cynx-lib 1.3.84 → 1.3.86

package/utils/utils/session_manager.cjs

@@ -0,0 +1,490 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var session_manager_exports = {};
+__export(session_manager_exports, {
+  SessionManager: () => SessionManager,
+  createSessionManager: () => createSessionManager,
+  default: () => session_manager_default,
+  extractToken: () => extractToken,
+  formatToken: () => formatToken,
+  getSessionId: () => getSessionId,
+  parseToken: () => parseToken
+});
+module.exports = __toCommonJS(session_manager_exports);
+var import_uid = require("./uid.cjs");
+var import_duration = require("./duration.cjs");
+var import_session = require("./session.cjs");
+function formatToken(sessionId, secret, prefix = "st_") {
+  return `${prefix}${sessionId}$${secret}`;
+}
+function parseToken(token, prefix = "st_") {
+  if (!token || typeof token !== "string") {
+    return { version: 0, sessionId: null, secret: null, prefix, raw: "", isValid: false };
+  }
+  const clean = token.replace(/^Bearer\s+/i, "").trim();
+  if (!clean) {
+    return { version: 0, sessionId: null, secret: null, prefix, raw: "", isValid: false };
+  }
+  if (clean.includes("$")) {
+    const parts = clean.split("$");
+    const head = parts[0];
+    const secret = parts.slice(1).join("$");
+    const sessionId = head.startsWith(prefix) ? head.slice(prefix.length) : head;
+    return {
+      version: 2,
+      sessionId,
+      secret,
+      prefix,
+      raw: clean,
+      isValid: Boolean(sessionId && secret)
+    };
+  }
+  return {
+    version: 1,
+    sessionId: null,
+    secret: clean,
+    prefix,
+    raw: clean,
+    isValid: true
+  };
+}
+function getSessionId(token, prefix = "st_") {
+  const parsed = parseToken(token, prefix);
+  return parsed.sessionId;
+}
+function extractToken(req) {
+  if (!req) return "";
+  const headers = req.headers || {};
+  const auth = headers.authorization || headers.Authorization || "";
+  if (typeof auth === "string" && auth.startsWith("Bearer ")) {
+    return auth.split(" ")[1].trim();
+  }
+  const custom = headers["x-auth-token"] || headers["x-session-token"] || headers["x-token"] || "";
+  if (typeof custom === "string" && custom.trim()) {
+    return custom.trim();
+  }
+  if (req.query && req.query.token) {
+    return String(req.query.token).trim();
+  }
+  return "";
+}
+class SessionManager {
+  constructor(options = {}) {
+    this.options = {
+      query: options.query || null,
+      sessionsTable: options.sessionsTable || "user_sessions",
+      usersTable: options.usersTable || "users",
+      rolesTable: options.rolesTable || "roles",
+      settingsTable: options.settingsTable || "system_settings",
+      superRole: (options.superRole || "superadmin").toLowerCase(),
+      tokenPrefix: options.tokenPrefix || "st_",
+      tokenVersion: options.tokenVersion || 2,
+      secretBytes: options.secretBytes || 32,
+      idLength: options.idLength || 12,
+      defaultAbsoluteTimeoutMs: options.defaultAbsoluteTimeoutMs || 30 * 24 * 60 * 60 * 1e3,
+      inactivityCacheTtlMs: options.inactivityCacheTtlMs || 3e4,
+      jwtSecret: options.jwtSecret || (typeof process !== "undefined" ? process.env.JWT_SECRET : ""),
+      ...options
+    };
+    this._inactTimeoutMs = null;
+    this._inactFetchedAt = 0;
+  }
+  async _query(sql, params = []) {
+    if (typeof this.options.query !== "function") {
+      throw new Error("[cynx/session] Database query function not configured in SessionManager.");
+    }
+    return this.options.query(sql, params);
+  }
+  parseToken(token) {
+    return parseToken(token, this.options.tokenPrefix);
+  }
+  getSessionId(token) {
+    return getSessionId(token, this.options.tokenPrefix);
+  }
+  extractToken(req) {
+    return extractToken(req);
+  }
+  formatToken(sessionId, secret) {
+    return formatToken(sessionId, secret, this.options.tokenPrefix);
+  }
+  async getInactivityTimeoutMs() {
+    const now = Date.now();
+    if (this._inactTimeoutMs !== null && now - this._inactFetchedAt < this.options.inactivityCacheTtlMs) {
+      return this._inactTimeoutMs;
+    }
+    try {
+      const sql = `SELECT value FROM ${this.options.settingsTable} WHERE key = 'session_inactivity_timeout'`;
+      const sRes = await this._query(sql).catch(() => ({ rows: [] }));
+      if (sRes.rows && sRes.rows.length > 0) {
+        let val = sRes.rows[0].value;
+        if (typeof val === "string") {
+          try {
+            val = JSON.parse(val);
+          } catch {
+          }
+        }
+        this._inactTimeoutMs = (0, import_duration.parseDurationMs)(val, 0);
+      } else {
+        this._inactTimeoutMs = 0;
+      }
+    } catch {
+      this._inactTimeoutMs = 0;
+    }
+    this._inactFetchedAt = now;
+    return this._inactTimeoutMs;
+  }
+  clearSettingsCache() {
+    this._inactTimeoutMs = null;
+    this._inactFetchedAt = 0;
+  }
+  /**
+   * Create and persist a new session for a user.
+   *
+   * @param {string|number} userId
+   * @param {object} [req] HTTP request object for device and IP detection
+   * @param {object} [options]
+   * @returns {Promise<string>} Generated session token
+   */
+  async createSession(userId, req = null, options = {}) {
+    const id = (0, import_uid.genUid)(this.options.idLength);
+    const userAgent = (req?.headers ? req.headers["user-agent"] || "" : "").slice(0, 500);
+    const ipAddress = (req?.headers ? req.headers["x-forwarded-for"] || req.socket?.remoteAddress || "" : "").slice(0, 45);
+    const deviceName = (0, import_session.deriveDeviceName)(req, userAgent);
+    let token;
+    if (this.options.tokenVersion === 2) {
+      const bytes = (0, import_uid.getRandomBytes)(this.options.secretBytes);
+      let hex = "";
+      for (let i = 0; i < bytes.length; i++) {
+        hex += bytes[i].toString(16).padStart(2, "0");
+      }
+      token = formatToken(id, hex, this.options.tokenPrefix);
+    } else {
+      token = (0, import_session.genSessionToken)(this.options.secretBytes);
+    }
+    let absoluteMs = this.options.defaultAbsoluteTimeoutMs;
+    try {
+      const sRes = await this._query(`SELECT value FROM ${this.options.settingsTable} WHERE key = 'session_absolute_timeout'`);
+      if (sRes.rows && sRes.rows.length > 0) {
+        let val = sRes.rows[0].value;
+        if (typeof val === "string") {
+          try {
+            val = JSON.parse(val);
+          } catch {
+          }
+        }
+        const parsed = (0, import_duration.parseDurationMs)(val, absoluteMs);
+        if (parsed > 0) absoluteMs = parsed;
+      }
+    } catch {
+    }
+    const expiresAt = new Date(Date.now() + absoluteMs);
+    const insertSql = `
+      INSERT INTO ${this.options.sessionsTable} (id, user_id, token, user_agent, device_name, ip_address, is_active, expires_at)
+      VALUES ($1, $2, $3, $4, $5, $6, true, $7)
+    `;
+    await this._query(insertSql, [id, userId, token, userAgent, deviceName, ipAddress, expiresAt]);
+    return token;
+  }
+  /**
+   * Validate a session token against PostgreSQL database and users table.
+   * Seamlessly resolves v2 compound tokens (O(1) lookup by primary key id) and v1 tokens.
+   *
+   * @param {string} token
+   * @param {object} [options] Options: { updateActivity: boolean }
+   * @returns {Promise<object|null>}
+   */
+  async validateSession(token, options = {}) {
+    if (!token || typeof token !== "string") return null;
+    const cleanToken = token.replace(/^Bearer\s+/i, "").trim();
+    if (!cleanToken) return null;
+    try {
+      const parsed = parseToken(cleanToken, this.options.tokenPrefix);
+      let sessionRes;
+      if (parsed.version === 2 && parsed.sessionId) {
+        const sql = `
+          SELECT s.id as session_id, s.user_id, s.token, s.is_active as session_active,
+                 s.expires_at, s.last_activity, s.device_name, s.ip_address,
+                 u.id as user_id, u.username, u.full_name, u.role, u.is_active as user_active,
+                 COALESCE(u.is_disabled, false) as user_disabled,
+                 u.employee_id, u.leader_id,
+                 u.permissions as user_permissions,
+                 r.permissions as role_permissions
+          FROM ${this.options.sessionsTable} s
+          JOIN ${this.options.usersTable} u ON u.id = s.user_id
+          LEFT JOIN ${this.options.rolesTable} r ON r.id = u.role OR r.name = u.role OR LOWER(r.name) = LOWER(u.role)
+          WHERE s.id = $1
+        `;
+        sessionRes = await this._query(sql, [parsed.sessionId]).catch(() => ({ rows: [] }));
+      } else {
+        const sql = `
+          SELECT s.id as session_id, s.user_id, s.token, s.is_active as session_active,
+                 s.expires_at, s.last_activity, s.device_name, s.ip_address,
+                 u.id as user_id, u.username, u.full_name, u.role, u.is_active as user_active,
+                 COALESCE(u.is_disabled, false) as user_disabled,
+                 u.employee_id, u.leader_id,
+                 u.permissions as user_permissions,
+                 r.permissions as role_permissions
+          FROM ${this.options.sessionsTable} s
+          JOIN ${this.options.usersTable} u ON u.id = s.user_id
+          LEFT JOIN ${this.options.rolesTable} r ON r.id = u.role OR r.name = u.role OR LOWER(r.name) = LOWER(u.role)
+          WHERE s.token = $1
+        `;
+        sessionRes = await this._query(sql, [cleanToken]).catch(() => ({ rows: [] }));
+      }
+      if (sessionRes.rows && sessionRes.rows.length > 0) {
+        const row = sessionRes.rows[0];
+        if (row.token !== cleanToken) {
+          return null;
+        }
+        const now = /* @__PURE__ */ new Date();
+        if (!row.session_active || !row.user_active || row.user_disabled || new Date(row.expires_at) < now) {
+          return null;
+        }
+        const inactTimeoutMs = await this.getInactivityTimeoutMs();
+        if (inactTimeoutMs > 0 && row.last_activity) {
+          const lastAct = new Date(row.last_activity).getTime();
+          if (now.getTime() - lastAct > inactTimeoutMs) {
+            this._query(`UPDATE ${this.options.sessionsTable} SET is_active = false WHERE id = $1`, [row.session_id]).catch(() => {
+            });
+            return null;
+          }
+        }
+        if (options.updateActivity !== false) {
+          this._query(`UPDATE ${this.options.sessionsTable} SET last_activity = NOW() WHERE id = $1`, [row.session_id]).catch(() => {
+          });
+        }
+        return {
+          valid: true,
+          userId: row.user_id,
+          sessionId: row.session_id,
+          token: cleanToken,
+          role: row.role,
+          employeeId: row.employee_id || null,
+          leaderId: row.leader_id || null,
+          userPermissions: row.user_permissions || {},
+          rolePermissions: row.role_permissions || {},
+          user: {
+            id: row.user_id,
+            username: row.username,
+            fullName: row.full_name,
+            role: row.role,
+            employeeId: row.employee_id,
+            leaderId: row.leader_id
+          }
+        };
+      }
+      if (this.options.jwtSecret) {
+        try {
+          const jwtModule = typeof require === "function" ? require("jsonwebtoken") : null;
+          if (jwtModule) {
+            const decoded = jwtModule.verify(cleanToken, this.options.jwtSecret);
+            if (decoded && (decoded.userId || decoded.id)) {
+              const uId = decoded.userId || decoded.id;
+              const uRes = await this._query(
+                `SELECT u.id, u.username, u.full_name, u.role, u.is_active, COALESCE(u.is_disabled, false) as is_disabled,
+                        u.employee_id, u.leader_id, u.permissions as user_permissions, r.permissions as role_permissions
+                 FROM ${this.options.usersTable} u
+                 LEFT JOIN ${this.options.rolesTable} r ON r.id = u.role OR r.name = u.role OR LOWER(r.name) = LOWER(u.role)
+                 WHERE u.id = $1`,
+                [uId]
+              ).catch(() => ({ rows: [] }));
+              if (uRes.rows && uRes.rows.length > 0 && uRes.rows[0].is_active && !uRes.rows[0].is_disabled) {
+                const uRow = uRes.rows[0];
+                return {
+                  valid: true,
+                  userId: uRow.id,
+                  sessionId: null,
+                  token: cleanToken,
+                  role: uRow.role || decoded.role,
+                  employeeId: uRow.employee_id || null,
+                  leaderId: uRow.leader_id || null,
+                  userPermissions: uRow.user_permissions || {},
+                  rolePermissions: uRow.role_permissions || {},
+                  user: {
+                    id: uRow.id,
+                    username: uRow.username,
+                    fullName: uRow.full_name,
+                    role: uRow.role || decoded.role,
+                    employeeId: uRow.employee_id,
+                    leaderId: uRow.leader_id
+                  }
+                };
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      return null;
+    } catch (err) {
+      console.warn("[SessionManager validateSession error]:", err.message);
+      return null;
+    }
+  }
+  /**
+   * Lock a session screen.
+   *
+   * @param {string} sessionIdOrToken Session ID or Token
+   * @returns {Promise<{ ok: boolean, sessionId: string, userId: string, token: string } | null>}
+   */
+  async lockSession(sessionIdOrToken) {
+    if (!sessionIdOrToken) return null;
+    const parsed = parseToken(sessionIdOrToken, this.options.tokenPrefix);
+    const idToUse = parsed.sessionId || sessionIdOrToken;
+    const sql = `
+      UPDATE ${this.options.sessionsTable}
+      SET is_locked = true, locked_at = NOW()
+      WHERE (id = $1 OR token = $1) AND is_active = true
+      RETURNING id, user_id, token
+    `;
+    const r = await this._query(sql, [idToUse]);
+    if (r.rows && r.rows.length > 0) {
+      const row = r.rows[0];
+      return { ok: true, sessionId: row.id, userId: row.user_id, token: row.token };
+    }
+    return null;
+  }
+  /**
+   * Unlock a session screen.
+   *
+   * @param {string} sessionIdOrToken Session ID or Token
+   * @returns {Promise<{ ok: boolean, sessionId: string, userId: string, token: string } | null>}
+   */
+  async unlockSession(sessionIdOrToken) {
+    if (!sessionIdOrToken) return null;
+    const parsed = parseToken(sessionIdOrToken, this.options.tokenPrefix);
+    const idToUse = parsed.sessionId || sessionIdOrToken;
+    const sql = `
+      UPDATE ${this.options.sessionsTable}
+      SET is_locked = false, locked_at = NULL
+      WHERE (id = $1 OR token = $1) AND is_active = true
+      RETURNING id, user_id, token
+    `;
+    const r = await this._query(sql, [idToUse]);
+    if (r.rows && r.rows.length > 0) {
+      const row = r.rows[0];
+      return { ok: true, sessionId: row.id, userId: row.user_id, token: row.token };
+    }
+    return null;
+  }
+  /**
+   * Terminate/revoke a single session.
+   *
+   * @param {string} sessionIdOrToken Session ID or Token
+   * @returns {Promise<{ ok: boolean, sessionId: string, userId: string, token: string } | null>}
+   */
+  async terminateSession(sessionIdOrToken) {
+    if (!sessionIdOrToken) return null;
+    const parsed = parseToken(sessionIdOrToken, this.options.tokenPrefix);
+    const idToUse = parsed.sessionId || sessionIdOrToken;
+    const sql = `
+      UPDATE ${this.options.sessionsTable}
+      SET is_active = false
+      WHERE id = $1 OR token = $1
+      RETURNING id, user_id, token
+    `;
+    const r = await this._query(sql, [idToUse]);
+    if (r.rows && r.rows.length > 0) {
+      const row = r.rows[0];
+      return { ok: true, sessionId: row.id, userId: row.user_id, token: row.token };
+    }
+    return null;
+  }
+  /**
+   * Terminate all other sessions except the current one.
+   *
+   * @param {string} currentSessionIdOrToken Current session ID or token to preserve
+   * @param {string|number} [currentUserId]
+   * @param {boolean} [protectSuperAdmin=true]
+   * @returns {Promise<Array<{ sessionId: string, userId: string, token: string }>>}
+   */
+  async terminateOtherSessions(currentSessionIdOrToken, currentUserId = null, protectSuperAdmin = true) {
+    const parsed = parseToken(currentSessionIdOrToken, this.options.tokenPrefix);
+    const preserveId = parsed.sessionId || currentSessionIdOrToken;
+    let whereClause = `id != $1 AND token != $1`;
+    let params = [preserveId];
+    if (currentUserId) {
+      whereClause += ` AND user_id = $2`;
+      params.push(currentUserId);
+    } else if (protectSuperAdmin) {
+      whereClause += ` AND user_id NOT IN (SELECT id FROM ${this.options.usersTable} WHERE LOWER(COALESCE(role, '')) = '${this.options.superRole}' OR LOWER(username) = '${this.options.superRole}')`;
+    }
+    const sql = `
+      UPDATE ${this.options.sessionsTable}
+      SET is_active = false
+      WHERE ${whereClause} AND is_active = true
+      RETURNING id, user_id, token
+    `;
+    const r = await this._query(sql, params);
+    return (r.rows || []).map((row) => ({
+      sessionId: row.id,
+      userId: row.user_id,
+      token: row.token
+    }));
+  }
+  /**
+   * Terminate all active sessions for a specific user.
+   *
+   * @param {string|number} userId
+   * @returns {Promise<Array<{ sessionId: string, userId: string, token: string }>>}
+   */
+  async terminateUserSessions(userId) {
+    if (!userId) return [];
+    const sql = `
+      UPDATE ${this.options.sessionsTable}
+      SET is_active = false
+      WHERE user_id = $1 AND is_active = true
+      RETURNING id, user_id, token
+    `;
+    const r = await this._query(sql, [userId]);
+    return (r.rows || []).map((row) => ({
+      sessionId: row.id,
+      userId: row.user_id,
+      token: row.token
+    }));
+  }
+  /**
+   * Aliases for backward compatibility.
+   */
+  async revokeSession(tokenOrId) {
+    return this.terminateSession(tokenOrId);
+  }
+  async revokeAllUserSessions(userId) {
+    return this.terminateUserSessions(userId);
+  }
+}
+function createSessionManager(options) {
+  return new SessionManager(options);
+}
+var session_manager_default = {
+  SessionManager,
+  createSessionManager,
+  formatToken,
+  parseToken,
+  getSessionId,
+  extractToken
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SessionManager,
+  createSessionManager,
+  extractToken,
+  formatToken,
+  getSessionId,
+  parseToken
+});