@treeseed/sdk 0.10.12 → 0.10.14

package/dist/api/auth/d1-store.js

@@ -310,6 +310,7 @@ class D1AuthStore {
         scopes: this.scopesForPrincipal(permissions),
         metadata: {
           ...parseJson(user.metadata_json, {}),
+          email: user.email ?? void 0,
           username: user.username ?? void 0
         }
       }
@@ -637,7 +638,11 @@ class D1AuthStore {
       expiresInSeconds: this.config.accessTokenTtlSeconds,
       principal: {
         ...principalRecord.principal,
-        scopes: requestedScopes
+        scopes: requestedScopes,
+        metadata: {
+          ...principalRecord.principal.metadata,
+          sessionId
+        }
       }
     };
   }
@@ -865,6 +870,20 @@ class D1AuthStore {
     }
     const payload = verifyAccessToken(token, this.config.authSecret);
     if (!payload) return null;
+    const sessionId = typeof payload.metadata?.sessionId === "string" ? payload.metadata.sessionId.trim() : "";
+    if (sessionId) {
+      const session = await this.first(
+        `SELECT id, user_id, expires_at, revoked_at
+				 FROM auth_sessions
+				 WHERE id = ?`,
+        [sessionId]
+      );
+      const sessionExpiresAt = session ? new Date(session.expires_at).getTime() : 0;
+      if (!session || session.user_id !== payload.sub || session.revoked_at || !Number.isFinite(sessionExpiresAt) || sessionExpiresAt <= Date.now()) {
+        return null;
+      }
+      await this.run(`UPDATE auth_sessions SET updated_at = ? WHERE id = ?`, [isoNow(), session.id]);
+    }
     return {
       principal: principalFromAccessTokenPayload(payload),
       credential: {