feat: invalidate existing sessions on auth restrict via token_version

Author: ddrayko

config/migrate.js

@@ -15,6 +15,7 @@ const tables = {
       { name: 'is_admin', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
       { name: 'restricted', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
       { name: 'auth_restricted', def: 'TINYINT(1) NOT NULL DEFAULT 0' },
+      { name: 'token_version', def: 'INT NOT NULL DEFAULT 0' },
       { name: 'avatar', def: 'VARCHAR(255) DEFAULT NULL' },
       { name: 'ptero_client_api_key', def: 'VARCHAR(255) DEFAULT NULL' },
       { name: 'created_at', def: 'TIMESTAMP DEFAULT CURRENT_TIMESTAMP' },

middleware/auth.js

@@ -1,4 +1,5 @@
 import jwt from 'jsonwebtoken';
+import { query } from '../config/db.js';
 
 const JWT_SECRET = process.env.JWT_SECRET;
 
@@ -8,7 +9,7 @@ if (!JWT_SECRET) {
   console.error('JWT_SECRET contains unresolved shell expansion characters ($(), backticks). Generate a proper random key (e.g. openssl rand -hex 32) and hardcode it in .env');
 }
 
-export function authenticateToken(req, res, next) {
+export async function authenticateToken(req, res, next) {
   const authHeader = req.headers['authorization'];
   const token = authHeader && authHeader.split(' ')[1];
 
@@ -19,6 +20,18 @@ export function authenticateToken(req, res, next) {
   try {
     const decoded = jwt.verify(token, JWT_SECRET);
     req.user = decoded;
+
+    if (decoded.tokenVersion !== undefined) {
+      try {
+        const rows = await query('SELECT token_version FROM users WHERE id = ?', [decoded.userId]);
+        if (rows.length > 0 && rows[0].token_version !== decoded.tokenVersion) {
+          return res.status(403).json({ error: 'Session expired. Please log in again.' });
+        }
+      } catch {
+        return res.status(403).json({ error: 'Session validation failed.' });
+      }
+    }
+
     next();
   } catch {
     return res.status(403).json({ error: 'Invalid or expired token' });

routes/admin.js

@@ -49,7 +49,7 @@ router.post('/login', async (req, res) => {
     }
 
     const token = jwt.sign(
-      { userId: user.id, email: user.email, username: user.username, pteroId: user.ptero_user_id, isAdmin: true },
+      { userId: user.id, email: user.email, username: user.username, pteroId: user.ptero_user_id, isAdmin: true, tokenVersion: user.token_version },
       JWT_SECRET,
       { expiresIn: '2h', algorithm: 'HS256' }
     );
@@ -348,7 +348,11 @@ router.post('/users/:id/toggle-auth-restriction', authenticateToken, requireAdmi
     }
 
     const newStatus = users[0].auth_restricted ? 0 : 1;
-    await query('UPDATE users SET auth_restricted = ? WHERE id = ?', [newStatus, userId]);
+    if (newStatus) {
+      await query('UPDATE users SET auth_restricted = 1, token_version = token_version + 1 WHERE id = ?', [userId]);
+    } else {
+      await query('UPDATE users SET auth_restricted = 0 WHERE id = ?', [userId]);
+    }
 
     await logActivity(req.user.userId, 'admin_toggle_auth_restriction', `${newStatus ? 'Auth restricted' : 'Auth unrestricted'} user #${userId}`);
     res.json({ success: true, auth_restricted: !!newStatus });

routes/auth.js

@@ -214,6 +214,7 @@ router.post('/login', async (req, res) => {
       username: user.username,
       pteroId: user.ptero_user_id,
       isAdmin: !!user.is_admin,
+      tokenVersion: user.token_version,
     });
 
     res.cookie('token', token, {