@syncello/auth 3.2.1 → 3.3.0

package/dist/index.cjs

@@ -644,6 +644,9 @@ async function hashToken(token) {
 // src/core/config.ts
 var AUTH_DEFAULTS = {
   SESSION_TTL_DAYS: 7,
+  // Absolute cap: a session dies this long after creation regardless of
+  // sliding-window activity (limits the value of a stolen session token).
+  SESSION_MAX_LIFETIME_DAYS: 30,
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
@@ -676,7 +679,7 @@ async function createSession(db, tables2, userId, fingerprint, ipAddress, sessio
   });
   return sessionId;
 }
-async function validateSession(db, tables2, sessionId, currentFingerprint) {
+async function validateSession(db, tables2, sessionId, currentFingerprint, sessionMaxLifetimeMs = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3) {
   const { sessions, users } = tables2;
   logger_default.debug("Validating session", {
     sessionId: sessionId?.slice(0, 8),
@@ -703,6 +706,17 @@ async function validateSession(db, tables2, sessionId, currentFingerprint) {
     return null;
   }
   const row = result[0];
+  if (Date.now() - row.sessionCreatedAt > sessionMaxLifetimeMs) {
+    logger_default.info("Session exceeded absolute lifetime - revoked", {
+      type: "security",
+      event: "session_max_lifetime_exceeded",
+      severity: "low",
+      sessionId: sessionId.slice(0, 8),
+      userId: row.userId
+    });
+    await deleteSession(db, { sessions }, sessionId);
+    return null;
+  }
   if (currentFingerprint && row.sessionFingerprint && row.sessionFingerprint !== currentFingerprint) {
     logger_default.info("Session fingerprint mismatch - likely SSR request", {
       type: "security",
@@ -981,8 +995,7 @@ function getSessionCookieName(env) {
   return COOKIE_NAMES[environment] || COOKIE_NAMES.development;
 }
 function isProduction(env) {
-  const environment = env?.ENVIRONMENT;
-  return environment === "production" || environment === "staging";
+  return env?.ENVIRONMENT !== "development";
 }
 function getCookieSecurityFlags(env) {
   if (isProduction(env)) {
@@ -2627,7 +2640,7 @@ var CloudflareEmailAdapter = class {
         logger_default.error("Cloudflare send error", {
           provider: this.providerName,
           error: errorText,
-          rawError: error,
+          errorName: error instanceof Error ? error.name : typeof error,
           to: options.to,
           subject: options.subject
         });