julien
c3de2340e7
## Summary
Hardens the BFF session per ADR-0010 §"TTL policy" and §"Revocation":
- **Absolute-timeout middleware** — every request that survives `express-session` runs through a new middleware that checks `req.session.absoluteExpiresAt`. Past the 12 h hard ceiling, the middleware destroys the Redis-side session, clears the `portal_session` cookie, drops the entry from the per-user index, and lets the request continue anonymously. Route-level guards (`/me`, future `@RequireAuth`) turn that into a 401 where the user actually needs auth — public routes keep serving.
- **`user_sessions:{userId}` secondary index** — a new `UserSessionIndexService` maintains a Redis set of active session ids per user. Hooked into `/auth/callback` (SADD on sign-in) and `/auth/logout` + the absolute-timeout middleware (SREM on destroy). Best-effort: a failed `SADD`/`SREM` logs a warning and the auth flow continues. No in-product consumer in this PR — the admin "logout everywhere" endpoint lands with the admin module.
- **Session payload extension** — `createdAt` and `absoluteExpiresAt` are now set on the session at the same moment as `req.session.user` (in `/auth/callback`). The `session.types.ts` declaration merging exposes them as optional `SessionData` fields.
## Notable choices
**Non-intrusive enforcement on expiry.** ADR-0010 says "returns 401"; we interpret that as "the user eventually sees a 401 when they touch something that needs auth", not "every route returns 401 the moment we notice the ceiling". The middleware destroys the session and calls `next()` — `/me` returns 401 on its own (no user on the session), public routes stay accessible. Validated with the project lead 2026-05-12.
**Express middleware exposed via DI, not a NestJS `MiddlewareConsumer`.** Same pattern as `SESSION_MIDDLEWARE`: factory inside `SessionModule`, resolved from the application context in `main.ts` with `app.get<RequestHandler>(SESSION_ABSOLUTE_TIMEOUT_MIDDLEWARE)`. Keeps the wiring co-located with the session middleware and avoids the `AppModule.configure(consumer)` boilerplate for a one-off enforcement layer.
**Best-effort index maintenance.** `UserSessionIndexService.add` / `remove` catch Redis errors and log a Pino warning instead of throwing. Rationale (per ADR-0010): the index is a convenience for admin operations, not a security invariant — a Redis hiccup must not break sign-in / sign-out. Orphans (entries pointing to keys that have expired idle-TTL on their own) are tolerated and will be filtered by future consumer code.
**Per-user index identifier = Entra `oid`.** Stable per-user inside the tenant, matches `req.session.user.oid`. Admin "logout user X" will work against this same key. Future multi-tenant scenarios may want `${tid}:${oid}` — easy refactor when External ID activation lands (ADR-0008).
## Out of scope (next PRs)
- Admin "logout everywhere" endpoint consuming `UserSessionIndexService.list(userId)`. Waits on the admin module + `@RequireAdmin` / `@RequireMfa` guards.
- Audit-pipeline first-class events for `session.absolute_timeout` and `user_session_index.*` (ADR-0013). For now they're structured Pino logs.
- Token blob persistence (id_token / access_token / refresh_token) in the encrypted session — ADR-0014 dependency.
## Test plan
- [x] `pnpm nx test portal-bff` → **123/123 pass** (was 110 before; +13 specs across new `user-session-index.service.spec.ts`, `absolute-timeout.middleware.spec.ts`, and added cases in `auth.controller.spec.ts`).
- [x] `pnpm nx lint portal-bff` → clean.
- [x] `pnpm nx build portal-bff` → clean webpack build.
- [x] Prettier-clean for all touched files.
- [ ] Manual smoke against running BFF:
- [ ] Sign in normally → Redis has `session:<id>` + `user_sessions:<oid>` SISMEMBER returns `<id>`.
- [ ] Logout → both keys gone.
- [ ] Forge a past `absoluteExpiresAt` in Redis (or shorten `SESSION_ABSOLUTE_TIMEOUT_SECONDS=5` in `.env`) → next request after expiry returns 401 on `/me`, cookie cleared, index entry SREM-ed.
---------
Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #115
81 lines
2.7 KiB
TypeScript
81 lines
2.7 KiB
TypeScript
import { Inject, Injectable } from '@nestjs/common';
|
|
import { Logger } from 'nestjs-pino';
|
|
import { REDIS_CLIENT, type Redis } from '../redis/redis.token';
|
|
|
|
/**
|
|
* Secondary index `user_sessions:{userId}` → Redis set of session
|
|
* ids the user currently has open (per ADR-0010 §"Revocation").
|
|
*
|
|
* Maintained on the lifecycle events:
|
|
* - session created in `/auth/callback` → `SADD`
|
|
* - session destroyed in `/auth/logout` → `SREM`
|
|
* - session destroyed by the absolute-timeout → `SREM`
|
|
*
|
|
* NOT actively cleaned on idle-TTL expiry: when the Redis session
|
|
* key disappears on its own, the corresponding entry in the user
|
|
* set becomes a "phantom" id pointing at nothing. ADR-0010 treats
|
|
* this as best-effort — orphans are filtered out by `list()` /
|
|
* future admin "logout everywhere" routes.
|
|
*
|
|
* Today the only consumer of `add` / `remove` is the auth surface.
|
|
* `list` and the matching admin endpoint land in a follow-up PR
|
|
* (admin module / `@RequireAdmin` guard).
|
|
*/
|
|
@Injectable()
|
|
export class UserSessionIndexService {
|
|
private static readonly KEY_PREFIX = 'user_sessions:';
|
|
|
|
constructor(
|
|
@Inject(REDIS_CLIENT) private readonly redis: Redis,
|
|
private readonly logger: Logger,
|
|
) {}
|
|
|
|
async add(userId: string, sessionId: string): Promise<void> {
|
|
try {
|
|
await this.redis.sadd(this.keyFor(userId), sessionId);
|
|
} catch (err) {
|
|
// Best-effort by design: a failed SADD leaves the session
|
|
// unreachable from "logout everywhere" but does not break
|
|
// sign-in itself. Log so ops can spot a degraded Redis.
|
|
this.logger.warn(
|
|
{
|
|
event: 'user_session_index.add_failed',
|
|
userId,
|
|
message: err instanceof Error ? err.message : String(err),
|
|
},
|
|
'UserSessionIndex',
|
|
);
|
|
}
|
|
}
|
|
|
|
async remove(userId: string, sessionId: string): Promise<void> {
|
|
try {
|
|
await this.redis.srem(this.keyFor(userId), sessionId);
|
|
} catch (err) {
|
|
this.logger.warn(
|
|
{
|
|
event: 'user_session_index.remove_failed',
|
|
userId,
|
|
message: err instanceof Error ? err.message : String(err),
|
|
},
|
|
'UserSessionIndex',
|
|
);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns the raw set of session ids for a user. Includes
|
|
* orphans (entries whose `session:<id>` Redis key has already
|
|
* expired); the caller is expected to filter or rely on idle
|
|
* cleanup. v1 has no in-product consumer — exposed for tests
|
|
* today and the upcoming admin module.
|
|
*/
|
|
async list(userId: string): Promise<string[]> {
|
|
return this.redis.smembers(this.keyFor(userId));
|
|
}
|
|
|
|
private keyFor(userId: string): string {
|
|
return `${UserSessionIndexService.KEY_PREFIX}${userId}`;
|
|
}
|
|
}
|