@usequark/quark-create-app 1.25.13 → 1.25.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.13",
+  "version": "1.25.14",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/templates/base-project/apps/web/src/lib/auth.js

@@ -2,7 +2,7 @@ import { PrismaAdapter } from "@auth/prisma-adapter";
 import { createAuthConfig, verifyPassword } from "@usequark/quark-core/auth";
 import { createLogger } from "@usequark/quark-core/core";
 import { AppError } from "@usequark/quark-core/errors";
-import { Prisma, prisma, user } from "@usequark/quark-db";
+import { Prisma, prisma, user as userQueries } from "@usequark/quark-db";
 import NextAuth from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import GithubProvider from "next-auth/providers/github";
@@ -66,7 +66,7 @@ const providers = [
 			}
 
 			try {
-				const existingUser = await user.findByEmail(credentials.email);
+				const existingUser = await userQueries.findByEmail(credentials.email);
 
 				if (!existingUser?.password) {
 					return null;
@@ -156,6 +156,64 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
 	);
 }
 
+/**
+ * Re-validate the session against the database on every request.
+ *
+ * Web sessions are signed JWTs: a credentials provider forces the JWT
+ * strategy (Auth.js rejects `strategy: "database"` when every provider is
+ * credentials, and scaffolds always ship one), and the cookie would otherwise
+ * stay valid for its full 30 days no matter what happened to the account
+ * behind it. That was the review's "logins can't be revoked" finding — banning
+ * a user, demoting an admin, or changing a password did nothing until the
+ * token expired on its own.
+ *
+ * The revocation check is a single indexed primary-key read, which is the
+ * same cost Auth.js itself pays for database sessions — but it works for
+ * credentials apps too:
+ *
+ *   - user gone (deleted / banned by deletion)  → reject, cookie cleared
+ *   - `passwordChangedAt` after the token's iat → reject, cookie cleared
+ *   - role or profile changed                   → refreshed into the token,
+ *     so `requireRole` reads the current role, not the sign-in-time one
+ *
+ * Returning null from the `jwt` callback is Auth.js's documented "invalidate
+ * this session" signal: it clears the cookie and the request continues
+ * unauthenticated.
+ */
+async function validateSessionToken(token) {
+	if (typeof token.id !== "string" || token.id.length === 0) {
+		return null;
+	}
+
+	try {
+		const account = await userQueries.findById(token.id);
+
+		if (!account) {
+			return null;
+		}
+
+		if (
+			account.passwordChangedAt &&
+			typeof token.iat === "number" &&
+			account.passwordChangedAt.getTime() / 1000 > token.iat
+		) {
+			return null;
+		}
+
+		token.email = account.email;
+		token.name = account.name;
+		token.role = account.role;
+		return token;
+	} catch (err) {
+		// Fail closed: an unreachable database invalidates the session rather
+		// than letting an unverified cookie through. The next request retries.
+		logger.error("Session validation failed", {
+			message: err?.message ?? String(err),
+		});
+		return null;
+	}
+}
+
 export function getAuthOptions() {
 	return createAuthConfig({
 		adapter: PrismaAdapter(prisma),
@@ -172,7 +230,28 @@ export function getAuthOptions() {
 			},
 		},
 		session: {
+			// JWT is not a preference here, it is a constraint: Auth.js throws
+			// `UnsupportedStrategy` when strategy is "database" and every
+			// configured provider is credentials, and the scaffold always ships
+			// the credentials provider. Revocation is therefore enforced by
+			// `validateSessionToken` above, not by server-side session rows.
 			strategy: "jwt",
+			maxAge: 30 * 24 * 60 * 60, // 30 days
+		},
+		callbacks: {
+			async jwt({ token, user: signedInUser }) {
+				// Sign-in: stamp the identity once; the DB check below is for
+				// every subsequent request.
+				if (signedInUser) {
+					token.id = signedInUser.id;
+					token.email = signedInUser.email;
+					token.name = signedInUser.name;
+					token.role = signedInUser.role || "viewer";
+					return token;
+				}
+
+				return validateSessionToken(token);
+			},
 		},
 	});
 }

package/templates/base-project/apps/web/src/lib/proxy-auth.js

@@ -1,6 +1,3 @@
-import { getAuthSecret } from "@usequark/quark-core/auth";
-import { getToken } from "next-auth/jwt";
-
 const STRICT_AUTH_RATE_LIMIT_ROUTES = new Set([
 	// `callback/credentials` is where the next-auth client POSTs a credentials
 	// sign-in (next-auth/react posts to `callback/<provider>` for credentials

package/templates/base-project/packages/db/prisma/migrations/20260202061128_initial/migration.sql

@@ -16,6 +16,7 @@ CREATE TABLE "User" (
     "password" TEXT,
     "image" TEXT,
     "role" "UserRole" NOT NULL DEFAULT 'viewer',
+    "passwordChangedAt" TIMESTAMP(3),
     "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
     "updatedAt" TIMESTAMP(3) NOT NULL,
 
@@ -117,9 +118,6 @@ CREATE TABLE "AuditLog" (
 -- CreateIndex
 CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
 
--- CreateIndex
-CREATE INDEX "User_email_idx" ON "User"("email");
-
 -- CreateIndex
 CREATE INDEX "User_createdAt_idx" ON "User"("createdAt");
 
@@ -141,9 +139,6 @@ CREATE INDEX "Session_expires_idx" ON "Session"("expires");
 -- CreateIndex
 CREATE UNIQUE INDEX "VerificationToken_token_key" ON "VerificationToken"("token");
 
--- CreateIndex
-CREATE INDEX "VerificationToken_token_idx" ON "VerificationToken"("token");
-
 -- CreateIndex
 CREATE INDEX "VerificationToken_expires_idx" ON "VerificationToken"("expires");
 
@@ -153,12 +148,6 @@ CREATE UNIQUE INDEX "VerificationToken_identifier_token_key" ON "VerificationTok
 -- CreateIndex
 CREATE INDEX "Job_queue_idx" ON "Job"("queue");
 
--- CreateIndex
-CREATE INDEX "Job_status_idx" ON "Job"("status");
-
--- CreateIndex
-CREATE INDEX "Job_runAt_idx" ON "Job"("runAt");
-
 -- CreateIndex
 CREATE INDEX "Job_status_runAt_idx" ON "Job"("status", "runAt");
 

package/templates/base-project/packages/db/prisma/schema.prisma

@@ -29,6 +29,10 @@ model User {
   password      String?
   image         String?
   role          UserRole  @default(viewer)
+  // Bumped whenever the account's password changes. Session tokens (web JWTs
+  // and mobile refresh tokens) issued before this instant are rejected, so a
+  // stolen or pre-change session dies with the password it was born under.
+  passwordChangedAt DateTime?
   createdAt     DateTime  @default(now())
   updatedAt     DateTime  @updatedAt
 
@@ -37,7 +41,8 @@ model User {
   auditLogs     AuditLog[]
   files         File[]
 
-  @@index([email])
+  // `email` is already @unique (User_email_key); a second plain index on the
+  // same column only adds write cost.
   @@index([createdAt])
 }
 
@@ -85,8 +90,9 @@ model VerificationToken {
   createdAt  DateTime @default(now())
   updatedAt  DateTime @updatedAt
 
+  // `token` is already @unique (VerificationToken_token_key); a second plain
+  // index on the same column only adds write cost.
   @@unique([identifier, token])
-  @@index([token])
   @@index([expires])
 }
 
@@ -106,9 +112,9 @@ model Job {
   createdAt DateTime  @default(now())
   updatedAt DateTime  @updatedAt
 
+  // (status, runAt) serves status-only queries through its leftmost prefix;
+  // single-column [status] and [runAt] indexes were removed as redundant.
   @@index([queue])
-  @@index([status])
-  @@index([runAt])
   @@index([status, runAt])
   @@index([createdAt])
 }

package/templates/base-project/packages/db/src/queries.js

@@ -11,6 +11,7 @@ const USER_SAFE_SELECT = {
 	name: true,
 	image: true,
 	role: true,
+	passwordChangedAt: true,
 	createdAt: true,
 	updatedAt: true,
 };