create-snapify-app 0.0.0-stage → 1.1.0

package/template/server/security/audit.ts

@@ -0,0 +1,143 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import type { NextFunction, Request, Response } from 'express';
+import { and, desc, eq, gte, ilike, like, lt, lte, or, sql, type SQL } from 'drizzle-orm';
+import { db } from '../db/client';
+import { auditLog } from '../db/schema';
+import { clientIp } from './ip';
+import type { AuthedRequest } from '../middleware/adminAuth';
+
+export interface AuditEntry {
+  action: string;
+  target?: string;
+  detail?: Record<string, unknown>;
+  userId?: string;
+  userEmail?: string;
+}
+
+/** Écrit une entrée du journal ; une erreur d'écriture ne fait jamais échouer la requête. */
+export async function audit(req: Request | null, entry: AuditEntry): Promise<void> {
+  const admin = (req as AuthedRequest | null)?.admin;
+  try {
+    await db.insert(auditLog).values({
+      action: entry.action,
+      target: entry.target?.slice(0, 300),
+      detail: entry.detail,
+      userId: entry.userId ?? admin?.sub,
+      userEmail: entry.userEmail ?? admin?.email,
+      ip: req ? clientIp(req) : null,
+      userAgent: req ? String(req.headers['user-agent'] || '').slice(0, 300) : null,
+    });
+  } catch (e) {
+    console.error('[audit] écriture impossible', e);
+  }
+}
+
+/** Actions déduites des routes d'administration (méthode + chemin relatif à /api/admin). */
+const RULES: [string, RegExp, string][] = [
+  ['PUT', /^general$/, 'settings.general'],
+  ['PUT', /^branding$/, 'appearance.branding'],
+  ['PUT', /^settings$/, 'settings.site'],
+  ['PUT', /^seo-settings$/, 'seo.settings'],
+  ['PUT', /^floating-buttons$/, 'engagement.update'],
+  ['PUT', /^newsletter$/, 'newsletter.settings'],
+  ['PUT', /^google$/, 'seo.google'],
+  ['POST', /^google\/disconnect$/, 'seo.google_disconnect'],
+  ['PUT', /^menus\/([^/]+)$/, 'menu.update'],
+  ['PUT', /^redirects$/, 'seo.redirects'],
+  ['POST', /^pages$/, 'page.create'],
+  ['PUT', /^pages\/([^/]+)$/, 'page.update'],
+  ['DELETE', /^pages\/([^/]+)$/, 'page.delete'],
+  ['POST', /^pages\/([^/]+)\/revisions\/[^/]+\/restore$/, 'page.restore'],
+  ['POST', /^posts$/, 'post.create'],
+  ['PUT', /^posts\/([^/]+)$/, 'post.update'],
+  ['DELETE', /^posts\/([^/]+)$/, 'post.delete'],
+  ['POST', /^posts\/([^/]+)\/revisions\/[^/]+\/restore$/, 'post.restore'],
+  ['PUT', /^forms\/([^/]+)$/, 'form.update'],
+  ['DELETE', /^submissions\/([^/]+)$/, 'submission.delete'],
+  ['POST', /^media\/upload$/, 'media.upload'],
+  ['PATCH', /^media\/([^/]+)$/, 'media.update'],
+  ['DELETE', /^media\/([^/]+)$/, 'media.delete'],
+  ['PATCH', /^subscribers\/([^/]+)$/, 'subscriber.update'],
+  ['DELETE', /^subscribers\/([^/]+)$/, 'subscriber.delete'],
+  ['POST', /^modules\/upload$/, 'module.upload'],
+  ['POST', /^modules\/install$/, 'module.install'],
+  ['PUT', /^modules\/([^/]+)\/settings$/, 'module.settings'],
+  ['POST', /^modules\/([^/]+)\/enabled$/, 'module.toggle'],
+  ['POST', /^modules\/([^/]+)\/license$/, 'module.license'],
+  ['DELETE', /^modules\/([^/]+)$/, 'module.delete'],
+  ['POST', /^marketplace\/([^/]+)\/stage$/, 'marketplace.download'],
+  ['POST', /^themes\/([^/]+)\/activate$/, 'theme.activate'],
+  ['PUT', /^themes\/([^/]+)\/settings$/, 'theme.customize'],
+  ['DELETE', /^themes\/([^/]+)$/, 'theme.delete'],
+];
+
+declare module 'express-serve-static-core' {
+  interface Locals {
+    /** `false` = ne pas journaliser ; objet = entrée explicite (prioritaire sur les règles). */
+    audit?: false | Partial<AuditEntry>;
+  }
+}
+
+/** Journalise automatiquement les modifications réussies faites depuis l'administration. */
+export function auditMiddleware(req: Request, res: Response, next: NextFunction) {
+  if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next();
+  res.on('finish', () => {
+    const explicit = res.locals.audit;
+    if (explicit === false || res.statusCode >= 400 || !(req as AuthedRequest).admin) return;
+    const rel = req.originalUrl.split('?')[0].replace(/^\/api\/admin\/?/, '').replace(/\/$/, '');
+    const rule = RULES.find(([m, re]) => m === req.method && re.test(rel));
+    const action = explicit?.action ?? rule?.[2];
+    if (!action) return;
+    const target = explicit?.target ?? (rule ? rel.match(rule[1])?.[1] : undefined);
+    void audit(req, { action, target: target ? decodeURIComponent(target) : undefined, detail: explicit?.detail });
+  });
+  next();
+}
+
+export interface AuditQuery {
+  userId?: string;
+  action?: string;
+  q?: string;
+  from?: Date;
+  to?: Date;
+  page: number;
+  pageSize: number;
+}
+
+export async function queryAudit(qry: AuditQuery) {
+  const where: SQL[] = [];
+  if (qry.userId) where.push(eq(auditLog.userId, qry.userId));
+  if (qry.action) where.push(qry.action.endsWith('.') ? like(auditLog.action, `${qry.action}%`) : eq(auditLog.action, qry.action));
+  if (qry.from) where.push(gte(auditLog.ts, qry.from));
+  if (qry.to) where.push(lte(auditLog.ts, qry.to));
+  if (qry.q) {
+    const term = `%${qry.q.replace(/[%_]/g, '')}%`;
+    where.push(or(ilike(auditLog.userEmail, term), ilike(auditLog.target, term), ilike(auditLog.ip, term), ilike(auditLog.action, term))!);
+  }
+  const cond = where.length ? and(...where) : undefined;
+  const [items, [{ total }]] = await Promise.all([
+    db
+      .select()
+      .from(auditLog)
+      .where(cond)
+      .orderBy(desc(auditLog.ts), desc(auditLog.id))
+      .limit(qry.pageSize)
+      .offset((qry.page - 1) * qry.pageSize),
+    db.select({ total: sql<number>`count(*)::int` }).from(auditLog).where(cond),
+  ]);
+  return { items, total };
+}
+
+export async function purgeAudit(days: number): Promise<number> {
+  if (days <= 0) return 0;
+  const rows = await db
+    .delete(auditLog)
+    .where(lt(auditLog.ts, new Date(Date.now() - days * 86400_000)))
+    .returning({ id: auditLog.id });
+  return rows.length;
+}

package/template/server/security/authTokens.ts

@@ -0,0 +1,74 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/** Liens à usage unique (invitation, réinitialisation du mot de passe). Seule l'empreinte est stockée. */
+import { and, eq, gt, isNull, lt, or } from 'drizzle-orm';
+import { db } from '../db/client';
+import { authTokens } from '../db/schema';
+import { randomToken, sha256 } from './secrets';
+
+export type AuthTokenKind = 'invite' | 'reset';
+
+export const TOKEN_TTL: Record<AuthTokenKind, number> = {
+  invite: 7 * 86400_000,
+  reset: 60 * 60_000,
+};
+
+/** Crée un lien et invalide les précédents du même type pour ce compte. */
+export async function issueAuthToken(userId: string, kind: AuthTokenKind, createdBy?: string): Promise<{ token: string; expiresAt: Date }> {
+  const token = randomToken(32);
+  const expiresAt = new Date(Date.now() + TOKEN_TTL[kind]);
+  await db.transaction(async (tx) => {
+    await tx
+      .update(authTokens)
+      .set({ usedAt: new Date() })
+      .where(and(eq(authTokens.userId, userId), eq(authTokens.kind, kind), isNull(authTokens.usedAt)));
+    await tx.insert(authTokens).values({ id: sha256(token), userId, kind, expiresAt, createdBy });
+  });
+  return { token, expiresAt };
+}
+
+export async function findAuthToken(token: string) {
+  if (!token || token.length > 200) return null;
+  const [row] = await db
+    .select()
+    .from(authTokens)
+    .where(and(eq(authTokens.id, sha256(token)), isNull(authTokens.usedAt), gt(authTokens.expiresAt, new Date())))
+    .limit(1);
+  return row ?? null;
+}
+
+/** Marque le jeton comme utilisé ; `false` s'il l'était déjà (deux onglets simultanés). */
+export async function consumeAuthToken(token: string): Promise<boolean> {
+  const rows = await db
+    .update(authTokens)
+    .set({ usedAt: new Date() })
+    .where(and(eq(authTokens.id, sha256(token)), isNull(authTokens.usedAt)))
+    .returning({ id: authTokens.id });
+  return rows.length > 0;
+}
+
+export async function revokeAuthTokens(userId: string) {
+  await db.update(authTokens).set({ usedAt: new Date() }).where(and(eq(authTokens.userId, userId), isNull(authTokens.usedAt)));
+}
+
+export async function pendingInvite(userId: string) {
+  const [row] = await db
+    .select({ expiresAt: authTokens.expiresAt })
+    .from(authTokens)
+    .where(and(eq(authTokens.userId, userId), eq(authTokens.kind, 'invite'), isNull(authTokens.usedAt)))
+    .limit(1);
+  return row ?? null;
+}
+
+export async function purgeAuthTokens(): Promise<number> {
+  const limit = new Date(Date.now() - 30 * 86400_000);
+  const rows = await db
+    .delete(authTokens)
+    .where(or(lt(authTokens.expiresAt, limit), lt(authTokens.usedAt, limit)))
+    .returning({ id: authTokens.id });
+  return rows.length;
+}

package/template/server/security/ip.ts

@@ -0,0 +1,68 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import net from 'net';
+import type { Request } from 'express';
+
+export function normalizeIp(ip: string): string {
+  const v = ip.trim();
+  return v.startsWith('::ffff:') && net.isIPv4(v.slice(7)) ? v.slice(7) : v.toLowerCase();
+}
+
+export const clientIp = (req: Request) => normalizeIp(req.ip || req.socket.remoteAddress || '');
+
+const ipv4ToInt = (ip: string) => ip.split('.').reduce((acc, n) => (acc << 8) + Number(n), 0) >>> 0;
+
+/** Entrée valide : IPv4, IPv6 ou plage CIDR IPv4 (`10.0.0.0/8`). */
+export function isValidIpRule(rule: string): boolean {
+  const [addr, bits, extra] = rule.trim().split('/');
+  if (extra !== undefined) return false;
+  if (bits === undefined) return net.isIP(addr) !== 0;
+  const n = Number(bits);
+  return net.isIPv4(addr) && Number.isInteger(n) && n >= 0 && n <= 32;
+}
+
+export function ipMatches(ip: string, rule: string): boolean {
+  const target = normalizeIp(ip);
+  const [addr, bits] = rule.trim().split('/');
+  if (bits === undefined) return normalizeIp(addr) === target;
+  if (!net.isIPv4(addr) || !net.isIPv4(target)) return false;
+  const n = Number(bits);
+  const mask = n === 0 ? 0 : (~0 << (32 - n)) >>> 0;
+  return (ipv4ToInt(addr) & mask) === (ipv4ToInt(target) & mask);
+}
+
+export const ipAllowed = (ip: string, rules: string[]) => !rules.length || rules.some((r) => ipMatches(ip, r));
+
+/** Libellé lisible d'un user-agent : « Chrome · macOS ». */
+export function describeUserAgent(ua: string | undefined | null): string {
+  if (!ua) return 'Appareil inconnu';
+  const browser = /Edg\//.test(ua)
+    ? 'Edge'
+    : /OPR\//.test(ua)
+      ? 'Opera'
+      : /Firefox\//.test(ua)
+        ? 'Firefox'
+        : /Chrome\//.test(ua)
+          ? 'Chrome'
+          : /Safari\//.test(ua)
+            ? 'Safari'
+            : /curl\//i.test(ua)
+              ? 'curl'
+              : 'Navigateur';
+  const os = /iPhone|iPad/.test(ua)
+    ? 'iOS'
+    : /Android/.test(ua)
+      ? 'Android'
+      : /Mac OS X/.test(ua)
+        ? 'macOS'
+        : /Windows/.test(ua)
+          ? 'Windows'
+          : /Linux/.test(ua)
+            ? 'Linux'
+            : '';
+  return os ? `${browser} · ${os}` : browser;
+}

package/template/server/security/rateLimit.ts

@@ -0,0 +1,85 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/** Compteurs en mémoire à fenêtre fixe (processus unique sous PM2). */
+import type { NextFunction, Request, Response } from 'express';
+import { HttpError } from '../http';
+
+interface Bucket {
+  count: number;
+  resetAt: number;
+}
+
+const buckets = new Map<string, Bucket>();
+
+const sweep = setInterval(() => {
+  const now = Date.now();
+  for (const [k, b] of buckets) if (b.resetAt <= now) buckets.delete(k);
+}, 5 * 60_000);
+sweep.unref();
+
+export interface LimitResult {
+  ok: boolean;
+  remaining: number;
+  retryAfterSec: number;
+}
+
+/** Compte un appel ; `max <= 0` = illimité. */
+export function hit(key: string, max: number, windowMs: number): LimitResult {
+  if (max <= 0) return { ok: true, remaining: Infinity, retryAfterSec: 0 };
+  const now = Date.now();
+  let b = buckets.get(key);
+  if (!b || b.resetAt <= now) {
+    b = { count: 0, resetAt: now + windowMs };
+    buckets.set(key, b);
+  }
+  const retryAfterSec = Math.max(1, Math.ceil((b.resetAt - now) / 1000));
+  if (b.count >= max) return { ok: false, remaining: 0, retryAfterSec };
+  b.count++;
+  return { ok: true, remaining: max - b.count, retryAfterSec };
+}
+
+/** Vérifie sans compter (verrouillage après échecs de connexion). */
+export function peek(key: string, max: number): LimitResult {
+  const b = buckets.get(key);
+  const now = Date.now();
+  if (!b || b.resetAt <= now || max <= 0) return { ok: true, remaining: max, retryAfterSec: 0 };
+  const retryAfterSec = Math.max(1, Math.ceil((b.resetAt - now) / 1000));
+  return b.count >= max ? { ok: false, remaining: 0, retryAfterSec } : { ok: true, remaining: max - b.count, retryAfterSec };
+}
+
+export function reset(key: string) {
+  buckets.delete(key);
+}
+
+export function resetPrefix(prefix: string) {
+  for (const k of buckets.keys()) if (k.startsWith(prefix)) buckets.delete(k);
+}
+
+export function formatWait(sec: number): string {
+  if (sec < 60) return `${sec} s`;
+  const min = Math.ceil(sec / 60);
+  return min < 60 ? `${min} min` : `${Math.ceil(min / 60)} h`;
+}
+
+export function rateLimitError(res: Response, r: LimitResult, message = 'Trop de requêtes'): HttpError {
+  res.setHeader('Retry-After', String(r.retryAfterSec));
+  return new HttpError(429, `${message}. Réessayez dans ${formatWait(r.retryAfterSec)}.`);
+}
+
+/** Middleware : `limit` est relu à chaque requête pour suivre les réglages. */
+export function rateLimit(name: string, limit: () => Promise<{ max: number; windowMs: number }>, key: (req: Request) => string) {
+  return async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const { max, windowMs } = await limit();
+      const r = hit(`${name}:${key(req)}`, max, windowMs);
+      if (!r.ok) return next(rateLimitError(res, r));
+      next();
+    } catch (e) {
+      next(e);
+    }
+  };
+}

package/template/server/security/retention.ts

@@ -0,0 +1,46 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+/** Purge quotidienne selon les durées de conservation des paramètres « Données ». */
+import { pruneAnalytics } from '../cms/analyticsStore';
+import { loadSnapshot, updateSnapshot } from '../cms/store';
+import { purgeMailLog } from '../mail';
+import { purgeAudit } from './audit';
+import { purgeAuthTokens } from './authTokens';
+import { purgeSessions } from './sessions';
+
+export interface RetentionReport {
+  analytics: number;
+  submissions: number;
+  audit: number;
+  mailLog: number;
+  sessions: number;
+  tokens: number;
+}
+
+export async function runRetention(): Promise<RetentionReport> {
+  const { privacy } = (await loadSnapshot()).system;
+  let submissions = 0;
+  if (privacy.submissionsRetentionDays > 0) {
+    const limit = Date.now() - privacy.submissionsRetentionDays * 86400_000;
+    const s = await loadSnapshot();
+    if (s.formSubmissions.some((x) => new Date(x.createdAt).getTime() < limit)) {
+      await updateSnapshot((snap) => {
+        const before = snap.formSubmissions.length;
+        snap.formSubmissions = snap.formSubmissions.filter((x) => new Date(x.createdAt).getTime() >= limit);
+        submissions = before - snap.formSubmissions.length;
+      });
+    }
+  }
+  const [analytics, audit, mailLog, sessions, tokens] = await Promise.all([
+    pruneAnalytics(privacy.analyticsRetentionDays),
+    purgeAudit(privacy.auditRetentionDays),
+    purgeMailLog(privacy.mailLogRetentionDays),
+    purgeSessions(),
+    purgeAuthTokens(),
+  ]);
+  return { analytics, submissions, audit, mailLog, sessions, tokens };
+}

package/template/server/security/secrets.ts

@@ -0,0 +1,44 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import crypto from 'crypto';
+
+/** Clé maîtresse : SNAPIFY_SECRET_KEY, sinon ADMIN_JWT_SECRET. La changer rend illisibles les secrets déjà chiffrés. */
+function masterKey(): Buffer {
+  const raw = process.env.SNAPIFY_SECRET_KEY || process.env.ADMIN_JWT_SECRET;
+  if (!raw && process.env.NODE_ENV === 'production') throw new Error('SNAPIFY_SECRET_KEY ou ADMIN_JWT_SECRET doit être défini en production');
+  return crypto.createHash('sha256').update(`snapify-secrets:${raw || 'dev-only-secret-snapify-cms'}`).digest();
+}
+
+export function encryptSecret(plain: string): string {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', masterKey(), iv);
+  const data = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+  return ['v1', iv.toString('base64url'), cipher.getAuthTag().toString('base64url'), data.toString('base64url')].join(':');
+}
+
+export function decryptSecret(value: string | undefined | null): string | null {
+  if (!value) return null;
+  const [v, iv, tag, data] = value.split(':');
+  if (v !== 'v1' || !iv || !tag || !data) return null;
+  try {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', masterKey(), Buffer.from(iv, 'base64url'));
+    decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+    return Buffer.concat([decipher.update(Buffer.from(data, 'base64url')), decipher.final()]).toString('utf8');
+  } catch {
+    return null;
+  }
+}
+
+export const sha256 = (s: string) => crypto.createHash('sha256').update(s).digest('hex');
+
+export const randomToken = (bytes = 32) => crypto.randomBytes(bytes).toString('base64url');
+
+export function safeEqualStr(a: string, b: string): boolean {
+  const ba = Buffer.from(a);
+  const bb = Buffer.from(b);
+  return ba.length === bb.length && crypto.timingSafeEqual(ba, bb);
+}

package/template/server/security/sessions.ts

@@ -0,0 +1,140 @@
+/**
+ * Snapify
+ * © 2026 NOVALABS WEB DESIGN — Tunisie
+ * Contact : contact@novalabs.tn · +216 24 734 647
+ * Tous droits réservés. Toute reproduction, modification ou diffusion sans autorisation écrite est interdite.
+ */
+import { and, desc, eq, gt, isNull, lt, ne, or, sql } from 'drizzle-orm';
+import { db } from '../db/client';
+import { adminSessions } from '../db/schema';
+import { randomToken } from './secrets';
+
+export type SessionRow = typeof adminSessions.$inferSelect;
+
+const CACHE_MS = 30_000;
+const FLUSH_MS = 60_000;
+
+const cache = new Map<string, { row: SessionRow | null; at: number }>();
+/** Dernière activité connue en mémoire ; écrite en base au plus une fois par minute. */
+const seen = new Map<string, { at: number; flushedAt: number }>();
+
+export async function createSession(input: { userId: string; ip: string; userAgent?: string; remember: boolean; ttlMs: number }): Promise<SessionRow> {
+  const now = new Date();
+  const [row] = await db
+    .insert(adminSessions)
+    .values({
+      id: randomToken(18),
+      userId: input.userId,
+      createdAt: now,
+      lastSeenAt: now,
+      expiresAt: new Date(now.getTime() + input.ttlMs),
+      ip: input.ip,
+      userAgent: input.userAgent?.slice(0, 400),
+      remember: input.remember,
+    })
+    .returning();
+  cache.set(row.id, { row, at: Date.now() });
+  seen.set(row.id, { at: Date.now(), flushedAt: Date.now() });
+  return row;
+}
+
+export async function getSession(id: string): Promise<SessionRow | null> {
+  const hit = cache.get(id);
+  if (hit && Date.now() - hit.at < CACHE_MS) return hit.row;
+  const [row] = await db.select().from(adminSessions).where(eq(adminSessions.id, id)).limit(1);
+  cache.set(id, { row: row ?? null, at: Date.now() });
+  return row ?? null;
+}
+
+export function lastActivity(row: SessionRow): number {
+  return Math.max(seen.get(row.id)?.at ?? 0, row.lastSeenAt.getTime());
+}
+
+export function isSessionActive(row: SessionRow | null, idleMinutes: number): boolean {
+  if (!row || row.revokedAt || row.expiresAt.getTime() <= Date.now()) return false;
+  if (idleMinutes > 0 && Date.now() - lastActivity(row) > idleMinutes * 60_000) return false;
+  return true;
+}
+
+export function touchSession(id: string, ip?: string) {
+  const now = Date.now();
+  const s = seen.get(id) ?? { at: now, flushedAt: 0 };
+  s.at = now;
+  seen.set(id, s);
+  if (now - s.flushedAt < FLUSH_MS) return;
+  s.flushedAt = now;
+  void db
+    .update(adminSessions)
+    .set({ lastSeenAt: new Date(now), ...(ip ? { ip } : {}) })
+    .where(eq(adminSessions.id, id))
+    .catch((e) => console.error('[sessions] mise à jour impossible', e));
+}
+
+function forget(ids: string[]) {
+  for (const id of ids) {
+    cache.delete(id);
+    seen.delete(id);
+  }
+}
+
+export async function revokeSession(id: string, userId?: string): Promise<boolean> {
+  const rows = await db
+    .update(adminSessions)
+    .set({ revokedAt: new Date() })
+    .where(and(eq(adminSessions.id, id), isNull(adminSessions.revokedAt), userId ? eq(adminSessions.userId, userId) : undefined))
+    .returning({ id: adminSessions.id });
+  forget([id]);
+  return rows.length > 0;
+}
+
+/** Révoque toutes les sessions d'un compte, sauf éventuellement `exceptId`. Renvoie le nombre de sessions fermées. */
+export async function revokeUserSessions(userId: string, exceptId?: string): Promise<number> {
+  const rows = await db
+    .update(adminSessions)
+    .set({ revokedAt: new Date() })
+    .where(and(eq(adminSessions.userId, userId), isNull(adminSessions.revokedAt), exceptId ? ne(adminSessions.id, exceptId) : undefined))
+    .returning({ id: adminSessions.id });
+  forget(rows.map((r) => r.id));
+  return rows.length;
+}
+
+export async function listActiveSessions(userId: string): Promise<SessionRow[]> {
+  const rows = await db
+    .select()
+    .from(adminSessions)
+    .where(and(eq(adminSessions.userId, userId), isNull(adminSessions.revokedAt), gt(adminSessions.expiresAt, new Date())))
+    .orderBy(desc(adminSessions.lastSeenAt));
+  return rows.map((r) => ({ ...r, lastSeenAt: new Date(lastActivity(r)) }));
+}
+
+/** Nombre de sessions actives par utilisateur. */
+export async function activeSessionCounts(): Promise<Map<string, number>> {
+  const rows = await db
+    .select({ userId: adminSessions.userId, n: sql<number>`count(*)::int` })
+    .from(adminSessions)
+    .where(and(isNull(adminSessions.revokedAt), gt(adminSessions.expiresAt, new Date())))
+    .groupBy(adminSessions.userId);
+  return new Map(rows.map((r) => [r.userId, r.n]));
+}
+
+export async function hasUsedIp(userId: string, ip: string): Promise<boolean> {
+  const rows = await db
+    .select({ id: adminSessions.id })
+    .from(adminSessions)
+    .where(and(eq(adminSessions.userId, userId), eq(adminSessions.ip, ip)))
+    .limit(1);
+  return rows.length > 0;
+}
+
+/** Supprime les sessions expirées ou révoquées depuis plus de 30 jours. */
+export async function purgeSessions(): Promise<number> {
+  const limit = new Date(Date.now() - 30 * 86400_000);
+  const rows = await db
+    .delete(adminSessions)
+    .where(or(lt(adminSessions.expiresAt, limit), lt(adminSessions.revokedAt, limit)))
+    .returning({ id: adminSessions.id });
+  return rows.length;
+}
+
+export const sessionTtlMs = (security: { sessionHours: number; rememberDays: number }, remember: boolean) =>
+  remember ? security.rememberDays * 86400_000 : security.sessionHours * 3600_000;