Session Management

// Generation
const sessionToken = randomBytes(32).toString("hex");
// Result: "a1b2c3d4e5f6..." (64 chars)

CREATE TABLE sessions (
  id UUID PRIMARY KEY,
  user_id UUID NOT NULL,
  device_id UUID NOT NULL,
  token_hash TEXT NOT NULL,  -- SHA-256 of token
  expires_at TIMESTAMP NOT NULL,
  ip_address TEXT,
  user_agent TEXT,
  created_at TIMESTAMP DEFAULT NOW()
);

// 1. Generate token
const sessionToken = generateSessionToken();

// 2. Calculate expiration
const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days

// 3. Store hashed token
await db.insert(sessions).values({
  userId: user.id,
  deviceId: device.id,
  tokenHash: hashSessionToken(sessionToken),
  expiresAt,
  ipAddress: request.ip,
  userAgent: request.userAgent,
});

// 4. Set cookie
setSessionCookie(c, sessionToken, expiresAt);

// 5. Return token in response (for Bearer auth)
return { sessionToken, ... };

setCookie(c, "ave_session", token, {
  httpOnly: true,              // No JavaScript access
  secure: isSecureContext(c),  // HTTPS-only in production
  sameSite: secure ? "None" : "Lax",
  path: "/",
  domain: getCookieDomain(c),
  expires: expiresAt,
});

function isSecureContext(c: Context): boolean {
  // Allow override via environment variable
  if (process.env.COOKIE_SECURE === "false") return false;
  
  // Check X-Forwarded-Proto header (for proxies)
  const forwarded = c.req.header("x-forwarded-proto");
  if (forwarded === "https") return true;
  
  // Check production domain
  const host = c.req.header("host") || "";
  if (host === "aveid.net" || host.endsWith(".aveid.net")) return true;
  
  return false;
}

function getCookieDomain(c: Context): string | undefined {
  // Use environment variable if set
  const envDomain = process.env.COOKIE_DOMAIN;
  if (envDomain) return envDomain;
  
  // Auto-detect for aveid.net
  const host = c.req.header("host") || "";
  if (host === "aveid.net" || host.endsWith(".aveid.net")) {
    return ".aveid.net"; // Shares across all subdomains
  }
  
  return undefined; // Use current domain only
}

app.use("*", requireAuth);

app.get("/protected", async (c) => {
  const user = c.get("user");  // Available after requireAuth
  // ...
});

const authHeader = c.req.header("Authorization");
const bearerToken = authHeader?.startsWith("Bearer ") 
  ? authHeader.slice(7) 
  : null;

const cookieToken = parseCookie(c.req.header("Cookie"))["ave_session"];

const token = bearerToken || cookieToken;

// 1. Hash the provided token
const tokenHash = hashSessionToken(token);

// 2. Look up session by hash
const [session] = await db
  .select()
  .from(sessions)
  .where(eq(sessions.tokenHash, tokenHash))
  .limit(1);

// 3. Check if session exists and not expired
if (!session || new Date() > session.expiresAt) {
  return c.json({ error: "Invalid or expired session" }, 401);
}

// 4. Attach user to context
c.set("user", { id: session.userId, deviceId: session.deviceId });

POST /api/login/logout
Authorization: Bearer <token>

// 1. Hash token
const tokenHash = hashSessionToken(token);

// 2. Delete session from database
await db.delete(sessions).where(eq(sessions.tokenHash, tokenHash));

// 3. Clear cookie
clearSessionCookie(c);

DELETE /api/devices/:deviceId

// Delete all sessions for this device
await db.delete(sessions).where(eq(sessions.deviceId, deviceId));

// Mark device as inactive
await db.update(devices)
  .set({ isActive: false })
  .where(eq(devices.id, deviceId));

POST /api/devices/revoke-all

// Delete all sessions except current device
await db.delete(sessions)
  .where(
    and(
      eq(sessions.userId, user.id),
      ne(sessions.deviceId, currentDeviceId)
    )
  );

import { randomBytes } from "crypto";

export function generateSessionToken(): string {
  return randomBytes(32).toString("hex"); // 256 bits
}

export function hashSessionToken(token: string): string {
  return createHash("sha256").update(token).digest("hex");
}

setCookie(c, "ave_session", token, {
  httpOnly: true,  // Blocks document.cookie access
  // ...
});

setCookie(c, "ave_session", token, {
  secure: true,     // HTTPS-only transmission
  sameSite: "None", // Cross-site requests allowed (with HTTPS)
  // ...
});

{
  userId: "...",
  deviceId: "...",        // Specific device
  tokenHash: "...",
  ipAddress: "1.2.3.4",   // Original IP
  userAgent: "Chrome..."  // Original browser
}

{
  "action": "login",
  "details": {
    "method": "passkey" | "trust_code" | "device_approval",
    "deviceName": "Chrome on Mac",
    "isNewDevice": true
  },
  "deviceId": "...",
  "ipAddress": "1.2.3.4",
  "userAgent": "Mozilla/5.0...",
  "severity": "info" | "warning"
}

# Cookie security
COOKIE_SECURE=true|false  # Force secure flag (default: auto-detect)
COOKIE_DOMAIN=.example.com  # Cookie domain (default: auto-detect)

# WebAuthn
RP_ID=example.com          # Relying Party ID for passkeys
RP_ORIGIN=https://example.com  # Expected origin for WebAuthn
RP_NAME="Ave"              # Display name for passkeys