finish up turbo and add stimulus.

2026-07-13 20:00:04 -05:00
parent e390dbc966
commit b08d8ba028
21 changed files with 576 additions and 254 deletions
@@ -0,0 +1,125 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { generateToken } from "../../auth";
+import {
+  createSession,
+  getSessionById,
+  hashTokenForSession,
+  listUserSessions,
+  revokeSessionById,
+} from "../../db";
+import { createUser, deleteUser, getUserById } from "../../users";
+import { handleUiRoutes } from "./ui-routes";
+
+const PASSWORD = "Aa1!TurboFrameSessionsTest";
+const createdUserIds: number[] = [];
+const mockServer = { requestIP: () => ({ address: "127.0.0.1" }) };
+
+async function tempUser(userAgent = "Turbo Frame Test") {
+  const username = `ui_sessions_${Date.now().toString(36)}${Math.floor(Math.random() * 1e6).toString(36)}`;
+  const created = await createUser(username, PASSWORD, "admin", "test");
+  expect(created.success).toBe(true);
+  const user = getUserById(created.userId!);
+  expect(user).not.toBeNull();
+  createdUserIds.push(user!.id);
+  const token = await generateToken(user!, { ip: "127.0.0.1", userAgent });
+  return { user: user!, token };
+}
+
+function call(method: string, path: string, token: string | null) {
+  const url = new URL(`https://localhost${path}`);
+  const headers: Record<string, string> = {};
+  if (token) headers.Authorization = `Bearer ${token}`;
+  return handleUiRoutes(new Request(url, { method, headers }), url, mockServer);
+}
+
+function addSession(userId: number, userAgent: string) {
+  const now = Math.floor(Date.now() / 1000);
+  const session = {
+    id: crypto.randomUUID(),
+    userId,
+    tokenHash: crypto.randomUUID().replaceAll("-", ""),
+    ip: "127.0.0.2",
+    userAgent,
+    createdAt: now,
+    expiresAt: now + 3600,
+  };
+  createSession(session);
+  return session;
+}
+
+afterEach(() => {
+  while (createdUserIds.length > 0) {
+    const id = createdUserIds.pop();
+    if (typeof id === "number") deleteUser(id);
+  }
+});
+
+describe("settings sessions Turbo Frame", () => {
+  test("redirects unauthenticated frame requests to login", async () => {
+    const response = await call("GET", "/ui/settings/sessions", null);
+    expect(response!.status).toBe(303);
+    expect(response!.headers.get("location")).toBe("https://localhost/login.html");
+  });
+
+  test("renders an escaped frame and marks the current session", async () => {
+    const account = await tempUser('<script>alert("xss")</script>');
+    const response = await call("GET", "/ui/settings/sessions", account.token);
+    expect(response!.status).toBe(200);
+    expect(response!.headers.get("content-type")).toContain("text/html");
+    expect(response!.headers.get("cache-control")).toBe("no-store");
+
+    const body = await response!.text();
+    expect(body).toContain('<turbo-frame id="section-sessions"');
+    expect(body).toContain("Current");
+    expect(body).toContain("&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;");
+    expect(body).not.toContain('<script>alert("xss")</script>');
+    expect(body).toContain('data-controller="sessions"');
+    expect(body).toContain('data-turbo="true"');
+  });
+
+  test("revokes another session and returns the refreshed frame", async () => {
+    const account = await tempUser();
+    const added = addSession(account.user.id, "Second browser");
+    const secondSession = getSessionById(added.id);
+    expect(secondSession).toBeDefined();
+
+    const response = await call(
+      "POST",
+      `/ui/settings/sessions/${encodeURIComponent(secondSession!.id)}/revoke`,
+      account.token,
+    );
+    expect(response!.status).toBe(200);
+    expect(await response!.text()).toContain("Session revoked successfully.");
+    expect(getSessionById(secondSession!.id)?.revoked).toBe(true);
+  });
+
+  test("revoking the current session clears the cookie and redirects", async () => {
+    const account = await tempUser();
+    const currentHash = hashTokenForSession(account.token);
+    const currentSession = listUserSessions(account.user.id).find((session) => session.tokenHash === currentHash);
+    expect(currentSession).toBeDefined();
+
+    const response = await call(
+      "POST",
+      `/ui/settings/sessions/${encodeURIComponent(currentSession!.id)}/revoke`,
+      account.token,
+    );
+    expect(response!.status).toBe(303);
+    expect(response!.headers.get("location")).toBe("/");
+    expect(response!.headers.get("set-cookie")).toContain("Max-Age=0");
+    expect(getSessionById(currentSession!.id)?.revoked).toBe(true);
+  });
+
+  test("removes inactive sessions and reports the count", async () => {
+    const account = await tempUser();
+    const added = addSession(account.user.id, "Inactive browser");
+    const secondSession = getSessionById(added.id);
+    expect(secondSession).toBeDefined();
+    revokeSessionById(secondSession!.id);
+
+    const response = await call("POST", "/ui/settings/sessions/inactive", account.token);
+    expect(response!.status).toBe(200);
+    expect(await response!.text()).toContain("Removed 1 inactive session(s).");
+    expect(getSessionById(secondSession!.id)).toBeNull();
+  });
+});
@@ -0,0 +1,118 @@
+import { authenticateRequest, extractTokenFromRequest } from "../../auth";
+import { AuditAction, logAudit } from "../../auditLog";
+import {
+  deleteInactiveSessions,
+  getSessionById,
+  hashTokenForSession,
+  listUserSessions,
+  persistRevokedTokenHash,
+  revokeSessionById,
+} from "../../db";
+import { htmlResponse } from "../ui/html";
+import { renderSessionsFrame } from "../ui/sessions-view";
+import { makeAuthCookieClear } from "./auth-cookie";
+
+type UiRouteServer = {
+  requestIP: (req: Request) => { address?: string } | null | undefined;
+};
+
+function redirectToLogin(req: Request): Response {
+  return Response.redirect(new URL("/login.html", req.url), 303);
+}
+
+function currentTokenHash(req: Request): string | null {
+  const token = extractTokenFromRequest(req);
+  return token ? hashTokenForSession(token) : null;
+}
+
+export async function handleUiRoutes(
+  req: Request,
+  url: URL,
+  server: UiRouteServer,
+): Promise<Response | null> {
+  if (!url.pathname.startsWith("/ui/")) return null;
+
+  const user = await authenticateRequest(req);
+  if (!user) return redirectToLogin(req);
+
+  if (req.method === "GET" && url.pathname === "/ui/settings/sessions") {
+    return htmlResponse(renderSessionsFrame(
+      listUserSessions(user.userId),
+      currentTokenHash(req),
+    ));
+  }
+
+  if (req.method === "POST" && url.pathname === "/ui/settings/sessions/inactive") {
+    const removed = deleteInactiveSessions(user.userId);
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: server.requestIP(req)?.address || "unknown",
+      action: AuditAction.LOGOUT,
+      details: `Removed ${removed} inactive session(s)`,
+      success: true,
+    });
+    return htmlResponse(renderSessionsFrame(
+      listUserSessions(user.userId),
+      currentTokenHash(req),
+      { text: `Removed ${removed} inactive session(s).` },
+    ));
+  }
+
+  const revokeMatch = req.method === "POST"
+    ? url.pathname.match(/^\/ui\/settings\/sessions\/([^/]+)\/revoke$/)
+    : null;
+  if (revokeMatch) {
+    let sessionId = "";
+    try {
+      sessionId = decodeURIComponent(revokeMatch[1]);
+    } catch {
+      return htmlResponse(renderSessionsFrame(
+        listUserSessions(user.userId),
+        currentTokenHash(req),
+        { text: "Invalid session identifier.", type: "error" },
+      ), { status: 400 });
+    }
+
+    const session = getSessionById(sessionId);
+    if (!session || session.userId !== user.userId) {
+      return htmlResponse(renderSessionsFrame(
+        listUserSessions(user.userId),
+        currentTokenHash(req),
+        { text: "Session not found.", type: "error" },
+      ), { status: 404 });
+    }
+
+    const tokenHash = currentTokenHash(req);
+    const revokingCurrentSession = session.tokenHash === tokenHash;
+    const result = revokeSessionById(sessionId);
+    if (result.tokenHash) persistRevokedTokenHash(result.tokenHash, session.expiresAt);
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: server.requestIP(req)?.address || "unknown",
+      action: AuditAction.LOGOUT,
+      details: `Revoked session ${sessionId}`,
+      success: true,
+    });
+
+    if (revokingCurrentSession) {
+      return new Response(null, {
+        status: 303,
+        headers: {
+          "Location": "/",
+          "Set-Cookie": makeAuthCookieClear(req),
+        },
+      });
+    }
+
+    return htmlResponse(renderSessionsFrame(
+      listUserSessions(user.userId),
+      tokenHash,
+      { text: "Session revoked successfully." },
+    ));
+  }
+
+  return htmlResponse("<h1>Not found</h1>", { status: 404 });
+}