startx 1.0.5 → 1.0.9

package/packages/@repo/lib/src/session-module/i-session.ts

@@ -1,12 +1,18 @@
+import { Time } from "@repo/common/time";
 import type { SessionUser } from "@repo/common/types/users";
 import { defineEnv } from "@repo/env";
+import crypto from "node:crypto";
 import { z } from "zod";
 import { TokenModule } from "../extra/token-module.js";
-const env = defineEnv({
-	SESSION_DURATION: z.number().default(60 * 60 * 6),
+
+export const sessionEnv = defineEnv({
+	SESSION_DURATION: z.number().default(Time.days(30).milliseconds),
+	SESSION_TYPE: z.enum(["single", "multi"]).default("multi"),
+	MAX_CONCURRENT_SESSIONS: z.number().default(1),
 });
+
 export const constants = {
-	sessionDuration: env.SESSION_DURATION,
+	sessionDuration: sessionEnv.SESSION_DURATION,
 };
 
 export type TokenPair = {
@@ -14,95 +20,162 @@ export type TokenPair = {
 	refreshToken: string;
 };
 
+export type SessionType =
+	| {
+			type: "single";
+	  }
+	| {
+			type: "multi";
+			maxConcurrentSessions: number;
+	  };
+
+export type SessionRecord = {
+	sessionId: string;
+	user: Omit<SessionUser, "accessToken">;
+	refreshTokenHash: string;
+	createdAt: number;
+	lastSeenAt: number;
+};
+
 export abstract class IUserSession {
-	protected accessTokenKey(key: string) {
-		return `access_token:${key}`;
+	protected abstract type: SessionType;
+
+	protected sessionKey(sessionId: string) {
+		return `session:${sessionId}`;
 	}
-	protected refreshTokenKey(key: string) {
-		return `refresh_token:${key}`;
+
+	protected userSessionsKey(userId: string) {
+		return `user:sessions:${userId}`;
 	}
-	protected userTokensKey(userId: string) {
-		return `session:${userId}`;
+
+	protected hashToken(token: string) {
+		return crypto.createHash("sha256").update(token).digest("hex");
 	}
 
-	protected abstract setSessionData(key: string, data: SessionUser, ttl: number): Promise<void>;
-	protected abstract getSessionData(key: string): Promise<SessionUser | null>;
-	protected abstract deleteSessionData(key: string): Promise<void>;
+	protected abstract setSession(sessionId: string, data: SessionRecord, ttl: number): Promise<void>;
+
+	protected abstract getSession(sessionId: string): Promise<SessionRecord | null>;
 
-	protected abstract setTokenData(key: string, data: TokenPair, ttl: number): Promise<void>;
-	protected abstract getTokenData(key: string): Promise<TokenPair | null>;
-	protected abstract deleteTokenData(key: string): Promise<void>;
+	protected abstract deleteSession(sessionId: string): Promise<void>;
 
-	public async getSessionUser(token: string): Promise<SessionUser | null> {
-		return await this.getSessionData(this.accessTokenKey(token));
+	protected abstract addUserSession(userId: string, sessionId: string): Promise<void>;
+
+	protected abstract removeUserSession(userId: string, sessionId: string): Promise<void>;
+
+	protected abstract getUserSessions(userId: string): Promise<string[]>;
+
+	protected abstract clearUserSessions(userId: string): Promise<void>;
+
+	protected generateSessionId() {
+		return crypto.randomUUID();
 	}
 
-	public async startSession(payload: Omit<SessionUser, "accessToken">): Promise<TokenPair> {
-		await this.endSession(payload.id);
+	protected generateRefreshJti() {
+		return crypto.randomUUID();
+	}
+
+	public async startSession(user: Omit<SessionUser, "accessToken">): Promise<TokenPair> {
+		if (this.type.type === "single") {
+			await this.endAllSessions(user.id);
+		}
+
+		if (this.type.type === "multi") {
+			const existing = await this.getUserSessions(user.id);
+
+			if (existing.length >= this.type.maxConcurrentSessions) {
+				const oldest = existing[0];
+				await this.endSession(oldest);
+			}
+		}
+
+		const sessionId = this.generateSessionId();
+		const refreshJti = this.generateRefreshJti();
 
 		const accessToken = TokenModule.signAccessToken({
-			userID: payload.id,
-			email: payload.email,
+			userID: user.id,
+			email: user.email,
+			sessionID: sessionId,
 		});
 
 		const refreshToken = TokenModule.signRefreshToken({
-			userID: payload.id,
-			email: payload.email,
+			userID: user.id,
+			email: user.email,
+			sessionID: sessionId,
+			jti: refreshJti,
 		});
 
-		const sessionData: SessionUser = { ...payload, accessToken };
-		const tokens: TokenPair = { accessToken, refreshToken };
+		const record: SessionRecord = {
+			sessionId,
+			user,
+			refreshTokenHash: this.hashToken(refreshToken),
+			createdAt: Date.now(),
+			lastSeenAt: Date.now(),
+		};
 
 		await Promise.all([
-			this.setSessionData(this.accessTokenKey(accessToken), sessionData, constants.sessionDuration),
-			this.setSessionData(payload.id, sessionData, constants.sessionDuration),
-			this.setTokenData(this.refreshTokenKey(refreshToken), tokens, constants.sessionDuration),
-			this.setTokenData(this.userTokensKey(payload.id), tokens, constants.sessionDuration),
+			this.setSession(sessionId, record, constants.sessionDuration),
+			this.addUserSession(user.id, sessionId),
 		]);
 
-		return tokens;
+		return {
+			accessToken,
+			refreshToken,
+		};
 	}
 
-	public async checkRefreshToken(refreshToken: string): Promise<TokenPair | null> {
-		return await this.getTokenData(this.refreshTokenKey(refreshToken));
+	public async validateSession(sessionId: string): Promise<SessionRecord | null> {
+		return await this.getSession(sessionId);
 	}
 
-	public async updateAccessToken(payload: Omit<SessionUser, "accessToken">): Promise<string | null> {
-		const tokens = await this.getTokens(payload.id);
-		if (!tokens) return null;
+	public async rotateRefreshToken(sessionId: string, refreshToken: string): Promise<TokenPair | null> {
+		const session = await this.getSession(sessionId);
+		if (!session) return null;
 
-		const accessToken = tokens.accessToken;
-		const sessionData: SessionUser = { ...payload, accessToken };
+		const incomingHash = this.hashToken(refreshToken);
 
-		await Promise.all([
-			this.setSessionData(this.accessTokenKey(accessToken), sessionData, constants.sessionDuration),
-			this.setSessionData(payload.id, sessionData, constants.sessionDuration),
-		]);
+		if (incomingHash !== session.refreshTokenHash) {
+			await this.endSession(sessionId);
+			return null;
+		}
 
-		return accessToken;
-	}
+		const newRefreshJti = this.generateRefreshJti();
+
+		const accessToken = TokenModule.signAccessToken({
+			userID: session.user.id,
+			email: session.user.email,
+			sessionID: sessionId,
+		});
 
-	public async getTokens(userId: string): Promise<TokenPair | null> {
-		return await this.getTokenData(this.userTokensKey(userId));
+		const newRefreshToken = TokenModule.signRefreshToken({
+			userID: session.user.id,
+			email: session.user.email,
+			sessionID: sessionId,
+			jti: newRefreshJti,
+		});
+
+		session.refreshTokenHash = this.hashToken(newRefreshToken);
+		session.lastSeenAt = Date.now();
+
+		await this.setSession(sessionId, session, constants.sessionDuration);
+
+		return {
+			accessToken,
+			refreshToken: newRefreshToken,
+		};
 	}
 
-	public async logout(accessToken: string): Promise<null> {
-		const session = await this.getSessionUser(accessToken);
-		if (!session) return null;
+	public async endSession(sessionId: string): Promise<void> {
+		const session = await this.getSession(sessionId);
+		if (!session) return;
 
-		await this.endSession(session.id);
-		return null;
+		await Promise.all([this.deleteSession(sessionId), this.removeUserSession(session.user.id, sessionId)]);
 	}
 
-	public async endSession(userId: string): Promise<void> {
-		const tokens = await this.getTokens(userId);
-		if (!tokens) return;
+	public async endAllSessions(userId: string): Promise<void> {
+		const sessions = await this.getUserSessions(userId);
 
-		await Promise.all([
-			this.deleteTokenData(this.refreshTokenKey(tokens.refreshToken)),
-			this.deleteSessionData(this.accessTokenKey(tokens.accessToken)),
-			this.deleteTokenData(this.userTokensKey(userId)),
-			this.deleteSessionData(userId),
-		]);
+		await Promise.all(sessions.map(sid => this.deleteSession(sid)));
+
+		await this.clearUserSessions(userId);
 	}
 }

package/packages/@repo/lib/src/session-module/index.ts

@@ -1,10 +1,16 @@
+import { sessionEnv, type SessionType } from "./i-session.js";
 import { RedisUserSession } from "./redis-session.js";
 
-export const userSession = (type: "redis" | "pg") => {
+export const userSession = (type: "redis" | "pg", options: SessionType) => {
 	switch (type) {
 		case "redis":
-			return new RedisUserSession();
+			return new RedisUserSession(options);
 		default:
 			throw new Error("Unknown session type");
 	}
 };
+
+export const defaultUserSession = userSession("redis", {
+	type: sessionEnv.SESSION_TYPE,
+	maxConcurrentSessions: sessionEnv.MAX_CONCURRENT_SESSIONS,
+});

package/packages/@repo/lib/src/session-module/redis-session.ts

@@ -1,44 +1,74 @@
-import type { SessionUser } from "@repo/common/types/users";
 import { RedisStore } from "@repo/redis";
-import { IUserSession, type TokenPair } from "./i-session.js";
+import type { SessionRecord, SessionType } from "./i-session.js";
+import { constants, IUserSession } from "./i-session.js";
+
+type SessionIndex = string[];
 
 export class RedisUserSession extends IUserSession {
-	private userStore: RedisStore<SessionUser>;
-	private tokenStore: RedisStore<TokenPair>;
+	private sessionStore: RedisStore<SessionRecord>;
+	private sessionIndexStore: RedisStore<SessionIndex>;
 
-	constructor() {
+	constructor(type: SessionType) {
 		super();
-		this.userStore = new RedisStore<SessionUser>({
-			namespace: "user-session",
+
+		this.type = type;
+
+		this.sessionStore = new RedisStore<SessionRecord>({
+			namespace: "auth-session",
 		});
-		this.tokenStore = new RedisStore<TokenPair>({
-			namespace: "user-tokens",
+
+		this.sessionIndexStore = new RedisStore<SessionIndex>({
+			namespace: "auth-session-index",
 		});
 	}
 
-	protected async setSessionData(key: string, data: SessionUser, ttl: number): Promise<void> {
-		await this.userStore.set(key, data, ttl);
+	protected type: SessionType;
+	protected async setSession(sessionId: string, data: SessionRecord, ttl: number): Promise<void> {
+		await this.sessionStore.set(sessionId, data, ttl);
 	}
 
-	protected async getSessionData(key: string): Promise<SessionUser | null> {
-		const data = await this.userStore.get(key);
-		return data ?? null;
+	protected async getSession(sessionId: string): Promise<SessionRecord | null> {
+		const session = await this.sessionStore.get(sessionId);
+		return session ?? null;
 	}
 
-	protected async deleteSessionData(key: string): Promise<void> {
-		await this.userStore.del(key);
+	protected async deleteSession(sessionId: string): Promise<void> {
+		await this.sessionStore.del(sessionId);
 	}
 
-	protected async setTokenData(key: string, data: TokenPair, ttl: number): Promise<void> {
-		await this.tokenStore.set(key, data, ttl);
+	protected async addUserSession(userId: string, sessionId: string): Promise<void> {
+		const key = this.userSessionsKey(userId);
+
+		const sessions = (await this.sessionIndexStore.get(key)) ?? [];
+
+		if (!sessions.includes(sessionId)) {
+			sessions.push(sessionId);
+		}
+
+		await this.sessionIndexStore.set(key, sessions, constants.sessionDuration);
+	}
+
+	protected async removeUserSession(userId: string, sessionId: string): Promise<void> {
+		const key = this.userSessionsKey(userId);
+
+		const sessions = (await this.sessionIndexStore.get(key)) ?? [];
+
+		const filtered = sessions.filter(id => id !== sessionId);
+
+		if (filtered.length === 0) {
+			await this.sessionIndexStore.del(key);
+			return;
+		}
+
+		await this.sessionIndexStore.set(key, filtered, constants.sessionDuration);
 	}
 
-	protected async getTokenData(key: string): Promise<TokenPair | null> {
-		const data = await this.tokenStore.get(key);
-		return data ?? null;
+	protected async getUserSessions(userId: string): Promise<string[]> {
+		const key = this.userSessionsKey(userId);
+		return (await this.sessionIndexStore.get(key)) ?? [];
 	}
 
-	protected async deleteTokenData(key: string): Promise<void> {
-		await this.tokenStore.del(key);
+	protected async clearUserSessions(userId: string): Promise<void> {
+		await this.sessionIndexStore.del(this.userSessionsKey(userId));
 	}
 }

package/packages/@repo/lib/src/validation-module/index.ts

@@ -1,15 +1,11 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { logger } from "@repo/logger";
 import vine from "@vinejs/vine";
 import type { Infer, SchemaTypes } from "@vinejs/vine/types";
 import type { NextFunction, Request, Response } from "express";
 
 import { ErrorResponse } from "../error-handlers-module/index.js";
-import { logger } from "@repo/logger";
 
-type ExpressHandler<P = unknown, ResBody = unknown, ReqBody = unknown, Query = unknown> = (
-	req: Request<P, ResBody, ReqBody, Query>,
-	res: Response,
-	next: NextFunction
-) => unknown;
 export async function validateBody<T extends SchemaTypes>(
 	schema: T,
 	payload: unknown
@@ -30,17 +26,20 @@ export async function validateBody<T extends SchemaTypes>(
 		return { error: ["Validation failed"] };
 	}
 }
+
 export function bodyValidator<T extends SchemaTypes>(schema: T) {
-	return function <F extends ExpressHandler<unknown, unknown, Infer<T>, unknown>>(
-		_target: unknown,
-		_propertyKey: string,
-		descriptor: TypedPropertyDescriptor<F>
-	) {
+	return function <
+		F extends (
+			req: Request<any, any, Infer<T>, any, Record<string, any>>,
+			res: Response<any, Record<string, any>>,
+			next: NextFunction
+		) => Promise<any> | void,
+	>(_target: unknown, _propertyKey: string, descriptor: TypedPropertyDescriptor<F>) {
 		const originalMethod = descriptor.value!;
 
 		descriptor.value = async function (
 			this: unknown,
-			req: Request<unknown, unknown, Infer<T>>,
+			req: Request<any, any, Infer<T>, any, Record<string, any>>,
 			res: Response,
 			next: NextFunction
 		) {
@@ -57,23 +56,26 @@ export function bodyValidator<T extends SchemaTypes>(schema: T) {
 
 			req.body = data;
 
-			return originalMethod.call(this, req, res, next);
-		} as F;
+			return await originalMethod.call(this, req, res, next);
+		} as unknown as F;
 
 		return descriptor;
 	};
 }
+
 export function paramsValidator<T extends SchemaTypes>(schema: T) {
-	return function <F extends ExpressHandler<Infer<T>, unknown, unknown, unknown>>(
-		_target: unknown,
-		_propertyKey: string,
-		descriptor: TypedPropertyDescriptor<F>
-	) {
+	return function <
+		F extends (
+			req: Request<any, any, Infer<T>, any, Record<string, any>>,
+			res: Response<any, Record<string, any>>,
+			next: NextFunction
+		) => Promise<any> | void,
+	>(_target: unknown, _propertyKey: string, descriptor: TypedPropertyDescriptor<F>) {
 		const originalMethod = descriptor.value!;
 
 		descriptor.value = async function (
 			this: unknown,
-			req: Request<Infer<T>>,
+			req: Request<Infer<T>, any, any, any, Record<string, any>>,
 			res: Response,
 			next: NextFunction
 		) {
@@ -84,26 +86,28 @@ export function paramsValidator<T extends SchemaTypes>(schema: T) {
 				return res.status(422).json({ message: error.join("\n") });
 			}
 
-			req.params = data;
+			Object.assign(req.query, data);
 
-			return originalMethod.call(this, req, res, next);
-		} as F;
+			return await originalMethod.call(this, req, res, next);
+		} as unknown as F;
 
 		return descriptor;
 	};
 }
 
 export function queryValidator<T extends SchemaTypes>(schema: T) {
-	return function <F extends ExpressHandler<unknown, unknown, unknown, Infer<T>>>(
-		_target: unknown,
-		_propertyKey: string,
-		descriptor: TypedPropertyDescriptor<F>
-	) {
+	return function <
+		F extends (
+			req: Request<any, any, Infer<T>, any, Record<string, any>>,
+			res: Response<any, Record<string, any>>,
+			next: NextFunction
+		) => Promise<any> | void,
+	>(_target: unknown, _propertyKey: string, descriptor: TypedPropertyDescriptor<F>) {
 		const originalMethod = descriptor.value!;
 
 		descriptor.value = async function (
 			this: unknown,
-			req: Request<unknown, unknown, unknown, Infer<T>>,
+			req: Request<any, any, any, Infer<T>, Record<string, any>>,
 			res: Response,
 			next: NextFunction
 		) {
@@ -114,56 +118,27 @@ export function queryValidator<T extends SchemaTypes>(schema: T) {
 				return res.status(422).json({ message: error.join("\n") });
 			}
 
-			req.query = data;
-
-			return originalMethod.call(this, req, res, next);
-		} as F;
+			Object.assign(req.query, data);
+			return await originalMethod.call(this, req, res, next);
+		} as unknown as F;
 
 		return descriptor;
 	};
 }
-// export function authValidator({ optional = false }: { optional?: boolean } | undefined = {}) {
-// 	return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {
-// 		const originalMethod = descriptor.value;
-// 		descriptor.value = async function (req: Request, res: Response, next: NextFunction) {
-// 			try {
-// 				const accessToken = req.headers["authorization"]?.split(" ")[1];
-// 				if (optional && (!accessToken || !TokenModule.verifyAccessToken(accessToken))) {
-// 					return originalMethod.apply(this, [req, res, next]);
-// 				}
-// 				if (!accessToken) {
-// 					res.status(401).json({ message: "access token missing" });
-// 					return;
-// 				}
-// 				const payload = TokenModule.verifyAccessToken(accessToken);
-
-// 				if (!payload) {
-// 					res.status(401).json({ message: "invalid access token" });
-// 					return;
-// 				}
-// 				req.user = {
-// 					id: payload.userID,
-// 					email: payload.email
-// 				};
-// 				return originalMethod.apply(this, [req, res, next]);
-// 			} catch (error) {
-// 				next(error);
-// 			}
-// 		};
-// 	};
-// }
 
 export function mediaBodyValidator<T extends SchemaTypes>(schema: T, optional = false) {
-	return function <F extends ExpressHandler<unknown, unknown, Infer<T>, unknown>>(
-		_target: unknown,
-		_propertyKey: string,
-		descriptor: TypedPropertyDescriptor<F>
-	) {
+	return function <
+		F extends (
+			req: Request<any, any, Infer<T>, any, Record<string, any>> & { files?: any },
+			res: Response<any, Record<string, any>>,
+			next: NextFunction
+		) => Promise<any> | void,
+	>(_target: unknown, _propertyKey: string, descriptor: TypedPropertyDescriptor<F>) {
 		const originalMethod = descriptor.value!;
 
 		descriptor.value = async function (
 			this: unknown,
-			req: Request<unknown, unknown, Infer<T>>,
+			req: Request<any, any, Infer<T>, any, Record<string, any>> & { files?: any },
 			res: Response,
 			next: NextFunction
 		) {
@@ -184,9 +159,7 @@ export function mediaBodyValidator<T extends SchemaTypes>(schema: T, optional =
 				}
 			};
 
-			const parsedData = Object.fromEntries(
-				Object.entries(req.body).map(([k, v]) => [k, isJSON(v)])
-			);
+			const parsedData = Object.fromEntries(Object.entries(req.body).map(([k, v]) => [k, isJSON(v)]));
 
 			const { error, data } = await validateBody(schema, parsedData);
 
@@ -198,12 +171,13 @@ export function mediaBodyValidator<T extends SchemaTypes>(schema: T, optional =
 			req.body = data;
 			req.files = files;
 
-			return originalMethod.call(this, req, res, next);
-		} as F;
+			return await originalMethod.call(this, req, res, next);
+		} as unknown as F;
 
 		return descriptor;
 	};
 }
+
 export const validateId = vine.object({
 	id: vine.string().uuid(),
 });
@@ -224,10 +198,8 @@ export const paginationValidator = vine.object({
 		.parse(e => (!e ? "" : e))
 		.optional(),
 });
-export async function validate<T extends SchemaTypes>(
-	schema: T,
-	payload: Infer<T>
-): Promise<Infer<T>> {
+
+export async function validate<T extends SchemaTypes>(schema: T, payload: Infer<T>): Promise<Infer<T>> {
 	const result = await validateBody(schema, payload);
 
 	if (result.error.length) {

package/packages/@repo/lib/tsconfig.json

@@ -1,7 +1,8 @@
 {
 	"extends": "typescript-config/tsconfig.node.json",
 	"compilerOptions": {
-		"jsx": "react"
+		"jsx": "react",
+		"lib": ["DOM", "ES2022"]
 	},
 	"include": ["src/**/*.ts"]
 }

package/packages/@repo/model/eslint.config.ts

@@ -0,0 +1,4 @@
+import { baseConfig } from "eslint-config/base";
+import { extend } from "eslint-config/extend";
+
+export default extend(baseConfig);

package/packages/@repo/model/package.json

@@ -0,0 +1,41 @@
+{
+	"name": "@repo/model",
+	"type": "module",
+	"scripts": {
+		"lint": "eslint .",
+		"lint:fix": "eslint . src/**/*.ts --fix",
+		"clean": "rimraf dist build .turbo",
+		"deep:clean": "rimraf node_modules dist build .turbo",
+		"typecheck": "tsc --noEmit",
+		"format": "prettier --write .",
+		"format:check": "prettier --check .",
+		"test": "vitest run"
+	},
+	"exports": {
+		".": "./src/index.ts",
+		"./*": "./src/*/index.ts"
+	},
+	"dependencies": {
+		"@repo/lib": "workspace:^",
+		"@repo/logger": "workspace:^"
+	},
+	"devDependencies": {
+		"typescript-config": "workspace:^",
+		"eslint-config": "workspace:^",
+		"vitest-config": "workspace:^"
+	},
+	"startx": {
+		"iTags": [
+			"node"
+		],
+		"gTags": [],
+		"tags": [],
+		"requiredDeps": [
+			"@repo/env",
+			"@repo/lib"
+		],
+		"requiredDevDeps": [
+			"typescript-config"
+		]
+	}
+}

package/packages/@repo/model/tsconfig.json

@@ -0,0 +1,7 @@
+{
+	"extends": "typescript-config/tsconfig.node.json",
+	"compilerOptions": {
+		// "baseUrl": "./src"
+	},
+	"include": ["src/**/*.ts"]
+}

package/packages/@repo/model/vitest.config.ts

@@ -0,0 +1,3 @@
+import vitestConfig from "vitest-config/node";
+
+export default vitestConfig;