or3-provider-basic-auth 0.0.9 → 0.0.11

package/README.md

@@ -51,6 +51,7 @@ Optional:
 - `OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD`
 - `OR3_BASIC_AUTH_RATE_LIMIT_BACKEND` (`sqlite` default; `memory` is per-process and intended for single-instance development only)
 - `OR3_BASIC_AUTH_ALLOW_INSECURE_DEV` (`true` in non-production to start with missing secrets instead of failing)
+- `OR3_PLUGIN_DEV_COOKIE_SCOPE` (set by the isolated plugin development launcher to keep browser sessions separate across local hosts)
 
 Registration mode is a core-auth policy, not a provider setting:
 
@@ -68,10 +69,12 @@ Strict-mode behavior:
 - Canonical OR3 users/workspaces are still resolved by the selected `AuthWorkspaceStore`.
 - In `invite_only` mode, signed-token, expiry, persisted invite state/token hash, and normalized-email validation runs before Basic Auth creates an account or session.
 - The selected `AuthWorkspaceStore` must support atomic invite provisioning; internal user/auth mapping, membership, and invite consumption are committed together by that provider.
+- Invite links (`/?invite=TOKEN`, copied from Admin → Workspaces, or carried in the lock page's `next`) open registration for signed-out visitors with the token filled in. The token is removed from the address bar on first read and kept in memory for that page; only one mounted auth control (sidebar, mobile More sheet or lock page) opens registration per link. On mobile the account control lives in More, so registration opens when the visitor opens More. This invite-link handoff requires published `or3-provider-basic-auth@0.0.11` or later.
 - Basic Auth account and initial refresh-session rows are created in one local SQLite transaction.
 - Access JWTs are short-lived and validated by `basicAuthProvider.getSession(event)`.
 - Refresh tokens are rotated and hashed at rest; replay attempts revoke active sessions.
 - The refresh cookie is scoped to `/api` so `/api/auth/session` can transparently rotate expired access tokens during session resolution.
+- Sign-out never refreshes the session: the user is resolved without rotation, and revoking a token also revokes the sessions it was rotated into and clears their rotation grace, so a replayed predecessor cannot recover a successor after logout.
 - The SQLite DB file and directory are hardened to mode `0600`/`0700`; the DB uses WAL journaling.
 
 ## Runtime entrypoints
@@ -90,6 +93,8 @@ Strict-mode behavior:
 | `src/runtime/plugins/auth-status.client.ts` | Client auth-status resolver + silent-refresh recovery |
 | `src/runtime/components/*.client.vue` | Provider-owned auth UI (modals, user menu, sidebar button, lock page) |
 
+New passwords must be at least eight characters and no more than 72 UTF-8 bytes, matching bcrypt's input limit. Existing account hashes remain verifiable, including passwords created before this limit was enforced.
+
 The registered sidebar auth adapter accepts `layout="rail"` (default) and
 `layout="more-sheet"`. In the More sheet it renders Account/Login with the
 host's shared full-width `.more-row` structure, while keeping the existing
@@ -134,3 +139,19 @@ bun run type-check
 bun run test
 bun run build
 ```
+
+
+### Testing local changes in OR3 Chat
+
+With this repository beside `or3-chat`, run `bun install` here once, then
+`bun run dev:ssr` from Chat. Chat's dev wrapper rebuilds the local provider and
+prints its selected path; restart it after provider edits. Missing repositories
+or failed builds fall back to installed packages with a warning.
+`OR3_LOCAL_PROVIDERS=false` disables local selection. Production builds use the
+installed package, so local development does not publish these changes.
+
+Basic Auth's database always uses `better-sqlite3`, independently of the sync
+provider's SQLite driver. If the source launcher selects Bun for sync, this
+native binding must also work under the project-pinned Bun version. The launcher
+checks it in that runtime before starting Nuxt and reports incompatible bindings
+or runtime crashes. Managed Cloud uses Node with `better-sqlite3`.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-basic-auth",
   "configKey": "or3-provider-basic-auth",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/components/BasicAuthChangePasswordModal.client.vue

@@ -31,7 +31,7 @@
 
           <USeparator />
 
-          <UFormField label="New Password" name="newPassword">
+          <UFormField label="New Password" name="newPassword" hint="At least 8 characters; at most 72 UTF-8 bytes">
             <UInput
               v-model="state.newPassword"
               type="password"
@@ -83,6 +83,7 @@
 
 <script setup>
 import { computed, reactive, ref } from "vue";
+import { newPasswordFitsBcrypt } from "../password-policy";
 const modalUi = {
   overlay: "basic-auth-modal-overlay",
   content: "basic-auth-modal-content sm:max-w-[400px]"
@@ -108,6 +109,14 @@ function close() {
   emit("update:modelValue", false);
 }
 async function onSubmit() {
+  if (state.newPassword.length < 8) {
+    errorMessage.value = "New password must be at least 8 characters.";
+    return;
+  }
+  if (!newPasswordFitsBcrypt(state.newPassword)) {
+    errorMessage.value = "New password must be 72 UTF-8 bytes or fewer.";
+    return;
+  }
   if (state.newPassword !== state.confirmNewPassword) {
     errorMessage.value = "Passwords do not match";
     return;

package/dist/runtime/components/BasicAuthLockPage.client.vue

@@ -23,18 +23,25 @@
 
     <BasicAuthRegisterModal
       v-model="registerModalOpen"
+      :invite-token="inviteToken"
       @registered="handleRegistered"
     />
   </div>
 </template>
 
 <script setup>
-import { nextTick, ref } from "vue";
+import { nextTick, onMounted, ref } from "vue";
 import BasicAuthRegisterModal from "./BasicAuthRegisterModal.client.vue";
 import BasicAuthSignInModal from "./BasicAuthSignInModal.client.vue";
+import { claimInviteLinkAutoOpen, readInviteLinkToken } from "../lib/invite-link.client";
 const loginIcon = "i-lucide-log-in";
 const signInModalOpen = ref(false);
 const registerModalOpen = ref(false);
+const inviteToken = ref(null);
+onMounted(() => {
+  inviteToken.value = readInviteLinkToken();
+  if (claimInviteLinkAutoOpen()) registerModalOpen.value = true;
+});
 function notifyAuthSessionChanged() {
   if (typeof window === "undefined") return;
   window.dispatchEvent(new CustomEvent("or3:auth-session-changed"));

package/dist/runtime/components/BasicAuthRegisterModal.client.d.vue.ts

@@ -1,5 +1,7 @@
 type __VLS_Props = {
     modelValue: boolean;
+    /** Token from an invite link; filled in when the form opens. */
+    inviteToken?: string | null;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;

package/dist/runtime/components/BasicAuthRegisterModal.client.vue

@@ -46,7 +46,7 @@
           <UFormField
             label="Password"
             name="password"
-            hint="At least 8 characters"
+            hint="At least 8 characters; at most 72 UTF-8 bytes"
           >
             <UInput
               v-model="state.password"
@@ -73,7 +73,10 @@
             />
           </UFormField>
 
-          <UFormField label="Invite token (optional)" name="inviteToken">
+          <UFormField
+            :label="props.inviteToken ? 'Invite token (from your invite link)' : 'Invite token (optional)'"
+            name="inviteToken"
+          >
             <UInput
               v-model="state.inviteToken"
               type="text"
@@ -111,13 +114,15 @@
 </template>
 
 <script setup>
-import { computed, reactive, ref } from "vue";
+import { computed, reactive, ref, watch } from "vue";
+import { newPasswordFitsBcrypt } from "../password-policy";
 const modalUi = {
   overlay: "basic-auth-modal-overlay",
   content: "basic-auth-modal-content sm:max-w-[420px]"
 };
 const props = defineProps({
-  modelValue: { type: Boolean, required: true }
+  modelValue: { type: Boolean, required: true },
+  inviteToken: { type: [String, null], required: false }
 });
 const emit = defineEmits(["update:modelValue", "registered"]);
 const state = reactive({
@@ -135,6 +140,9 @@ const isOpen = computed({
     emit("update:modelValue", value);
   }
 });
+watch(() => [props.modelValue, props.inviteToken], ([open, token]) => {
+  if (open && token && !state.inviteToken.trim()) state.inviteToken = token;
+}, { immediate: true });
 function close() {
   errorMessage.value = "";
   emit("update:modelValue", false);
@@ -150,6 +158,9 @@ function validateClientSide() {
   if (state.password.length > 512) {
     return "Password is too long.";
   }
+  if (!newPasswordFitsBcrypt(state.password)) {
+    return "Password must be 72 UTF-8 bytes or fewer.";
+  }
   if (state.password !== state.confirmPassword) {
     return "Passwords must match.";
   }
@@ -186,7 +197,7 @@ async function onSubmit() {
     const statusCode = typeof error === "object" && error !== null && "statusCode" in error ? Number(error.statusCode) : null;
     const serverMessage = readFetchErrorMessage(error);
     if (statusCode === 400) {
-      errorMessage.value = serverMessage || "Please check your email and password (min 8 characters).";
+      errorMessage.value = serverMessage || "Please check your email and password (8 characters minimum; 72 UTF-8 bytes maximum).";
     } else if (statusCode === 403) {
       errorMessage.value = serverMessage || "Registration is restricted for this instance.";
     } else if (statusCode === 401) {

package/dist/runtime/components/BasicAuthRegisterModal.client.vue.d.ts

@@ -1,5 +1,7 @@
 type __VLS_Props = {
     modelValue: boolean;
+    /** Token from an invite link; filled in when the form opens. */
+    inviteToken?: string | null;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;

package/dist/runtime/components/SidebarAuthButtonBasic.client.vue

@@ -57,6 +57,7 @@
 
     <BasicAuthRegisterModal
       v-model="registerModalOpen"
+      :invite-token="inviteToken"
       @registered="onRegistered"
     />
 
@@ -76,6 +77,7 @@ import {
   AUTH_UI_LAYOUT_KEY
 } from "../lib/auth-ui-layout";
 import { silentRefreshOnce } from "../lib/silent-refresh.client";
+import { claimInviteLinkAutoOpen, readInviteLinkToken } from "../lib/invite-link.client";
 import BasicAuthSignInModal from "./BasicAuthSignInModal.client.vue";
 import BasicAuthRegisterModal from "./BasicAuthRegisterModal.client.vue";
 import BasicAuthUserMenu from "./BasicAuthUserMenu.client.vue";
@@ -171,8 +173,13 @@ async function onRegistered() {
   await refreshSession({ allowSilentRefresh: false });
   notifyAuthSessionChanged();
 }
-onMounted(() => {
-  void refreshSession();
+const inviteToken = ref(null);
+onMounted(async () => {
+  inviteToken.value = readInviteLinkToken();
+  await refreshSession();
+  if (!isSignedIn.value && isBasicAuthProvider.value && claimInviteLinkAutoOpen()) {
+    registerModalOpen.value = true;
+  }
 });
 </script>
 

package/dist/runtime/lib/invite-link.client.d.ts

@@ -0,0 +1,4 @@
+export declare function readInviteLinkToken(): string | null;
+/** True for the one caller that should open registration for this link. */
+export declare function claimInviteLinkAutoOpen(): boolean;
+export declare function resetInviteLinkForTests(): void;

package/dist/runtime/lib/invite-link.client.js

@@ -0,0 +1,39 @@
+let token;
+let autoOpenClaimed = false;
+function takeInvite(url) {
+  const direct = url.searchParams.get("invite")?.trim();
+  if (direct) {
+    url.searchParams.delete("invite");
+    return direct;
+  }
+  const next = url.searchParams.get("next");
+  if (!next) return null;
+  const target = new URL(next, url.origin);
+  const carried = target.searchParams.get("invite")?.trim();
+  if (!carried) return null;
+  target.searchParams.delete("invite");
+  url.searchParams.set("next", target.pathname + target.search + target.hash);
+  return carried;
+}
+export function readInviteLinkToken() {
+  if (token !== void 0) return token;
+  token = null;
+  if (typeof window === "undefined") return token;
+  try {
+    const url = new URL(window.location.href);
+    token = takeInvite(url);
+    if (token) window.history.replaceState(window.history.state, "", url.pathname + url.search + url.hash);
+  } catch {
+    token = null;
+  }
+  return token;
+}
+export function claimInviteLinkAutoOpen() {
+  if (!readInviteLinkToken() || autoOpenClaimed) return false;
+  autoOpenClaimed = true;
+  return true;
+}
+export function resetInviteLinkForTests() {
+  token = void 0;
+  autoOpenClaimed = false;
+}

package/dist/runtime/password-policy.d.ts

@@ -0,0 +1,2 @@
+export declare const MAX_BCRYPT_PASSWORD_BYTES = 72;
+export declare function newPasswordFitsBcrypt(password: string): boolean;

package/dist/runtime/password-policy.js

@@ -0,0 +1,4 @@
+export const MAX_BCRYPT_PASSWORD_BYTES = 72;
+export function newPasswordFitsBcrypt(password) {
+  return new TextEncoder().encode(password).length <= MAX_BCRYPT_PASSWORD_BYTES;
+}

package/dist/runtime/server/api/basic-auth/_helpers.js

@@ -18,6 +18,9 @@ export async function parseBodyWithSchema(event, schema) {
     const firstIssue = result.error.issues[0];
     const path = firstIssue?.path?.join(".") || "input";
     const detail = firstIssue?.message || "Invalid request";
+    if (detail === "Password must be 72 UTF-8 bytes or fewer.") {
+      throw createError({ statusCode: 400, statusMessage: detail });
+    }
     if (path === "password" || path === "confirmPassword") {
       throw createError({
         statusCode: 400,

package/dist/runtime/server/api/basic-auth/change-password.post.js

@@ -11,11 +11,16 @@ import {
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
 import { basicAuthProvider } from "../../auth/basic-auth-provider.js";
 import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.js";
+import { newPasswordFitsBcrypt } from "../../../password-policy.js";
 const changePasswordSchema = z.object({
   // Existing accounts may have legacy short passwords; only new password is length-enforced.
   currentPassword: z.string().min(1).max(512),
-  newPassword: z.string().min(8).max(512),
-  confirmNewPassword: z.string().min(8).max(512)
+  newPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
+  confirmNewPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  })
 }).refine((input) => input.newPassword === input.confirmNewPassword, {
   message: "Passwords must match"
 });

package/dist/runtime/server/api/basic-auth/register.post.js

@@ -23,11 +23,16 @@ import {
   getSessionMetadataFromEvent
 } from "../../lib/session-store.js";
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
+import { newPasswordFitsBcrypt } from "../../../password-policy.js";
 import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.js";
 const registerSchema = z.object({
   email: z.string().email().max(320),
-  password: z.string().min(8).max(512),
-  confirmPassword: z.string().min(8).max(512),
+  password: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
+  confirmPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
   displayName: z.string().trim().min(1).max(120).optional(),
   inviteToken: z.string().trim().min(1).max(4096).optional()
 }).refine((value) => value.password === value.confirmPassword, {

package/dist/runtime/server/api/basic-auth/sign-out.post.js

@@ -1,4 +1,5 @@
 import { defineEventHandler } from "h3";
+import { revokeHostActivationsForUser } from "~~/server/utils/plugins/isolation/activation-registry";
 import { clearAuthCookies } from "../../lib/cookies.js";
 import {
   getAccessTokenFromEvent,
@@ -7,26 +8,60 @@ import {
   verifyRefreshToken
 } from "../../lib/jwt.js";
 import { enforceBasicAuthRateLimit } from "../../lib/rate-limit.js";
-import { revokeSessionById } from "../../lib/session-store.js";
+import {
+  findAccountById,
+  findUsableSessionInChain,
+  revokeSessionChain
+} from "../../lib/session-store.js";
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
 import { assertBasicAuthReady, noStore } from "./_helpers.js";
+async function resolveSignOutUserId(event) {
+  const accessToken = getAccessTokenFromEvent(event);
+  if (accessToken) {
+    const claims = await verifyAccessToken(accessToken);
+    if (claims && findUsableSessionInChain(claims.sid)) {
+      const account = findAccountById(claims.sub);
+      if (account && account.token_version === claims.ver) {
+        return account.id;
+      }
+    }
+  }
+  const refreshToken = getRefreshTokenFromEvent(event);
+  if (refreshToken) {
+    const claims = await verifyRefreshToken(refreshToken);
+    if (claims && findUsableSessionInChain(claims.sid)) {
+      const account = findAccountById(claims.sub);
+      if (account && account.token_version === claims.ver) {
+        return account.id;
+      }
+    }
+  }
+  return null;
+}
 export async function handleSignOut(event) {
   assertBasicAuthReady(event);
   noStore(event);
   enforceMutationOriginPolicy(event);
   enforceBasicAuthRateLimit(event, "basic-auth:sign-out");
+  try {
+    const userId = await resolveSignOutUserId(event);
+    if (userId) {
+      revokeHostActivationsForUser(userId, "logout");
+    }
+  } catch {
+  }
   const refreshToken = getRefreshTokenFromEvent(event);
   if (refreshToken) {
     const refreshClaims = await verifyRefreshToken(refreshToken);
     if (refreshClaims) {
-      revokeSessionById(refreshClaims.sid);
+      revokeSessionChain(refreshClaims.sid);
     }
   }
   const accessToken = getAccessTokenFromEvent(event);
   if (accessToken) {
     const accessClaims = await verifyAccessToken(accessToken);
     if (accessClaims) {
-      revokeSessionById(accessClaims.sid);
+      revokeSessionChain(accessClaims.sid);
     }
   }
   clearAuthCookies(event);

package/dist/runtime/server/lib/cookies.d.ts

@@ -1,4 +1,6 @@
 import { type H3Event } from 'h3';
+export declare function accessCookieName(): string;
+export declare function refreshCookieName(): string;
 export declare function setAccessCookie(event: H3Event, token: string, maxAgeSeconds: number): void;
 export declare function setRefreshCookie(event: H3Event, token: string, maxAgeSeconds: number): void;
 export declare function clearAuthCookies(event: H3Event): void;

package/dist/runtime/server/lib/cookies.js

@@ -9,6 +9,14 @@ import {
 function isProduction() {
   return process.env.NODE_ENV === "production";
 }
+export function accessCookieName() {
+  const scope = process.env.OR3_PLUGIN_DEV_COOKIE_SCOPE;
+  return scope ? `${ACCESS_COOKIE_NAME}_${scope}` : ACCESS_COOKIE_NAME;
+}
+export function refreshCookieName() {
+  const scope = process.env.OR3_PLUGIN_DEV_COOKIE_SCOPE;
+  return scope ? `${REFRESH_COOKIE_NAME}_${scope}` : REFRESH_COOKIE_NAME;
+}
 function refreshCookieBase() {
   return {
     httpOnly: true,
@@ -17,7 +25,7 @@ function refreshCookieBase() {
   };
 }
 export function setAccessCookie(event, token, maxAgeSeconds) {
-  setCookie(event, ACCESS_COOKIE_NAME, token, {
+  setCookie(event, accessCookieName(), token, {
     httpOnly: true,
     sameSite: "lax",
     secure: isProduction(),
@@ -26,28 +34,28 @@ export function setAccessCookie(event, token, maxAgeSeconds) {
   });
 }
 export function setRefreshCookie(event, token, maxAgeSeconds) {
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: LEGACY_REFRESH_COOKIE_PATH
   });
-  setCookie(event, REFRESH_COOKIE_NAME, token, {
+  setCookie(event, refreshCookieName(), token, {
     ...refreshCookieBase(),
     path: REFRESH_COOKIE_PATH,
     maxAge: maxAgeSeconds
   });
 }
 export function clearAuthCookies(event) {
-  deleteCookie(event, ACCESS_COOKIE_NAME, {
+  deleteCookie(event, accessCookieName(), {
     httpOnly: true,
     sameSite: "lax",
     secure: isProduction(),
     path: ACCESS_COOKIE_PATH
   });
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: REFRESH_COOKIE_PATH
   });
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: LEGACY_REFRESH_COOKIE_PATH
   });

package/dist/runtime/server/lib/jwt.js

@@ -1,7 +1,7 @@
 import { randomUUID, createHash } from "node:crypto";
 import { getCookie } from "h3";
 import jwt from "jsonwebtoken";
-import { ACCESS_COOKIE_NAME, REFRESH_COOKIE_NAME } from "../../lib/constants.js";
+import { accessCookieName, refreshCookieName } from "./cookies.js";
 import { getBasicAuthConfig } from "./config.js";
 export async function signAccessToken(input) {
   const config = getBasicAuthConfig();
@@ -67,10 +67,10 @@ export async function verifyRefreshToken(token) {
   }
 }
 export function getAccessTokenFromEvent(event) {
-  return getCookie(event, ACCESS_COOKIE_NAME) ?? null;
+  return getCookie(event, accessCookieName()) ?? null;
 }
 export function getRefreshTokenFromEvent(event) {
-  return getCookie(event, REFRESH_COOKIE_NAME) ?? null;
+  return getCookie(event, refreshCookieName()) ?? null;
 }
 export function hashRefreshToken(token) {
   return createHash("sha256").update(token).digest("hex");

package/dist/runtime/server/lib/password.js

@@ -1,6 +1,10 @@
 import bcrypt from "bcryptjs";
+import { newPasswordFitsBcrypt } from "../../password-policy.js";
 const PASSWORD_COST = 12;
 export async function hashPassword(password) {
+  if (!newPasswordFitsBcrypt(password)) {
+    throw new RangeError("New passwords must be 72 UTF-8 bytes or fewer.");
+  }
   return await bcrypt.hash(password, PASSWORD_COST);
 }
 export async function verifyPassword(password, hash) {

package/dist/runtime/server/lib/session-store.d.ts

@@ -61,6 +61,14 @@ export declare function ensureBootstrapAccount(input: CreateAccountInput): Basic
 export declare function createAuthSession(input: CreateSessionInput): BasicAuthSession;
 export declare function findSessionById(sessionId: string): BasicAuthSession | null;
 export declare function revokeSessionById(sessionId: string, revokedAtMs?: number): void;
+/**
+ * Revoke a session and every successor it was rotated into, clearing rotation
+ * grace on each. A replayed rotated refresh token therefore cannot recover its
+ * successor after sign-out.
+ */
+export declare function revokeSessionChain(sessionId: string, revokedAtMs?: number): void;
+/** First usable session walking from `sessionId` through rotation successors. */
+export declare function findUsableSessionInChain(sessionId: string): BasicAuthSession | null;
 export declare function revokeAllSessionsForAccount(accountId: string, revokedAtMs?: number): void;
 export declare function rotateSession(input: RotationInput): RotationResult;
 export declare function updatePasswordAndRevokeSessions(accountId: string, newPasswordHash: string): void;

package/dist/runtime/server/lib/session-store.js

@@ -140,6 +140,36 @@ export function revokeSessionById(sessionId, revokedAtMs = Date.now()) {
     "UPDATE basic_auth_sessions SET revoked_at = COALESCE(revoked_at, ?) WHERE id = ?"
   ).run(revokedAtMs, sessionId);
 }
+export function revokeSessionChain(sessionId, revokedAtMs = Date.now()) {
+  const db = getBasicAuthDb();
+  db.transaction(() => {
+    const visited = /* @__PURE__ */ new Set();
+    let currentId = sessionId;
+    while (currentId && !visited.has(currentId)) {
+      visited.add(currentId);
+      const session = findSessionById(currentId);
+      if (!session) break;
+      db.prepare(
+        `UPDATE basic_auth_sessions
+         SET revoked_at = COALESCE(revoked_at, ?),
+             rotation_grace_until = NULL,
+             rotation_grace_refresh_token = NULL
+         WHERE id = ?`
+      ).run(revokedAtMs, currentId);
+      currentId = session.replaced_by_session_id;
+    }
+  })();
+}
+export function findUsableSessionInChain(sessionId) {
+  const visited = /* @__PURE__ */ new Set();
+  let current = findSessionById(sessionId);
+  while (current && !visited.has(current.id)) {
+    if (isSessionUsable(current)) return current;
+    visited.add(current.id);
+    current = current.replaced_by_session_id ? findSessionById(current.replaced_by_session_id) : null;
+  }
+  return null;
+}
 export function revokeAllSessionsForAccount(accountId, revokedAtMs = Date.now()) {
   const db = getBasicAuthDb();
   db.prepare(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "or3-provider-basic-auth",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Saluana/or3-provider-basic-auth.git"