hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat: OIDC phase 2 — session-bound refresh tokens, server-side logout

Browse source 
Hub sessions gain an optional sid backed by auth_sessions (login/reissue
write the row; POST /auth/logout revokes it; pre-phase2 tokens are
refused at reissue so revocation applies from the next epoch bump).
The OIDC provider issues rotating refresh tokens (oidc_refresh_tokens,
SHA-256 at rest, family-wide revocation on reuse detection) that live
and die with the consenting Hub session — an oCIS session can no longer
outlive the sign-in that minted it, and Hub logout propagates at the
next refresh instead of the next silent-authorize. Discovery advertises
refresh_token. Migration 034; RLS via the audit_append definer pattern
for the unauthenticated token-endpoint lookup.
This commit is contained in:
glass beadian 2026-10-14 11:33:47 +00:00
parent d6eb39ff27
commit 643fbb94bc
10 changed files with 601 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

9
apps/api/src/auth/auth.controller.ts
View file

@ -38,10 +38,15 @@ export class AuthController {
return this.auth.reissue(session);
}
/** Stateless tokens: logout is client-side (drop the token). Revocation-by-epoch covers role changes. */
/** Signed session present ⇒ its server-side row is revoked (phase 2). Legacy tokens: client-side only. */
@Post("logout")
@HttpCode(200)
logout(): { ok: true } {
logout(@Req() request: Request): { ok: true } {
const authorization = request.headers.authorization;
const session = authorization !== undefined && authorization.startsWith("Bearer ")
? verifySession(authorization.slice("Bearer ".length))
: null;
void this.auth.logout(session);
return { ok: true };
}
}