🐛Fixed bug with ability to log in with revoked session

tdrive/backend/node/src/services/console/clients/remote.ts

@@ -265,6 +265,9 @@ export class ConsoleRemoteClient implements ConsoleServiceClient {
         sid: sessionInfo.sid,
       });
       if (existingSession) {
+        if (existingSession.revoked_at) {
+          throw CrudException.unauthorized(`Session ${sessionInfo.sid} expired`);
+        }
         return existingSession.sid;
       } else {
         const sessionBody = new Session();
@@ -320,7 +323,8 @@ export class ConsoleRemoteClient implements ConsoleServiceClient {
     const sessionRepository = gr.services.console.getSessionRepo();
     const session = await sessionRepository.findOne({ sid: payload.claims.sid });
     if (session) {
-      await sessionRepository.remove(session);
+      session.revoked_at = new Date().getTime();
+      await sessionRepository.save(session);
     }
   }
 
@@ -332,7 +336,9 @@ export class ConsoleRemoteClient implements ConsoleServiceClient {
       });
       if (!session) {
         // fail for not matching session id
-        throw new Error("Invalid session id");
+        throw new Error(`Session ${sid} not found`);
+      } else if (session.revoked_at > 0) {
+        throw new Error(`Session ${sid} revoked`);
       }
     } else {
       // fail for missing session id

tdrive/backend/node/src/services/console/entities/session.ts

@@ -5,7 +5,7 @@ export const TYPE = "session";
 
 @Entity(TYPE, {
   primaryKey: [["company_id"], "sid"],
-  globalIndexes: [["sid"]],
+  globalIndexes: [["sid"], ["revoked_at"]],
   type: TYPE,
 })
 export default class Session {
@@ -17,6 +17,9 @@ export default class Session {
 
   @Column("sid", "string")
   sid: string;
+
+  @Column("revoked_at", "number")
+  revoked_at: number;
 }
 
 export type UserSessionPrimaryKey = Pick<Session, "sid">;