@syncello/auth 3.3.0 → 3.3.1

package/dist/index.js

@@ -1190,6 +1190,19 @@ var problems = {
 };
 
 // src/middleware/auth.ts
+var SESSION_MAX_LIFETIME_MS = AUTH_DEFAULTS.SESSION_MAX_LIFETIME_DAYS * 24 * 60 * 60 * 1e3;
+async function revokeIfPastMaxLifetime(db, sessions, sessionId, session) {
+  if (Date.now() - session.createdAt <= SESSION_MAX_LIFETIME_MS) return false;
+  logger_default.info("Session exceeded absolute lifetime - revoked", {
+    type: "security",
+    event: "session_max_lifetime_exceeded",
+    severity: "low",
+    sessionId: sessionId.slice(0, 8),
+    userId: session.userId
+  });
+  await deleteSession(db, { sessions }, sessionId);
+  return true;
+}
 async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
   const cookieName = getSessionCookieName(env);
   const cookiePattern = new RegExp(`${cookieName}=([^;]+)`);
@@ -1199,10 +1212,13 @@ async function getSessionFromCookie(db, sessions, cookieHeader, request, env) {
   const foundSessions = await db.select({
     userId: sessions.userId,
     expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt,
     fingerprint: sessions.fingerprint
   }).from(sessions).where(and2(eq4(sessions.id, sessionId), gt2(sessions.expiresAt, Date.now()))).limit(1);
   if (foundSessions.length === 0) return null;
   const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
+  await refreshSession(db, { sessions }, sessionId);
   const userAgent = request.headers.get("user-agent") || "";
   const cfWorker = request.headers.get("cf-worker") || "";
   const clientIp = request.headers.get("cf-connecting-ip") || request.headers.get("x-real-ip") || "";
@@ -1246,10 +1262,12 @@ async function getSessionFromBearerToken(db, sessions, authHeader) {
   const sessionId = authHeader.slice(7);
   const foundSessions = await db.select({
     userId: sessions.userId,
-    expiresAt: sessions.expiresAt
+    expiresAt: sessions.expiresAt,
+    createdAt: sessions.createdAt
   }).from(sessions).where(and2(eq4(sessions.id, sessionId), gt2(sessions.expiresAt, Date.now()))).limit(1);
   if (foundSessions.length === 0) return null;
   const session = foundSessions[0];
+  if (await revokeIfPastMaxLifetime(db, sessions, sessionId, session)) return null;
   await refreshSession(db, { sessions }, sessionId);
   return {
     userId: session.userId,
@@ -4412,10 +4430,10 @@ var statusRoute = createRoute16({
       content: { "application/json": { schema: statusResponseSchema } },
       headers: {
         "Cache-Control": {
-          description: "Cache for 24 hours",
+          description: "Cache for 60 seconds",
           schema: {
             type: "string",
-            example: "private, max-age=86400, stale-while-revalidate=3600"
+            example: "private, max-age=60"
           }
         }
       }
@@ -4432,7 +4450,7 @@ var statusHandler = async (c) => {
   const { db, schema } = getAuthContext(c);
   const methods = await getUserEnabled2faMethods(db, userId, schema.user2faMethods);
   const backupCodes = await db.select({ id: schema.userBackupCodes.id }).from(schema.userBackupCodes).where(and7(eq19(schema.userBackupCodes.userId, userId), isNull2(schema.userBackupCodes.usedAt)));
-  c.header("Cache-Control", "private, max-age=86400, stale-while-revalidate=3600");
+  c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({
     enabled: methods.length > 0,
@@ -4923,10 +4941,10 @@ var trustedDevicesGetRoute = createRoute24({
       content: { "application/json": { schema: trustedDevicesResponseSchema } },
       headers: {
         "Cache-Control": {
-          description: "Cache for 24 hours",
+          description: "Cache for 60 seconds",
           schema: {
             type: "string",
-            example: "private, max-age=86400, stale-while-revalidate=3600"
+            example: "private, max-age=60"
           }
         }
       }
@@ -4950,7 +4968,7 @@ var trustedDevicesGetHandler = async (c) => {
     lastUsedAt: schema.userTrustedDevices.lastUsedAt,
     createdAt: schema.userTrustedDevices.createdAt
   }).from(schema.userTrustedDevices).where(and13(eq27(schema.userTrustedDevices.userId, userId), gt5(schema.userTrustedDevices.expiresAt, now)));
-  c.header("Cache-Control", "private, max-age=86400, stale-while-revalidate=3600");
+  c.header("Cache-Control", "private, max-age=60");
   c.header("Vary", "Cookie");
   return c.json({ devices });
 };