indraq_cli 2.2.0 → 2.2.2

package/CHANGELOG_v2.2.0.md

@@ -26,7 +26,7 @@
 
 ## User/scope operations
 
-- Added `indraq user scopes [username]`.
+- Added `indraq user scopes [email]`.
 - NPM/Jenkins scope-native account records now retain the user's encrypted password for personal resolution and self-rotation.
 - Existing Jenkins Role Strategy Item Role synchronization remains the project-pipeline authorization mechanism.
 
@@ -50,3 +50,11 @@ Added `cloud-api/sql/009_scope_user_secrets_and_project_lifecycle.sql`:
   - `src/modules/scopes/commands/scope.command.ts`
   - `src/modules/users/providers/aws-user.provider.ts`
 - Runtime behavior is unchanged; this is a source/type compatibility correction.
+
+## Documentation/help synchronization
+
+- Focused `help scope` now lists personal AWS credential/key and NPM/Jenkins password rotation commands.
+- Focused `help users` now documents `user list`, `user scopes [email]`, and self-service Cloud password reset.
+- Focused `help deploy` now explains saved scope reuse and the explicit `--select-scopes` override.
+- Removed stale v2.1 wording from compatibility command descriptions.
+- README now explicitly states that provider-management secrets are never returned to normal `USE` members.

package/CHANGELOG_v2.2.1.md

@@ -0,0 +1,19 @@
+# IndraQ CLI v2.2.1
+
+Bug-fix release for project scope selection and shared-environment deployment.
+
+## Fixed
+
+- Project scope linking now always displays the eligible scopes, even when only one scope is visible.
+- The selected scope is shown with provider/name/company/endpoint/access before it is linked.
+- The audit-reason prompt now comes after scope selection so the account being linked is clear.
+- `indraq deploy` now lists the available shared environments and lets the user choose one interactively.
+- `indraq deploy --env <environment>` validates and deploys the exact shared environment used by prebuild.
+- `indraq deployment run` can also prompt for an environment when `--env` is omitted.
+- `deploy:dev` and `deploy:prod` remain compatibility aliases. If no matching dev/prod environment exists, they open the shared-environment picker instead of trying to deploy a nonexistent environment.
+- Help and README examples now prefer real shared-environment names rather than assuming every organization has `dev` and `prod` environments.
+
+## Validation
+
+- 16/16 configured regression suites pass, including the new v2.2.1 environment/scope-selection regression.
+- Updated emitted JavaScript files pass `node --check`.

package/CHANGELOG_v2.2.2.md

@@ -0,0 +1,18 @@
+# IndraQ CLI v2.2.2
+
+## Persistent Cloud sessions
+
+- Replaced the single 12-hour login JWT with a persistent server-side CLI session.
+- Access JWTs are now short-lived (1 hour) and refresh automatically in the background.
+- A refresh/session token is stored alongside the access token in `~/.indraq/cloud.json`.
+- The refresh session has no time-based expiry: normal users stay signed in until they explicitly run `indraq logout`, their account is removed/disabled, or their Cloud password is reset.
+- `indraq logout` now revokes the server-side session as well as clearing local credentials.
+- Every session-backed Cloud request verifies that the server-side session has not been revoked.
+- Existing still-valid v2.2.1 JWTs are automatically upgraded to persistent sessions on the next Cloud request, avoiding an unnecessary login during upgrade when possible.
+- Cloud password reset/admin password reset revokes existing sessions. First-login password change keeps the current session and revokes any other temporary-password sessions.
+
+## Cloud API
+
+- Cloud API version: `0.8.0`.
+- Added migration `010_persistent_auth_sessions.sql`.
+- Added `/auth/session`, `/auth/refresh`, and `/auth/logout` endpoints.

package/README.md

@@ -72,7 +72,7 @@ Teams often manage several servers, customers and cloud accounts at once. A sing
 
 ### Provider scope
 
-One organization-owned provider account/server plus its encrypted management credential and safe metadata.
+One organization-owned provider account/server plus its encrypted management credential and safe metadata. The management secret is used by the Cloud API for provisioning/administration and is **not returned to normal `USE` members**. AWS/NPM/Jenkins users resolve their own native identities instead.
 
 ### Scope membership
 
@@ -212,7 +212,7 @@ indraq project link
 ### 7. Choose project provider defaults
 
 ```bash
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 ```
 
 A project may use a different scope than your personal default.
@@ -220,27 +220,33 @@ A project may use a different scope than your personal default.
 ### 8. Reconcile infrastructure
 
 ```bash
-indraq prebuild --env dev
+indraq prebuild
+# choose one of the shared environments shown by the CLI
 ```
 
 ### 9. Deploy
 
 ```bash
-indraq deploy:dev
-# or
-indraq deploy --env staging
+indraq deploy
+# choose one of the shared environments shown by the CLI
+# or deploy directly:
+indraq deploy --env indraq-test-airtel
 ```
 
 Normal deploys reuse the scopes already saved for that project/environment. Use `--select-scopes` only when you intentionally want to review or change those bindings:
 
 ```bash
-indraq deploy --env dev --select-scopes
+indraq deploy --env indraq-test-airtel --select-scopes
 ```
 
 ---
 
 ## Provider scopes
 
+### Scope selection is always visible
+
+When linking a project to a provider scope, the CLI prints the eligible scopes and asks you to choose one even when only one scope is available. This prevents silent account selection and lets you verify company/account/endpoint before linking.
+
 ### Unlimited named scopes
 
 ```text
@@ -348,7 +354,7 @@ flowchart LR
 Use:
 
 ```bash
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 indraq project scopes --env prod
 ```
 
@@ -497,12 +503,25 @@ Provider identities are removed first. Cloud identity is deleted last. Projects
 
 ## Command reference
 
+### Built-in focused help
+
+The CLI help is aligned with the v2.2 scope-first workflow:
+
+```bash
+indraq help scope
+indraq help users
+indraq help deploy
+indraq help configure
+indraq help aws
+```
+
+
 ### Authentication and diagnostics
 
 | Command | Use |
 |---|---|
 | `indraq login` | Sign in |
-| `indraq logout` | Remove local Cloud token |
+| `indraq logout` | Revoke the persistent Cloud session and remove local session credentials |
 | `indraq whoami` | Show current identity |
 | `indraq doctor` | Diagnose Node/Java/Git/tar/PATH |
 | `indraq logs` | Audit/log access where permitted |
@@ -559,9 +578,10 @@ Provider identities are removed first. Cloud identity is deleted last. Projects
 | Command | Use |
 |---|---|
 | `indraq prebuild --env <env>` | Reconcile infrastructure |
-| `indraq deploy:dev` | Dev deploy |
-| `indraq deploy:prod` | Prod deploy |
-| `indraq deploy --env <env>` | Named environment deploy using saved scope bindings |
+| `indraq deploy` | Interactively choose an available shared environment and deploy |
+| `indraq deploy --env <env>` | Deploy an exact shared environment using its saved scope bindings |
+| `indraq deploy:dev` | Convenience alias if `dev`/`development` exists; otherwise opens the environment picker |
+| `indraq deploy:prod` | Convenience alias if `prod`/`production` exists; otherwise opens the environment picker |
 | `indraq deploy --env <env> --select-scopes` | Explicitly review/change project scope bindings before deploy |
 | `indraq jenkins pipelines --stage dev` | List visible pipelines |
 | `indraq jenkins run [job] --stage dev` | Run pipeline with discovered parameters |
@@ -583,6 +603,12 @@ indraq proxy create api.example.com
 
 ---
 
+### Persistent login sessions
+
+`indraq login` creates a persistent CLI session. The access token is refreshed automatically by the CLI, so normal users do **not** need to log in again every few hours or before each build/deployment. The session continues until `indraq logout` is run, the Cloud account is removed/disabled, or the Cloud password is reset. `indraq logout` revokes the server-side session and removes the local session credentials.
+
+Existing v2.2.1 tokens are upgraded automatically when still valid; if an old token has already expired, one final login is required after upgrading.
+
 ## Common workflows
 
 ### Admin adds a new customer server
@@ -608,7 +634,7 @@ The manager can choose only a scope where they already have MANAGE access and ca
 ```bash
 indraq scope list
 indraq scope describe "AWS Client ABC"
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 indraq prebuild --env dev
 indraq deploy:dev
 ```
@@ -664,7 +690,7 @@ indraq scope add-user
 Those two are mandatory. Add the user to the required scope and link/select it:
 
 ```bash
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 ```
 
 ### DNS is missing but deployment should continue
@@ -713,7 +739,7 @@ npm --prefix cloud-api run build
 <div align="center">
   <img src="docs/assets/indraq-mark.png" alt="IndraQ mark" width="70" />
 
-  **IndraQ CLI v2.2.0**
+  **IndraQ CLI v2.2.2**
 
   Scope-based infrastructure access. Durable projects. Safer deployments.
 </div>

package/RELEASE_CHECKS_v2.2.2.md

@@ -0,0 +1,26 @@
+# Release checks — v2.2.2
+
+## Persistent login/session behavior
+
+- [x] Login stores an access token plus a persistent refresh/session token.
+- [x] Expired access token receives HTTP 401, refreshes through `/auth/refresh`, and retries the original Cloud request automatically.
+- [x] `indraq logout` revokes the server-side session when Cloud is reachable and always clears local session credentials.
+- [x] Server checks session revocation on every request for session-backed access tokens.
+- [x] Existing still-valid v2.2.1 JWTs can upgrade via `/auth/session` without a password prompt.
+- [x] Cloud password reset/admin password reset revokes existing sessions.
+- [x] First-login password change keeps the current session and revokes other temporary-password sessions.
+- [x] Refresh tokens are stored hashed in PostgreSQL, never plaintext.
+- [x] Migration `010_persistent_auth_sessions.sql` is included and applied by the existing migration runner.
+
+## Regression validation
+
+- [x] Existing v2.2.1 environment/scope-selection regression remains green.
+- [x] New v2.2.2 persistent-session source regression passes.
+- [x] New v2.2.2 runtime regression passes against compiled `dist` and verifies login → expiry/refresh/retry → logout → legacy-session upgrade.
+- [x] Full configured regression chain passes (18 commands/suites).
+- [x] Changed CLI session core (`cloud-config.ts` + `cloud-api.service.ts`) passes strict TypeScript checking with `exactOptionalPropertyTypes` enabled.
+- [x] Emitted changed JavaScript and Cloud API `dist/index.js` pass `node --check`.
+
+## Build-environment note
+
+The sandbox npm registry install timed out and left external dependency directories incomplete, so a dependency-backed full root/cloud `npm run build` could not be repeated here. The changed session core was strict-type-checked independently, Cloud API source was syntax-transpiled with TypeScript, and runtime/regression tests use the rebuilt changed `dist`. Run the normal clean build on the release machine before deployment/publish.

package/TEST_RESULTS_v2.2.1.txt

@@ -0,0 +1,11 @@
+IndraQ CLI v2.2.1 validation
+============================
+
+Result: PASS
+
+Configured regression suites: 16/16 PASS
+New regression: v2.2.1 environment/scope-selection PASS
+Updated emitted JavaScript syntax checks: PASS
+
+Environment note:
+A fully clean npm install could not complete inside the packaging sandbox because package-registry access timed out. The source package uses the same dependency versions as v2.2.0. Run `npm i && npm run build && npm test` on a normal machine with npm registry access before publishing.

package/TEST_RESULTS_v2.2.2.txt

@@ -0,0 +1,39 @@
+IndraQ CLI v2.2.2 test results
+================================
+
+PASS test:cloud-endpoint
+PASS test:user-credentials
+PASS test:infrastructure
+PASS test:platform
+PASS test:project-access
+PASS test:project-create
+PASS test:jenkins-crumb
+PASS test:jenkins-port
+PASS test:prebuild
+PASS test:docker-context
+PASS test:identity-security
+PASS test:user-lifecycle-jenkins
+PASS test:v2-lifecycle
+PASS test:v21-scopes
+PASS test:v22
+PASS test:v221
+PASS test:v222
+PASS test:v222-runtime
+
+Persistent-session runtime coverage:
+- login stores access + refresh tokens
+- expired access token -> /auth/refresh -> original request retry
+- refreshed access token persisted locally
+- logout calls /auth/logout and removes local credentials
+- still-valid legacy v2.2.1 JWT upgrades through /auth/session without password prompt
+
+Focused strict TypeScript check:
+PASS src/modules/cloud/config/cloud-config.ts
+PASS src/modules/cloud/services/cloud-api.service.ts
+
+JavaScript syntax checks:
+PASS changed CLI dist files
+PASS cloud-api/dist/index.js
+
+Environment limitation:
+A clean npm dependency install could not complete in this sandbox because registry access timed out. See RELEASE_CHECKS_v2.2.2.md.

package/UPGRADE_v2.2.1_to_v2.2.2.md

@@ -0,0 +1,15 @@
+# Upgrade v2.2.1 → v2.2.2
+
+1. Deploy the updated `cloud-api` first.
+2. Ensure startup migrations apply `cloud-api/sql/010_persistent_auth_sessions.sql`.
+3. Install/link the v2.2.2 CLI.
+4. Existing v2.2.1 logins that still have a valid 12-hour JWT are automatically converted into persistent sessions on the next Cloud request.
+5. If the old JWT had already expired before the upgrade, log in one final time. After that the CLI automatically refreshes its access token until `indraq logout` is run.
+
+Normal usage:
+
+```bash
+indraq login
+# ... use the CLI for days/weeks without logging in again ...
+indraq logout
+```

package/cloud-api/README.md

@@ -1,93 +1,101 @@
-# IndraQ Cloud API
-
-Control plane for IndraQ CLI v2.1. The public CLI endpoint is `https://cli.indraq.com`.
-
-## Responsibilities
-
-- authentication and organization RBAC (`user`, `manager`, `admin`)
-- provider scopes for AWS/NPM/Jenkins/GHCR
-- scope USE/MANAGE membership and audited delegation
-- encrypted provider scope secrets
-- per-user scope defaults
-- per-project/environment scope bindings
-- scope-native AWS/NPM/Jenkins identity mappings
-- self-service AWS key rotation and password lifecycle
-- projects, environments and project resource grants
-- audit logging
-
-## Requirements
-
-- Node.js 22+
-- PostgreSQL
-
-## Configure
-
-```bash
-npm install
-cp .env.example .env
-```
-
-Required values include:
-
-```env
-PORT=4010
-DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
-JWT_SECRET=replace-with-at-least-32-random-characters
-MASTER_KEY=replace-with-exactly-64-hex-characters
-BOOTSTRAP_ADMIN_EMAIL=admin@example.com
-BOOTSTRAP_ADMIN_PASSWORD=use-a-strong-password
-```
-
-`MASTER_KEY` must remain stable because provider scope secrets use AES-256-GCM encryption.
-
-## Build / run
-
-```bash
-npm run build
-npm start
-```
-
-Development:
-
-```bash
-npm run dev
-```
-
-Numbered migrations in `sql/` are applied automatically at startup. v2.1 adds:
-
-```text
-008_provider_scopes.sql
-```
-
-## v2.1 authorization model
-
-- **Admin** — creates/deletes scopes, grants MANAGE/USE, creates managers/admins, changes organization roles.
-- **Manager** — can add/remove normal users only inside scopes where the manager has MANAGE.
-- **User** — can use only assigned scopes and rotate only their own managed provider credentials.
-
-Scope membership operations and secret resolution require an audit reason and are written to `audit_logs`.
-
-## Provider scopes
-
-`provider_scopes` stores named organization accounts/controllers. `provider_scope_members` controls visibility and use. A user cannot discover a scope simply because it exists.
-
-Related v2.1 tables:
-
-- `provider_scopes`
-- `provider_scope_members`
-- `user_scope_defaults`
-- `project_environment_scopes`
-- `scope_external_accounts`
-- `scope_aws_credentials`
-
-## Projects
-
-Projects and infrastructure are durable. Deleting a user removes scope memberships/native identity mappings and the Cloud identity but retains shared project/environment/resource definitions. Ownership is reassigned before hard deletion where required.
-
-## Security notes
-
-- Passwords are bcrypt-hashed.
-- Provider secrets are encrypted with AES-256-GCM.
-- Secret-resolution responses are `Cache-Control: no-store` and audited.
-- Role/account state is re-read from PostgreSQL on protected requests so demotion/disable takes effect without waiting for JWT expiry.
-- Keep bootstrap credentials and `MASTER_KEY` out of source control.
+# IndraQ Cloud API
+
+Control plane for IndraQ CLI v2.2.2. The public CLI endpoint is `https://cli.indraq.com`.
+
+## Responsibilities
+
+- persistent CLI authentication sessions and organization RBAC (`user`, `manager`, `admin`)
+- provider scopes for AWS/NPM/Jenkins/GHCR
+- scope USE/MANAGE membership and audited delegation
+- encrypted provider scope secrets
+- per-user scope defaults
+- per-project/environment scope bindings
+- scope-native AWS/NPM/Jenkins identity mappings
+- self-service AWS key rotation and password lifecycle
+- projects, environments and project resource grants
+- audit logging
+
+## Requirements
+
+- Node.js 22+
+- PostgreSQL
+
+## Configure
+
+```bash
+npm install
+cp .env.example .env
+```
+
+Required values include:
+
+```env
+PORT=4010
+DATABASE_URL=postgresql://indraq:change-me@127.0.0.1:5432/indraq_cloud
+JWT_SECRET=replace-with-at-least-32-random-characters
+MASTER_KEY=replace-with-exactly-64-hex-characters
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=use-a-strong-password
+```
+
+`MASTER_KEY` must remain stable because provider scope secrets use AES-256-GCM encryption.
+
+## Build / run
+
+```bash
+npm run build
+npm start
+```
+
+Development:
+
+```bash
+npm run dev
+```
+
+Numbered migrations in `sql/` are applied automatically at startup. Current scope/session migrations include:
+
+```text
+008_provider_scopes.sql
+009_scope_user_secrets_and_project_lifecycle.sql
+010_persistent_auth_sessions.sql
+```
+
+## Authorization model
+
+- **Admin** — creates/deletes scopes, grants MANAGE/USE, creates managers/admins, changes organization roles.
+- **Manager** — can add/remove normal users only inside scopes where the manager has MANAGE.
+- **User** — can use only assigned scopes and rotate only their own managed provider credentials.
+
+Scope membership operations and secret resolution require an audit reason and are written to `audit_logs`.
+
+## Provider scopes
+
+`provider_scopes` stores named organization accounts/controllers. `provider_scope_members` controls visibility and use. A user cannot discover a scope simply because it exists.
+
+Related scope tables:
+
+- `provider_scopes`
+- `provider_scope_members`
+- `user_scope_defaults`
+- `project_environment_scopes`
+- `scope_external_accounts`
+- `scope_aws_credentials`
+
+## Projects
+
+Projects and infrastructure are durable. Deleting a user removes scope memberships/native identity mappings and the Cloud identity but retains shared project/environment/resource definitions. Ownership is reassigned before hard deletion where required.
+
+## Persistent CLI sessions
+
+A successful `/auth/login` creates a server-side `auth_sessions` row and returns an access JWT plus an opaque refresh token. The database stores only a SHA-256 hash of the refresh token. The CLI automatically calls `/auth/refresh` after access-token expiry and retries the original request, so normal users remain signed in until they explicitly logout or a security event revokes the session.
+
+`/auth/logout` revokes the session. Session-backed access JWTs include a session ID and the auth middleware checks that the corresponding session has not been revoked on every protected request. Still-valid legacy v2.2.1 JWTs may use `/auth/session` once to upgrade to the persistent model without another password prompt.
+
+## Security notes
+
+- Passwords are bcrypt-hashed.
+- Provider secrets are encrypted with AES-256-GCM.
+- Secret-resolution responses are `Cache-Control: no-store` and audited.
+- Role/account state is re-read from PostgreSQL on protected requests so demotion/disable takes effect without waiting for JWT expiry.
+- Keep bootstrap credentials and `MASTER_KEY` out of source control.

package/cloud-api/dist/index.js

@@ -5,7 +5,7 @@ import jwt from 'jsonwebtoken';
 import pg from 'pg';
 import nodemailer from 'nodemailer';
 import { IAMClient, CreateAccessKeyCommand, DeleteAccessKeyCommand, ListAccessKeysCommand } from '@aws-sdk/client-iam';
-import { createCipheriv, createDecipheriv, randomBytes, randomInt } from 'node:crypto';
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from 'node:crypto';
 import { isIP } from 'node:net';
 import { readdir, readFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
@@ -21,6 +21,13 @@ const masterHex = process.env.MASTER_KEY || '';
 if (!/^[a-fA-F0-9]{64}$/.test(masterHex))
     throw new Error('MASTER_KEY must be exactly 64 hex characters (32 bytes).');
 const masterKey = Buffer.from(masterHex, 'hex');
+const accessTokenFor = (user, sessionId) => jwt.sign({ id: user.id, email: user.email, role: user.role, sid: sessionId }, jwtSecret, { expiresIn: '1h' });
+const refreshHash = (token) => createHash('sha256').update(token).digest('hex');
+const createAuthSession = async (userId) => {
+    const refreshToken = randomBytes(48).toString('base64url');
+    const result = await pool.query('INSERT INTO auth_sessions(user_id,refresh_token_hash) VALUES($1,$2) RETURNING id', [userId, refreshHash(refreshToken)]);
+    return { sessionId: result.rows[0].id, refreshToken };
+};
 const encrypt = (text) => {
     const iv = randomBytes(12);
     const cipher = createCipheriv('aes-256-gcm', masterKey, iv);
@@ -49,15 +56,21 @@ const auth = async (req, res, next) => {
             return;
         }
         // Roles and account state are resolved from the database on every request.
-        // This makes admin/manager demotion and account disabling effective
-        // immediately instead of trusting a stale role embedded in a 12-hour JWT.
-        const current = await pool.query('SELECT id,email,name,role,is_active,must_change_password FROM users WHERE id=$1', [token.id]);
+        // Session-backed tokens also verify server-side revocation on every request,
+        // so `indraq logout` takes effect immediately. Legacy tokens without sid are
+        // temporarily accepted so a v2.2.1 CLI session can upgrade without re-login.
+        const current = token.sid
+            ? await pool.query(`SELECT u.id,u.email,u.name,u.role,u.is_active,u.must_change_password
+             FROM users u
+             JOIN auth_sessions s ON s.id=$2 AND s.user_id=u.id AND s.revoked_at IS NULL
+            WHERE u.id=$1`, [token.id, token.sid])
+            : await pool.query('SELECT id,email,name,role,is_active,must_change_password FROM users WHERE id=$1', [token.id]);
         const user = current.rows[0];
         if (!user || !user.is_active || !['user', 'manager', 'admin'].includes(user.role)) {
             res.status(401).json({ error: 'Account is disabled or no longer available' });
             return;
         }
-        req.auth = { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password };
+        req.auth = { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password, ...(token.sid ? { sessionId: token.sid } : {}) };
         if (user.must_change_password && !['/auth/me', '/auth/first-login-password'].includes(req.path)) {
             res.status(428).json({ error: 'Temporary password must be changed before using IndraQ. Run `indraq login` and complete the first-login password change.' });
             return;
@@ -467,8 +480,46 @@ app.post('/auth/login', async (req, res) => {
         return;
     }
     await pool.query('UPDATE users SET last_login_at=now() WHERE id=$1', [user.id]);
-    const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, jwtSecret, { expiresIn: '12h' });
-    res.json({ token, user: { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password } });
+    const session = await createAuthSession(user.id);
+    const token = accessTokenFor({ id: user.id, email: user.email, role: user.role }, session.sessionId);
+    res.setHeader('Cache-Control', 'no-store');
+    res.json({ token, refreshToken: session.refreshToken, user: { id: user.id, email: user.email, name: user.name, role: user.role, mustChangePassword: !!user.must_change_password } });
+});
+app.post('/auth/session', auth, async (req, res) => {
+    if (req.auth.sessionId) {
+        res.status(409).json({ error: 'This access token already belongs to a persistent session.' });
+        return;
+    }
+    const session = await createAuthSession(req.auth.id);
+    const token = accessTokenFor({ id: req.auth.id, email: req.auth.email, role: req.auth.role }, session.sessionId);
+    res.setHeader('Cache-Control', 'no-store');
+    res.json({ token, refreshToken: session.refreshToken });
+});
+app.post('/auth/refresh', async (req, res) => {
+    const refreshToken = String(req.body?.refreshToken || '');
+    if (!refreshToken) {
+        res.status(401).json({ error: 'Refresh token required' });
+        return;
+    }
+    const result = await pool.query(`SELECT s.id AS session_id,u.id,u.email,u.role,u.is_active
+       FROM auth_sessions s
+       JOIN users u ON u.id=s.user_id
+      WHERE s.refresh_token_hash=$1 AND s.revoked_at IS NULL`, [refreshHash(refreshToken)]);
+    const row = result.rows[0];
+    if (!row || !row.is_active) {
+        res.status(401).json({ error: 'Session is no longer valid' });
+        return;
+    }
+    await pool.query('UPDATE auth_sessions SET last_used_at=now() WHERE id=$1', [row.session_id]);
+    const token = accessTokenFor({ id: row.id, email: row.email, role: row.role }, row.session_id);
+    res.setHeader('Cache-Control', 'no-store');
+    res.json({ token, refreshToken });
+});
+app.post('/auth/logout', async (req, res) => {
+    const refreshToken = String(req.body?.refreshToken || '');
+    if (refreshToken)
+        await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE refresh_token_hash=$1 AND revoked_at IS NULL', [refreshHash(refreshToken)]);
+    res.status(204).end();
 });
 app.get('/auth/me', auth, (req, res) => res.json(req.auth));
 app.post('/auth/first-login-password', auth, async (req, res) => {
@@ -488,6 +539,8 @@ app.post('/auth/first-login-password', auth, async (req, res) => {
         return;
     }
     await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), req.auth.id]);
+    if (req.auth.sessionId)
+        await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND id<>$2 AND revoked_at IS NULL', [req.auth.id, req.auth.sessionId]);
     await audit(req.auth.id, 'user.password.first-login', 'user', req.auth.id, 'Required first-login password change', { providers: external.map((item) => item.provider) });
     res.json({ ok: true, results: [{ provider: 'cloud', ok: true }, ...external] });
 });
@@ -553,6 +606,7 @@ app.post('/auth/password-reset/verify', async (req, res) => {
         results.push(...await resetManagedExternalPasswords(user.id, newPassword, targets));
     if (targets.includes('cloud')) {
         await pool.query('UPDATE users SET password_hash=$1,must_change_password=false,password_changed_at=now(),updated_at=now() WHERE id=$2', [await bcrypt.hash(newPassword, 12), user.id]);
+        await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND revoked_at IS NULL', [user.id]);
         results.unshift({ provider: 'cloud', ok: true });
     }
     await pool.query('UPDATE password_reset_otps SET used_at=now() WHERE id=$1', [row.id]);
@@ -606,6 +660,7 @@ app.patch('/users/:id/password', ...allow('manager', 'admin'), async (req, res)
         return;
     }
     await pool.query('UPDATE users SET password_hash=$1,must_change_password=true,updated_at=now() WHERE id=$2', [await bcrypt.hash(password, 12), id]);
+    await pool.query('UPDATE auth_sessions SET revoked_at=now() WHERE user_id=$1 AND revoked_at IS NULL', [id]);
     await audit(req.auth.id, 'user.password.update', 'user', id, reason);
     res.status(204).end();
 });

package/cloud-api/node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@indraq/cloud-api",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/cloud-api/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@indraq/cloud-api",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@indraq/cloud-api",
-      "version": "0.7.0",
+      "version": "0.8.0",
       "dependencies": {
         "@aws-sdk/client-iam": "^3.1123.0",
         "bcryptjs": "^3.0.2",

package/cloud-api/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@indraq/cloud-api",
   "private": true,
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "scripts": {
     "dev": "tsx watch src/index.ts",