toiljs 0.0.119 → 0.0.121

package/server/globals/auth.ts

@@ -1,3 +1,4 @@
+import { AuthReads } from 'toiljs/server/auth/AuthReads';
 // AuthService: the server half of the post-quantum auth primitive, available
 // as a no-import global (registered via the toilscript `--lib` mechanism, the
 // same way `crypto` is a global). The client derives an ML-DSA-44 keypair from
@@ -11,11 +12,12 @@
 
 import { DataWriter, DataReader } from 'data';
 import { SessionEpochs } from 'toiljs/server/auth/SessionEpochs';
-import { SessionRevocations, SessionDigest, RevokedSession } from 'toiljs/server/auth/SessionRevocations';
+import { AuthStateDb, SessionDigest, RevokedSession } from 'toiljs/server/auth/AuthStateDb';
 import { HmacImportParams, HmacParams, ALG_SHA_256, FMT_RAW, USAGE_SIGN, USAGE_VERIFY } from 'crypto';
 
 import {
     Server,
+    Request,
     SecureCookies,
     Cookie,
     SameSite,
@@ -265,7 +267,7 @@ export namespace AuthService {
     const SESSION_VERSION: u8 = 2;
 
     /** Default session lifetime if `mintSession` is called without a ttl. */
-    export const DEFAULT_SESSION_TTL_SECS: u64 = 86400; // 24h
+    export const DEFAULT_SESSION_TTL_SECS: u64 = 604800; // 7 days
 
     /**
      * Override the session-signing secret programmatically. OPTIONAL: by default
@@ -274,6 +276,7 @@ export namespace AuthService {
      * the env value for the current request; keep it out of any client bundle.
      */
     export function setSecret(secret: Uint8Array): void {
+        invalidateSession();
         __sessionSecret = secret;
     }
 
@@ -286,13 +289,33 @@ export namespace AuthService {
     export function getSessionBytes(): Uint8Array | null {
         const req = Server.currentRequest;
         if (req == null) return null;
+        if (!req.__authChecked) {
+            // Publish only after verification completes. A host fault must never
+            // turn into a cached anonymous result if the application handles it.
+            req.__authBytes = verifySession(req);
+            req.__authChecked = true;
+        }
+        if (Time.nowSeconds() >= req.__authExpires) return null;
+        const bytes = req.__authBytes;
+        // Callers may decode/mutate their copy without changing later auth checks.
+        return bytes == null ? null : bytes.slice();
+    }
+
+    function invalidateSession(): void {
+        const req = Server.currentRequest;
+        if (req == null) return;
+        req.__authChecked = false;
+        req.__authBytes = null;
+        req.__authExpires = 0;
+    }
 
+    function verifySession(req: Request): Uint8Array | null {
         const sealed = SecureCookies.signed(__resolveSessionSecret()).open(
             req.cookies(),
             sessionCookieName(__reqIsSecure()),
         );
         if (sealed == null) return null;
-        if (SessionRevocations.sessions.lookup(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed)))) != null) return null;
+        if (AuthReads.owner(AuthStateDb.revokedSessions, new SessionDigest(crypto.toHex(crypto.sha256Text(sealed)))) != null) return null;
 
         const payload = base64UrlDecode(sealed);
         if (payload == null) return null;
@@ -310,6 +333,7 @@ export namespace AuthService {
         if (Time.nowSeconds() >= exp) return null;       // expired
         if (!SessionEpochs.allowed(userBytes, generation)) return null;
 
+        req.__authExpires = exp;
         return userBytes;
     }
 
@@ -397,6 +421,7 @@ export namespace AuthService {
 
     /** Invalidate all browser sessions authorized under the prior session generation. */
     export function revokeUserSessions(userData: Uint8Array): void {
+        invalidateSession();
         SessionEpochs.revoke(userData);
     }
 
@@ -406,7 +431,8 @@ export namespace AuthService {
         const req = Server.currentRequest!;
         const sealed = SecureCookies.signed(__resolveSessionSecret()).open(req.cookies(), sessionCookieName(__reqIsSecure()));
         if (sealed == null) return;
-        SessionRevocations.sessions.claim(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed))), new RevokedSession());
+        invalidateSession();
+        AuthStateDb.revokedSessions.claim(new SessionDigest(crypto.toHex(crypto.sha256Text(sealed))), new RevokedSession());
     }
 
     /** A `Set-Cookie` that immediately clears the session (logout). */

package/server/runtime/request.ts

@@ -33,6 +33,12 @@ export class Request {
     headers: Array<Header>;
     body: Uint8Array;
 
+    // Auth verification belongs to this request object, never a process/tenant cache.
+    // Internal AuthService state; cleared before local revocations or secret changes.
+    __authChecked: bool = false;
+    __authBytes: Uint8Array | null = null;
+    __authExpires: u64 = 0;
+
     // Lazily parsed `Cookie` header, cached for the life of the request.
     private _cookies: CookieMap | null = null;
 

package/server/auth/SessionRevocations.ts

@@ -1,13 +0,0 @@
-@data
-export class SessionDigest {
-    digest: string = '';
-    constructor(digest: string = '') { this.digest = digest; }
-}
-@data
-export class RevokedSession {
-    revoked: bool = true;
-}
-@database
-export class SessionRevocations {
-    @collection static sessions: Unique<SessionDigest, RevokedSession>;
-}