saqib mirandClaude Sonnet 5
40687f68fa
Replaces the no-op fastify.authenticate stub and the never-implemented
identity/auth login with real bcrypt password verification, JWT session
issuance/verification (reusing the existing JWT_SECRET), and a Redis-backed
revocation denylist for logout. Adds requireRole('ADMIN') to admin-only
configuration writes across 002-009 that previously relied on a decorator
that never actually checked anything. Adds self-identity (GET /auth/me,
re-validated against live account state) and admin-provisioned accounts
(POST /admin/users).
Making the auth check genuinely reject invalid/missing tokens exposed that
~18 pre-existing integration test files called already-gated routes with no
Authorization header (safe against the old no-op stub, broken against a real
one) — fixed via a shared tests/helpers/auth.ts (loginAs/authHeader) and a
file-by-file pass, plus two related SLA-run cleanup races exposed once admin
setup calls in those files' own beforeAll blocks started actually succeeding.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
18 lines
745 B
TypeScript
18 lines
745 B
TypeScript
import { cacheService } from './cache.service';
|
|
|
|
const REVOKED_KEY_PREFIX = 'auth:revoked:';
|
|
|
|
/**
|
|
* Explicit-logout revocation for staff session tokens (specs/010-identity-auth/research.md
|
|
* "Redis-backed revocation denylist, reusing 002's own jti-tracking mechanism"). A jti is
|
|
* denylisted only until its own token would have expired anyway, so the set never grows
|
|
* unbounded — the same shape as replay-guard.ts's hasSeenJti/markJtiSeen.
|
|
*/
|
|
export async function isTokenRevoked(jti: string): Promise<boolean> {
|
|
return cacheService.exists(`${REVOKED_KEY_PREFIX}${jti}`);
|
|
}
|
|
|
|
export async function revokeToken(jti: string, ttlSeconds: number): Promise<void> {
|
|
await cacheService.set(`${REVOKED_KEY_PREFIX}${jti}`, '1', ttlSeconds);
|
|
}
|