Files
jobtrackingapp/job-tracker-ui/src/components/SessionsSettingsCard.tsx
T
cesnimda c6918cbeea feat(auth): add server-tracked sessions with view/revoke
JWTs were previously fully stateless -- the token alone was the credential
until its own expiry, with no way to list or kill a session server-side. Add
a UserSession table alongside every JWT issued (AppSessionIssuer), embed its
id as a "sid" claim, and check that claim against the DB on every "local"
scheme request (Program.cs OnTokenValidated) so a session can actually be
revoked before its JWT naturally expires. New /api/auth/sessions endpoints
(list, revoke one, revoke-others) plus a Sessions card on the profile page.

Fails closed on a missing "sid" claim: every JWT issued going forward has
one, so a token without it is either pre-deploy (forces one re-login for
already-signed-in users at deploy time, same additive-forward cost the
2FA/trusted-device work on this branch already paid) or forged.
2026-07-13 01:47:31 +02:00

149 lines
4.7 KiB
TypeScript

import React, { useEffect, useState } from "react";
import {
Alert,
Box,
Button,
Dialog,
DialogActions,
DialogContent,
DialogTitle,
IconButton,
List,
ListItem,
ListItemSecondaryAction,
ListItemText,
Paper,
Typography,
} from "@mui/material";
import DeleteIcon from "@mui/icons-material/Delete";
import { api, getApiErrorMessage } from "../api";
import { useToast } from "../toast";
import { useI18n } from "../i18n/I18nProvider";
import { clearAuthClientState } from "../auth";
type Session = {
id: string;
deviceLabel: string | null;
createdAtUtc: string;
lastSeenAtUtc: string;
expiresAtUtc: string;
isCurrentSession: boolean;
};
function apiErrorMessage(e: any, t: (k: any) => string) {
return getApiErrorMessage(e, t("twoFactorGenericError"));
}
export default function SessionsSettingsCard() {
const { toast } = useToast();
const { t } = useI18n();
const [sessions, setSessions] = useState<Session[]>([]);
const [loading, setLoading] = useState(false);
const [error, setError] = useState<string | null>(null);
const [confirmRevokeOthers, setConfirmRevokeOthers] = useState(false);
const loadSessions = () => {
setLoading(true);
setError(null);
api
.get<Session[]>("/auth/sessions")
.then((r) => setSessions(r.data))
.catch((e) => setError(apiErrorMessage(e, t)))
.finally(() => setLoading(false));
};
useEffect(() => { loadSessions(); }, []);
async function revokeSession(id: string, isCurrentSession: boolean) {
try {
await api.delete(`/auth/sessions/${id}`);
if (isCurrentSession) {
// Same pattern as AuthStatusCard's sign-out: clearing local auth state emits
// "auth-changed", which App.tsx's listener picks up to refetch /auth/me (now 401,
// since the server already deleted the session cookie) and redirect to /login.
clearAuthClientState();
return;
}
toast(t("sessionsRevoked"), "success");
loadSessions();
} catch (e: any) {
setError(apiErrorMessage(e, t));
}
}
async function revokeOthers() {
try {
await api.post("/auth/sessions/revoke-others");
toast(t("sessionsRevokedOthers"), "success");
setConfirmRevokeOthers(false);
loadSessions();
} catch (e: any) {
setError(apiErrorMessage(e, t));
}
}
return (
<Paper sx={{ mt: 2, p: 2 }}>
<Typography variant="h6" sx={{ mb: 1 }}>
{t("sessionsSectionTitle")}
</Typography>
{error ? <Alert severity="error" role="alert" sx={{ mb: 1 }}>{error}</Alert> : null}
{!loading && sessions.length === 0 && !error ? (
<Typography sx={{ color: "text.secondary", mb: 1 }}>{t("sessionsEmpty")}</Typography>
) : null}
{sessions.length > 0 ? (
<List dense disablePadding>
{sessions.map((s) => (
<ListItem key={s.id} divider>
<ListItemText
primary={
<>
{s.deviceLabel || t("sessionsUnknownDevice")}
{s.isCurrentSession ? (
<Typography component="span" variant="caption" sx={{ ml: 1, color: "primary.main", fontWeight: 700 }}>
{t("sessionsCurrentDevice")}
</Typography>
) : null}
</>
}
secondary={t("sessionsMeta", {
lastSeen: new Date(s.lastSeenAtUtc).toLocaleString(),
expires: new Date(s.expiresAtUtc).toLocaleDateString(),
})}
/>
<ListItemSecondaryAction>
<IconButton edge="end" aria-label={t("sessionsRevoke")} onClick={() => revokeSession(s.id, s.isCurrentSession)}>
<DeleteIcon fontSize="small" />
</IconButton>
</ListItemSecondaryAction>
</ListItem>
))}
</List>
) : null}
{sessions.length > 1 ? (
<Button variant="text" color="warning" size="small" sx={{ mt: 1 }} onClick={() => setConfirmRevokeOthers(true)}>
{t("sessionsRevokeOthers")}
</Button>
) : null}
<Dialog open={confirmRevokeOthers} onClose={() => setConfirmRevokeOthers(false)} maxWidth="sm" fullWidth>
<DialogTitle>{t("sessionsRevokeOthersConfirmTitle")}</DialogTitle>
<DialogContent>
<Typography>{t("sessionsRevokeOthersConfirmBody")}</Typography>
</DialogContent>
<DialogActions>
<Button type="button" onClick={() => setConfirmRevokeOthers(false)}>{t("cancel")}</Button>
<Button variant="contained" color="warning" onClick={revokeOthers}>
{t("sessionsRevokeOthers")}
</Button>
</DialogActions>
</Dialog>
</Paper>
);
}