@syncello/auth 3.2.1 → 3.3.1

package/dist/index.d.cts

@@ -108,9 +108,10 @@ declare function createSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'ses
  * @param tables - Session tables (sessions, users)
  * @param sessionId - Session ID from cookie
  * @param currentFingerprint - Current browser fingerprint (optional)
+ * @param sessionMaxLifetimeMs - Absolute session lifetime cap in milliseconds (optional)
  * @returns Session data or null if invalid
  */
-declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string): Promise<SessionData | null>;
+declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string, sessionMaxLifetimeMs?: number): Promise<SessionData | null>;
 /**
  * Refresh session expiration (sliding window)
  * @param db - Drizzle database instance
@@ -161,6 +162,7 @@ declare function hashToken(token: string): Promise<string>;
  */
 declare const AUTH_DEFAULTS: {
     readonly SESSION_TTL_DAYS: 7;
+    readonly SESSION_MAX_LIFETIME_DAYS: 30;
     readonly LOCKOUT_DURATION_MINUTES: 30;
     readonly LOCKOUT_MAX_ATTEMPTS: 5;
     readonly PASSWORD_RESET_TTL_MINUTES: 15;

package/dist/index.d.ts

@@ -108,9 +108,10 @@ declare function createSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'ses
  * @param tables - Session tables (sessions, users)
  * @param sessionId - Session ID from cookie
  * @param currentFingerprint - Current browser fingerprint (optional)
+ * @param sessionMaxLifetimeMs - Absolute session lifetime cap in milliseconds (optional)
  * @returns Session data or null if invalid
  */
-declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string): Promise<SessionData | null>;
+declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string, sessionMaxLifetimeMs?: number): Promise<SessionData | null>;
 /**
  * Refresh session expiration (sliding window)
  * @param db - Drizzle database instance
@@ -161,6 +162,7 @@ declare function hashToken(token: string): Promise<string>;
  */
 declare const AUTH_DEFAULTS: {
     readonly SESSION_TTL_DAYS: 7;
+    readonly SESSION_MAX_LIFETIME_DAYS: 30;
     readonly LOCKOUT_DURATION_MINUTES: 30;
     readonly LOCKOUT_MAX_ATTEMPTS: 5;
     readonly PASSWORD_RESET_TTL_MINUTES: 15;

package/dist/index.js

@@ -252,6 +252,9 @@ async function hashToken(token) {
 // src/core/config.ts
 var AUTH_DEFAULTS = {
   SESSION_TTL_DAYS: 7,
+  // Absolute cap: a session dies this long after creation regardless of
+  // sliding-window activity (limits the value of a stolen session token).
+  SESSION_MAX_LIFETIME_DAYS: 30,
   LOCKOUT_DURATION_MINUTES: 30,
   LOCKOUT_MAX_ATTEMPTS: 5,
   PASSWORD_RESET_TTL_MINUTES: 15,
@@ -284,7 +287,7 @@ async function createSession(db, tables2, userId, fingerprint, ipAddress, sessio
   });
   return sessionId;
 }
-async function validateSession(db, tables2, sessionId, currentFingerprint) {
+async function validateSession(db, tables2, sessionId, currentFingerprint, sessionMaxLifetimeMs = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3) {
   const { sessions, users } = tables2;
   logger_default.debug("Validating session", {
     sessionId: sessionId?.slice(0, 8),
@@ -311,6 +314,17 @@ async function validateSession(db, tables2, sessionId, currentFingerprint) {
     return null;
   }
   const row = result[0];
+  if (Date.now() - row.sessionCreatedAt > sessionMaxLifetimeMs) {
+    logger_default.info("Session exceeded absolute lifetime - revoked", {
+      type: "security",
+      event: "session_max_lifetime_exceeded",
+      severity: "low",
+      sessionId: sessionId.slice(0, 8),
+      userId: row.userId
+    });
+    await deleteSession(db, { sessions }, sessionId);
+    return null;
+  }
   if (currentFingerprint && row.sessionFingerprint && row.sessionFingerprint !== currentFingerprint) {
     logger_default.info("Session fingerprint mismatch - likely SSR request", {
       type: "security",
@@ -589,8 +603,7 @@ function getSessionCookieName(env) {
   return COOKIE_NAMES[environment] || COOKIE_NAMES.development;
 }
 function isProduction(env) {
-  const environment = env?.ENVIRONMENT;
-  return environment === "production" || environment === "staging";
+  return env?.ENVIRONMENT !== "development";
 }
 function getCookieSecurityFlags(env) {
   if (isProduction(env)) {
@@ -1177,6 +1190,19 @@ var problems = {
 };
 
 // src/middleware/auth.ts
+var SESSION_MAX_LIFETIME_MS = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3;
+async function revokeIfPastMaxLifetime(db, sessions, sessionId, session) {
+  if (Date.now() - session.createdAt <= SESSION_MAX_LIFETIME_MS) return false;
+  logger_default.info("Session exceeded absolute lifetime - revoked", {
+    type: "security",
+    event: "session_max_lifetime_exceeded",
+    severity: "low",
+    sessionId: sessionId.slice(0, 8),
+    userId: session.userId
+  });
+  await deleteSession(db, { sessions }, sessionId);
+  return true;
+}
 async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
   const cookieName = getSessionCookieName(env);
   const cookiePattern = new RegExp(`${cookieName}=([^;]+)`);
@@ -1186,10 +1212,13 @@ async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
   const foundSessions = await db.select({
     userId: sessions.userId,
     expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt,
     fingerprint: sessions.fingerprint
   }).from(sessions).where(and2(eq4(sessions.id, sessionId), gt2(sessions.expiresAt, Date.now()))).limit(1);
   if (foundSessions.length === 0) return null;
   const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
+  await refreshSession(db, { sessions }, sessionId);
   const userAgent = request.headers.get("user-agent") || "";
   const cfWorker = request.headers.get("cf-worker") || "";
   const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || "";
@@ -1233,10 +1262,12 @@ async function getSessionFromBearerToken(db, sessions, authHeader) {
   const sessionId = authHeader.slice(7);
   const foundSessions = await db.select({
     userId: sessions.userId,
-    expiresAt: sessions.expiresAt
+    expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt
   }).from(sessions).where(and2(eq4(sessions.id, sessionId), gt2(sessions.expiresAt, Date.now()))).limit(1);
   if (foundSessions.length === 0) return null;
   const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
   await refreshSession(db, { sessions }, sessionId);
   return {
     userId: session.userId,
@@ -2235,7 +2266,7 @@ var CloudflareEmailAdapter = class {
         logger_default.error("Cloudflare send error", {
           provider: this.providerName,
           error: errorText,
-          rawError: error,
+          errorName: error instanceof Error ? error.name : typeof error,
           to: options.to,
           subject: options.subject
         });
@@ -4399,10 +4430,10 @@ var statusRoute = createRoute16({
       content: { "application/json": { schema: statusResponseSchema } },
       headers: {
         "Cache-Control": {
-          description: "Cache for 24 hours",
+          description: "Cache for 60 seconds",
           schema: {
             type: "string",
-            example: "private, max-age=86400, stale-while-revalidate=3600"
+            example: "private, max-age=60"
           }
         }
       }
@@ -4419,7 +4450,7 @@ var statusHandler = async (c) => {
   const { db, schema } = getAuthContext(c);
   const methods = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   const backupCodes = await db.select({ id: schema.userBackupCodes.id }).from(schema.userBackupCodes).where(and7(eq19(schema.userBackupCodes.userId, userId), isNull2(schema.userBackupCodes.usedAt)));
-  c.header("Cache-Control", "private, max-age=86400, stale-while-revalidate=3600");
+  c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({
     enabled: methods.length > 0,
@@ -4910,10 +4941,10 @@ var trustedDevicesGetRoute = createRoute24({
       content: { "application/json": { schema: trustedDevicesResponseSchema } },
       headers: {
         "Cache-Control": {
-          description: "Cache for 24 hours",
+          description: "Cache for 60 seconds",
           schema: {
             type: "string",
-            example: "private, max-age=86400, stale-while-revalidate=3600"
+            example: "private, max-age=60"
           }
         }
       }
@@ -4937,7 +4968,7 @@ var trustedDevicesGetHandler = async (c) => {
     lastUsedAt: schema.userTrustedDevices.lastUsedAt,
     createdAt: schema.userTrustedDevices.createdAt
   }).from(schema.userTrustedDevices).where(and13(eq27(schema.userTrustedDevices.userId, userId), gt5(schema.userTrustedDevices.expiresAt, now)));
-  c.header("Cache-Control", "private, max-age=86400, stale-while-revalidate=3600");
+  c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({ devices });
 };