@tumbaland/backend-core 1.41.0 → 1.43.0

package/dist/middleware/authMiddleware.js

@@ -8,6 +8,8 @@ exports.optionalAuth = optionalAuth;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const env_1 = require("../config/env");
 const tokens_1 = require("../oauth/tokens");
+const session_1 = require("../auth/session");
+const membership_1 = require("../groups/membership");
 /**
  * JWT authentication middleware
  * Verifies JWT token and attaches user info (and its embedded groups) to
@@ -21,7 +23,7 @@ const tokens_1 = require("../oauth/tokens");
  * enforces both — so anything still guarded by this one is a person's to do,
  * and letting a token through would be handing an assistant the account.
  */
-function authenticateToken(req, res, next) {
+async function authenticateToken(req, res, next) {
     try {
         const JWT_SECRET = (0, env_1.requireEnv)('JWT_SECRET');
         const token = req.cookies?.access_token || req.headers.authorization?.replace('Bearer ', '');
@@ -37,14 +39,23 @@ function authenticateToken(req, res, next) {
             });
             return;
         }
-        const user = claims;
-        req.user = user;
-        req.userGroups = user.groups ?? [];
-        next();
+        // A signed-out or revoked device keeps a validly signed token; only its
+        // session record says it has ended.
+        if (!(await (0, session_1.isCurrentSession)(claims))) {
+            res.status(401).json({ success: false, message: 'Session has ended' });
+            return;
+        }
+        // Membership is asked of group-service, not read from the token, so a
+        // change applies within seconds rather than at the next renewal.
+        const groups = await (0, membership_1.currentGroupsOf)(claims);
+        req.user = { ...claims, groups };
+        req.userGroups = groups;
     }
     catch (error) {
         res.status(401).json({ success: false, message: 'Invalid or expired token' });
+        return;
     }
+    next();
 }
 /**
  * Attaches the user when a valid token is present, and never rejects.
@@ -59,7 +70,7 @@ function authenticateToken(req, res, next) {
  * around would break the landing page for exactly the people most likely to
  * have one.
  */
-function optionalAuth(req, _res, next) {
+async function optionalAuth(req, _res, next) {
     try {
         const JWT_SECRET = (0, env_1.requireEnv)('JWT_SECRET');
         const token = req.cookies?.access_token || req.headers.authorization?.replace('Bearer ', '');
@@ -67,10 +78,11 @@ function optionalAuth(req, _res, next) {
             const claims = jsonwebtoken_1.default.verify(token, JWT_SECRET);
             // An access token is not a session; treated as none, exactly like an
             // expired cookie, so the route still answers with its public form.
-            if (!(0, tokens_1.isAccessTokenClaims)(claims)) {
-                const user = claims;
-                req.user = user;
-                req.userGroups = user.groups ?? [];
+            // An ended session is treated as none, like an expired cookie.
+            if (!(0, tokens_1.isAccessTokenClaims)(claims) && (await (0, session_1.isCurrentSession)(claims))) {
+                const groups = await (0, membership_1.currentGroupsOf)(claims);
+                req.user = { ...claims, groups };
+                req.userGroups = groups;
             }
         }
     }

package/dist/middleware/authMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":";;;;;AAmBA,8CA0BC;AAcD,oCAmBC;AA7ED,gEAA+B;AAC/B,uCAA2C;AAC3C,4CAAsD;AAGtD;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC/E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,2EAA2E;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAqB,CAAC;QACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AACD;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IAC3E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7C,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAqB,CAAC;gBACnC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}
+{"version":3,"file":"authMiddleware.js","sourceRoot":"","sources":["../../src/middleware/authMiddleware.ts"],"names":[],"mappings":";;;;;AAqBA,8CAmCC;AAcD,oCAoBC;AAzFD,gEAA+B;AAC/B,uCAA2C;AAC3C,4CAAsD;AAEtD,6CAAmD;AACnD,qDAAuD;AAEvD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACrF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,IAAA,4BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,2EAA2E;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,oCAAoC;QACpC,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAe,EAAC,MAAqB,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,GAAG,EAAE,GAAI,MAAsB,EAAE,MAAM,EAAE,CAAC;QAClD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AACD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,YAAY,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACjF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAA,gBAAU,EAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7C,qEAAqE;YACrE,mEAAmE;YACnE,+DAA+D;YAC/D,IAAI,CAAC,IAAA,4BAAmB,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAe,EAAC,MAAqB,CAAC,CAAC;gBAC5D,GAAG,CAAC,IAAI,GAAG,EAAE,GAAI,MAAsB,EAAE,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/testing/serviceTestSetup.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=serviceTestSetup.d.ts.map

package/dist/testing/serviceTestSetup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTestSetup.d.ts","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":""}

package/dist/testing/serviceTestSetup.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const session_1 = require("../auth/session");
+const membership_1 = require("../groups/membership");
+/**
+ * Jest setup for service test suites: they sign session tokens without a
+ * session and run with no database or group-service, so every token's session
+ * counts as live and its `groups` claim stands in for group membership.
+ * The session check itself is tested in backend-core (auth/session.test.ts).
+ *
+ * Loaded through the package's test-only entry point:
+ *   setupFiles: ['@tumbaland/backend-core/testing']
+ */
+(0, session_1.overrideSessionCheckForTests)(async () => true);
+// No group-service either: a test token's own `groups` claim is taken as the
+// person's membership. The live lookup is tested in groups/membership.test.ts.
+(0, membership_1.overrideMembershipLookupForTests)(async (user) => user.groups ?? []);
+//# sourceMappingURL=serviceTestSetup.js.map

package/dist/testing/serviceTestSetup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTestSetup.js","sourceRoot":"","sources":["../../src/testing/serviceTestSetup.ts"],"names":[],"mappings":";;AAAA,6CAA+D;AAC/D,qDAAwE;AAExE;;;;;;;;GAQG;AACH,IAAA,sCAA4B,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/C,6EAA6E;AAC7E,+EAA+E;AAC/E,IAAA,6CAAgC,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC"}

package/dist/types/auth.d.ts

@@ -6,6 +6,9 @@ export interface UserPayload {
     picture?: string;
     groups?: string[];
     roles?: string[];
+    tokenVersion?: number;
+    /** The auth-service session (user_sessions) this token belongs to; absent on pre-sessions tokens. */
+    sid?: string;
 }
 /**
  * Attaches `user`/`userGroups` to every Express `Request` across all

package/dist/types/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/types/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,WAAW,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,IAAI,CAAC,EAAE,IAAI,CAAC;SACb;KACF;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/types/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qGAAqG;IACrG,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;GAUG;AACH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,WAAW,CAAC;YACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,IAAI,CAAC,EAAE,IAAI,CAAC;SACb;KACF;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tumbaland/backend-core",
-  "version": "1.41.0",
+  "version": "1.43.0",
   "description": "Core shared functionality for Tumbaland backend services",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/apiKeys/middleware.test.ts

@@ -11,6 +11,8 @@ import { verifyApiKey } from './service';
 import { mintAccessToken, type MintAccessTokenInput } from '../oauth/tokens';
 import { PERSONAL_TENANT } from './types';
 import { authenticateAgent, requireScope, denyApiKeys } from './middleware';
+import { overrideSessionCheckForTests } from '../auth/session';
+import { overrideMembershipLookupForTests } from '../groups/membership';
 
 const mockedVerify = verifyApiKey as jest.Mock;
 const ORIGINAL_ENV = process.env;
@@ -43,11 +45,18 @@ const okVerification = (over: Record<string, unknown> = {}) => ({
   ...over
 });
 
+// Unless a test says otherwise, the owner still belongs to every group used here.
+let memberOf: string[];
+
 beforeEach(() => {
   jest.clearAllMocks();
   process.env = { ...ORIGINAL_ENV, JWT_SECRET: 'test-jwt-secret' };
+  memberOf = ['g1', 'g2'];
+  overrideMembershipLookupForTests(async () => memberOf);
 });
 
+afterAll(() => overrideMembershipLookupForTests());
+
 afterEach(() => {
   process.env = ORIGINAL_ENV;
 });
@@ -65,6 +74,32 @@ describe('authenticateAgent — no credentials', () => {
 });
 
 describe('authenticateAgent — session tokens', () => {
+  beforeEach(() => overrideSessionCheckForTests(async () => true));
+  afterAll(() => overrideSessionCheckForTests());
+
+  it('rejects a validly signed JWT whose session has ended', async () => {
+    overrideSessionCheckForTests(async () => false);
+    const token = jwt.sign({ id: 'u1', email: 'a@b.c', name: 'A', sid: 'a'.repeat(24) }, 'test-jwt-secret');
+    const res = mockRes();
+    const next = jest.fn();
+
+    await authenticateAgent()(req({ headers: { authorization: `Bearer ${token}` } }), res, next);
+
+    expect(res.status).toHaveBeenCalledWith(401);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it("takes the person's groups from group-service, not from the token", async () => {
+    memberOf = ['g2'];
+    const token = jwt.sign({ id: 'u1', email: 'a@b.c', name: 'A', groups: ['g1'] }, 'test-jwt-secret');
+    const request = req({ headers: { authorization: `Bearer ${token}` } });
+
+    await authenticateAgent()(request, mockRes(), jest.fn());
+
+    expect(request.userGroups).toEqual(['g2']);
+    expect(request.user?.groups).toEqual(['g2']);
+  });
+
   it('accepts a valid JWT and grants the full session, with no apiKey context', async () => {
     const token = jwt.sign({ id: 'u1', email: 'a@b.c', name: 'A', groups: ['g1', 'g2'] }, 'test-jwt-secret');
     const request = req({ headers: { authorization: `Bearer ${token}` } });
@@ -343,6 +378,55 @@ describe('authenticateAgent — a multi-tenant grant', () => {
   });
 });
 
+describe('authenticateAgent — groups the owner has since left', () => {
+  it('drops a granted group the owner no longer belongs to', async () => {
+    memberOf = ['g2'];
+    mockedVerify.mockResolvedValue(
+      okVerification({ tenants: { allowed: [PERSONAL_TENANT, 'g1', 'g2'], default: PERSONAL_TENANT } })
+    );
+    const request = withKey();
+
+    await authenticateAgent()(request, mockRes(), jest.fn());
+
+    expect(request.userGroups).toEqual(['g2']);
+    expect(request.apiKey?.tenants.allowed).toEqual([PERSONAL_TENANT, 'g2']);
+  });
+
+  it('refuses a request for a group the owner has left, although the key was granted it', async () => {
+    memberOf = [];
+    mockedVerify.mockResolvedValue(okVerification({ tenants: grant(PERSONAL_TENANT, 'g1') }));
+    const res = mockRes();
+    const next = jest.fn();
+
+    await authenticateAgent()(withKey(undefined, { query: { groupId: 'g1' } } as Partial<Request>), res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('refuses a key whose only group the owner has left, rather than acting somewhere else', async () => {
+    memberOf = [];
+    mockedVerify.mockResolvedValue(okVerification({ tenants: grant('g1') }));
+    const res = mockRes();
+    const next = jest.fn();
+
+    await authenticateAgent()(withKey(), res, next);
+
+    expect(res.status).toHaveBeenCalledWith(403);
+    expect(next).not.toHaveBeenCalled();
+  });
+
+  it('asks about the key owner, by email', async () => {
+    const lookup = jest.fn(async () => ['g1']);
+    overrideMembershipLookupForTests(lookup);
+    mockedVerify.mockResolvedValue(okVerification({ tenants: grant('g1') }));
+
+    await authenticateAgent()(withKey(), mockRes(), jest.fn());
+
+    expect(lookup).toHaveBeenCalledWith({ email: 'u1@example.com' });
+  });
+});
+
 describe('requireScope', () => {
   const keyReq = (scopes: string[]) =>
     req({

package/src/apiKeys/middleware.ts

@@ -16,6 +16,8 @@ import {
   type ApiKeyTenant,
   type Tenant
 } from './types';
+import { isCurrentSession } from '../auth/session';
+import { currentGroupsOf } from '../groups/membership';
 
 /**
  * Request-scoped facts about the key a request arrived on. Absent on ordinary
@@ -147,13 +149,13 @@ interface AgentCredential {
  * Settling that in one place is what keeps the two from drifting into subtly
  * different amounts of access.
  */
-function admitAgent(
+async function admitAgent(
   req: Request,
   res: Response,
   next: NextFunction,
   requiredScopes: ApiKeyScope[],
   credential: AgentCredential
-): void {
+): Promise<void> {
   const missing = requiredScopes.filter((scope) => !credential.scopes.includes(scope));
   if (missing.length > 0) {
     res.status(403).json({
@@ -163,7 +165,16 @@ function admitAgent(
     return;
   }
 
-  const actingAs = applyTenantGrant(req, credential.tenants);
+  // A grant names the groups the owner belonged to when they made it. Only the
+  // ones they still belong to count, so leaving a group also takes it from
+  // every key and connection they gave it to.
+  const stillMemberOf = new Set(await currentGroupsOf({ email: credential.email }));
+  const tenants: ApiKeyTenant = {
+    ...credential.tenants,
+    allowed: credential.tenants.allowed.filter((tenant) => tenant === PERSONAL_TENANT || stillMemberOf.has(tenant))
+  };
+
+  const actingAs = applyTenantGrant(req, tenants);
   if (actingAs === null) {
     res.status(403).json({
       success: false,
@@ -176,11 +187,11 @@ function admitAgent(
   // Only the granted groups, never the owner's full membership: this is what
   // stops a credential reaching a group it was not issued for through any
   // handler that consults `userGroups` instead of the `groupId` parameter.
-  req.userGroups = groupIdsOf(credential.tenants.allowed);
+  req.userGroups = groupIdsOf(tenants.allowed);
   req.apiKey = {
     keyId: credential.credentialId,
     scopes: credential.scopes,
-    tenants: credential.tenants,
+    tenants,
     actingAs,
     kind: credential.kind,
     label: credential.label,
@@ -223,9 +234,13 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
       }
 
       if (!isAccessTokenClaims(claims)) {
-        const user = claims as UserPayload;
-        req.user = user;
-        req.userGroups = user.groups ?? [];
+        if (!(await isCurrentSession(claims))) {
+          unauthorized(res);
+          return;
+        }
+        const groups = await currentGroupsOf(claims as UserPayload);
+        req.user = { ...(claims as UserPayload), groups };
+        req.userGroups = groups;
         beginAudit(req, res, next);
         return;
       }
@@ -240,7 +255,7 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
       // `undefined`, scoped writes were refused as inaccessible, and a read
       // whose scope collapsed to nothing fell through to "no user context" and
       // answered from the whole collection.
-      admitAgent(req, res, next, requiredScopes, {
+      await admitAgent(req, res, next, requiredScopes, {
         // The client, not the token: `jti` is a new value every hour.
         credentialId: claims.clientId ?? 'unknown-client',
         kind: 'oauth',
@@ -263,7 +278,7 @@ export const authenticateAgent = (...requiredScopes: ApiKeyScope[]): RequestHand
       return;
     }
 
-    admitAgent(req, res, next, requiredScopes, {
+    await admitAgent(req, res, next, requiredScopes, {
       credentialId: result.keyId!,
       kind: 'api_key',
       label: result.label || 'An API key',

package/src/auth/session.test.ts

@@ -0,0 +1,89 @@
+const connection = { readyState: 1, collection: jest.fn() };
+
+jest.mock('mongoose', () => {
+  const actual = jest.requireActual('mongoose');
+  return { __esModule: true, default: { connection, Types: actual.Types } };
+});
+
+import mongoose from 'mongoose';
+import {
+  USER_SESSIONS_COLLECTION,
+  isCurrentSession,
+  isLegacySessionlessToken,
+  overrideSessionCheckForTests
+} from './session';
+
+const USER_ID = 'b'.repeat(24);
+const SESSION_ID = 'a'.repeat(24);
+const now = Math.floor(Date.now() / 1000);
+
+describe('isLegacySessionlessToken', () => {
+  it('accepts a pre-sessions token that lived 24 hours at most', () => {
+    expect(isLegacySessionlessToken({ iat: now, exp: now + 24 * 60 * 60 })).toBe(true);
+  });
+
+  it('refuses a session-less token that lives longer, or has no expiry', () => {
+    expect(isLegacySessionlessToken({ iat: now, exp: now + 24 * 60 * 60 + 1 })).toBe(false);
+    expect(isLegacySessionlessToken({ iat: now })).toBe(false);
+  });
+
+  it('is never true for a token that names a session', () => {
+    expect(isLegacySessionlessToken({ sid: SESSION_ID, iat: now, exp: now + 60 })).toBe(false);
+  });
+});
+
+describe('isCurrentSession', () => {
+  const findOne = jest.fn();
+
+  beforeEach(() => {
+    overrideSessionCheckForTests();
+    findOne.mockReset();
+    connection.readyState = 1;
+    connection.collection.mockReset().mockReturnValue({ findOne });
+  });
+
+  it('accepts a live session that belongs to the token user', async () => {
+    findOne.mockResolvedValue({ _id: SESSION_ID });
+
+    await expect(isCurrentSession({ id: USER_ID, sid: SESSION_ID })).resolves.toBe(true);
+
+    expect(mongoose.connection.collection).toHaveBeenCalledWith(USER_SESSIONS_COLLECTION);
+    const [query, options] = findOne.mock.calls[0];
+    expect(query._id.toString()).toBe(SESSION_ID);
+    expect(query.userId.toString()).toBe(USER_ID);
+    expect(query.expiresAt.$gt).toBeInstanceOf(Date);
+    expect(options).toMatchObject({ readPreference: 'primary' });
+  });
+
+  it('refuses a revoked or expired session', async () => {
+    findOne.mockResolvedValue(null);
+
+    await expect(isCurrentSession({ id: USER_ID, sid: SESSION_ID })).resolves.toBe(false);
+  });
+
+  it('refuses while the database is unavailable rather than letting the token through', async () => {
+    connection.readyState = 0;
+
+    await expect(isCurrentSession({ id: USER_ID, sid: SESSION_ID })).resolves.toBe(false);
+    expect(findOne).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    [{ id: USER_ID, sid: 'not-an-id' }],
+    [{ id: 'not-an-id', sid: SESSION_ID }],
+    [{ id: USER_ID, sid: 42 }],
+    [null]
+  ])('refuses malformed claims %j without a lookup', async (claims) => {
+    await expect(isCurrentSession(claims)).resolves.toBe(false);
+    expect(findOne).not.toHaveBeenCalled();
+  });
+
+  it('accepts a short-lived pre-sessions token without a lookup', async () => {
+    await expect(isCurrentSession({ id: USER_ID, iat: now, exp: now + 60 })).resolves.toBe(true);
+    expect(findOne).not.toHaveBeenCalled();
+  });
+
+  it('refuses a long-lived token with no session', async () => {
+    await expect(isCurrentSession({ id: USER_ID, iat: now, exp: now + 90 * 24 * 60 * 60 })).resolves.toBe(false);
+  });
+});

package/src/auth/session.ts

@@ -0,0 +1,75 @@
+import mongoose from 'mongoose';
+
+/**
+ * One document per signed-in device, owned and written by auth-service; every
+ * other service only reads it here. A session token names its document in the
+ * `sid` claim, and the token is only as good as that document: deleting it
+ * (sign-out, "sign out this device") ends the session on its next request, in
+ * every service, and its `expiresAt` (slid forward by auth-service while the
+ * device is in use, never past a hard cap from sign-in) is what idle expiry
+ * actually means.
+ */
+export const USER_SESSIONS_COLLECTION = 'user_sessions';
+
+/**
+ * Tokens minted before sessions existed carry no `sid` and lived 24 hours.
+ * auth-service upgrades one to a session the next time `/auth/verify` sees it,
+ * so this window closes by itself a day after the sessions release; the branch
+ * accepting them can be deleted after that.
+ */
+const LEGACY_TOKEN_MAX_LIFETIME_SECONDS = 24 * 60 * 60;
+
+const OBJECT_ID = /^[a-f\d]{24}$/i;
+
+/** True for a pre-sessions token: no `sid`, and the old 24-hour lifetime at most. */
+export function isLegacySessionlessToken(claims: unknown): boolean {
+  if (!claims || typeof claims !== 'object') return false;
+  const { sid, iat, exp } = claims as { sid?: unknown; iat?: unknown; exp?: unknown };
+  return (
+    sid === undefined &&
+    Number.isSafeInteger(iat) &&
+    Number.isSafeInteger(exp) &&
+    (exp as number) - (iat as number) <= LEGACY_TOKEN_MAX_LIFETIME_SECONDS
+  );
+}
+
+type SessionCheck = (claims: unknown) => Promise<boolean>;
+
+/**
+ * Whether a verified session token still stands: for a token with a `sid`,
+ * its session belongs to the token's user and has neither been revoked nor
+ * expired. Read on the primary, uncached, so a revocation holds from the next
+ * request.
+ */
+const checkSessionInDatabase: SessionCheck = async (claims) => {
+  if (!claims || typeof claims !== 'object') return false;
+  const { id, sid } = claims as { id?: unknown; sid?: unknown };
+  if (sid === undefined) return isLegacySessionlessToken(claims);
+  if (typeof sid !== 'string' || !OBJECT_ID.test(sid)) return false;
+  if (typeof id !== 'string' || !OBJECT_ID.test(id)) return false;
+  // Refuse rather than queue an authentication query while the database is down.
+  if (mongoose.connection.readyState !== 1) return false;
+
+  const session = await mongoose.connection.collection(USER_SESSIONS_COLLECTION).findOne(
+    {
+      _id: new mongoose.Types.ObjectId(sid),
+      userId: new mongoose.Types.ObjectId(id),
+      expiresAt: { $gt: new Date() }
+    },
+    { projection: { _id: 1 }, readPreference: 'primary', maxTimeMS: 3000 }
+  );
+  return session !== null;
+};
+
+let sessionCheck: SessionCheck = checkSessionInDatabase;
+
+export const isCurrentSession = (claims: unknown): Promise<boolean> => sessionCheck(claims);
+
+/**
+ * Replaces the check, for tests only; pass nothing to restore the real one.
+ * Not exported from the package index: service suites reach it through the
+ * `@tumbaland/backend-core/testing` entry point (see testing.js).
+ */
+export function overrideSessionCheckForTests(check?: SessionCheck): void {
+  sessionCheck = check ?? checkSessionInDatabase;
+}

package/src/groups/client.ts

@@ -76,7 +76,7 @@ interface GroupOwnerResponse {
  * round, out through the proxy and back, carrying the internal token across the
  * public edge.
  */
-function internalGroupUrl(): string | undefined {
+export function internalGroupUrl(): string | undefined {
   return process.env.GROUP_INTERNAL_URL || process.env.GROUP_API_URL;
 }
 

package/src/groups/index.ts

@@ -3,3 +3,5 @@ export type { GroupOwner } from './client';
 
 export { groupOwnerSubject } from './subject';
 export type { GroupIdResolver } from './subject';
+
+export { getUserGroupIds, currentGroupsOf, clearMembershipCache } from './membership';

package/src/groups/membership.test.ts

@@ -0,0 +1,84 @@
+import { clearMembershipCache, currentGroupsOf, getUserGroupIds } from './membership';
+import logger from '../logging/logger';
+
+jest.mock('../logging/logger', () => ({ __esModule: true, default: { error: jest.fn(), warn: jest.fn() } }));
+
+const ORIGINAL_ENV = process.env;
+const answer = (data: unknown, ok = true, status = 200) =>
+  ({ ok, status, json: async () => ({ success: ok, data }) }) as unknown as Response;
+
+beforeEach(() => {
+  clearMembershipCache();
+  jest.useRealTimers();
+  process.env = {
+    ...ORIGINAL_ENV,
+    GROUP_INTERNAL_URL: 'http://group-service:5006',
+    INTERNAL_SERVICE_TOKEN: 'internal-token',
+    SERVICE_NAME: 'album-service'
+  };
+  global.fetch = jest.fn().mockResolvedValue(answer(['g1', 'g2']));
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+it('asks group-service over the internal channel', async () => {
+  await expect(getUserGroupIds('Ada@Example.com')).resolves.toEqual(['g1', 'g2']);
+
+  expect(global.fetch).toHaveBeenCalledWith(
+    'http://group-service:5006/api/groups/mine/ids?userEmail=ada%40example.com',
+    expect.objectContaining({
+      headers: expect.objectContaining({ 'x-internal-token': 'internal-token', 'x-service-id': 'album-service' })
+    })
+  );
+});
+
+it('answers from the cache for 30 seconds, then asks again', async () => {
+  jest.useFakeTimers();
+
+  await getUserGroupIds('ada@example.com');
+  await getUserGroupIds('ADA@example.com');
+  expect(global.fetch).toHaveBeenCalledTimes(1);
+
+  jest.advanceTimersByTime(30_001);
+  await getUserGroupIds('ada@example.com');
+  expect(global.fetch).toHaveBeenCalledTimes(2);
+});
+
+it('shares one request between callers asking at the same time', async () => {
+  await Promise.all([getUserGroupIds('ada@example.com'), getUserGroupIds('ada@example.com')]);
+
+  expect(global.fetch).toHaveBeenCalledTimes(1);
+});
+
+it('keeps the last known membership while group-service is unreachable', async () => {
+  jest.useFakeTimers();
+  await getUserGroupIds('ada@example.com');
+  jest.advanceTimersByTime(30_001);
+  (global.fetch as jest.Mock).mockRejectedValue(new Error('connect ECONNREFUSED'));
+
+  await expect(getUserGroupIds('ada@example.com')).resolves.toEqual(['g1', 'g2']);
+  expect(logger.warn).toHaveBeenCalled();
+});
+
+it('grants no groups when it has never been able to ask', async () => {
+  (global.fetch as jest.Mock).mockResolvedValue(answer(null, false, 503));
+
+  await expect(getUserGroupIds('ada@example.com')).resolves.toEqual([]);
+  expect(logger.error).toHaveBeenCalled();
+});
+
+it('grants no groups when not configured, without calling anything', async () => {
+  delete process.env.GROUP_INTERNAL_URL;
+  delete process.env.GROUP_API_URL;
+
+  await expect(getUserGroupIds('ada@example.com')).resolves.toEqual([]);
+  expect(global.fetch).not.toHaveBeenCalled();
+});
+
+it('never takes the groups from the token', async () => {
+  (global.fetch as jest.Mock).mockResolvedValue(answer(['g2']));
+
+  await expect(currentGroupsOf({ email: 'ada@example.com', groups: ['g1', 'g9'] })).resolves.toEqual(['g2']);
+});