Authentication and Authorisation

// ioredis client. No claims in the cookie, so the store is consulted every
// request — and logout takes effect everywhere immediately.
const crypto = require('node:crypto');

async function login(res, user) {
  const sid = crypto.randomBytes(32).toString('base64url'); // 256 bits, unguessable
  await redis.set(`sess:${sid}`,
    JSON.stringify({ uid: user.id, tenant: user.tenantId }),
    'EX', 60 * 60 * 24 * 14);          // 14-day idle window, extended on use
  await redis.sadd(`user_sessions:${user.id}`, sid);
  res.cookie('sid', sid, {
    httpOnly: true,   // unreadable from JS, so an XSS bug cannot exfiltrate it
    secure: true,
    sameSite: 'lax',  // 'strict' breaks inbound links from email and Slack
    path: '/'
  });
}

async function logoutEverywhere(userId) {
  // With sessions, "sign out all devices" is a delete. With stateless JWTs there
  // is no equivalent: you wait for exp, or you add a denylist and become stateful.
  const sids = await redis.smembers(`user_sessions:${userId}`);
  if (sids.length) await redis.del(...sids.map(s => `sess:${s}`));
  await redis.del(`user_sessions:${userId}`);
}

// RFC 9700: refresh tokens for public clients are sender-constrained OR rotated.
// Rotation without replay detection is bookkeeping, not security.
// A refresh token belongs to a family — one login. Replay kills the family.
async function rotate(presented) {
  const hash = sha256(presented); // store hashes; a leaked DB must not yield live tokens
  const row = await db.oneOrNone(
    `SELECT id, family_id, user_id, used_at, revoked_at, expires_at
       FROM refresh_tokens WHERE token_hash = $1`, [hash]);

  if (!row || row.revoked_at || row.expires_at < new Date()) throw new AuthError('invalid');

  if (row.used_at) {
    // This token was already exchanged. Either the real client retried after a
    // dropped response, or a thief is using a copy. You cannot tell which, so
    // end the whole login and make the user sign in again.
    await db.none(
      'UPDATE refresh_tokens SET revoked_at = now() WHERE family_id = $1 AND revoked_at IS NULL',
      [row.family_id]);
    throw new AuthError('replayed');
  }

  const next = crypto.randomBytes(32).toString('base64url');
  await db.tx(async t => {
    await t.none('UPDATE refresh_tokens SET used_at = now() WHERE id = $1', [row.id]);
    await t.none(
      `INSERT INTO refresh_tokens (token_hash, family_id, user_id, expires_at)
       VALUES ($1, $2, $3, now() + interval '30 days')`,
      [sha256(next), row.family_id, row.user_id]);
  });
  return { access: issueAccess(await loadUser(row.user_id)), refresh: next };
}

// Tokens carry a session id. Only sessions that were explicitly killed are
// ever present in the cache, so the key set stays small.
function issueAccess(user, sid) {
  return jwt.sign({ sub: user.id, sid, tenant: user.tenantId },
    process.env.JWT_PRIVATE_KEY,
    { algorithm: 'RS256', expiresIn: '10m' });
}

const DENY_TTL = 15 * 60; // one access-token lifetime plus clock slack

async function revokeSession(sid) {
  // Self-expiring: after the longest a live token can survive, the entry is
  // pointless and removes itself. No cleanup job.
  await redis.set(`revoked:${sid}`, '1', 'EX', DENY_TTL);
}

async function guard(req, res, next) {
  let claims;
  try {
    claims = jwt.verify(bearer(req), process.env.JWT_PUBLIC_KEY, { algorithms: ['RS256'] });
  } catch { return res.sendStatus(401); }

  // Fail closed on a cache outage for an admin API; fail open for a read path.
  // Decide this deliberately and say which you chose.
  if (await redis.exists(`revoked:${claims.sid}`)) return res.sendStatus(401);

  req.user = claims;
  next();
}