@terreno/api 0.13.2 → 0.14.0

package/dist/api.test.js

@@ -88,7 +88,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// biome-ignore-all lint/suspicious/noExplicitAny: test mock typing
+// biome-ignore-all lint/suspicious/noImplicitAnyLet: test mock typing
 var bun_test_1 = require("bun:test");
+var luxon_1 = require("luxon");
 var supertest_1 = __importDefault(require("supertest"));
 var api_1 = require("./api");
 var auth_1 = require("./auth");
@@ -2405,4 +2408,175 @@ var transformers_1 = require("./transformers");
             });
         }); });
     });
+    (0, bun_test_1.describe)("conflict detection (If-Unmodified-Since)", function () {
+        var admin;
+        var _notAdmin;
+        var agent;
+        var spinach;
+        (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                    case 1:
+                        _a = __read.apply(void 0, [_b.sent(), 2]), admin = _a[0], _notAdmin = _a[1];
+                        return [4 /*yield*/, tests_1.FoodModel.create({
+                                calories: 10,
+                                created: luxon_1.DateTime.fromISO("2025-06-15T12:00:00.000Z").toJSDate(),
+                                hidden: false,
+                                name: "Spinach",
+                                ownerId: admin._id,
+                            })];
+                    case 2:
+                        spinach = _b.sent();
+                        return [4 /*yield*/, tests_1.FoodModel.collection.updateOne({ _id: spinach._id }, { $set: { updated: luxon_1.DateTime.fromISO("2025-06-15T12:00:00.000Z").toJSDate() } })];
+                    case 3:
+                        _b.sent();
+                        app = (0, tests_1.getBaseServer)();
+                        (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                        (0, auth_1.addAuthRoutes)(app, tests_1.UserModel);
+                        app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                            permissions: {
+                                create: [permissions_1.Permissions.IsAny],
+                                delete: [permissions_1.Permissions.IsAny],
+                                list: [permissions_1.Permissions.IsAny],
+                                read: [permissions_1.Permissions.IsAny],
+                                update: [permissions_1.Permissions.IsAny],
+                            },
+                        }));
+                        server = (0, supertest_1.default)(app);
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(app, "admin")];
+                    case 4:
+                        agent = _b.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 409 when If-Unmodified-Since is older than doc.updated", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var staleTimestamp, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        staleTimestamp = luxon_1.DateTime.fromISO("2025-06-15T11:00:00.000Z").toHTTP();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .set("If-Unmodified-Since", staleTimestamp)
+                                .send({ name: "Should Fail" })
+                                .expect(409)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.error).toBe("Conflict");
+                        (0, bun_test_1.expect)(res.body.message).toBe("Document was modified since your last read");
+                        (0, bun_test_1.expect)(res.body.data).toBeDefined();
+                        // The response should contain the current server version
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Spinach");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("succeeds when If-Unmodified-Since matches or is newer than doc.updated", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var freshTimestamp, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        freshTimestamp = luxon_1.DateTime.fromISO("2025-06-15T13:00:00.000Z").toHTTP();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .set("If-Unmodified-Since", freshTimestamp)
+                                .send({ name: "Updated Spinach" })
+                                .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Updated Spinach");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("succeeds normally when If-Unmodified-Since header is not present", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .send({ name: "No Header Update" })
+                            .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("No Header Update");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("succeeds when If-Unmodified-Since exactly matches doc.updated", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var exactTimestamp, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        exactTimestamp = luxon_1.DateTime.fromISO("2025-06-15T12:00:00.000Z").toHTTP();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .set("If-Unmodified-Since", exactTimestamp)
+                                .send({ name: "Exact Match" })
+                                .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Exact Match");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("prefers precise conflict timestamp header when present", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var roundedStaleTimestamp, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        roundedStaleTimestamp = luxon_1.DateTime.fromISO("2025-06-15T11:59:59.000Z").toHTTP();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .set("If-Unmodified-Since", roundedStaleTimestamp)
+                                .set("X-Unmodified-Since-ISO", "2025-06-15T12:00:00.750Z")
+                                .send({ name: "Precise Match" })
+                                .expect(200)];
+                    case 1:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Precise Match");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 409 when precise conflict timestamp is older than doc.updated", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, agent
+                            .patch("/food/".concat(spinach._id))
+                            .set("If-Unmodified-Since", luxon_1.DateTime.fromISO("2025-06-15T12:00:01.000Z").toHTTP())
+                            .set("X-Unmodified-Since-ISO", "2025-06-15T11:59:59.500Z")
+                            .send({ name: "Precise Stale" })
+                            .expect(409)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("falls back to doc.created when doc.updated is unavailable", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, tests_1.FoodModel.collection.updateOne({ _id: spinach._id }, { $unset: { updated: "" } })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, agent
+                                .patch("/food/".concat(spinach._id))
+                                .set("If-Unmodified-Since", luxon_1.DateTime.fromISO("2025-06-15T11:59:59.999Z").toHTTP())
+                                .send({ name: "Created Fallback" })
+                                .expect(409)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.name).toBe("Spinach");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
 });

package/dist/auth.d.ts

@@ -13,14 +13,17 @@ export interface User {
 }
 export interface UserModel extends Model<User> {
     createAnonymousUser?: (id?: string) => Promise<User>;
-    postCreate?: (body: any) => Promise<void>;
+    postCreate?: (body: Record<string, unknown>) => Promise<void>;
     createStrategy(): any;
     serializeUser(): any;
     deserializeUser(): any;
     findByUsername(username: string, findOpts: any): any;
 }
-export declare function authenticateMiddleware(anonymous?: boolean): (req: any, res: any, next: any) => any;
-export declare function signupUser(userModel: UserModel, email: string, password: string, body?: any): Promise<any>;
+export interface GenerateTokensOptions {
+    sessionId?: string;
+}
+export declare function authenticateMiddleware(anonymous?: boolean): (req: express.Request, res: express.Response, next: express.NextFunction) => any;
+export declare function signupUser(userModel: UserModel, email: string, password: string, body?: Record<string, unknown>): Promise<any>;
 /**
  * Generates both an access token (JWT) and a refresh token for a given user.
  *
@@ -38,11 +41,13 @@ export declare function signupUser(userModel: UserModel, email: string, password
  * authentication providers) to reuse and customize the same token generation logic.
  * This ensures consistent and secure token issuance across different authentication flows.
  */
-export declare const generateTokens: (user: any, authOptions?: AuthOptions) => Promise<{
+export declare const generateTokens: (user: unknown, authOptions?: AuthOptions, options?: GenerateTokensOptions) => Promise<{
     refreshToken: null;
     token: null;
+    sessionId?: undefined;
 } | {
-    refreshToken: any;
+    refreshToken: string | undefined;
+    sessionId: string;
     token: string;
 }>;
 export declare function setupAuth(app: express.Application, userModel: UserModel): void;

package/dist/auth.js

@@ -57,6 +57,31 @@ var __rest = (this && this.__rest) || function (s, e) {
         }
     return t;
 };
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -67,6 +92,7 @@ exports.signupUser = signupUser;
 exports.setupAuth = setupAuth;
 exports.addAuthRoutes = addAuthRoutes;
 exports.addMeRoutes = addMeRoutes;
+var node_crypto_1 = require("node:crypto");
 var express_1 = __importDefault(require("express"));
 var jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 var ms_1 = __importDefault(require("ms"));
@@ -76,6 +102,7 @@ var passport_jwt_1 = require("passport-jwt");
 var passport_local_1 = require("passport-local");
 var errors_1 = require("./errors");
 var logger_1 = require("./logger");
+var requestContext_1 = require("./requestContext");
 function authenticateMiddleware(anonymous) {
     if (anonymous === void 0) { anonymous = false; }
     var strategies = ["jwt"];
@@ -96,36 +123,37 @@ function authenticateMiddleware(anonymous) {
 }
 function signupUser(userModel, email, password, body) {
     return __awaiter(this, void 0, void 0, function () {
-        var _email, _password, bodyRest, user, error_1, error_2;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
+        var _a, _email, _password, bodyRest, user, error_1, error_2, message;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
                 case 0:
-                    _email = body.email, _password = body.password, bodyRest = __rest(body, ["email", "password"]);
-                    _a.label = 1;
+                    _a = body !== null && body !== void 0 ? body : {}, _email = _a.email, _password = _a.password, bodyRest = __rest(_a, ["email", "password"]);
+                    _b.label = 1;
                 case 1:
-                    _a.trys.push([1, 8, , 9]);
+                    _b.trys.push([1, 8, , 9]);
                     return [4 /*yield*/, userModel.register(__assign({ email: email }, bodyRest), password)];
                 case 2:
-                    user = _a.sent();
+                    user = _b.sent();
                     if (!user.postCreate) return [3 /*break*/, 6];
-                    _a.label = 3;
+                    _b.label = 3;
                 case 3:
-                    _a.trys.push([3, 5, , 6]);
+                    _b.trys.push([3, 5, , 6]);
                     return [4 /*yield*/, user.postCreate(bodyRest)];
                 case 4:
-                    _a.sent();
+                    _b.sent();
                     return [3 /*break*/, 6];
                 case 5:
-                    error_1 = _a.sent();
+                    error_1 = _b.sent();
                     logger_1.logger.error("Error in user.postCreate: ".concat(error_1));
                     throw error_1;
                 case 6: return [4 /*yield*/, user.save()];
                 case 7:
-                    _a.sent();
+                    _b.sent();
                     return [2 /*return*/, user];
                 case 8:
-                    error_2 = _a.sent();
-                    throw new errors_1.APIError({ title: error_2.message });
+                    error_2 = _b.sent();
+                    message = (0, errors_1.errorMessage)(error_2);
+                    throw new errors_1.APIError({ title: message });
                 case 9: return [2 /*return*/];
             }
         });
@@ -148,71 +176,81 @@ function signupUser(userModel, email, password, body) {
  * authentication providers) to reuse and customize the same token generation logic.
  * This ensures consistent and secure token issuance across different authentication flows.
  */
-var generateTokens = function (user, authOptions) { return __awaiter(void 0, void 0, void 0, function () {
-    var tokenSecretOrKey, payload, tokenOptions, token, refreshTokenSecretOrKey, refreshToken, refreshTokenOptions;
-    return __generator(this, function (_a) {
-        tokenSecretOrKey = process.env.TOKEN_SECRET;
-        if (!tokenSecretOrKey) {
-            throw new Error("TOKEN_SECRET must be set in env.");
-        }
-        if (!(user === null || user === void 0 ? void 0 : user._id)) {
-            logger_1.logger.warn("No user found for token generation");
-            return [2 /*return*/, { refreshToken: null, token: null }];
-        }
-        payload = { id: user._id.toString() };
-        if (authOptions === null || authOptions === void 0 ? void 0 : authOptions.generateJWTPayload) {
-            payload = __assign(__assign({}, authOptions.generateJWTPayload(user)), payload);
-        }
-        tokenOptions = {
-            expiresIn: "15m",
-        };
-        if (authOptions === null || authOptions === void 0 ? void 0 : authOptions.generateTokenExpiration) {
-            tokenOptions.expiresIn = authOptions.generateTokenExpiration(user);
-        }
-        else if (process.env.TOKEN_EXPIRES_IN) {
-            try {
-                // this call to ms is purely for validation of the env variable. If it is invalid,
-                // we want to be able to log the error and use the default.
-                (0, ms_1.default)(process.env.TOKEN_EXPIRES_IN);
-                tokenOptions.expiresIn = process.env.TOKEN_EXPIRES_IN;
+var generateTokens = function (user_1, authOptions_1) {
+    var args_1 = [];
+    for (var _i = 2; _i < arguments.length; _i++) {
+        args_1[_i - 2] = arguments[_i];
+    }
+    return __awaiter(void 0, __spreadArray([user_1, authOptions_1], __read(args_1), false), void 0, function (user, authOptions, options) {
+        var tokenSecretOrKey, tokenUser, sessionId, payload, tokenOptions, token, refreshTokenSecretOrKey, refreshToken, refreshTokenOptions;
+        var _a;
+        if (options === void 0) { options = {}; }
+        return __generator(this, function (_b) {
+            tokenSecretOrKey = process.env.TOKEN_SECRET;
+            if (!tokenSecretOrKey) {
+                throw new Error("TOKEN_SECRET must be set in env.");
             }
-            catch (error) {
-                // This error will result in using the default value above of 15m.
-                logger_1.logger.error(error);
+            tokenUser = user;
+            if (!(tokenUser === null || tokenUser === void 0 ? void 0 : tokenUser._id)) {
+                logger_1.logger.warn("No user found for token generation");
+                return [2 /*return*/, { refreshToken: null, token: null }];
             }
-        }
-        if (process.env.TOKEN_ISSUER) {
-            tokenOptions.issuer = process.env.TOKEN_ISSUER;
-        }
-        token = jsonwebtoken_1.default.sign(payload, tokenSecretOrKey, tokenOptions);
-        refreshTokenSecretOrKey = process.env.REFRESH_TOKEN_SECRET;
-        if (refreshTokenSecretOrKey) {
-            refreshTokenOptions = {
-                expiresIn: "30d",
+            sessionId = (_a = options.sessionId) !== null && _a !== void 0 ? _a : (0, node_crypto_1.randomUUID)();
+            payload = { id: String(tokenUser._id), sid: sessionId };
+            if (authOptions === null || authOptions === void 0 ? void 0 : authOptions.generateJWTPayload) {
+                payload = __assign(__assign({}, authOptions.generateJWTPayload(user)), payload);
+            }
+            tokenOptions = {
+                expiresIn: "15m",
             };
-            if (authOptions === null || authOptions === void 0 ? void 0 : authOptions.generateRefreshTokenExpiration) {
-                refreshTokenOptions.expiresIn = authOptions.generateRefreshTokenExpiration(user);
+            if (authOptions === null || authOptions === void 0 ? void 0 : authOptions.generateTokenExpiration) {
+                tokenOptions.expiresIn = authOptions.generateTokenExpiration(user);
             }
-            else if (process.env.REFRESH_TOKEN_EXPIRES_IN) {
+            else if (process.env.TOKEN_EXPIRES_IN) {
                 try {
                     // this call to ms is purely for validation of the env variable. If it is invalid,
                     // we want to be able to log the error and use the default.
-                    (0, ms_1.default)(process.env.REFRESH_TOKEN_EXPIRES_IN);
-                    refreshTokenOptions.expiresIn = process.env.REFRESH_TOKEN_EXPIRES_IN;
+                    (0, ms_1.default)(process.env.TOKEN_EXPIRES_IN);
+                    tokenOptions.expiresIn = process.env.TOKEN_EXPIRES_IN;
                 }
                 catch (error) {
-                    // This error will result in using the default value above of 30d.
+                    // This error will result in using the default value above of 15m.
                     logger_1.logger.error(error);
                 }
             }
-            refreshToken = jsonwebtoken_1.default.sign(payload, refreshTokenSecretOrKey, refreshTokenOptions);
-        }
-        else {
-            logger_1.logger.info("REFRESH_TOKEN_SECRET not set so refresh tokens will not be issued");
-        }
-        return [2 /*return*/, { refreshToken: refreshToken, token: token }];
+            if (process.env.TOKEN_ISSUER) {
+                tokenOptions.issuer = process.env.TOKEN_ISSUER;
+            }
+            token = jsonwebtoken_1.default.sign(payload, tokenSecretOrKey, tokenOptions);
+            refreshTokenSecretOrKey = process.env.REFRESH_TOKEN_SECRET;
+            if (refreshTokenSecretOrKey) {
+                refreshTokenOptions = {
+                    expiresIn: "30d",
+                };
+                if (authOptions === null || authOptions === void 0 ? void 0 : authOptions.generateRefreshTokenExpiration) {
+                    refreshTokenOptions.expiresIn = authOptions.generateRefreshTokenExpiration(user);
+                }
+                else if (process.env.REFRESH_TOKEN_EXPIRES_IN) {
+                    try {
+                        // this call to ms is purely for validation of the env variable. If it is invalid,
+                        // we want to be able to log the error and use the default.
+                        (0, ms_1.default)(process.env.REFRESH_TOKEN_EXPIRES_IN);
+                        refreshTokenOptions.expiresIn = process.env.REFRESH_TOKEN_EXPIRES_IN;
+                    }
+                    catch (error) {
+                        // This error will result in using the default value above of 30d.
+                        logger_1.logger.error(error);
+                    }
+                }
+                refreshToken = jsonwebtoken_1.default.sign(payload, refreshTokenSecretOrKey, refreshTokenOptions);
+            }
+            else {
+                logger_1.logger.info("REFRESH_TOKEN_SECRET not set so refresh tokens will not be issued");
+            }
+            return [2 /*return*/, { refreshToken: refreshToken, sessionId: sessionId, token: token }];
+        });
     });
-}); };
+};
 exports.generateTokens = generateTokens;
 // TODO allow customization
 function setupAuth(app, userModel) {
@@ -274,6 +312,7 @@ function setupAuth(app, userModel) {
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        user = null;
                         if (!jwtPayload) {
                             return [2 /*return*/, done(null, false)];
                         }
@@ -309,17 +348,17 @@ function setupAuth(app, userModel) {
     // but passport doesn't give us req.user early enough.
     function decodeJWTMiddleware(req, res, next) {
         return __awaiter(this, void 0, void 0, function () {
-            var token, decoded, userText, details, _a, error_5;
-            var _b, _c, _d, _e;
-            return __generator(this, function (_f) {
-                switch (_f.label) {
+            var token, decoded, userText, expiredAt, message, details, sessionId, user, error_5;
+            var _a, _b, _c, _d;
+            return __generator(this, function (_e) {
+                switch (_e.label) {
                     case 0:
                         if (!process.env.TOKEN_SECRET) {
                             return [2 /*return*/, next()];
                         }
                         // Allow requests with a "Secret" prefix to pass through since this is a string value,
                         // not a jwt that needs to be decoded
-                        if (((_c = (_b = req === null || req === void 0 ? void 0 : req.headers) === null || _b === void 0 ? void 0 : _b.authorization) === null || _c === void 0 ? void 0 : _c.split(" ")[0]) === "Secret") {
+                        if (((_b = (_a = req === null || req === void 0 ? void 0 : req.headers) === null || _a === void 0 ? void 0 : _a.authorization) === null || _b === void 0 ? void 0 : _b.split(" ")[0]) === "Secret") {
                             return [2 /*return*/, next()];
                         }
                         token = customTokenExtractor(req);
@@ -334,26 +373,37 @@ function setupAuth(app, userModel) {
                             });
                         }
                         catch (error) {
-                            userText = ((_d = req.user) === null || _d === void 0 ? void 0 : _d._id) ? " for user ".concat(req.user._id, " ") : "";
-                            details = "[jwt] Error decoding token".concat(userText, ": ").concat(error, ", expired at ").concat(error === null || error === void 0 ? void 0 : error.expiredAt, ", current time: ").concat(Date.now());
+                            userText = ((_c = req.user) === null || _c === void 0 ? void 0 : _c._id) ? " for user ".concat(req.user._id, " ") : "";
+                            expiredAt = error && typeof error === "object" && "expiredAt" in error
+                                ? error.expiredAt
+                                : undefined;
+                            message = (0, errors_1.errorMessage)(error);
+                            details = "[jwt] Error decoding token".concat(userText, ": ").concat(error, ", expired at ").concat(expiredAt, ", current time: ").concat(Date.now());
                             logger_1.logger.debug(details);
-                            return [2 /*return*/, res.status(401).json({ details: details, message: error === null || error === void 0 ? void 0 : error.message })];
+                            return [2 /*return*/, res.status(401).json({ details: details, message: message })];
+                        }
+                        if (!(decoded === null || decoded === void 0 ? void 0 : decoded.id)) return [3 /*break*/, 4];
+                        sessionId = (0, requestContext_1.getSessionIdFromJwtPayload)(decoded);
+                        req.authTokenPayload = decoded;
+                        if (sessionId) {
+                            req.sessionId = sessionId;
+                            (0, requestContext_1.setRequestContext)({ sessionId: sessionId });
                         }
-                        if (!decoded.id) return [3 /*break*/, 4];
-                        _f.label = 1;
+                        _e.label = 1;
                     case 1:
-                        _f.trys.push([1, 3, , 4]);
-                        _a = req;
+                        _e.trys.push([1, 3, , 4]);
                         return [4 /*yield*/, userModel.findById(decoded.id)];
                     case 2:
-                        _a.user = _f.sent();
-                        if ((_e = req.user) === null || _e === void 0 ? void 0 : _e.disabled) {
+                        user = _e.sent();
+                        req.user = user;
+                        (0, requestContext_1.updateRequestContextFromRequest)(req, res);
+                        if ((_d = req.user) === null || _d === void 0 ? void 0 : _d.disabled) {
                             logger_1.logger.warn("[jwt] User ".concat(req.user.id, " is disabled"));
                             return [2 /*return*/, res.status(401).json({ status: 401, title: "User is disabled" })];
                         }
                         return [3 /*break*/, 4];
                     case 3:
-                        error_5 = _f.sent();
+                        error_5 = _e.sent();
                         logger_1.logger.warn("[jwt] Error finding user from id: ".concat(error_5));
                         return [3 /*break*/, 4];
                     case 4: return [2 /*return*/, next()];
@@ -362,6 +412,7 @@ function setupAuth(app, userModel) {
         });
     }
     app.use(decodeJWTMiddleware);
+    // biome-ignore lint/suspicious/noExplicitAny: express 5 type for urlencoded doesn't match RequestHandler
     app.use(express_1.default.urlencoded({ extended: false }));
 }
 function addAuthRoutes(app, userModel, authOptions) {
@@ -389,6 +440,10 @@ function addAuthRoutes(app, userModel, authOptions) {
                             return [4 /*yield*/, (0, exports.generateTokens)(user, authOptions)];
                         case 1:
                             tokens = _a.sent();
+                            if (tokens.sessionId) {
+                                (0, requestContext_1.setRequestContext)({ sessionId: tokens.sessionId, userId: String(user._id) });
+                                res.setHeader("X-Session-ID", tokens.sessionId);
+                            }
                             return [2 /*return*/, res.json({
                                     data: { refreshToken: tokens.refreshToken, token: tokens.token, userId: user === null || user === void 0 ? void 0 : user._id },
                                 })];
@@ -399,7 +454,7 @@ function addAuthRoutes(app, userModel, authOptions) {
         });
     }); });
     router.post("/refresh_token", function (req, res) { return __awaiter(_this, void 0, void 0, function () {
-        var refreshTokenSecretOrKey, decoded, user, tokens;
+        var refreshTokenSecretOrKey, decoded, message, user, sessionId, tokens;
         var _a, _b, _c, _d;
         return __generator(this, function (_e) {
             switch (_e.label) {
@@ -420,15 +475,24 @@ function addAuthRoutes(app, userModel, authOptions) {
                     }
                     catch (error) {
                         logger_1.logger.error("Error refreshing token for user ".concat((_c = req.user) === null || _c === void 0 ? void 0 : _c.id, ": ").concat(error));
-                        return [2 /*return*/, res.status(401).json({ message: error === null || error === void 0 ? void 0 : error.message })];
+                        message = (0, errors_1.errorMessage)(error);
+                        return [2 /*return*/, res.status(401).json({ message: message })];
                     }
                     if (!(decoded === null || decoded === void 0 ? void 0 : decoded.id)) return [3 /*break*/, 3];
                     return [4 /*yield*/, userModel.findById(decoded.id)];
                 case 1:
                     user = _e.sent();
-                    return [4 /*yield*/, (0, exports.generateTokens)(user, authOptions)];
+                    sessionId = (0, requestContext_1.getSessionIdFromJwtPayload)(decoded);
+                    return [4 /*yield*/, (0, exports.generateTokens)(user, authOptions, { sessionId: sessionId })];
                 case 2:
                     tokens = _e.sent();
+                    if (tokens.sessionId) {
+                        (0, requestContext_1.setRequestContext)({
+                            sessionId: tokens.sessionId,
+                            userId: (user === null || user === void 0 ? void 0 : user._id) ? String(user._id) : undefined,
+                        });
+                        res.setHeader("X-Session-ID", tokens.sessionId);
+                    }
                     logger_1.logger.debug("Refreshed token for ".concat(user === null || user === void 0 ? void 0 : user.id));
                     return [2 /*return*/, res.json({ data: { refreshToken: tokens.refreshToken, token: tokens.token } })];
                 case 3:
@@ -441,13 +505,21 @@ function addAuthRoutes(app, userModel, authOptions) {
     if (!signupDisabled) {
         router.post("/signup", passport_1.default.authenticate("signup", { failWithError: true, session: false }), function (req, res) { return __awaiter(_this, void 0, void 0, function () {
             var tokens;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
+            var _a, _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
                     case 0: return [4 /*yield*/, (0, exports.generateTokens)(req.user, authOptions)];
                     case 1:
-                        tokens = _a.sent();
+                        tokens = _c.sent();
+                        if (tokens.sessionId) {
+                            (0, requestContext_1.setRequestContext)({
+                                sessionId: tokens.sessionId,
+                                userId: ((_a = req.user) === null || _a === void 0 ? void 0 : _a._id) ? String(req.user._id) : undefined,
+                            });
+                            res.setHeader("X-Session-ID", tokens.sessionId);
+                        }
                         return [2 /*return*/, res.json({
-                                data: { refreshToken: tokens.refreshToken, token: tokens.token, userId: req.user._id },
+                                data: { refreshToken: tokens.refreshToken, token: tokens.token, userId: (_b = req.user) === null || _b === void 0 ? void 0 : _b._id },
                             })];
                 }
             });
@@ -483,7 +555,7 @@ function addMeRoutes(app, userModel, _authOptions) {
         });
     }); });
     router.patch("/me", authenticateMiddleware(), function (req, res) { return __awaiter(_this, void 0, void 0, function () {
-        var doc, dataObject, error_6;
+        var doc, dataObject, error_6, message;
         var _a;
         return __generator(this, function (_b) {
             switch (_b.label) {
@@ -509,7 +581,8 @@ function addMeRoutes(app, userModel, _authOptions) {
                     return [2 /*return*/, res.json({ data: dataObject })];
                 case 4:
                     error_6 = _b.sent();
-                    return [2 /*return*/, res.status(403).send({ message: error_6.message })];
+                    message = (0, errors_1.errorMessage)(error_6);
+                    return [2 /*return*/, res.status(403).send({ message: message })];
                 case 5: return [2 /*return*/];
             }
         });