@syncello/auth 3.2.1 → 3.3.1

package/dist/index.cjs

@@ -644,6 +644,9 @@ async function hashToken(token) {
 // src/core/config.ts
 var AUTH_DEFAULTS = {
   SESSION_TTL_DAYS: 7,
+  // Absolute cap: a session dies this long after creation regardless of
+  // sliding-window activity (limits the value of a stolen session token).
+  SESSION_MAX_LIFETIME_DAYS: 30,
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
@@ -676,7 +679,7 @@ async function createSession(db, tables2, userId, fingerprint, ipAddress, sessio
   });
   return sessionId;
 }
-async function validateSession(db, tables2, sessionId, currentFingerprint) {
+async function validateSession(db, tables2, sessionId, currentFingerprint, sessionMaxLifetimeMs = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3) {
   const { sessions, users } = tables2;
   logger_default.debug("Validating session", {
     sessionId: sessionId?.slice(0, 8),
@@ -703,6 +706,17 @@ async function validateSession(db, tables2, sessionId, currentFingerprint) {
     return null;
   }
   const row = result[0];
+  if (Date.now() - row.sessionCreatedAt > sessionMaxLifetimeMs) {
+    logger_default.info("Session exceeded absolute lifetime - revoked", {
+      type: "security",
+      event: "session_max_lifetime_exceeded",
+      severity: "low",
+      sessionId: sessionId.slice(0, 8),
+      userId: row.userId
+    });
+    await deleteSession(db, { sessions }, sessionId);
+    return null;
+  }
   if (currentFingerprint && row.sessionFingerprint && row.sessionFingerprint !== currentFingerprint) {
     logger_default.info("Session fingerprint mismatch - likely SSR request", {
       type: "security",
@@ -981,8 +995,7 @@ function getSessionCookieName(env) {
   return COOKIE_NAMES[environment] || COOKIE_NAMES.development;
 }
 function isProduction(env) {
-  const environment = env?.ENVIRONMENT;
-  return environment === "production" || environment === "staging";
+  return env?.ENVIRONMENT !== "development";
 }
 function getCookieSecurityFlags(env) {
   if (isProduction(env)) {
@@ -1569,6 +1582,19 @@ var problems = {
 };
 
 // src/middleware/auth.ts
+var SESSION_MAX_LIFETIME_MS = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3;
+async function revokeIfPastMaxLifetime(db, sessions, sessionId, session) {
+  if (Date.now() - session.createdAt <= SESSION_MAX_LIFETIME_MS) return false;
+  logger_default.info("Session exceeded absolute lifetime - revoked", {
+    type: "security",
+    event: "session_max_lifetime_exceeded",
+    severity: "low",
+    sessionId: sessionId.slice(0, 8),
+    userId: session.userId
+  });
+  await deleteSession(db, { sessions }, sessionId);
+  return true;
+}
 async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
   const cookieName = getSessionCookieName(env);
   const cookiePattern = new RegExp(`${cookieName}=([^;]+)`);
@@ -1578,10 +1604,13 @@ async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
   const foundSessions = await db.select({
     userId: sessions.userId,
     expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt,
     fingerprint: sessions.fingerprint
   }).from(sessions).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(sessions.id, sessionId), (0, import_drizzle_orm4.gt)(sessions.expiresAt, Date.now()))).limit(1);
   if (foundSessions.length === 0) return null;
   const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
+  await refreshSession(db, { sessions }, sessionId);
   const userAgent = request.headers.get("user-agent") || "";
   const cfWorker = request.headers.get("cf-worker") || "";
   const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || "";
@@ -1625,10 +1654,12 @@ async function getSessionFromBearerToken(db, sessions, authHeader) {
   const sessionId = authHeader.slice(7);
   const foundSessions = await db.select({
     userId: sessions.userId,
-    expiresAt: sessions.expiresAt
+    expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt
   }).from(sessions).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(sessions.id, sessionId), (0, import_drizzle_orm4.gt)(sessions.expiresAt, Date.now()))).limit(1);
   if (foundSessions.length === 0) return null;
   const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
   await refreshSession(db, { sessions }, sessionId);
   return {
     userId: session.userId,
@@ -2627,7 +2658,7 @@ var CloudflareEmailAdapter = class {
         logger_default.error("Cloudflare send error", {
           provider: this.providerName,
           error: errorText,
-          rawError: error,
+          errorName: error instanceof Error ? error.name : typeof error,
           to: options.to,
           subject: options.subject
         });
@@ -4791,10 +4822,10 @@ var statusRoute = (0, import_zod_openapi24.createRoute)({
       content: { "application/json": { schema: statusResponseSchema } },
       headers: {
         "Cache-Control": {
-          description: "Cache for 24 hours",
+          description: "Cache for 60 seconds",
           schema: {
             type: "string",
-            example: "private, max-age=86400, stale-while-revalidate=3600"
+            example: "private, max-age=60"
           }
         }
       }
@@ -4811,7 +4842,7 @@ var statusHandler = async (c) => {
   const { db, schema } = getAuthContext(c);
   const methods = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   const backupCodes = await db.select({ id: schema.userBackupCodes.id }).from(schema.userBackupCodes).where((0, import_drizzle_orm20.and)((0, import_drizzle_orm20.eq)(schema.userBackupCodes.userId, userId), (0, import_drizzle_orm20.isNull)(schema.userBackupCodes.usedAt)));
-  c.header("Cache-Control", "private, max-age=86400, stale-while-revalidate=3600");
+  c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({
     enabled: methods.length > 0,
@@ -5302,10 +5333,10 @@ var trustedDevicesGetRoute = (0, import_zod_openapi32.createRoute)({
       content: { "application/json": { schema: trustedDevicesResponseSchema } },
       headers: {
         "Cache-Control": {
-          description: "Cache for 24 hours",
+          description: "Cache for 60 seconds",
           schema: {
             type: "string",
-            example: "private, max-age=86400, stale-while-revalidate=3600"
+            example: "private, max-age=60"
           }
         }
       }
@@ -5329,7 +5360,7 @@ var trustedDevicesGetHandler = async (c) => {
     lastUsedAt: schema.userTrustedDevices.lastUsedAt,
     createdAt: schema.userTrustedDevices.createdAt
   }).from(schema.userTrustedDevices).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(schema.userTrustedDevices.userId, userId), (0, import_drizzle_orm28.gt)(schema.userTrustedDevices.expiresAt, now)));
-  c.header("Cache-Control", "private, max-age=86400, stale-while-revalidate=3600");
+  c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({ devices });
 };