startx 1.0.4 → 1.0.8

package/packages/@db/drizzle/src/index.ts

@@ -1,26 +1,15 @@
 import { defineEnv } from "@repo/env";
-import type { ExtractTablesWithRelations } from "drizzle-orm";
 import { drizzle, type NodePgQueryResultHKT } from "drizzle-orm/node-postgres";
-import { type PgTransaction } from "drizzle-orm/pg-core";
-import Pg from "pg";
+import { PgAsyncTransaction } from "drizzle-orm/pg-core";
 import z from "zod";
 
-import * as schema from "./schema/index.js";
-
 const env = defineEnv({
 	DATABASE_URL: z.string(),
 });
-export const client = new Pg.Pool({
-	connectionString: env.DATABASE_URL,
-});
-const db = drizzle({ client, schema });
-export type DrizzleTransaction = PgTransaction<
-	NodePgQueryResultHKT,
-	typeof schema,
-	ExtractTablesWithRelations<typeof schema>
->;
+export type DrizzleTransaction = PgAsyncTransaction<NodePgQueryResultHKT>;
+const db = drizzle(env.DATABASE_URL);
+
 export type DrizzleDB = typeof db;
 export { db };
 export * from "drizzle-orm";
 export * from "./functions.js";
-export * from "./schema/index.js";

package/packages/@repo/lib/src/cookie-module/cookie-module.ts

@@ -1,48 +1,104 @@
+import { Time } from "@repo/common/time";
 import { defineEnv, ENV } from "@repo/env";
 import type { CookieOptions } from "express";
 import z from "zod";
 
 const credentials = defineEnv({
-	COOKIE_DOMAIN: z.string().optional().default(".localhost"),
+	COOKIE_DOMAIN: z.string().optional(),
 });
 
-const constants = {
-	refreshToken: {
-		cookie: "",
-		cookieDomain: "",
-		secureCookie: false,
-		maxAge: 0,
-	},
-	initialize() {
-		const prodMaxAge = 1000 * 60 * 60 * 24 * 30;
-		const stagingMaxAge = 1000 * 60 * 60 * 24 * 365;
-		const prodEnv = ENV.NODE_ENV === "production";
-		const stagingEnv = ENV.NODE_ENV === "staging";
-
-		if (prodEnv) {
-			this.refreshToken.cookie = "refresh-token";
-			this.refreshToken.cookieDomain = credentials.COOKIE_DOMAIN;
-			this.refreshToken.secureCookie = true;
-			this.refreshToken.maxAge = prodMaxAge;
-		} else {
-			this.refreshToken.cookie = "refresh-token-staging";
-			this.refreshToken.cookieDomain = stagingEnv
-				? credentials.COOKIE_DOMAIN
-				: credentials.COOKIE_DOMAIN || "localhost";
-			this.refreshToken.secureCookie = stagingEnv ? true : false;
-			this.refreshToken.maxAge = stagingMaxAge;
-		}
-	},
+type RuntimeEnv = "development" | "staging" | "production";
+
+type CookieDescriptor = {
+	name: string;
+	options: CookieOptions;
 };
-constants.initialize();
-
-export function getCookieOptions(refreshToken: string): [string, string, CookieOptions] {
-	const cookieOptions: CookieOptions = {
-		domain: constants.refreshToken.cookieDomain,
-		maxAge: constants.refreshToken.maxAge,
-		sameSite: "lax",
-		httpOnly: true,
-		secure: constants.refreshToken.secureCookie,
+
+const COOKIE_NAMES = {
+	production: "refresh-token",
+	nonProduction: "refresh-token-staging",
+} as const;
+
+const COOKIE_TTL = {
+	development: Time.days(90).milliseconds, // 3 months
+	staging: Time.days(90).milliseconds, // 3 months
+	production: Time.days(30).milliseconds, // 30 days
+} as const;
+
+function getRuntimeEnv(): RuntimeEnv {
+	switch (ENV.NODE_ENV) {
+		case "production":
+			return "production";
+		case "staging":
+			return "staging";
+		default:
+			return "development";
+	}
+}
+
+function resolveCookieDomain(env: RuntimeEnv): string | undefined {
+	if (env === "development") {
+		return undefined;
+	}
+
+	if (!credentials.COOKIE_DOMAIN) {
+		throw new Error("COOKIE_DOMAIN must be configured in staging/production environments");
+	}
+
+	return credentials.COOKIE_DOMAIN;
+}
+
+function resolveSameSite(env: RuntimeEnv): CookieOptions["sameSite"] {
+	/**
+	 * If frontend and API are on different origins:
+	 * use "none" + secure=true
+	 *
+	 * Otherwise lax is safer.
+	 */
+	return env === "production" || env === "staging" ? "lax" : "lax";
+}
+
+function createRefreshTokenCookie(): CookieDescriptor {
+	const env = getRuntimeEnv();
+	const secure = env !== "development";
+
+	return {
+		name: env === "production" ? COOKIE_NAMES.production : COOKIE_NAMES.nonProduction,
+		options: {
+			httpOnly: true,
+			secure,
+			sameSite: resolveSameSite(env),
+			maxAge: COOKIE_TTL[env],
+			domain: resolveCookieDomain(env),
+			path: "/",
+		},
 	};
-	return [constants.refreshToken.cookie, refreshToken, cookieOptions];
 }
+
+const refreshTokenCookie = createRefreshTokenCookie();
+
+export const CookieModule = Object.freeze({
+	refreshTokenName(): string {
+		return refreshTokenCookie.name;
+	},
+
+	setRefreshToken(token: string): [string, string, CookieOptions] {
+		return [refreshTokenCookie.name, token, refreshTokenCookie.options];
+	},
+
+	clearRefreshToken(): [string, string, CookieOptions] {
+		return [
+			refreshTokenCookie.name,
+			"",
+			{
+				...refreshTokenCookie.options,
+				maxAge: 0,
+				expires: new Date(0),
+			},
+		];
+	},
+
+	getRefreshTokenOptions(): CookieOptions {
+		return refreshTokenCookie.options;
+	},
+});

package/packages/@repo/lib/src/extra/index.ts

@@ -1 +1,2 @@
 export * from "./pagination-module.js";
+export * from "./token-module.js"

package/packages/@repo/lib/src/extra/token-module.ts

@@ -1,41 +1,70 @@
-import { defineEnv, ENV } from "@repo/env";
-import * as jwt from "jsonwebtoken";
+import { Time } from "@repo/common/time";
+import { defineEnv } from "@repo/env";
+import { logger } from "@repo/logger";
+import jwt from "jsonwebtoken";
 import z from "zod";
-export type AuthTokenPayload = {
+
+export type AccessTokenPayload = {
+	userID: string;
+	email: string;
+	sessionID: string;
+};
+
+export type RefreshTokenPayload = {
 	userID: string;
 	email: string;
+	sessionID: string;
+	jti: string;
 };
 
-const credentials = defineEnv({
-	ACCESS_TOKEN_SECRET: z.string(),
-	REFRESH_TOKEN_SECRET: z.string(),
+const env = defineEnv({
+	ACCESS_TOKEN_SECRET: z.string().min(32),
+	REFRESH_TOKEN_SECRET: z.string().min(32),
+	ACCESS_TOKEN_EXPIRY: z.coerce.number().default(Time.hours(1).milliseconds),
+	REFRESH_TOKEN_EXPIRY: z.coerce.number().default(Time.days(30).milliseconds),
 });
-const accessTokenSecret = credentials.ACCESS_TOKEN_SECRET;
-const refreshTokenSecret = credentials.REFRESH_TOKEN_SECRET;
+
+const JWT_CONFIG = {
+	algorithm: "HS256" as const,
+};
 
 export class TokenModule {
-	static signRefreshToken(payload: AuthTokenPayload) {
-		return jwt.sign(payload, refreshTokenSecret, { expiresIn: "365d" });
+	static signAccessToken(payload: AccessTokenPayload): string {
+		return jwt.sign(payload, env.ACCESS_TOKEN_SECRET, {
+			...JWT_CONFIG,
+			expiresIn: env.ACCESS_TOKEN_EXPIRY,
+		});
 	}
-	static verifyRefreshToken(refreshToken: string) {
+
+	static verifyAccessToken(token: string): AccessTokenPayload | null {
 		try {
-			const payload = jwt.verify(refreshToken, refreshTokenSecret) as AuthTokenPayload;
-			return payload;
+			return jwt.verify(token, env.ACCESS_TOKEN_SECRET, {
+				algorithms: ["HS256"],
+			}) as AccessTokenPayload;
 		} catch (error) {
-			console.error(error);
+			logger.warn("Access token verification failed", {
+				error: error instanceof Error ? error.message : "unknown",
+			});
 			return null;
 		}
 	}
-	static signAccessToken(payload: AuthTokenPayload) {
-		const expiration = ENV.NODE_ENV === "development" ? "30d" : "1d";
-		return jwt.sign(payload, accessTokenSecret, { expiresIn: expiration });
+
+	static signRefreshToken(payload: RefreshTokenPayload): string {
+		return jwt.sign(payload, env.REFRESH_TOKEN_SECRET, {
+			...JWT_CONFIG,
+			expiresIn: env.REFRESH_TOKEN_EXPIRY,
+		});
 	}
-	static verifyAccessToken(accessToken: string) {
+
+	static verifyRefreshToken(token: string): RefreshTokenPayload | null {
 		try {
-			const payload = jwt.verify(accessToken, accessTokenSecret) as AuthTokenPayload;
-			return payload;
+			return jwt.verify(token, env.REFRESH_TOKEN_SECRET, {
+				algorithms: ["HS256"],
+			}) as RefreshTokenPayload;
 		} catch (error) {
-			console.error(error);
+			logger.warn("Refresh token verification failed", {
+				error: error instanceof Error ? error.message : "unknown",
+			});
 			return null;
 		}
 	}

package/packages/@repo/lib/src/mail-module/nodemailer.ts

@@ -6,48 +6,61 @@ import z from "zod";
 
 const credentials = defineEnv({
 	SMTP_HOST: z.string(),
-	SMTP_PORT: z.coerce.number().default(587),
+	SMTP_PORT: z.coerce.number().default(465),
 	SMTP_USER: z.string(),
 	SMTP_PASSWORD: z.string(),
-	SMTP_MAIL_ENCRYPTION: z.string().default("tls"),
+	SMTP_MAIL_ENCRYPTION: z.enum(["ssl", "tls", "starttls"]).default("ssl"),
 	SMTP_SENDER_MAIL: z.string().email(),
 	SMTP_SENDER_NAME: z.string().default("Startx"),
 });
 
+export type SMTPConfig = typeof credentials;
+
 class SMTPMailService {
-	private static transporter: Transporter | null = null;
+	private static transporters = new Map<string, Transporter>();
+
+	private static getTransporter(config: SMTPConfig): Transporter {
+		const cacheKey = `${config.SMTP_HOST}:${config.SMTP_USER}`;
 
-	private static initializeTransporter(): Transporter {
-		if (!this.transporter) {
-			this.transporter = nodemailer.createTransport({
-				host: credentials.SMTP_HOST,
-				port: credentials.SMTP_PORT,
-				secure: credentials.SMTP_MAIL_ENCRYPTION === "ssl",
+		if (!this.transporters.has(cacheKey)) {
+			const transporter = nodemailer.createTransport({
+				host: config.SMTP_HOST,
+				port: config.SMTP_PORT,
+				secure: config.SMTP_MAIL_ENCRYPTION === "ssl",
 				auth: {
-					user: credentials.SMTP_USER,
-					pass: credentials.SMTP_PASSWORD,
+					user: config.SMTP_USER,
+					pass: config.SMTP_PASSWORD,
 				},
 			});
+			this.transporters.set(cacheKey, transporter);
 		}
-		return this.transporter;
+
+		return this.transporters.get(cacheKey)!;
 	}
 
-	static async verifyConnection(): Promise<void> {
-		const transporter = this.initializeTransporter();
+	static async verifyConnection(customConfig?: SMTPConfig): Promise<boolean> {
+		const config = customConfig || credentials;
+		const transporter = this.getTransporter(config);
+
 		try {
 			await transporter.verify();
-			logger.info("SMTP Connection verified successfully.");
+			logger.info(`SMTP Connection verified successfully for ${config.SMTP_HOST}`);
+			return true;
 		} catch (error) {
-			logger.error("SMTP Connection verification failed:", error);
-			throw error;
+			logger.error(`SMTP Connection verification failed for ${config.SMTP_HOST}:`, error);
+			return false;
 		}
 	}
 
-	static async sendMail(props: { to: string; subject: string; text: string; html?: string }) {
-		const transporter = this.initializeTransporter();
+	static async sendMail(
+		props: { to: string; subject: string; text: string; html?: string },
+		customConfig?: SMTPConfig
+	) {
+		const config = customConfig || credentials;
+		const transporter = this.getTransporter(config);
 
 		const mailOptions: SendMailOptions = {
-			from: `"${credentials.SMTP_SENDER_NAME}" <${credentials.SMTP_SENDER_MAIL}>`,
+			from: `"${config.SMTP_SENDER_NAME}" <${config.SMTP_SENDER_MAIL}>`,
 			to: props.to,
 			subject: props.subject,
 			text: props.text,
@@ -60,7 +73,6 @@ class SMTPMailService {
 			return info;
 		} catch (error) {
 			logger.error("Error sending email:", error);
-			// Retain the original error context for debugging
 			throw new Error("Failed to send email", { cause: error });
 		}
 	}

package/packages/@repo/lib/src/session-module/i-session.ts

@@ -1,12 +1,18 @@
+import { Time } from "@repo/common/time";
 import type { SessionUser } from "@repo/common/types/users";
 import { defineEnv } from "@repo/env";
+import crypto from "node:crypto";
 import { z } from "zod";
 import { TokenModule } from "../extra/token-module.js";
-const env = defineEnv({
-	SESSION_DURATION: z.number().default(60 * 60 * 6),
+
+export const sessionEnv = defineEnv({
+	SESSION_DURATION: z.number().default(Time.days(30).milliseconds),
+	SESSION_TYPE: z.enum(["single", "multi"]).default("multi"),
+	MAX_CONCURRENT_SESSIONS: z.number().default(1),
 });
+
 export const constants = {
-	sessionDuration: env.SESSION_DURATION,
+	sessionDuration: sessionEnv.SESSION_DURATION,
 };
 
 export type TokenPair = {
@@ -14,95 +20,162 @@ export type TokenPair = {
 	refreshToken: string;
 };
 
+export type SessionType =
+	| {
+			type: "single";
+	  }
+	| {
+			type: "multi";
+			maxConcurrentSessions: number;
+	  };
+
+export type SessionRecord = {
+	sessionId: string;
+	user: Omit<SessionUser, "accessToken">;
+	refreshTokenHash: string;
+	createdAt: number;
+	lastSeenAt: number;
+};
+
 export abstract class IUserSession {
-	protected accessTokenKey(key: string) {
-		return `access_token:${key}`;
+	protected abstract type: SessionType;
+
+	protected sessionKey(sessionId: string) {
+		return `session:${sessionId}`;
 	}
-	protected refreshTokenKey(key: string) {
-		return `refresh_token:${key}`;
+
+	protected userSessionsKey(userId: string) {
+		return `user:sessions:${userId}`;
 	}
-	protected userTokensKey(userId: string) {
-		return `session:${userId}`;
+
+	protected hashToken(token: string) {
+		return crypto.createHash("sha256").update(token).digest("hex");
 	}
 
-	protected abstract setSessionData(key: string, data: SessionUser, ttl: number): Promise<void>;
-	protected abstract getSessionData(key: string): Promise<SessionUser | null>;
-	protected abstract deleteSessionData(key: string): Promise<void>;
+	protected abstract setSession(sessionId: string, data: SessionRecord, ttl: number): Promise<void>;
+
+	protected abstract getSession(sessionId: string): Promise<SessionRecord | null>;
 
-	protected abstract setTokenData(key: string, data: TokenPair, ttl: number): Promise<void>;
-	protected abstract getTokenData(key: string): Promise<TokenPair | null>;
-	protected abstract deleteTokenData(key: string): Promise<void>;
+	protected abstract deleteSession(sessionId: string): Promise<void>;
 
-	public async getSessionUser(token: string): Promise<SessionUser | null> {
-		return await this.getSessionData(this.accessTokenKey(token));
+	protected abstract addUserSession(userId: string, sessionId: string): Promise<void>;
+
+	protected abstract removeUserSession(userId: string, sessionId: string): Promise<void>;
+
+	protected abstract getUserSessions(userId: string): Promise<string[]>;
+
+	protected abstract clearUserSessions(userId: string): Promise<void>;
+
+	protected generateSessionId() {
+		return crypto.randomUUID();
 	}
 
-	public async startSession(payload: Omit<SessionUser, "accessToken">): Promise<TokenPair> {
-		await this.endSession(payload.id);
+	protected generateRefreshJti() {
+		return crypto.randomUUID();
+	}
+
+	public async startSession(user: Omit<SessionUser, "accessToken">): Promise<TokenPair> {
+		if (this.type.type === "single") {
+			await this.endAllSessions(user.id);
+		}
+
+		if (this.type.type === "multi") {
+			const existing = await this.getUserSessions(user.id);
+
+			if (existing.length >= this.type.maxConcurrentSessions) {
+				const oldest = existing[0];
+				await this.endSession(oldest);
+			}
+		}
+
+		const sessionId = this.generateSessionId();
+		const refreshJti = this.generateRefreshJti();
 
 		const accessToken = TokenModule.signAccessToken({
-			userID: payload.id,
-			email: payload.email,
+			userID: user.id,
+			email: user.email,
+			sessionID: sessionId,
 		});
 
 		const refreshToken = TokenModule.signRefreshToken({
-			userID: payload.id,
-			email: payload.email,
+			userID: user.id,
+			email: user.email,
+			sessionID: sessionId,
+			jti: refreshJti,
 		});
 
-		const sessionData: SessionUser = { ...payload, accessToken };
-		const tokens: TokenPair = { accessToken, refreshToken };
+		const record: SessionRecord = {
+			sessionId,
+			user,
+			refreshTokenHash: this.hashToken(refreshToken),
+			createdAt: Date.now(),
+			lastSeenAt: Date.now(),
+		};
 
 		await Promise.all([
-			this.setSessionData(this.accessTokenKey(accessToken), sessionData, constants.sessionDuration),
-			this.setSessionData(payload.id, sessionData, constants.sessionDuration),
-			this.setTokenData(this.refreshTokenKey(refreshToken), tokens, constants.sessionDuration),
-			this.setTokenData(this.userTokensKey(payload.id), tokens, constants.sessionDuration),
+			this.setSession(sessionId, record, constants.sessionDuration),
+			this.addUserSession(user.id, sessionId),
 		]);
 
-		return tokens;
+		return {
+			accessToken,
+			refreshToken,
+		};
 	}
 
-	public async checkRefreshToken(refreshToken: string): Promise<TokenPair | null> {
-		return await this.getTokenData(this.refreshTokenKey(refreshToken));
+	public async validateSession(sessionId: string): Promise<SessionRecord | null> {
+		return await this.getSession(sessionId);
 	}
 
-	public async updateAccessToken(payload: Omit<SessionUser, "accessToken">): Promise<string | null> {
-		const tokens = await this.getTokens(payload.id);
-		if (!tokens) return null;
+	public async rotateRefreshToken(sessionId: string, refreshToken: string): Promise<TokenPair | null> {
+		const session = await this.getSession(sessionId);
+		if (!session) return null;
 
-		const accessToken = tokens.accessToken;
-		const sessionData: SessionUser = { ...payload, accessToken };
+		const incomingHash = this.hashToken(refreshToken);
 
-		await Promise.all([
-			this.setSessionData(this.accessTokenKey(accessToken), sessionData, constants.sessionDuration),
-			this.setSessionData(payload.id, sessionData, constants.sessionDuration),
-		]);
+		if (incomingHash !== session.refreshTokenHash) {
+			await this.endSession(sessionId);
+			return null;
+		}
 
-		return accessToken;
-	}
+		const newRefreshJti = this.generateRefreshJti();
+
+		const accessToken = TokenModule.signAccessToken({
+			userID: session.user.id,
+			email: session.user.email,
+			sessionID: sessionId,
+		});
 
-	public async getTokens(userId: string): Promise<TokenPair | null> {
-		return await this.getTokenData(this.userTokensKey(userId));
+		const newRefreshToken = TokenModule.signRefreshToken({
+			userID: session.user.id,
+			email: session.user.email,
+			sessionID: sessionId,
+			jti: newRefreshJti,
+		});
+
+		session.refreshTokenHash = this.hashToken(newRefreshToken);
+		session.lastSeenAt = Date.now();
+
+		await this.setSession(sessionId, session, constants.sessionDuration);
+
+		return {
+			accessToken,
+			refreshToken: newRefreshToken,
+		};
 	}
 
-	public async logout(accessToken: string): Promise<null> {
-		const session = await this.getSessionUser(accessToken);
-		if (!session) return null;
+	public async endSession(sessionId: string): Promise<void> {
+		const session = await this.getSession(sessionId);
+		if (!session) return;
 
-		await this.endSession(session.id);
-		return null;
+		await Promise.all([this.deleteSession(sessionId), this.removeUserSession(session.user.id, sessionId)]);
 	}
 
-	public async endSession(userId: string): Promise<void> {
-		const tokens = await this.getTokens(userId);
-		if (!tokens) return;
+	public async endAllSessions(userId: string): Promise<void> {
+		const sessions = await this.getUserSessions(userId);
 
-		await Promise.all([
-			this.deleteTokenData(this.refreshTokenKey(tokens.refreshToken)),
-			this.deleteSessionData(this.accessTokenKey(tokens.accessToken)),
-			this.deleteTokenData(this.userTokensKey(userId)),
-			this.deleteSessionData(userId),
-		]);
+		await Promise.all(sessions.map(sid => this.deleteSession(sid)));
+
+		await this.clearUserSessions(userId);
 	}
 }

package/packages/@repo/lib/src/session-module/index.ts

@@ -1,10 +1,16 @@
+import { sessionEnv, type SessionType } from "./i-session.js";
 import { RedisUserSession } from "./redis-session.js";
 
-export const userSession = (type: "redis" | "pg") => {
+export const userSession = (type: "redis" | "pg", options: SessionType) => {
 	switch (type) {
 		case "redis":
-			return new RedisUserSession();
+			return new RedisUserSession(options);
 		default:
 			throw new Error("Unknown session type");
 	}
 };
+
+export const defaultUserSession = userSession("redis", {
+	type: sessionEnv.SESSION_TYPE,
+	maxConcurrentSessions: sessionEnv.MAX_CONCURRENT_SESSIONS,
+});