@webtypen/webframez-core 0.3.78 → 0.3.81

package/dist/Auth/ModelAuth.d.ts

@@ -86,7 +86,7 @@ export declare class AuthScope extends WebAuth {
     login(req: Request, res: Response, verifyCredentials?: () => Promise<string | null>): Promise<AuthSession>;
     logout(req: Request, res: Response): Promise<void>;
     /** Trusted SSO/server entry point; the subject must already be verified by the caller. */
-    establishBearerSession(req: Request, subject: string, parent?: AuthSession["parent"], environment?: string): Promise<{
+    establishBearerSession(req: Request, subject: string, parent?: AuthSession["parent"], environment?: string, parentExpiresAt?: number): Promise<{
         auth_token: string;
         refresh_token: string;
         auth_expires_at: number;

package/dist/Auth/ModelAuth.js

@@ -211,7 +211,7 @@ class AuthScope extends WebAuth_1.WebAuth {
         });
     }
     /** Trusted SSO/server entry point; the subject must already be verified by the caller. */
-    establishBearerSession(req, subject, parent = null, environment) {
+    establishBearerSession(req, subject, parent = null, environment, parentExpiresAt) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.modelOptions.transport !== "bearer")
                 throw new Error("Bearer transport is not enabled for this auth scope.");
@@ -229,14 +229,14 @@ class AuthScope extends WebAuth_1.WebAuth {
                     throw new AuthHookError("login_blocked", error);
                 }
             }
-            const pair = yield this.sessions.create(subject, parent, environment);
-            if (this.modelOptions.trackActivity !== false)
+            const pair = yield this.sessions.create(subject, parent, environment, parentExpiresAt);
+            if (!pair.reused && this.modelOptions.trackActivity !== false)
                 yield this.sessions.recordLogin(pair.session, (0, AuthSecurity_1.authHeader)(req, "user-agent"));
             if (this.modelOptions.onLogin)
                 yield this.modelOptions.onLogin(pair.session, req);
             if (this.modelOptions.afterLogin)
                 yield this.modelOptions.afterLogin(req, user, this);
-            const { csrf_token } = pair, tokens = __rest(pair, ["csrf_token"]);
+            const { csrf_token, reused } = pair, tokens = __rest(pair, ["csrf_token", "reused"]);
             return tokens;
         });
     }

package/dist/Auth/SessionAuth.d.ts

@@ -24,6 +24,7 @@ export type SessionTokenPair = {
 };
 export type CreatedAuthSession = SessionTokenPair & {
     csrf_token: string;
+    reused?: boolean;
 };
 export type SessionAuthOptions = {
     issuer: string;
@@ -32,6 +33,11 @@ export type SessionAuthOptions = {
     environment?: string;
     /** Allow server-selected environments per session instead of one fixed environment. */
     allowDynamicEnvironment?: boolean;
+    /** Reuse one child per parent, subject and environment. Requires a strong server-held secret. */
+    parentSessions?: {
+        mode: "new" | "reuse";
+        secret?: string;
+    };
     connection?: string;
     collection?: string;
     accessTokenSeconds?: number;
@@ -60,7 +66,10 @@ export declare class SessionAuth {
     private liveFilter;
     private allowed;
     private pair;
-    create(subject: string, parent?: AuthSession["parent"], environment?: string): Promise<CreatedAuthSession>;
+    private credentials;
+    private reuse;
+    private linkedRecord;
+    create(subject: string, parent?: AuthSession["parent"], environment?: string, parentExpiresAt?: number): Promise<CreatedAuthSession>;
     authenticate(token: string): Promise<AuthSession | null>;
     /** Trusted-server introspection; never expose this method as an unauthenticated endpoint. */
     inspect(sessionId: string): Promise<AuthSession | null>;

package/dist/Auth/SessionAuth.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionAuth = void 0;
+const crypto_1 = require("crypto");
 const DBConnection_1 = require("../Database/DBConnection");
 const AuthSecurity_1 = require("./AuthSecurity");
 function publicSession(record) {
@@ -21,13 +22,16 @@ function tokenSessionId(token) {
 /** Revocable, hashed, independently addressable device sessions. Legacy UserAuth is unaffected. */
 class SessionAuth {
     constructor(options) {
-        var _a;
+        var _a, _b;
         this.options = options;
         this.scope = Object.assign({ issuer: (0, AuthSecurity_1.authText)(options.issuer, "issuer"), audience: (0, AuthSecurity_1.authText)(options.audience, "audience"), scope: (0, AuthSecurity_1.authText)((_a = options.scope) !== null && _a !== void 0 ? _a : "main", "scope") }, (options.allowDynamicEnvironment && options.environment === undefined ? {}
             : { environment: options.environment === undefined ? null : (0, AuthSecurity_1.authText)(options.environment, "environment") }));
         this.accessSeconds = (0, AuthSecurity_1.authLifetime)(options.accessTokenSeconds, 15 * 60);
         this.sessionSeconds = (0, AuthSecurity_1.authLifetime)(options.sessionSeconds, 30 * 86400);
         this.idleSeconds = options.idleTimeoutSeconds === undefined || options.idleTimeoutSeconds === false ? false : (0, AuthSecurity_1.authLifetime)(options.idleTimeoutSeconds, 7 * 86400);
+        if (((_b = options.parentSessions) === null || _b === void 0 ? void 0 : _b.mode) === "reuse" && (typeof options.parentSessions.secret !== "string" || options.parentSessions.secret.length < 32)) {
+            throw new Error("Parent session reuse requires a strong server secret.");
+        }
         if (typeof options.isSessionAllowed !== "function")
             throw new Error("SessionAuth requires isSessionAllowed.");
     }
@@ -66,8 +70,82 @@ class SessionAuth {
         return { auth_token: access, refresh_token: refresh, auth_expires_at: record.accessExpiresAt,
             refresh_expires_at: Math.min(record.expiresAt, record.createdAt + this.sessionSeconds * 1000), session: publicSession(record) };
     }
-    create(subject, parent = null, environment) {
+    credentials(record) {
+        var _a, _b, _c;
+        if (!record.credentialState || !((_a = this.options.parentSessions) === null || _a === void 0 ? void 0 : _a.secret))
+            throw new Error("Linked session credentials are unavailable.");
+        const context = JSON.stringify([String(record._id), String(record._subject), record.issuer, record.audience,
+            record.scope, record.environment, (_b = record.parent) === null || _b === void 0 ? void 0 : _b.issuer, (_c = record.parent) === null || _c === void 0 ? void 0 : _c.sessionId]);
+        const derive = (kind) => (0, crypto_1.createHmac)("sha256", this.options.parentSessions.secret)
+            .update(JSON.stringify(["webframez-parent-session-v1", context, kind, record.credentialState[kind]])).digest("base64url");
+        return { access: `${record._id}.${derive("access")}`, refresh: `${record._id}.${derive("refresh")}`, csrf: derive("csrf") };
+    }
+    reuse(record) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!(yield this.allowed(record)))
+                throw new Error("Session is not allowed.");
+            const credentials = this.credentials(record);
+            if ((0, AuthSecurity_1.hashAuthToken)(credentials.access) !== record.accessHash || (0, AuthSecurity_1.hashAuthToken)(credentials.refresh) !== record.refreshHash
+                || (0, AuthSecurity_1.hashAuthToken)(credentials.csrf) !== record.csrfHash)
+                throw new Error("Linked session credentials have changed.");
+            if (record.accessExpiresAt <= Date.now()) {
+                yield this.renewAccess(credentials.refresh);
+                const current = yield (yield this.rows()).findOne(Object.assign({ _id: record._id }, this.scope));
+                if (!current || current.accessExpiresAt <= Date.now())
+                    throw new Error("Linked session access could not be renewed.");
+                return this.reuse(current);
+            }
+            const session = publicSession(record);
+            yield this.touch(session);
+            return Object.assign(Object.assign({}, this.pair(record, credentials.access, credentials.refresh)), { session, csrf_token: credentials.csrf, reused: true });
+        });
+    }
+    linkedRecord(record) {
         var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const db = yield (this.options.database ? this.options.database() : DBConnection_1.DBConnection.getDocumentStore(this.options.connection));
+            const links = db.collection(`${this.options.collection || "auth_sessions"}_links`);
+            const key = (0, AuthSecurity_1.hashAuthToken)(JSON.stringify([record.issuer, record.audience, record.scope, String(record._subject),
+                record.environment, record.parent.issuer, record.parent.sessionId]));
+            let link;
+            try {
+                link = yield links.findOneAndUpdate({ _id: key }, { $setOnInsert: Object.assign(Object.assign({}, this.scope), { environment: record.environment, sessionId: record._id, purgeAt: new Date(record.expiresAt) }) }, { upsert: true, returnDocument: "after" });
+            }
+            catch (error) {
+                if (error.code !== 11000)
+                    throw error;
+                link = yield links.findOne({ _id: key });
+            }
+            if (!link)
+                throw new Error("Linked session reference is unavailable.");
+            for (let attempt = 0; attempt < 5; attempt++) {
+                const candidate = Object.assign(Object.assign({}, record), { _id: link.sessionId, accessExpiresAt: Math.min(record.accessExpiresAt, record.expiresAt) });
+                const credentials = this.credentials(candidate);
+                Object.assign(candidate, { accessHash: (0, AuthSecurity_1.hashAuthToken)(credentials.access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(credentials.refresh), csrfHash: (0, AuthSecurity_1.hashAuthToken)(credentials.csrf) });
+                let stored;
+                try {
+                    stored = yield (yield this.rows()).findOneAndUpdate({ _id: candidate._id }, { $setOnInsert: candidate }, { upsert: true, returnDocument: "after" });
+                }
+                catch (error) {
+                    if (error.code !== 11000)
+                        throw error;
+                    stored = yield (yield this.rows()).findOne({ _id: candidate._id });
+                }
+                if (!stored)
+                    throw new Error("Linked session is unavailable.");
+                // A denied parent or membership must fail closed, rather than create another session.
+                if (stored.revokedAt === null && stored.expiresAt > Date.now()
+                    && stored.createdAt + this.sessionSeconds * 1000 > Date.now()
+                    && (this.idleSeconds === false || ((_a = stored.lastActiveAt) !== null && _a !== void 0 ? _a : stored.createdAt) + this.idleSeconds * 1000 > Date.now()))
+                    return stored;
+                link = (yield links.findOneAndUpdate({ _id: key, sessionId: stored._id }, { $set: { sessionId: this.ids().create(), purgeAt: new Date(record.expiresAt) } }, { returnDocument: "after" }))
+                    || (yield links.findOne({ _id: key }));
+            }
+            throw new Error("Linked session could not be established.");
+        });
+    }
+    create(subject, parent = null, environment, parentExpiresAt) {
+        var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
             (0, AuthSecurity_1.authText)(subject, "subject");
             if (environment !== undefined && (!this.options.allowDynamicEnvironment || this.options.environment !== undefined)) {
@@ -77,11 +155,21 @@ class SessionAuth {
                 (0, AuthSecurity_1.authText)(parent.issuer, "parent issuer");
                 (0, AuthSecurity_1.authText)(parent.sessionId, "parent session");
             }
+            if (parentExpiresAt !== undefined && (!parent || !Number.isFinite(parentExpiresAt) || parentExpiresAt <= Date.now())) {
+                throw new Error("Invalid parent session expiry.");
+            }
             const now = Date.now(), id = this.ids().create();
             const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, refresh = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, csrf = (0, AuthSecurity_1.randomAuthToken)();
-            const record = Object.assign(Object.assign({ _id: id, _subject: this.ids().create(subject) }, this.scope), { environment: environment === undefined ? (_a = this.scope.environment) !== null && _a !== void 0 ? _a : null : (0, AuthSecurity_1.authText)(environment, "environment"), parent: parent ? Object.assign({}, parent) : null, createdAt: now, lastActiveAt: now, expiresAt: now + this.sessionSeconds * 1000, accessExpiresAt: now + Math.min(this.accessSeconds, this.sessionSeconds) * 1000, accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh), csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf), usedRefreshHashes: [], revokedAt: null });
+            const record = Object.assign(Object.assign({ _id: id, _subject: this.ids().create(subject) }, this.scope), { environment: environment === undefined ? (_a = this.scope.environment) !== null && _a !== void 0 ? _a : null : (0, AuthSecurity_1.authText)(environment, "environment"), parent: parent ? Object.assign({}, parent) : null, createdAt: now, lastActiveAt: now, expiresAt: Math.min(now + this.sessionSeconds * 1000, parentExpiresAt !== null && parentExpiresAt !== void 0 ? parentExpiresAt : Infinity), accessExpiresAt: now + Math.min(this.accessSeconds, this.sessionSeconds) * 1000, accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh), csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf), usedRefreshHashes: [], revokedAt: null });
             if (!(yield this.allowed(record)))
                 throw new Error("Session is not allowed.");
+            if (parent && ((_b = this.options.parentSessions) === null || _b === void 0 ? void 0 : _b.mode) === "reuse") {
+                record.credentialState = { access: (0, AuthSecurity_1.randomAuthToken)(), refresh: (0, AuthSecurity_1.randomAuthToken)(), csrf: (0, AuthSecurity_1.randomAuthToken)() };
+                const stored = yield this.linkedRecord(record);
+                const pair = yield this.reuse(stored);
+                return Object.assign(Object.assign({}, pair), { reused: ((_c = stored.credentialState) === null || _c === void 0 ? void 0 : _c.access) !== record.credentialState.access });
+            }
+            record.accessExpiresAt = Math.min(record.accessExpiresAt, record.expiresAt);
             yield (yield this.rows()).insertOne(record);
             return Object.assign(Object.assign({}, this.pair(record, access, refresh)), { csrf_token: csrf });
         });
@@ -117,6 +205,7 @@ class SessionAuth {
     }
     /** One winner under concurrency. A previously consumed refresh token revokes its device session. */
     refresh(token) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             const id = tokenSessionId(token);
             if (!id)
@@ -135,11 +224,10 @@ class SessionAuth {
                 yield this.revoke(id);
                 return null;
             }
-            const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, refresh = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`;
-            const next = yield rows.findOneAndUpdate(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: hash }), this.liveFilter()), { $set: { accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh),
-                    accessExpiresAt: Math.min(Date.now() + this.accessSeconds * 1000, row.expiresAt, row.createdAt + this.sessionSeconds * 1000),
-                    lastActiveAt: Date.now(),
-                    usedRefreshHashes: [...row.usedRefreshHashes, hash] } }, { returnDocument: "after" });
+            const credentialState = row.credentialState ? Object.assign(Object.assign({}, row.credentialState), { access: (0, AuthSecurity_1.randomAuthToken)(), refresh: (0, AuthSecurity_1.randomAuthToken)() }) : undefined;
+            const credentials = credentialState ? this.credentials(Object.assign(Object.assign({}, row), { credentialState })) : null;
+            const access = (_a = credentials === null || credentials === void 0 ? void 0 : credentials.access) !== null && _a !== void 0 ? _a : `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, refresh = (_b = credentials === null || credentials === void 0 ? void 0 : credentials.refresh) !== null && _b !== void 0 ? _b : `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`;
+            const next = yield rows.findOneAndUpdate(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: hash }), this.liveFilter()), { $set: Object.assign(Object.assign({}, (credentialState ? { credentialState } : {})), { accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh), accessExpiresAt: Math.min(Date.now() + this.accessSeconds * 1000, row.expiresAt, row.createdAt + this.sessionSeconds * 1000), lastActiveAt: Date.now(), usedRefreshHashes: [...row.usedRefreshHashes, hash] }) }, { returnDocument: "after" });
             if (!next) {
                 // Also detect simultaneous replay that lost the compare-and-swap.
                 yield rows.updateOne(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { usedRefreshHashes: hash, revokedAt: null }), { $set: { revokedAt: Date.now() } });
@@ -168,10 +256,9 @@ class SessionAuth {
             const row = yield rows.findOne(filter);
             if (!row || !(yield this.allowed(row)))
                 return null;
-            const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, now = Date.now();
-            const next = yield rows.findOneAndUpdate(filter, { $set: { accessHash: (0, AuthSecurity_1.hashAuthToken)(access),
-                    accessExpiresAt: Math.min(now + this.accessSeconds * 1000, row.expiresAt, row.createdAt + this.sessionSeconds * 1000),
-                    lastActiveAt: now } }, { returnDocument: "after" });
+            const credentialState = row.credentialState ? Object.assign(Object.assign({}, row.credentialState), { access: (0, AuthSecurity_1.randomAuthToken)() }) : undefined;
+            const access = credentialState ? this.credentials(Object.assign(Object.assign({}, row), { credentialState })).access : `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, now = Date.now();
+            const next = yield rows.findOneAndUpdate(filter, { $set: Object.assign(Object.assign({}, (credentialState ? { credentialState } : {})), { accessHash: (0, AuthSecurity_1.hashAuthToken)(access), accessExpiresAt: Math.min(now + this.accessSeconds * 1000, row.expiresAt, row.createdAt + this.sessionSeconds * 1000), lastActiveAt: now }) }, { returnDocument: "after" });
             const session = next ? yield this.allowed(next) : null;
             return next && session ? Object.assign(Object.assign({}, this.pair(next, access, token)), { session }) : null;
         });

package/dist/Commands/QueueWorkerCommand.d.ts

@@ -11,6 +11,14 @@ export declare class QueueWorkerCommand extends ConsoleCommand {
     workerOperationId: string | null;
     workerHadError: boolean;
     lastAutomationCheckAt: any;
+    private stopping;
+    private automationRun;
+    private runtimeState;
+    private wakeWaiters;
+    private readonly stopSignal;
+    get workerInstanceKey(): string;
+    requestStop(): void;
+    private publishRuntimeState;
     jobsExecuted: number;
     jobsSucceeded: number;
     jobsFailed: number;
@@ -23,7 +31,7 @@ export declare class QueueWorkerCommand extends ConsoleCommand {
     init(): boolean;
     canStart(): boolean;
     random(min: number, max: number): number;
-    wait(ms: number): Promise<unknown>;
+    wait(ms: number): Promise<void>;
     waitRun(): Promise<unknown>;
     cancelRun(jobId: any): Promise<unknown>;
     updateWorkerStatus(values: {

package/dist/Commands/QueueWorkerCommand.js

@@ -14,6 +14,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.QueueWorkerCommand = void 0;
 const fs_1 = __importDefault(require("fs"));
+const crypto_1 = __importDefault(require("crypto"));
 const path_1 = __importDefault(require("path"));
 const moment_timezone_1 = __importDefault(require("moment-timezone"));
 const ConsoleCommand_1 = require("./ConsoleCommand");
@@ -40,12 +41,44 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
         this.workerOperationId = null;
         this.workerHadError = false;
         this.lastAutomationCheckAt = null;
+        this.stopping = false;
+        this.automationRun = null;
+        this.runtimeState = {};
+        this.wakeWaiters = new Set();
+        this.stopSignal = () => this.requestStop();
         // Statistics
         this.jobsExecuted = 0;
         this.jobsSucceeded = 0;
         this.jobsFailed = 0;
         this.lastJob = null;
     }
+    get workerInstanceKey() {
+        const instance = process.env.WEBFRAMEZ_QUEUE_INSTANCE;
+        if (instance && !/^[A-Za-z0-9_.-]+$/.test(instance))
+            throw new Error("Invalid queue instance ID");
+        return this.workerKey + (instance ? `--${instance}` : "");
+    }
+    requestStop() {
+        this.stopping = true;
+        try {
+            this.updateWorkerStatus({ status: "draining", status_at: new Date().toISOString() });
+        }
+        catch (error) {
+            // A telemetry/storage failure must not turn a graceful signal into a job interruption.
+            console.error("Could not publish queue drain status", error);
+        }
+        for (const wake of this.wakeWaiters)
+            wake();
+    }
+    publishRuntimeState(values) {
+        this.runtimeState = Object.assign(Object.assign(Object.assign({}, this.runtimeState), values), { pid: process.pid, worker: this.workerKey });
+        const target = process.env.WEBFRAMEZ_QUEUE_STATE_FILE;
+        if (!target)
+            return;
+        const temporary = `${target}.${process.pid}.tmp`;
+        fs_1.default.writeFileSync(temporary, JSON.stringify(this.runtimeState), { mode: 0o600 });
+        fs_1.default.renameSync(temporary, target);
+    }
     log(message) {
         this.writeln(`[${this.workerKey} | ${(0, moment_timezone_1.default)()
             .tz(this.workerConfig.timezone ? this.workerConfig.timezone : "Europe/Berlin")
@@ -101,31 +134,37 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
             const workerKey = this.getOption("worker");
             if (!workerKey || typeof workerKey !== "string" || workerKey.trim() === "") {
                 this.error("You must specify a worker key using --worker=<worker_key>");
+                this.workerHadError = true;
                 return;
             }
             this.workerConfig = Config_1.Config.get("queue.workers." + workerKey);
             if (!this.workerConfig) {
                 this.error(`Worker '${workerKey}' is not defined in the queue configuration.`);
+                this.workerHadError = true;
                 return;
             }
             if (!this.workerConfig.is_active) {
                 this.error(`Worker '${workerKey}' is disabled in the queue configuration.`);
+                this.workerHadError = true;
                 return;
             }
             this.workerKey = workerKey;
             this.startTime = (0, moment_timezone_1.default)().tz(this.workerConfig.timezone ? this.workerConfig.timezone : "Europe/Berlin");
             if (!this.init()) {
+                this.workerHadError = true;
                 return;
             }
+            process.on("SIGTERM", this.stopSignal);
+            process.on("SIGINT", this.stopSignal);
             this.workerOperationId = WebframezHooks_1.WebframezHooks.createOperationId("worker");
-            yield WebframezHooks_1.WebframezHooks.emit("queue.worker.start", {
-                operationId: this.workerOperationId,
-                name: workerKey,
-                attributes: {
-                    "webframez.queue.worker": workerKey,
-                },
-            });
             try {
+                yield WebframezHooks_1.WebframezHooks.emit("queue.worker.start", {
+                    operationId: this.workerOperationId,
+                    name: workerKey,
+                    attributes: {
+                        "webframez.queue.worker": workerKey,
+                    },
+                });
                 this.log("Queue started");
                 this.logRegisteredAutomation();
                 yield this.run();
@@ -158,21 +197,33 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
                 this.error(`Queue run failed: ${e instanceof Error ? e.message : String(e)}`);
             }
             finally {
-                if (!this.workerHadError && this.workerOperationId) {
-                    yield WebframezHooks_1.WebframezHooks.emit("queue.worker.end", {
-                        operationId: this.workerOperationId,
-                        name: workerKey,
-                        status: "ok",
-                        attributes: {
-                            "webframez.queue.worker": workerKey,
-                        },
+                this.stopping = true;
+                for (const wake of this.wakeWaiters)
+                    wake();
+                yield this.automationRun;
+                try {
+                    if (!this.workerHadError && this.workerOperationId) {
+                        yield WebframezHooks_1.WebframezHooks.emit("queue.worker.end", {
+                            operationId: this.workerOperationId,
+                            name: workerKey,
+                            status: "ok",
+                            attributes: {
+                                "webframez.queue.worker": workerKey,
+                            },
+                        });
+                    }
+                    this.log("Queue stopped");
+                    this.updateWorkerStatus({
+                        status: "stopped",
+                        ended_at: new Date().toISOString(),
+                        current_job: null,
+                        current_job_number: null,
                     });
                 }
-                this.log("Queue stopped");
-                this.updateWorkerStatus({
-                    status: "stopped",
-                    ended_at: new Date().toISOString(),
-                });
+                finally {
+                    process.off("SIGTERM", this.stopSignal);
+                    process.off("SIGINT", this.stopSignal);
+                }
             }
         });
     }
@@ -187,7 +238,7 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
         if (!fs_1.default.existsSync((0, FileFunctions_1.storageDir)("queue"))) {
             fs_1.default.mkdirSync((0, FileFunctions_1.storageDir)("queue"), { recursive: true });
         }
-        const filePath = (0, FileFunctions_1.storageDir)("queue", `worker_${this.workerKey}.json`);
+        const filePath = (0, FileFunctions_1.storageDir)("queue", `worker_${this.workerInstanceKey}.json`);
         let lastLogFile = null;
         if (fs_1.default.existsSync(filePath)) {
             try {
@@ -207,7 +258,7 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
         return true;
     }
     canStart() {
-        const filePath = (0, FileFunctions_1.storageDir)("queue", `worker_${this.workerKey}.json`);
+        const filePath = (0, FileFunctions_1.storageDir)("queue", `worker_${this.workerInstanceKey}.json`);
         if (!fs_1.default.existsSync(filePath)) {
             return true;
         }
@@ -242,8 +293,16 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
     }
     wait(ms) {
         return __awaiter(this, void 0, void 0, function* () {
-            return new Promise((resolve) => {
-                setTimeout(() => resolve(true), ms);
+            if (this.stopping)
+                return;
+            yield new Promise((resolve) => {
+                const done = () => {
+                    clearTimeout(timer);
+                    this.wakeWaiters.delete(done);
+                    resolve();
+                };
+                const timer = setTimeout(done, ms);
+                this.wakeWaiters.add(done);
             });
         });
     }
@@ -254,6 +313,7 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
                     status: "waiting",
                     status_at: new Date().toISOString(),
                     current_job: null,
+                    current_job_number: null,
                 });
                 yield this.wait(1000);
                 resolve(true);
@@ -277,7 +337,10 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
         });
     }
     updateWorkerStatus(values) {
-        const filePath = (0, FileFunctions_1.storageDir)("queue", `worker_${this.workerKey}.json`);
+        if (this.stopping && values.status !== "stopped")
+            values = Object.assign(Object.assign({}, values), { status: "draining" });
+        this.publishRuntimeState(values);
+        const filePath = (0, FileFunctions_1.storageDir)("queue", `worker_${this.workerInstanceKey}.json`);
         if (!fs_1.default.existsSync(filePath))
             return;
         const json = JSON.parse(fs_1.default.readFileSync(filePath, "utf-8"));
@@ -378,6 +441,8 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
                         continue;
                     }
                     for (let automation of checkAutomation) {
+                        if (this.checkStop())
+                            break;
                         if (!automation || !automation.jobclass || !automation._execution || !automation._execution.key) {
                             continue;
                         }
@@ -391,6 +456,7 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
                         // Create the automation job
                         const now = (0, moment_timezone_1.default)().tz(this.workerConfig.timezone ? this.workerConfig.timezone : "Europe/Berlin");
                         const newJob = {
+                            _id: yield DBConnection_1.DBConnection.objectId(crypto_1.default.createHash("sha256").update("queue-automation:" + automation._execution.key).digest("hex").slice(0, 24)),
                             jobclass: automation.jobclass,
                             number: yield this.getNextJobNumber(connection),
                             is_automated: true,
@@ -406,7 +472,17 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
                             executions: [],
                             worker: this.workerKey,
                         };
-                        yield DBConnection_1.DBConnection.documentStore(connection).collection("queue_jobs").insertOne(newJob);
+                        if (this.checkStop())
+                            break;
+                        try {
+                            yield DBConnection_1.DBConnection.documentStore(connection).collection("queue_jobs").insertOne(newJob);
+                        }
+                        catch (error) {
+                            // Concurrent replicas may schedule the same occurrence; the primary key arbitrates.
+                            const existing = yield DBConnection_1.DBConnection.documentStore(connection).collection("queue_jobs").findOne({ _id: newJob._id });
+                            if (!existing)
+                                throw error;
+                        }
                     }
                     yield this.wait(5000);
                 }
@@ -436,9 +512,11 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
         });
     }
     checkStop() {
+        if (this.stopping)
+            return true;
         if (!this.workerKey)
             return false;
-        const stopFilePath = path_1.default.join((0, FileFunctions_1.storageDir)(), "queue", this.workerKey + ".stop");
+        const stopFilePath = path_1.default.join((0, FileFunctions_1.storageDir)(), "queue", this.workerInstanceKey + ".stop");
         if (fs_1.default.existsSync(stopFilePath)) {
             if (this.autorestart) {
                 fs_1.default.writeFileSync(path_1.default.join((0, FileFunctions_1.storageDir)(), "queue", this.workerKey + ".stop-autorestart"), JSON.stringify({ date: new Date() }));
@@ -450,7 +528,8 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
     run() {
         return __awaiter(this, void 0, void 0, function* () {
             const connection = yield DBConnection_1.DBConnection.getConnection();
-            this.runAutomation();
+            this.updateWorkerStatus({ status: "waiting", current_job: null });
+            this.automationRun = this.runAutomation();
             while (true) {
                 const now = (0, moment_timezone_1.default)().tz(this.workerConfig.timezone ? this.workerConfig.timezone : "Europe/Berlin");
                 if (this.checkStop()) {
@@ -486,6 +565,12 @@ class QueueWorkerCommand extends ConsoleCommand_1.ConsoleCommand {
                     returnDocument: "after",
                 });
                 const job = jobUpdate;
+                // A signal can arrive while the atomic claim is in flight. Return that claim before executing it.
+                if (this.checkStop()) {
+                    if (job === null || job === void 0 ? void 0 : job._id)
+                        yield DBConnection_1.DBConnection.documentStore(connection).collection("queue_jobs").updateOne({ _id: job._id, status: "running", worker: this.workerKey }, { $set: { status: "pending", started_at: null } });
+                    break;
+                }
                 if (!job || !job.jobclass || !job._id) {
                     this.currentJob = null;
                     if (job && job._id) {

package/dist/ConsoleApplication.js

@@ -105,6 +105,10 @@ class ConsoleApplication {
                     if (options && options.onEnd) {
                         yield options.onEnd(command.signature);
                     }
+                    // Managed workers must terminate even when a database driver keeps sockets open.
+                    if (command.signature === "queue:worker" && process.env.WEBFRAMEZ_QUEUE_STATE_FILE) {
+                        process.exit(commandInstance.workerHadError ? 1 : 0);
+                    }
                 }
                 catch (e) {
                     yield ErrorHandler_1.ErrorHandler.report(e, {

package/docs/authentication.md

@@ -562,3 +562,25 @@ access nor refresh credentials need appear in navigation URLs. Configure a stron
 and an instance-specific audience. Create TTL indexes on `auth_handoffs.purgeAt`,
 `auth_sso_transactions.purgeAt` and `auth_sso_codes.purgeAt`, or schedule their cleanup methods.
 SSO introspection records successful central session activity, respecting its absolute expiry.
+
+### Linked parent session reuse
+
+`session.parentSessions: { mode: "reuse", secret: serverSecret }` opts into one local
+session per exact parent issuer/session, user, scope, audience and environment. The default
+`mode: "new"` retains independent session creation. Logins without a parent remain independent.
+The secret must be at least 32 characters and stay stable across all processes of an instance.
+Core stores hashes and independent random credential nonces, never plaintext tokens; a
+domain-separated HMAC derives the current credentials only on the trusted server. Rotation
+updates both hashes and nonces atomically. Reopening returns the current pair without rotating
+refresh or resetting the login timestamp. `auth_sessions_links` uses its primary key for atomic
+creation; add an optional TTL index on `purgeAt` for housekeeping. Session `_id` and `_subject`
+continue to use driver-native IDs. A revoked/expired local child creates a new generation.
+Changing the secret requires revoking existing linked sessions before reauthentication.
+
+Trusted callers can pass parent expiry as the fifth argument to
+`Auth.scope().establishBearerSession(request, subject, parent, environment, parentExpiresAt)`
+or fourth argument to `sessions.create`. It caps child expiry. Parent revocation must still be
+checked by `isSessionAllowed` on every authentication/refresh. To enforce logout on the next
+request, do not cache positive introspection results. This requires one authority round trip
+per check and fails closed when the authority is unavailable. No browser push is implied;
+clients detect logout when making their next authenticated request.

package/docs/queue-workers.md

@@ -0,0 +1,9 @@
+# Managed queue workers
+
+`queue:worker --worker=<key>` handles SIGTERM and SIGINT by stopping new claims and automated scheduling, then finishing the current job and persisting its result. A claim that completes after a stop request is returned to pending without executing its handler. Repeated stop signals remain graceful; SIGKILL is the explicit force operation.
+
+The server runtime assigns `WEBFRAMEZ_QUEUE_INSTANCE` for independent status files and `WEBFRAMEZ_QUEUE_STATE_FILE` for readiness/drain telemetry. The worker configuration key still controls routing and job selection. When the managed console finishes its command/application completion hooks, it exits even if a database connection keeps Node sockets open. Run queue:worker directly under the runtime; do not nest queue:start or queue:worker:autorestart.
+
+Automatic schedule occurrences have deterministic primary keys, preventing concurrent managed workers from creating the same occurrence twice. Existing pending jobs still use an atomic claim.
+
+Graceful draining does not make job side effects transactional. A forcibly killed job may remain running in the database and have partially completed external work. Check its effects before manually recovering/retrying it.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webtypen/webframez-core",
-    "version": "0.3.78",
+    "version": "0.3.81",
     "description": "The core package of the typescript based webframez (web-framework) by webtypen.de",
     "homepage": "https://webtypen.de/",
     "license": "MIT",
@@ -32,7 +32,8 @@
         "auth-client.js",
         "auth-client.d.ts",
         "bearer-auth-client.js",
-        "bearer-auth-client.d.ts"
+        "bearer-auth-client.d.ts",
+        "docs/queue-workers.md"
     ],
     "scripts": {
         "build": "tsc",