1eb70e9b9b
Some checks failed
Deploy / Deploy Production (push) Has been skipped
Deploy / Deploy Preview (push) Failing after 1s
Deploy / Cleanup Preview (push) Has been skipped
CI / UI / Build (pull_request) Failing after 13s
CI / Scraper / Lint (pull_request) Successful in 19s
CI / Scraper / Test (pull_request) Successful in 20s
CI / Scraper / Build (pull_request) Successful in 12s
- Add user_sessions PocketBase collection (user_id, session_id, user_agent, ip, created/last_seen) - Extend auth token format to include a per-login authSessionId (4th segment) - Hook validates authSessionId against DB on each request; revoked sessions are cleared immediately - Login/register create a session record capturing user-agent and IP - Profile page shows all active sessions with current session highlighted; per-session End/Sign out buttons - GET /api/sessions and DELETE /api/sessions/[id] endpoints for client-side revocation - Backward compatible: legacy 3-segment tokens pass through without DB check
33 lines
983 B
TypeScript
33 lines
983 B
TypeScript
import { json, error } from '@sveltejs/kit';
|
|
import type { RequestHandler } from './$types';
|
|
import { listUserSessions } from '$lib/server/pocketbase';
|
|
import { log } from '$lib/server/logger';
|
|
|
|
/**
|
|
* GET /api/sessions
|
|
* Returns all active sessions for the logged-in user.
|
|
*/
|
|
export const GET: RequestHandler = async ({ locals }) => {
|
|
if (!locals.user) {
|
|
error(401, 'Not logged in');
|
|
}
|
|
|
|
try {
|
|
const sessions = await listUserSessions(locals.user.id);
|
|
// Don't expose raw session_id to the client — only the record ID for revocation
|
|
const safe = sessions.map((s) => ({
|
|
id: s.id,
|
|
user_agent: s.user_agent,
|
|
ip: s.ip,
|
|
created_at: s.created_at,
|
|
last_seen: s.last_seen,
|
|
// Tell the client whether this is the currently active session
|
|
is_current: s.session_id === locals.user!.authSessionId
|
|
}));
|
|
return json({ sessions: safe });
|
|
} catch (e) {
|
|
log.error('sessions', 'GET failed', { err: String(e) });
|
|
error(500, 'Failed to load sessions');
|
|
}
|
|
};
|