) {
-        conditions.push({ field: 'email', operator: 'like', value: `%${email}%` });
-      }
-
-      if (conditions.length === 1) {
-        queryBody.filter = conditions[0];
-      } else if (conditions.length > 1) {
-        queryBody.filter = { operator: 'and', conditions };
-      }
-
-      const result = await vibeServiceRequest<any>(
-        '/v1/collections/vibe_app/tables/login_sessions/query',
-        { method: 'POST', body: queryBody }
-      );
-
-      if (!result.ok) {
-        return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
-      }
-
-      // Extract sessions from response
-      const rawSessions = result.data?.data || result.data?.documents || [];
-      const sessions = rawSessions.map((s: any) => ({
-        id: s.id || s.document_id,
-        idp_user_id: s.idp_user_id || s.user_id,
-        email: s.email || '',
-        name: s.name || s.display_name || '',
-        status: s.status || 'active',
-        ip_address: s.ip_address || s.ip,
-        city: s.city,
-        region: s.region,
-        country_code: s.country_code || s.country,
-        device_type: s.device_type || s.device,
-        browser: s.browser,
-        os: s.os,
-        created_at: s.created_at,
-        last_activity: s.last_activity || s.updated_at,
-        revoked_at: s.revoked_at,
-        revoked_by: s.revoked_by,
-        country_flag: getCountryFlag(s.country_code || s.country || ''),
-      }));
-
-      return NextResponse.json({ sessions });
-    },
-
-    async POST(request: NextRequest) {
-      const adminCheck = await checkAdminRole(request);
-      if (adminCheck.error) return adminCheck.error;
-
-      const body = await request.json();
-      const { action, sessionId, userId } = body;
-
-      if (action === 'stats') {
-        // Get all sessions for stats calculation
-        const result = await vibeServiceRequest<any>(
-          '/v1/collections/vibe_app/tables/login_sessions/query',
-          { method: 'POST', body: { page: 1, pageSize: 1000 } }
-        );
-
-        if (!result.ok) {
-          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
-        }
-
-        const sessions = result.data?.data || result.data?.documents || [];
-
-        // Calculate stats
-        const now = new Date();
-        const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000);
-
-        const stats = {
-          totalActive: sessions.filter((s: any) => s.status === 'active').length,
-          totalRevoked: sessions.filter((s: any) => s.status === 'revoked').length,
-          uniqueUsers: new Set(sessions.map((s: any) => s.idp_user_id || s.user_id)).size,
-          recentLogins: sessions.filter((s: any) => new Date(s.created_at) > oneDayAgo).length,
-          byCountryWithFlags: {} as Record<string, { count: number; flag: string }>,
-          byDevice: {} as Record<string, number>,
-        };
-
-        // Count by country
-        sessions.forEach((s: any) => {
-          const country = s.country_code || s.country || 'Unknown';
-          if (!stats.byCountryWithFlags[country]) {
-            stats.byCountryWithFlags[country] = { count: 0, flag: getCountryFlag(country) };
-          }
-          stats.byCountryWithFlags[country].count++;
-
-          const device = s.device_type || s.device || 'Unknown';
-          stats.byDevice[device] = (stats.byDevice[device] || 0) + 1;
-        });
-
-        return NextResponse.json({ stats });
-      }
-
-      if (action === 'revoke' && sessionId) {
-        // Revoke single session
-        const result = await vibeServiceRequest<any>(
-          `/v1/collections/vibe_app/tables/login_sessions/${sessionId}`,
-          {
-            method: 'PUT',
-            body: {
-              status: 'revoked',
-              revoked_at: new Date().toISOString(),
-              revoked_by: `admin:${adminCheck.userId}`,
-            },
-          }
-        );
-
-        if (!result.ok) {
-          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
-        }
-
-        return NextResponse.json({ success: true });
-      }
-
-      if (action === 'revoke_all' && userId) {
-        // Get all active sessions for user
-        const queryResult = await vibeServiceRequest<any>(
-          '/v1/collections/vibe_app/tables/login_sessions/query',
-          {
-            method: 'POST',
-            body: {
-              filter: {
-                operator: 'and',
-                conditions: [
-                  { field: 'idp_user_id', operator: 'eq', value: userId },
-                  { field: 'status', operator: 'eq', value: 'active' },
-                ],
-              },
-            },
-          }
-        );
-
-        if (!queryResult.ok) {
-          return NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
-        }
-
-        const sessions = queryResult.data?.data || queryResult.data?.documents || [];
-        let revokedCount = 0;
-
-        // Revoke each session
-        for (const session of sessions) {
-          const id = session.id || session.document_id;
-          const result = await vibeServiceRequest<any>(
-            `/v1/collections/vibe_app/tables/login_sessions/${id}`,
-            {
-              method: 'PUT',
-              body: {
-                status: 'revoked',
-                revoked_at: new Date().toISOString(),
-                revoked_by: `admin:${adminCheck.userId}`,
-              },
-            }
-          );
-          if (result.ok) revokedCount++;
-        }
-
-        return NextResponse.json({ success: true, revokedCount });
-      }
-
-      return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
-    },
-  };
-}
+/**
+ * Admin Sessions API Handler
+ *
+ * Provides admin-level access to login sessions using service account credentials.
+ * Used by SessionsTab component.
+ *
+ * @version 1.0
+ * @requires Admin role (vibe_app_admin or payez_admin)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getSession } from '../../server/auth';
+import { getStartupIDPConfig } from '../../lib/startup-init';
+import { resolveClientKey } from '../../lib/client-key';
+import { ADMIN_ROLES, hasAnyRole } from '../../lib/roles';
+import { randomUUID } from 'crypto';
+import { allOf, contains, eq, orderByMap } from '../../vibe/filters';
+
+interface VibeRequestOptions {
+  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+  body?: unknown;
+}
+
+/**
+ * Check if the current user has admin role
+ */
+async function checkAdminRole(request: NextRequest): Promise<{ isAdmin: boolean; userId?: number; error?: NextResponse }> {
+  const session = await getSession(request) as any;
+
+  if (!session?.user) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: 'Please sign in' },
+        { status: 401 }
+      ),
+    };
+  }
+
+  const userRoles = (session.user?.roles as string[]) || [];
+  const hasAdminRole = ADMIN_ROLES.some(role => userRoles.includes(role));
+
+  if (!hasAdminRole) {
+    return {
+      isAdmin: false,
+      error: NextResponse.json(
+        { success: false, error: 'Admin access required' },
+        { status: 403 }
+      ),
+    };
+  }
+
+  return { isAdmin: true, userId: session.user?.id };
+}
+
+/**
+ * Make a service account request to Vibe (admin mode)
+ */
+async function vibeServiceRequest<T = unknown>(
+  endpoint: string,
+  options: VibeRequestOptions
+): Promise<{ ok: boolean; status: number; data: T | null; error?: string; correlationId?: string }> {
+  // PAY-1429: `error` can reach the HTTP caller, so it never carries upstream Vibe text or
+  // exception text. Failures return a fixed message + correlationId; the same id is on the
+  // server log line, which carries status + bodyLength only (PAY-1424).
+  const idpUrl = process.env.NEXT_PUBLIC_IDP_URL || process.env.IDP_URL;
+  const clientId = process.env.VIBE_CLIENT_ID;
+  const signingKey = process.env.VIBE_HMAC_KEY;
+
+  if (!idpUrl || !clientId || !signingKey) {
+    return { ok: false, status: 500, data: null, error: 'Vibe not configured' };
+  }
+
+  const timestamp = Math.floor(Date.now() / 1000);
+  const stringToSign = `${timestamp}|${options.method}|${endpoint}`;
+
+  const crypto = await import('crypto');
+  const signature = crypto
+    .createHmac('sha256', Buffer.from(signingKey, 'base64'))
+    .update(stringToSign)
+    .digest('base64');
+
+  const proxyUrl = `${idpUrl}/api/vibe/proxy`;
+
+  // Get the client slug from startup config for multi-client admin support
+  const idpConfig = getStartupIDPConfig();
+  const idpClientId = resolveClientKey(idpConfig, 'admin/sessions').key;
+
+  try {
+    const res = await fetch(proxyUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Vibe-Client-Id': clientId,
+        'X-Vibe-Timestamp': String(timestamp),
+        'X-Vibe-Signature': signature,
+        ...(idpClientId && { 'X-Client-Id': idpClientId }),
+      },
+      body: JSON.stringify({
+        endpoint,
+        method: options.method,
+        data: options.body ?? null,
+      }),
+      cache: 'no-store',
+    });
+
+    if (res.status === 204) {
+      return { ok: true, status: 204, data: null };
+    }
+
+    if (!res.ok) {
+      const errorText = await res.text();
+      const correlationId = randomUUID();
+      console.error(`[admin/sessions] Vibe request failed: ${options.method} ${endpoint} - ${res.status}`, { correlationId, bodyLength: errorText.length });
+      return { ok: false, status: res.status, data: null, error: `Vibe request failed (HTTP ${res.status})`, correlationId };
+    }
+
+    const body = await res.json();
+    return { ok: true, status: res.status, data: body };
+  } catch (error) {
+    const correlationId = randomUUID();
+    console.error(`[admin/sessions] Vibe request exception: ${options.method} ${endpoint}`, { correlationId, error });
+    return { ok: false, status: 0, data: null, error: 'Vibe request could not be completed', correlationId };
+  }
+}
+
+// Country code to flag emoji mapping
+function getCountryFlag(countryCode: string): string {
+  if (!countryCode || countryCode.length !== 2) return '';
+  const codePoints = countryCode
+    .toUpperCase()
+    .split('')
+    .map(char => 127397 + char.charCodeAt(0));
+  return String.fromCodePoint(...codePoints);
+}
+
+export interface AdminSessionsHandlerConfig {
+}
+
+/**
+ * GET /api/admin/sessions - List sessions
+ * POST /api/admin/sessions - Stats, revoke actions
+ */
+export function createSessionsHandler(config: AdminSessionsHandlerConfig) {
+  return {
+    async GET(request: NextRequest) {
+      const adminCheck = await checkAdminRole(request);
+      if (adminCheck.error) return adminCheck.error;
+
+      const { searchParams } = new URL(request.url);
+      const status = searchParams.get('status');
+      const email = searchParams.get('email');
+
+      // Build query for login_sessions table
+      const queryBody: any = {
+        page: 1,
+        pageSize: 100,
+        // PAY-1810: orderBy is a { field: dir } map; a bare string is rejected or ignored by Core.
+        orderBy: orderByMap('created_at', 'desc'),
+      };
+
+      // PAY-1810: Core filter forms only (vibe/filters.ts): compound uses `filters`, and substring is `contains` (`like` is not a Core
+      // operator and a flat unknown operator is DROPPED, which returned every session).
+      const filter = allOf([
+        status && status !== 'all' ? eq('status', status) : null,
+        email ? contains('email', email) : null,
+      ]);
+      if (filter) queryBody.filter = filter;
+
+      const result = await vibeServiceRequest<any>(
+        '/v1/collections/vibe_app/tables/login_sessions/query',
+        { method: 'POST', body: queryBody }
+      );
+
+      if (!result.ok) {
+        return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
+      }
+
+      // Extract sessions from response
+      const rawSessions = result.data?.data || result.data?.documents || [];
+      const sessions = rawSessions.map((s: any) => ({
+        id: s.id || s.document_id,
+        idp_user_id: s.idp_user_id || s.user_id,
+        email: s.email || '',
+        name: s.name || s.display_name || '',
+        status: s.status || 'active',
+        ip_address: s.ip_address || s.ip,
+        city: s.city,
+        region: s.region,
+        country_code: s.country_code || s.country,
+        device_type: s.device_type || s.device,
+        browser: s.browser,
+        os: s.os,
+        created_at: s.created_at,
+        last_activity: s.last_activity || s.updated_at,
+        revoked_at: s.revoked_at,
+        revoked_by: s.revoked_by,
+        country_flag: getCountryFlag(s.country_code || s.country || ''),
+      }));
+
+      return NextResponse.json({ sessions });
+    },
+
+    async POST(request: NextRequest) {
+      const adminCheck = await checkAdminRole(request);
+      if (adminCheck.error) return adminCheck.error;
+
+      const body = await request.json();
+      const { action, sessionId, userId } = body;
+
+      if (action === 'stats') {
+        // Get all sessions for stats calculation
+        const result = await vibeServiceRequest<any>(
+          '/v1/collections/vibe_app/tables/login_sessions/query',
+          { method: 'POST', body: { page: 1, pageSize: 1000 } }
+        );
+
+        if (!result.ok) {
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
+        }
+
+        const sessions = result.data?.data || result.data?.documents || [];
+
+        // Calculate stats
+        const now = new Date();
+        const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000);
+
+        const stats = {
+          totalActive: sessions.filter((s: any) => s.status === 'active').length,
+          totalRevoked: sessions.filter((s: any) => s.status === 'revoked').length,
+          uniqueUsers: new Set(sessions.map((s: any) => s.idp_user_id || s.user_id)).size,
+          recentLogins: sessions.filter((s: any) => new Date(s.created_at) > oneDayAgo).length,
+          byCountryWithFlags: {} as Record<string, { count: number; flag: string }>,
+          byDevice: {} as Record<string, number>,
+        };
+
+        // Count by country
+        sessions.forEach((s: any) => {
+          const country = s.country_code || s.country || 'Unknown';
+          if (!stats.byCountryWithFlags[country]) {
+            stats.byCountryWithFlags[country] = { count: 0, flag: getCountryFlag(country) };
+          }
+          stats.byCountryWithFlags[country].count++;
+
+          const device = s.device_type || s.device || 'Unknown';
+          stats.byDevice[device] = (stats.byDevice[device] || 0) + 1;
+        });
+
+        return NextResponse.json({ stats });
+      }
+
+      if (action === 'revoke' && sessionId) {
+        // Revoke single session
+        const result = await vibeServiceRequest<any>(
+          `/v1/collections/vibe_app/tables/login_sessions/${sessionId}`,
+          {
+            // PAY-1810 (NightHawk 75394): PATCH, not PUT. A PUT to a Vibe document REPLACES it (Core UpdateAsync SET data = body), so this 3-field body
+            // erased idp_user_id / session_token_hash / the rest of the row: the revoked row then vanished from the revocation check and the user list.
+            method: 'PATCH',
+            body: {
+              status: 'revoked',
+              revoked_at: new Date().toISOString(),
+              revoked_by: `admin:${adminCheck.userId}`,
+            },
+          }
+        );
+
+        if (!result.ok) {
+          return NextResponse.json({ error: result.error, code: 'UPSTREAM_ERROR', correlationId: result.correlationId }, { status: result.status || 500 });
+        }
+
+        return NextResponse.json({ success: true });
+      }
+
+      if (action === 'revoke_all' && userId) {
+        // PAY-1810: one /query call returns ONE page (Core's default page size is 20), so a user with more active sessions than a page would keep
+        // the rest signed in. Revoked sessions leave the `status = active` filter, so re-reading page 1 walks the whole set. It stops when a read
+        // is empty (complete), when a round revokes nothing (no progress: never loops on a failing write), or after REVOKE_ALL_MAX_ROUNDS.
+        const REVOKE_ALL_PAGE_SIZE = 50;
+        const REVOKE_ALL_MAX_ROUNDS = 20;
+        let revokedCount = 0;
+        let complete = false;
+
+        for (let round = 0; round < REVOKE_ALL_MAX_ROUNDS; round++) {
+          const queryResult = await vibeServiceRequest<any>(
+            '/v1/collections/vibe_app/tables/login_sessions/query',
+            {
+              method: 'POST',
+              body: {
+                // PAY-1810: `conditions` is not a Core key (it read zero rows, so revoke_all revoked 0 and answered success); `filters` is.
+                filter: allOf([eq('idp_user_id', userId), eq('status', 'active')]),
+                page: 1,
+                pageSize: REVOKE_ALL_PAGE_SIZE,
+              },
+            }
+          );
+
+          if (!queryResult.ok) {
+            // The first read failing is a plain upstream error (as before). A later one leaves a partial result, reported as incomplete.
+            if (round === 0) {
+              return NextResponse.json({ error: queryResult.error, code: 'UPSTREAM_ERROR', correlationId: queryResult.correlationId }, { status: queryResult.status || 500 });
+            }
+            break;
+          }
+
+          const sessions = queryResult.data?.data || queryResult.data?.documents || [];
+          if (sessions.length === 0) {
+            complete = true;
+            break;
+          }
+
+          let revokedThisRound = 0;
+          for (const session of sessions) {
+            const id = session.id || session.document_id;
+            const result = await vibeServiceRequest<any>(
+              `/v1/collections/vibe_app/tables/login_sessions/${id}`,
+              {
+                method: 'PATCH', // PAY-1810: PATCH merges {status, revoked_at, revoked_by}; PUT would replace the whole row (see the single revoke above)
+                body: {
+                  status: 'revoked',
+                  revoked_at: new Date().toISOString(),
+                  revoked_by: `admin:${adminCheck.userId}`,
+                },
+              }
+            );
+            if (result.ok) {
+              revokedCount++;
+              revokedThisRound++;
+            }
+          }
+          if (revokedThisRound === 0) break;
+        }
+
+        // success only when the whole set was revoked: a sign-out control must not say success when every write failed (Scout 75399).
+        return NextResponse.json({ success: complete, revokedCount, complete });
+      }
+
+      return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
+    },
+  };
+}