alepha 0.20.2 → 0.20.4

package/dist/api/users/index.js

@@ -3,7 +3,7 @@ import { AuditService } from "alepha/api/audits";
 import { $bucket } from "alepha/bucket";
 import { $issuer, $permission, $secure, CryptoProvider, InvalidCredentialsError, SecurityProvider } from "alepha/security";
 import { $action, BadRequestError, ConflictError, HttpError, UnauthorizedError, okSchema } from "alepha/server";
-import { $entity, $repository, db, pageQuerySchema, parseQueryString, sql } from "alepha/orm";
+import { $entity, $repository, db, pageQuerySchema, sql } from "alepha/orm";
 import { $logger } from "alepha/logger";
 import { $client } from "alepha/server/links";
 import { $notification } from "alepha/api/notifications";
@@ -202,7 +202,11 @@ const realmAuthSettingsAtom = $atom({
 				default: 900 * 1e3,
 				minimum: 1e3
 			})
-		})
+		}),
+		refreshToken: t.object({ expirationIdle: t.optional(t.integer({
+			description: "Maximum time in milliseconds a refresh token may stay unused before being invalidated. When set, sessions whose last refresh is older than this window are rejected and deleted, even if the absolute `expiresAt` has not been reached. Recommended for SaaS auth posture (SOC2/ISO27001). Leave undefined to disable idle invalidation (default).",
+			minimum: 1e3
+		})) })
 	}),
 	default: {
 		registrationAllowed: true,
@@ -229,7 +233,8 @@ const realmAuthSettingsAtom = $atom({
 			ipMaxAttempts: 15,
 			accountMaxAttempts: 5,
 			windowMs: 900 * 1e3
-		}
+		},
+		refreshToken: {}
 	}
 });
 //#endregion
@@ -244,6 +249,12 @@ const sessions = $entity({
 		refreshToken: t.uuid(),
 		userId: db.ref(t.uuid(), () => users.cols.id),
 		expiresAt: t.datetime(),
+		/**
+		* Last time the session was used to refresh an access token.
+		* Used by realm `refreshToken.expirationIdle` to invalidate idle sessions.
+		* `null` on existing rows pre-migration — falls back to `createdAt`.
+		*/
+		lastUsedAt: t.optional(t.datetime()),
 		ip: t.optional(t.text()),
 		userAgent: t.optional(t.object({
 			os: t.text(),
@@ -300,6 +311,10 @@ var RealmProvider = class {
 				loginRateLimit: {
 					...realmAuthSettingsAtom.options.default.loginRateLimit,
 					...realmOptions.settings?.loginRateLimit
+				},
+				refreshToken: {
+					...realmAuthSettingsAtom.options.default.refreshToken,
+					...realmOptions.settings?.refreshToken
 				}
 			},
 			features,
@@ -628,8 +643,7 @@ const userQuerySchema = t.extend(pageQuerySchema, {
 	email: t.optional(t.string()),
 	enabled: t.optional(t.boolean()),
 	emailVerified: t.optional(t.boolean()),
-	roles: t.optional(t.array(t.string())),
-	query: t.optional(t.text())
+	roles: t.optional(t.array(t.string()))
 });
 //#endregion
 //#region ../../src/api/users/schemas/userResourceSchema.ts
@@ -940,7 +954,6 @@ var UserService = class {
 		if (q.enabled !== void 0) where.enabled = { eq: q.enabled };
 		if (q.emailVerified !== void 0) where.emailVerified = { eq: q.emailVerified };
 		if (q.roles) where.roles = { arrayContains: q.roles };
-		if (q.query) Object.assign(where, parseQueryString(q.query));
 		const result = await this.users(userRealmName).paginate(q, { where }, { count: true });
 		this.log.debug("Users found", {
 			count: result.content.length,
@@ -2104,10 +2117,18 @@ var UserJobs = class {
 	log = $logger();
 	dateTimeProvider = $inject(DateTimeProvider);
 	sessionRepository = $repository(sessions);
+	realmProvider = $inject(RealmProvider);
 	/**
 	* Purge expired sessions from the database.
 	*
-	* Runs hourly (at :00) and deletes sessions whose `expiresAt` has passed.
+	* Runs hourly (at :00) and deletes:
+	* - sessions whose absolute `expiresAt` has passed
+	* - sessions whose `lastUsedAt` exceeds the realm's `refreshToken.expirationIdle`
+	*   (when configured). Falls back to `createdAt` for sessions without a
+	*   recorded `lastUsedAt`.
+	*
+	* The idle sweep is best-effort cleanup — runtime enforcement happens in
+	* `SessionService.refreshSession()`.
 	*/
 	purgeExpiredSessions = $job({
 		name: "api:users:purgeExpiredSessions",
@@ -2115,14 +2136,22 @@ var UserJobs = class {
 		handler: async () => {
 			const now = this.dateTimeProvider.nowISOString();
 			this.log.info("Starting expired sessions purge", { cutoffTime: now });
-			const expiredSessions = await this.sessionRepository.findMany({ where: { expiresAt: { lt: now } } });
-			if (expiredSessions.length === 0) {
-				this.log.info("No expired sessions found");
-				return;
+			const absoluteDeletedIds = await this.sessionRepository.deleteMany({ expiresAt: { lt: now } });
+			if (absoluteDeletedIds.length > 0) this.log.info("Expired sessions purged (absolute)", { deletedCount: absoluteDeletedIds.length });
+			const idleMs = (await this.realmProvider.getRealm().getSettings()).refreshToken?.expirationIdle;
+			if (idleMs && idleMs > 0) {
+				const cutoff = this.dateTimeProvider.now().subtract(idleMs, "milliseconds").toISOString();
+				const lastUsedDeletedIds = await this.sessionRepository.deleteMany({ lastUsedAt: { lt: cutoff } });
+				const fallbackDeletedIds = await this.sessionRepository.deleteMany({
+					lastUsedAt: { isNull: true },
+					createdAt: { lt: cutoff }
+				});
+				const idleTotal = lastUsedDeletedIds.length + fallbackDeletedIds.length;
+				if (idleTotal > 0) this.log.info("Expired sessions purged (idle)", {
+					deletedCount: idleTotal,
+					thresholdMs: idleMs
+				});
 			}
-			this.log.info("Found expired sessions", { count: expiredSessions.length });
-			const deletedIds = await this.sessionRepository.deleteMany({ expiresAt: { lt: now } });
-			this.log.info("Expired sessions purged successfully", { deletedCount: deletedIds.length });
 		}
 	});
 };
@@ -2453,6 +2482,7 @@ var SessionService = class SessionService {
 		const session = await this.sessions(userRealmName).create({
 			userId: user.id,
 			expiresAt,
+			lastUsedAt: this.dateTimeProvider.nowISOString(),
 			ip: request?.ip,
 			userAgent: request?.userAgent,
 			refreshToken
@@ -2480,6 +2510,21 @@ var SessionService = class SessionService {
 			await this.sessions(userRealmName).deleteById(session.id);
 			throw new UnauthorizedError("Session expired");
 		}
+		const idleMs = (await this.realmProvider.getRealm(userRealmName).getSettings()).refreshToken?.expirationIdle;
+		if (idleMs && idleMs > 0) {
+			const lastUsedRef = session.lastUsedAt ?? session.createdAt;
+			const idleSince = now.diff(this.dateTimeProvider.of(lastUsedRef));
+			if (idleSince > idleMs) {
+				this.log.info("Session expired (idle timeout)", {
+					sessionId: session.id,
+					userId: session.userId,
+					idleMs: idleSince,
+					thresholdMs: idleMs
+				});
+				await this.sessions(userRealmName).deleteById(session.id);
+				throw new UnauthorizedError("Session expired");
+			}
+		}
 		const user = await this.users(userRealmName).getOne({ where: { id: { eq: session.userId } } });
 		if (!user.enabled) {
 			this.log.warn("Session refresh for disabled account", {
@@ -2490,6 +2535,7 @@ var SessionService = class SessionService {
 			throw new UnauthorizedError("Account disabled");
 		}
 		await this.ensureAdminRole(user, userRealmName);
+		await this.sessions(userRealmName).updateById(session.id, { lastUsedAt: now.toISOString() });
 		this.log.debug("Session refreshed", {
 			sessionId: session.id,
 			userId: session.userId