@syncello/auth 3.2.0 → 3.3.0

package/dist/index.d.cts

@@ -108,9 +108,10 @@ declare function createSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'ses
  * @param tables - Session tables (sessions, users)
  * @param sessionId - Session ID from cookie
  * @param currentFingerprint - Current browser fingerprint (optional)
+ * @param sessionMaxLifetimeMs - Absolute session lifetime cap in milliseconds (optional)
  * @returns Session data or null if invalid
  */
-declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string): Promise<SessionData | null>;
+declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string, sessionMaxLifetimeMs?: number): Promise<SessionData | null>;
 /**
  * Refresh session expiration (sliding window)
  * @param db - Drizzle database instance
@@ -161,6 +162,7 @@ declare function hashToken(token: string): Promise<string>;
  */
 declare const AUTH_DEFAULTS: {
     readonly SESSION_TTL_DAYS: 7;
+    readonly SESSION_MAX_LIFETIME_DAYS: 30;
     readonly LOCKOUT_DURATION_MINUTES: 30;
     readonly LOCKOUT_MAX_ATTEMPTS: 5;
     readonly PASSWORD_RESET_TTL_MINUTES: 15;

package/dist/index.d.ts

@@ -108,9 +108,10 @@ declare function createSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'ses
  * @param tables - Session tables (sessions, users)
  * @param sessionId - Session ID from cookie
  * @param currentFingerprint - Current browser fingerprint (optional)
+ * @param sessionMaxLifetimeMs - Absolute session lifetime cap in milliseconds (optional)
  * @returns Session data or null if invalid
  */
-declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string): Promise<SessionData | null>;
+declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string, sessionMaxLifetimeMs?: number): Promise<SessionData | null>;
 /**
  * Refresh session expiration (sliding window)
  * @param db - Drizzle database instance
@@ -161,6 +162,7 @@ declare function hashToken(token: string): Promise<string>;
  */
 declare const AUTH_DEFAULTS: {
     readonly SESSION_TTL_DAYS: 7;
+    readonly SESSION_MAX_LIFETIME_DAYS: 30;
     readonly LOCKOUT_DURATION_MINUTES: 30;
     readonly LOCKOUT_MAX_ATTEMPTS: 5;
     readonly PASSWORD_RESET_TTL_MINUTES: 15;

package/dist/index.js

@@ -252,6 +252,9 @@ async function hashToken(token) {
 // src/core/config.ts
 var AUTH_DEFAULTS = {
   SESSION_TTL_DAYS: 7,
+  // Absolute cap: a session dies this long after creation regardless of
+  // sliding-window activity (limits the value of a stolen session token).
+  SESSION_MAX_LIFETIME_DAYS: 30,
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
@@ -284,7 +287,7 @@ async function createSession(db, tables2, userId, fingerprint, ipAddress, sessio
   });
   return sessionId;
 }
-async function validateSession(db, tables2, sessionId, currentFingerprint) {
+async function validateSession(db, tables2, sessionId, currentFingerprint, sessionMaxLifetimeMs = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3) {
   const { sessions, users } = tables2;
   logger_default.debug("Validating session", {
     sessionId: sessionId?.slice(0, 8),
@@ -311,6 +314,17 @@ async function validateSession(db, tables2, sessionId, currentFingerprint) {
     return null;
   }
   const row = result[0];
+  if (Date.now() - row.sessionCreatedAt > sessionMaxLifetimeMs) {
+    logger_default.info("Session exceeded absolute lifetime - revoked", {
+      type: "security",
+      event: "session_max_lifetime_exceeded",
+      severity: "low",
+      sessionId: sessionId.slice(0, 8),
+      userId: row.userId
+    });
+    await deleteSession(db, { sessions }, sessionId);
+    return null;
+  }
   if (currentFingerprint && row.sessionFingerprint && row.sessionFingerprint !== currentFingerprint) {
     logger_default.info("Session fingerprint mismatch - likely SSR request", {
       type: "security",
@@ -589,8 +603,7 @@ function getSessionCookieName(env) {
   return COOKIE_NAMES[environment] || COOKIE_NAMES.development;
 }
 function isProduction(env) {
-  const environment = env?.ENVIRONMENT;
-  return environment === "production" || environment === "staging";
+  return env?.ENVIRONMENT !== "development";
 }
 function getCookieSecurityFlags(env) {
   if (isProduction(env)) {
@@ -2235,6 +2248,7 @@ var CloudflareEmailAdapter = class {
         logger_default.error("Cloudflare send error", {
           provider: this.providerName,
           error: errorText,
+          errorName: error instanceof Error ? error.name : typeof error,
           to: options.to,
           subject: options.subject
         });