securenow 8.3.0 → 8.4.0

package/NPM_README.md

@@ -263,9 +263,13 @@ npx securenow notifications read-all
 
 ```js
 const securenow = require('securenow/sessions');
-app.use(securenow.guard());   // auto-detects NextAuth/connect.sid/JWT sessions; rejects revoked ones (401)
+// One line: emits session.seen (feeds impossible-travel / concurrent-session
+// detection) AND rejects revoked sessions. Auto-detects NextAuth/connect.sid/JWT.
+app.use(securenow.guard());
 // ...or check manually:
 if (securenow.isRevoked({ sessionId, userId })) return res.status(401).send('re-auth');
+// ...or emit-only (detection without enforcement):
+app.use(securenow.capture());
 ```
 
 Revoke from the CLI (the SDK enforces within ~seconds, outbound-only, fail-open):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",

package/sessions.d.ts

@@ -9,6 +9,10 @@ export interface GuardOptions {
   onRevoked?: (req: any, res: any, next: any, ctx: { sessionId: string | null; userId: string | null }) => void;
   /** Background sync interval in ms (default 30000). */
   syncIntervalMs?: number;
+  /** Emit session.seen events for detection (default true). Set false to enforce only. */
+  capture?: boolean;
+  /** Dedup window for session.seen emission, per (session, ip), in ms (default 300000). */
+  captureWindowMs?: number;
 }
 
 /** Start background revocation sync (called automatically by guard()). */
@@ -20,8 +24,14 @@ export function syncOnce(): Promise<boolean>;
 /** Is this session/user currently revoked? */
 export function isRevoked(input: { sessionId?: string | null; userId?: string | null }): boolean;
 
-/** Express-style middleware that rejects revoked sessions/users. Fail-open. */
+/** Express-style middleware: emits session.seen (detection) AND rejects revoked sessions. Fail-open. */
 export function guard(options?: GuardOptions): (req: any, res: any, next: any) => void;
 
+/** Express-style middleware that ONLY emits session.seen (detection feed, no enforcement). */
+export function capture(options?: GuardOptions): (req: any, res: any, next: any) => void;
+
+/** Resolve the client IP from a request (X-Forwarded-For / CF / socket). */
+export function resolveClientIp(req: any): string | null;
+
 /** SHA-256 helper (used to hash raw session tokens consistently). */
 export function sha256(value: string): string;

package/sessions.js

@@ -14,6 +14,7 @@
 
 const crypto = require('crypto');
 const appConfig = require('./app-config');
+const events = require('./events');
 
 let _entries = new Map(); // "type:value" -> expiryMs (0 = never)
 let _etag = null;
@@ -187,6 +188,72 @@ function defaultExtract(req) {
   return { sessionId, userId };
 }
 
+// --- Tier-0 auto-emit of session.seen (feeds session-theft detection) -------
+// Emitting on EVERY request would be huge volume, so we dedup per
+// (session, ip) within a window — enough to capture every new
+// session/network combination, which is what concurrent-network /
+// impossible-travel detection needs.
+const _seen = new Map(); // "sid|ip" -> lastEmitMs
+const _SEEN_MAX = 5000;
+let _captureWindowMs = 5 * 60 * 1000;
+
+function resolveClientIp(req) {
+  const h = (req && req.headers) || {};
+  const xff = h['x-forwarded-for'];
+  if (xff) return String(Array.isArray(xff) ? xff[0] : xff).split(',')[0].trim();
+  if (h['cf-connecting-ip']) return String(h['cf-connecting-ip']).trim();
+  if (h['x-real-ip']) return String(h['x-real-ip']).trim();
+  const sock = req && (req.socket || req.connection);
+  return (sock && sock.remoteAddress) || null;
+}
+
+function emitSessionSeen(sessionId, userId, ip) {
+  if (!sessionId && !userId) return;
+  const key = `${sessionId || ''}|${ip || ''}`;
+  const now = Date.now();
+  const last = _seen.get(key);
+  if (last && now - last < _captureWindowMs) return; // deduped
+  if (_seen.size > _SEEN_MAX) _seen.clear();
+  _seen.set(key, now);
+  try {
+    events.track('session.seen', { sessionId, userId, ip });
+  } catch {
+    /* never throw into the app */
+  }
+}
+
+function extractIdentity(req, getSessionId, getUserId) {
+  let sessionId = null;
+  let userId = null;
+  if (getSessionId || getUserId) {
+    if (getSessionId) sessionId = getSessionId(req);
+    if (getUserId) userId = getUserId(req);
+  } else {
+    const d = defaultExtract(req);
+    sessionId = d.sessionId;
+    userId = d.userId;
+  }
+  return { sessionId, userId };
+}
+
+/**
+ * Middleware that ONLY emits session.seen (detection feed), no enforcement.
+ * Use this if you want SecureNow to see sessions but not block anything.
+ */
+function capture(options = {}) {
+  if (options.captureWindowMs) _captureWindowMs = options.captureWindowMs;
+  const { getSessionId, getUserId } = options;
+  return function securenowSessionCapture(req, res, next) {
+    try {
+      const { sessionId, userId } = extractIdentity(req, getSessionId, getUserId);
+      emitSessionSeen(sessionId, userId, resolveClientIp(req));
+    } catch {
+      /* fail-open */
+    }
+    return next();
+  };
+}
+
 function defaultOnRevoked(req, res) {
   try {
     const clears = SESSION_COOKIES.map((n) => `${n}=; Path=/; Max-Age=0; HttpOnly`);
@@ -211,20 +278,16 @@ function defaultOnRevoked(req, res) {
  */
 function guard(options = {}) {
   start(options);
+  if (options.captureWindowMs) _captureWindowMs = options.captureWindowMs;
   const { getSessionId, getUserId } = options;
   const onRevoked = options.onRevoked || defaultOnRevoked;
+  const doCapture = options.capture !== false; // emit session.seen by default
   return function securenowSessionGuard(req, res, next) {
     try {
-      let sessionId = null;
-      let userId = null;
-      if (getSessionId || getUserId) {
-        if (getSessionId) sessionId = getSessionId(req);
-        if (getUserId) userId = getUserId(req);
-      } else {
-        const d = defaultExtract(req);
-        sessionId = d.sessionId;
-        userId = d.userId;
-      }
+      const { sessionId, userId } = extractIdentity(req, getSessionId, getUserId);
+      // Detect: feed session-theft detection (deduped, fire-and-forget).
+      if (doCapture) emitSessionSeen(sessionId, userId, resolveClientIp(req));
+      // Respond: reject if this session/user has been revoked.
       if (isRevoked({ sessionId, userId })) {
         return onRevoked(req, res, next, { sessionId, userId });
       }
@@ -235,4 +298,4 @@ function guard(options = {}) {
   };
 }
 
-module.exports = { start, syncOnce, isRevoked, guard, sha256 };
+module.exports = { start, syncOnce, isRevoked, guard, capture, resolveClientIp, sha256 };