mbkauthe 4.8.4 → 4.9.0

package/README.md

@@ -20,6 +20,7 @@
 
 ## ✨ Key Features
 
+- Compatible With Serverless Function (Vercel)
 - Secure password authentication (PBKDF2)
 - PostgreSQL session management
 - Multi-session support (configurable concurrent sessions per user)

package/index.js

@@ -98,5 +98,6 @@ export * from "./lib/routes/auth.js";
 export * from "./lib/utils/errors.js";
 export * from "./lib/config/cookies.js";
 export * from "./lib/config/security.js";
+export * from "./lib/db/AuthRepository.js";
 export { mbkautheVar } from "#config.js";
 export default app;

package/lib/db/AuthRepository.js

@@ -0,0 +1,295 @@
+import { BaseRepository } from "./BaseRepository.js";
+
+const OAUTH_PROVIDERS = {
+  github: {
+    table: "user_github",
+    idColumn: "github_id",
+    queryName: "github-login-get-user"
+  },
+  google: {
+    table: "user_google",
+    idColumn: "google_id",
+    queryName: "google-login-get-user"
+  }
+};
+
+export class AuthRepository extends BaseRepository {
+  resolveOAuthProvider(provider) {
+    const key = String(provider || "").toLowerCase();
+    const config = OAUTH_PROVIDERS[key];
+    if (!config) {
+      throw new Error(`Unsupported OAuth provider: ${provider}`);
+    }
+    return config;
+  }
+
+  async fetchActiveSession(sessionId) {
+    const query = `SELECT s.id as sid, s.expires_at, u.id as uid, u."UserName", u."Active", u."Role", u."AllowedApps"
+                 FROM "Sessions" s
+                 JOIN "Users" u ON s."UserName" = u."UserName"
+                 WHERE s.id = $1 LIMIT 1`;
+    const result = await this.executeRaw({ name: "multi-session-fetch", text: query, values: [sessionId] });
+    return result.rows?.[0] || null;
+  }
+
+  async deleteAppSessionById(sessionId, queryName = "invalidate-app-session") {
+    const query = `DELETE FROM "Sessions" WHERE id = $1`;
+    return this.executeRaw({ name: queryName, text: query, values: [sessionId] });
+  }
+
+  async deleteSessionBySid(sessionId, queryName = "login-delete-old-session-before-regen") {
+    const query = `DELETE FROM "session" WHERE sid = $1`;
+    return this.executeRaw({ name: queryName, text: query, values: [sessionId] });
+  }
+
+  async touchTrustedDevice(deviceTokenHash, username) {
+    const query = `
+      UPDATE "TrustedDevices" td
+      SET "LastUsed" = NOW()
+      FROM "Users" u
+      WHERE td."DeviceToken" = $1
+        AND td."UserName" = $2
+        AND td."ExpiresAt" > NOW()
+        AND u."UserName" = td."UserName"
+        AND u."Active" = TRUE
+      RETURNING td."UserName", td."ExpiresAt", u."id" as id, u."Active", u."Role", u."AllowedApps"
+    `;
+
+    const result = await this.executeRaw({
+      name: "check-trusted-device",
+      text: query,
+      values: [deviceTokenHash, username]
+    });
+    return result.rows?.[0] || null;
+  }
+
+  async cleanupAndCountUserSessions(username, queryName = "cleanup-and-count-user-sessions") {
+    const query = `
+          WITH deleted AS (
+            DELETE FROM "Sessions"
+            WHERE "UserName" = $1
+              AND expires_at IS NOT NULL
+              AND expires_at <= NOW()
+          )
+          SELECT COUNT(*)::int AS count
+          FROM "Sessions"
+          WHERE "UserName" = $1
+        `;
+
+    const result = await this.executeRaw({ name: queryName, text: query, values: [username] });
+    return Number(result.rows?.[0]?.count ?? 0);
+  }
+
+  async deleteOldestSessionsForUser(username, limit, queryName = "prune-oldest-user-session") {
+    if (!Number.isFinite(limit) || limit <= 0) return 0;
+    const query = `DELETE FROM "Sessions" WHERE id IN (SELECT id FROM "Sessions" WHERE "UserName" = $1 ORDER BY created_at ASC LIMIT $2)`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [username, limit] });
+    return result.rowCount || 0;
+  }
+
+  async deleteExpiredSessionsForUser(username) {
+    const query = this.sql`
+      DELETE FROM ${this.table("Sessions")}
+      WHERE ${this.ident("UserName")} = ${this.value(username)}
+        AND ${this.ident("expires_at")} IS NOT NULL
+        AND ${this.ident("expires_at")} <= ${this.now()}
+    `;
+
+    const result = await this.execute("cleanup-expired-user-sessions", query);
+    return result.rowCount || 0;
+  }
+
+  async countActiveSessionsForUser(username) {
+    const columns = this.columns([`COUNT(*) AS ${this.quoteIdentifier("count")}`]);
+    const query = this.sql`
+      SELECT ${columns}
+      FROM ${this.table("Sessions")}
+      WHERE ${this.ident("UserName")} = ${this.value(username)}
+    `;
+    const result = await this.execute("count-user-sessions", query);
+    return Number(result.rows?.[0]?.count ?? 0);
+  }
+
+  async getOldestSessionIds(username, limit) {
+    if (!Number.isFinite(limit) || limit <= 0) return [];
+
+    const query = this.sql`
+      SELECT ${this.column("id")}
+      FROM ${this.table("Sessions")}
+      WHERE ${this.ident("UserName")} = ${this.value(username)}
+      ORDER BY ${this.ident("created_at")} ASC
+      ${this.limit(limit)}
+    `;
+
+    const result = await this.execute("oldest-user-sessions", query);
+    return (result.rows || []).map((row) => row.id).filter(Boolean);
+  }
+
+  async insertAppSession(username, expiresAt, meta) {
+    const query = `INSERT INTO "Sessions" ("UserName", expires_at, meta) VALUES ($1, $2, $3) RETURNING id`;
+    const result = await this.executeRaw({
+      name: "insert-app-session",
+      text: query,
+      values: [username, expiresAt, meta]
+    });
+    return result.rows?.[0] || null;
+  }
+
+  async updateLastLoginReturnProfile(userId) {
+    const query = `UPDATE "Users" SET "last_login" = NOW() WHERE "id" = $1 RETURNING "FullName", "Image"`;
+    const result = await this.executeRaw({
+      name: "login-update-last-login-return-profile",
+      text: query,
+      values: [userId]
+    });
+    return result.rows?.[0] || null;
+  }
+
+  async getUserProfileByUsername(username, queryName = "login-get-fullname-and-image") {
+    const query = `SELECT "FullName", "Image" FROM "Users" WHERE "UserName" = $1 LIMIT 1`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [username] });
+    return result.rows?.[0] || null;
+  }
+
+  async insertTrustedDevice({ username, deviceTokenHash, deviceName, userAgent, ipAddress, expiresAt }) {
+    const query = `INSERT INTO "TrustedDevices" ("UserName", "DeviceToken", "DeviceName", "UserAgent", "IpAddress", "ExpiresAt") 
+                   VALUES ($1, $2, $3, $4, $5, $6)`;
+    return this.executeRaw({
+      name: "insert-trusted-device",
+      text: query,
+      values: [username, deviceTokenHash, deviceName, userAgent, ipAddress, expiresAt]
+    });
+  }
+
+  async getUserWithTwoFA(username, queryName = "login-get-user") {
+    const query = `
+      SELECT u.id, u."UserName", u."PasswordEnc", u."Active", u."Role", u."AllowedApps",
+             tfa."TwoFAStatus"
+      FROM "Users" u
+      LEFT JOIN "TwoFA" tfa ON u."UserName" = tfa."UserName"
+      WHERE u."UserName" = $1
+    `;
+
+    const result = await this.executeRaw({ name: queryName, text: query, values: [username] });
+    return result.rows?.[0] || null;
+  }
+
+  async getTwoFASecret(username) {
+    const query = `SELECT tfa."TwoFASecret" FROM "TwoFA" tfa WHERE tfa."UserName" = $1`;
+    const result = await this.executeRaw({ name: "verify-2fa-secret", text: query, values: [username] });
+    return result.rows?.[0] || null;
+  }
+
+  async deleteSessionsByIds(ids, queryName = "delete-sessions-by-ids") {
+    if (!Array.isArray(ids) || ids.length === 0) return 0;
+    const query = `DELETE FROM "Sessions" WHERE id = ANY($1)`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [ids] });
+    return result.rowCount || 0;
+  }
+
+  async getOAuthUserByProviderId(provider, providerId) {
+    const { table, idColumn, queryName } = this.resolveOAuthProvider(provider);
+    const query = `SELECT ug.*, u."UserName", u."Role", u."Active", u."AllowedApps", u."id" FROM ${table} ug JOIN "Users" u ON ug.user_name = u."UserName" WHERE ug.${idColumn} = $1`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [providerId] });
+    return result.rows?.[0] || null;
+  }
+
+  async getApiTokenByHash(tokenHash, queryName = "validate-api-token") {
+    const query = `
+      SELECT t.id, t."UserName", t."ExpiresAt", t."Permissions",
+             u.id as uid, u."Active", u."Role", u."AllowedApps" as user_allowed_apps, u."FullName"
+      FROM "ApiTokens" t
+      JOIN "Users" u ON t."UserName" = u."UserName"
+      WHERE t."TokenHash" = $1 LIMIT 1
+    `;
+
+    const result = await this.executeRaw({ name: queryName, text: query, values: [tokenHash] });
+    return result.rows?.[0] || null;
+  }
+
+  async updateApiTokenLastUsed(tokenId, queryName = null) {
+    const query = `UPDATE "ApiTokens" SET "LastUsed" = NOW() WHERE id = $1`;
+    if (queryName) {
+      return this.executeRaw({ name: queryName, text: query, values: [tokenId] });
+    }
+    return this.executeRaw({ text: query, values: [tokenId] });
+  }
+
+  async getSessionAuthData(sessionId, queryName = "validate-app-session") {
+    const query = `
+  SELECT s.expires_at, u."Active", u."Role"
+  FROM "Sessions" s
+  JOIN "Users" u ON s."UserName" = u."UserName"
+  WHERE s.id = $1
+  LIMIT 1
+`;
+
+    const result = await this.executeRaw({ name: queryName, text: query, values: [sessionId] });
+    return result.rows?.[0] || null;
+  }
+
+  async getSessionWithUserById(sessionId, queryName = "restore-user-session") {
+    const query = `SELECT u.id, u."UserName", u."Active", u."Role", u."AllowedApps", s.expires_at
+                     FROM "Sessions" s
+                     JOIN "Users" u ON s."UserName" = u."UserName"
+                     WHERE s.id = $1 LIMIT 1`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [sessionId] });
+    return result.rows?.[0] || null;
+  }
+
+  async getSessionWithUserForReload(sessionId, queryName = "reload-session-user") {
+    const query = `SELECT s.id as sid, s.expires_at, u.id as uid, u."UserName", u."Active", u."Role", u."AllowedApps"
+                   FROM "Sessions" s
+                   JOIN "Users" u ON s."UserName" = u."UserName"
+                   WHERE s.id = $1 LIMIT 1`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [sessionId] });
+    return result.rows?.[0] || null;
+  }
+
+  async getSessionValidationRow(sessionId, queryName = "check-session-validity-by-id") {
+    const query = `SELECT s.expires_at, u."Active", u."UserName", u."Role" FROM "Sessions" s JOIN "Users" u ON s."UserName" = u."UserName" WHERE s.id = $1 LIMIT 1`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [sessionId] });
+    return result.rows?.[0] || null;
+  }
+
+  async getUserFullNameByUsername(username, queryName = "get-fullname-by-username") {
+    const query = `SELECT "FullName" FROM "Users" WHERE "UserName" = $1 LIMIT 1`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [username] });
+    return result.rows?.[0] || null;
+  }
+
+  async getUserImageByUsername(username, queryName = "get-user-profile-pic") {
+    const query = `SELECT "Image" FROM "Users" WHERE "UserName" = $1 LIMIT 1`;
+    const result = await this.executeRaw({ name: queryName, text: query, values: [username] });
+    return result.rows?.[0] || null;
+  }
+
+  async getSessionValidity(sessionId, sessionStoreSid, queryName = "check-session-validity") {
+    const query = `
+        SELECT
+          s.expires_at,
+          u."Active",
+          CASE
+            WHEN s.expires_at IS NULL THEN (SELECT expire FROM "session" WHERE sid = $2)
+            ELSE NULL
+          END AS connect_expire
+        FROM "Sessions" s
+        JOIN "Users" u ON s."UserName" = u."UserName"
+        WHERE s.id = $1
+        LIMIT 1
+      `;
+
+    const result = await this.executeRaw({ name: queryName, text: query, values: [sessionId, sessionStoreSid] });
+    return result.rows?.[0] || null;
+  }
+
+  async deleteAllAppSessions(queryName = "delete-all-app-sessions") {
+    const query = `DELETE FROM "Sessions"`;
+    return this.executeRaw({ name: queryName, text: query, values: [] });
+  }
+
+  async deleteActiveSessionStoreRows(queryName = "delete-active-session-store-rows") {
+    const query = `DELETE FROM "session" WHERE expire > NOW()`;
+    return this.executeRaw({ name: queryName, text: query, values: [] });
+  }
+}

package/lib/db/BaseRepository.js

@@ -0,0 +1,185 @@
+import { postgresDialect } from "./dialects/postgres.js";
+
+const isPlainObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+
+export class BaseRepository {
+  constructor({ db, dialect = postgresDialect } = {}) {
+    this.db = db;
+    this.dialect = dialect;
+  }
+
+  quoteIdentifier(name) {
+    if (name === "*") return "*";
+    return String(name)
+      .split(".")
+      .map((part) => (part === "*" ? "*" : this.dialect.quoteIdentifier(part)))
+      .join(".");
+  }
+
+  ident(name) {
+    return { kind: "ident", name };
+  }
+
+  value(val) {
+    return { kind: "param", value: val };
+  }
+
+  raw(text) {
+    return { kind: "raw", text: text ?? "" };
+  }
+
+  list(values) {
+    return { kind: "list", values };
+  }
+
+  table(name, alias = null) {
+    const tableSql = this.quoteIdentifier(name);
+    if (alias) {
+      return this.raw(`${tableSql} AS ${this.quoteIdentifier(alias)}`);
+    }
+    return this.raw(tableSql);
+  }
+
+  column(name, alias = null) {
+    const columnSql = this.quoteIdentifier(name);
+    if (alias) {
+      return `${columnSql} AS ${this.quoteIdentifier(alias)}`;
+    }
+    return columnSql;
+  }
+
+  columns(list) {
+    const items = (list || []).filter(Boolean).map((item) => {
+      if (isPlainObject(item) && item.kind) {
+        if (item.kind === "ident") return this.quoteIdentifier(item.name);
+        if (item.kind === "raw") return item.text;
+      }
+      return String(item);
+    });
+    return this.raw(items.join(", "));
+  }
+
+  star(alias = null) {
+    if (!alias) return this.raw("*");
+    return this.raw(`${this.quoteIdentifier(alias)}.*`);
+  }
+
+  now() {
+    return this.raw(this.dialect.now());
+  }
+
+  boolean(value) {
+    return this.raw(this.dialect.boolean(value));
+  }
+
+  returning(columns) {
+    if (!this.dialect.supportsReturning) return this.raw("");
+    if (!columns) return this.raw("");
+
+    let columnSql = "";
+    if (isPlainObject(columns) && columns.kind === "raw") {
+      columnSql = columns.text;
+    } else if (Array.isArray(columns)) {
+      columnSql = columns.join(", ");
+    } else {
+      columnSql = String(columns);
+    }
+
+    if (!columnSql) return this.raw("");
+    return this.raw(this.dialect.returningClause(columnSql));
+  }
+
+  limit(limit, offset) {
+    return this.raw(this.dialect.limitOffset({ limit, offset }));
+  }
+
+  sql(strings, ...exprs) {
+    const values = [];
+    let text = strings?.[0] ?? "";
+
+    for (let i = 0; i < exprs.length; i += 1) {
+      text += this.renderToken(exprs[i], values);
+      text += strings?.[i + 1] ?? "";
+    }
+
+    return { text, values };
+  }
+
+  renderToken(token, values) {
+    if (token == null) return "";
+
+    if (!isPlainObject(token) || !token.kind) {
+      return String(token);
+    }
+
+    switch (token.kind) {
+      case "raw":
+        return token.text;
+      case "ident":
+        return this.quoteIdentifier(token.name);
+      case "param":
+        values.push(token.value);
+        return this.dialect.param(values.length);
+      case "list":
+        if (!Array.isArray(token.values) || token.values.length === 0) {
+          return "(NULL)";
+        }
+        return `(${token.values.map((item) => {
+          values.push(item);
+          return this.dialect.param(values.length);
+        }).join(", ")})`;
+      default:
+        return "";
+    }
+  }
+
+  async execute(name, query) {
+    const { text, values } = query;
+    if (name) {
+      return this.db.query({ name, text, values });
+    }
+    return this.db.query({ text, values });
+  }
+
+  async executeRaw({ name, text, values }) {
+    if (name) {
+      return this.db.query({ name, text, values });
+    }
+    return this.db.query({ text, values });
+  }
+
+  cloneWithDb(db) {
+    return new this.constructor({ db, dialect: this.dialect });
+  }
+
+  async withTransaction(fn) {
+    if (!this.db || typeof this.db.connect !== "function") {
+      return fn(this);
+    }
+
+    const client = await this.db.connect();
+    const txRepo = this.cloneWithDb(client);
+
+    try {
+      await client.query("BEGIN");
+      const result = await fn(txRepo);
+      await client.query("COMMIT");
+      return result;
+    } catch (err) {
+      await client.query("ROLLBACK").catch(() => {});
+      throw err;
+    } finally {
+      client.release();
+    }
+  }
+
+  async lockTable(tableName, mode) {
+    if (!this.dialect.lockTable) return null;
+    const text = this.dialect.lockTable(this.quoteIdentifier(tableName), mode);
+    return this.executeRaw({
+      name: `lock-${tableName}`,
+      text,
+      values: []
+    });
+  }
+}

package/lib/db/dialects/postgres.js

@@ -0,0 +1,18 @@
+const quoteIdentifier = (name) => `"${String(name).replace(/"/g, '""')}"`;
+
+export const postgresDialect = {
+  name: "postgres",
+  quoteIdentifier,
+  param: (index) => `$${index}`,
+  now: () => "NOW()",
+  boolean: (value) => (value ? "TRUE" : "FALSE"),
+  supportsReturning: true,
+  returningClause: (columns) => ` RETURNING ${columns}`,
+  limitOffset: ({ limit, offset } = {}) => {
+    const parts = [];
+    if (typeof limit === "number") parts.push(`LIMIT ${limit}`);
+    if (typeof offset === "number") parts.push(`OFFSET ${offset}`);
+    return parts.length ? ` ${parts.join(" ")}` : "";
+  },
+  lockTable: (tableSql, mode = "ROW EXCLUSIVE") => `LOCK TABLE ${tableSql} IN ${mode} MODE`
+};

package/lib/middleware/auth.js

@@ -6,18 +6,12 @@ import { ErrorCodes, createErrorResponse } from "../utils/errors.js";
 import { hashApiToken } from "#config.js";
 import { canAccessMethod } from "#config.js";
 import { extractAuthorizationToken, timingSafeTokenMatch } from "../utils/timingSafeToken.js";
+import { AuthRepository } from "../db/AuthRepository.js";
 
 const IS_DEV = process.env.env === 'dev' || process.env.test === 'dev' || process.env.NODE_ENV === 'development';
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const isUuid = (val) => typeof val === 'string' && UUID_RE.test(val);
-
-const SQL_VALIDATE_APP_SESSION = `
-  SELECT s.expires_at, u."Active", u."Role"
-  FROM "Sessions" s
-  JOIN "Users" u ON s."UserName" = u."UserName"
-  WHERE s.id = $1
-  LIMIT 1
-`;
+const authRepo = new AuthRepository({ db: dblogin });
 
 /**
  * Decide if the incoming request should return JSON errors instead of HTML.
@@ -64,18 +58,9 @@ async function validateTokenAuthentication(req) {
   // 1. Check for API Token (mbk_)
   if (token.startsWith('mbk_')) {
     const tokenHash = hashApiToken(token);
-    const tokenQuery = `
-      SELECT t.id, t."UserName", t."ExpiresAt", t."Permissions",
-             u.id as uid, u."Active", u."Role", u."AllowedApps" as user_allowed_apps, u."FullName"
-      FROM "ApiTokens" t
-      JOIN "Users" u ON t."UserName" = u."UserName"
-      WHERE t."TokenHash" = $1 LIMIT 1
-    `;
-    const tokenResult = await dblogin.query({ name: 'validate-api-token', text: tokenQuery, values: [tokenHash] });
-
-    if (tokenResult.rows.length === 0) return { error: 'INVALID_TOKEN' };
-
-    const row = tokenResult.rows[0];
+    const row = await authRepo.getApiTokenByHash(tokenHash);
+
+    if (!row) return { error: 'INVALID_TOKEN' };
     if (row.ExpiresAt && new Date(row.ExpiresAt) <= new Date()) return { error: 'TOKEN_EXPIRED' };
 
     // Parse permissions from JSONB
@@ -90,10 +75,7 @@ async function validateTokenAuthentication(req) {
     }
 
     // Update usage
-    dblogin.query({
-      text: 'UPDATE "ApiTokens" SET "LastUsed" = NOW() WHERE id = $1',
-      values: [row.id]
-    }).catch(e => console.error(`[mbkauthe] Failed to update token usage:`, e));
+    authRepo.updateApiTokenLastUsed(row.id).catch(e => console.error(`[mbkauthe] Failed to update token usage:`, e));
 
     return {
       id: row.uid,
@@ -208,13 +190,12 @@ async function validateSession(req, res, next, strictTokenValidation = false) {
     if (isJsonRequest(req)) {
       return res.status(401).json(createErrorResponse(401, ErrorCodes.SESSION_NOT_FOUND));
     }
-    return renderError(res, req, {
-      code: 401,
-      error: "Not Logged In",
-      message: "You Are Not Logged In. Please Log In To Continue.",
-      pagename: "Login",
-      page: `/mbkauthe/login?redirect=${encodeURIComponent(req.originalUrl)}`,
+    // Use OAuth 2.0 style redirect to the login page for browser navigation
+    const redirectParams = new URLSearchParams({
+      redirect: req.originalUrl,
+      reason: 'logged_out'
     });
+    return res.redirect(302, `/mbkauthe/login?${redirectParams.toString()}`);
   }
 
   try {
@@ -238,9 +219,9 @@ async function validateSession(req, res, next, strictTokenValidation = false) {
     }
 
     // Validate session by DB primary key id and join to user
-    const result = await dblogin.query({ name: 'validate-app-session', text: SQL_VALIDATE_APP_SESSION, values: [sessionId] });
+    const sessionRow = await authRepo.getSessionAuthData(sessionId, 'validate-app-session');
 
-    if (result.rows.length === 0) {
+    if (!sessionRow) {
       console.log(`[mbkauthe] Session not found for user "${req.session.user.username}"`);
       req.session.destroy();
       clearSessionCookies(res);
@@ -256,8 +237,6 @@ async function validateSession(req, res, next, strictTokenValidation = false) {
       });
     }
 
-    const sessionRow = result.rows[0];
-
     // Check expired
     if (sessionRow.expires_at) {
       const expiresMs = sessionRow.expires_at instanceof Date
@@ -349,16 +328,14 @@ async function validateApiSession(req, res, next) {
     }
 
     // Validate session by DB primary key id and join to user
-    const result = await dblogin.query({ name: 'validate-app-session-for-api', text: SQL_VALIDATE_APP_SESSION, values: [sessionId] });
+    const sessionRow = await authRepo.getSessionAuthData(sessionId, 'validate-app-session-for-api');
 
-    if (result.rows.length === 0) {
+    if (!sessionRow) {
       req.session.destroy();
       clearSessionCookies(res);
       return res.status(401).json(createErrorResponse(401, ErrorCodes.SESSION_INVALID));
     }
 
-    const sessionRow = result.rows[0];
-
     // Check expired
     if (sessionRow.expires_at) {
       const expiresMs = sessionRow.expires_at instanceof Date
@@ -372,7 +349,7 @@ async function validateApiSession(req, res, next) {
     }
 
 
-    if (!result.rows[0].Active) {
+    if (!sessionRow.Active) {
       console.log(`[mbkauthe] Account is inactive for user "${req.session.user.username}"`);
       req.session.destroy();
       clearSessionCookies(res);
@@ -420,21 +397,15 @@ async function reloadSessionUser(req, res) {
     }
 
     const normalizedSessionId = String(currentSessionId);
-    const query = `SELECT s.id as sid, s.expires_at, u.id as uid, u."UserName", u."Active", u."Role", u."AllowedApps"
-                   FROM "Sessions" s
-                   JOIN "Users" u ON s."UserName" = u."UserName"
-                   WHERE s.id = $1 LIMIT 1`;
-    const result = await dblogin.query({ name: 'reload-session-user', text: query, values: [normalizedSessionId] });
+    const row = await authRepo.getSessionWithUserForReload(normalizedSessionId, 'reload-session-user');
 
-    if (result.rows.length === 0) {
+    if (!row) {
       // Session not found — invalidate session
       req.session.destroy(() => { });
       clearSessionCookies(res);
       return false;
     }
 
-    const row = result.rows[0];
-
     // Check expired
     if (row.expires_at && new Date(row.expires_at) <= new Date()) {
       req.session.destroy(() => { });
@@ -470,8 +441,8 @@ async function reloadSessionUser(req, res) {
       req.session.user.fullname = req.cookies.fullName;
     } else {
       try {
-        const prof = await dblogin.query({ name: 'reload-get-fullname', text: 'SELECT "FullName" FROM "Users" WHERE "UserName" = $1 LIMIT 1', values: [row.UserName] });
-        if (prof.rows.length > 0 && prof.rows[0].FullName) req.session.user.fullname = prof.rows[0].FullName;
+        const prof = await authRepo.getUserFullNameByUsername(row.UserName, 'reload-get-fullname');
+        if (prof && prof.FullName) req.session.user.fullname = prof.FullName;
       } catch (profileErr) {
         console.error(`[mbkauthe] Error fetching fullname during reload:`, profileErr);
       }