refactor(server): sessions (#8915)

* refactor: auth device => sessions

* chore: open api

server/src/services/auth.service.spec.ts

@@ -9,25 +9,25 @@ import { IKeyRepository } from 'src/interfaces/api-key.interface';
 import { ICryptoRepository } from 'src/interfaces/crypto.interface';
 import { ILibraryRepository } from 'src/interfaces/library.interface';
 import { ILoggerRepository } from 'src/interfaces/logger.interface';
+import { ISessionRepository } from 'src/interfaces/session.interface';
 import { ISharedLinkRepository } from 'src/interfaces/shared-link.interface';
 import { ISystemConfigRepository } from 'src/interfaces/system-config.interface';
-import { IUserTokenRepository } from 'src/interfaces/user-token.interface';
 import { IUserRepository } from 'src/interfaces/user.interface';
 import { AuthService } from 'src/services/auth.service';
 import { keyStub } from 'test/fixtures/api-key.stub';
 import { authStub, loginResponseStub } from 'test/fixtures/auth.stub';
+import { sessionStub } from 'test/fixtures/session.stub';
 import { sharedLinkStub } from 'test/fixtures/shared-link.stub';
 import { systemConfigStub } from 'test/fixtures/system-config.stub';
-import { userTokenStub } from 'test/fixtures/user-token.stub';
 import { userStub } from 'test/fixtures/user.stub';
 import { IAccessRepositoryMock, newAccessRepositoryMock } from 'test/repositories/access.repository.mock';
 import { newKeyRepositoryMock } from 'test/repositories/api-key.repository.mock';
 import { newCryptoRepositoryMock } from 'test/repositories/crypto.repository.mock';
 import { newLibraryRepositoryMock } from 'test/repositories/library.repository.mock';
 import { newLoggerRepositoryMock } from 'test/repositories/logger.repository.mock';
+import { newSessionRepositoryMock } from 'test/repositories/session.repository.mock';
 import { newSharedLinkRepositoryMock } from 'test/repositories/shared-link.repository.mock';
 import { newSystemConfigRepositoryMock } from 'test/repositories/system-config.repository.mock';
-import { newUserTokenRepositoryMock } from 'test/repositories/user-token.repository.mock';
 import { newUserRepositoryMock } from 'test/repositories/user.repository.mock';
 import { Mock, Mocked, vitest } from 'vitest';
 
@@ -65,7 +65,7 @@ describe('AuthService', () => {
   let libraryMock: Mocked<ILibraryRepository>;
   let loggerMock: Mocked<ILoggerRepository>;
   let configMock: Mocked<ISystemConfigRepository>;
-  let userTokenMock: Mocked<IUserTokenRepository>;
+  let sessionMock: Mocked<ISessionRepository>;
   let shareMock: Mocked<ISharedLinkRepository>;
   let keyMock: Mocked<IKeyRepository>;
 
@@ -98,7 +98,7 @@ describe('AuthService', () => {
     libraryMock = newLibraryRepositoryMock();
     loggerMock = newLoggerRepositoryMock();
     configMock = newSystemConfigRepositoryMock();
-    userTokenMock = newUserTokenRepositoryMock();
+    sessionMock = newSessionRepositoryMock();
     shareMock = newSharedLinkRepositoryMock();
     keyMock = newKeyRepositoryMock();
 
@@ -109,7 +109,7 @@ describe('AuthService', () => {
       libraryMock,
       loggerMock,
       userMock,
-      userTokenMock,
+      sessionMock,
       shareMock,
       keyMock,
     );
@@ -139,14 +139,14 @@ describe('AuthService', () => {
 
     it('should successfully log the user in', async () => {
       userMock.getByEmail.mockResolvedValue(userStub.user1);
-      userTokenMock.create.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.create.mockResolvedValue(sessionStub.valid);
       await expect(sut.login(fixtures.login, loginDetails)).resolves.toEqual(loginResponseStub.user1password);
       expect(userMock.getByEmail).toHaveBeenCalledTimes(1);
     });
 
     it('should generate the cookie headers (insecure)', async () => {
       userMock.getByEmail.mockResolvedValue(userStub.user1);
-      userTokenMock.create.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.create.mockResolvedValue(sessionStub.valid);
       await expect(
         sut.login(fixtures.login, {
           clientIp: '127.0.0.1',
@@ -231,14 +231,14 @@ describe('AuthService', () => {
     });
 
     it('should delete the access token', async () => {
-      const auth = { user: { id: '123' }, userToken: { id: 'token123' } } as AuthDto;
+      const auth = { user: { id: '123' }, session: { id: 'token123' } } as AuthDto;
 
       await expect(sut.logout(auth, AuthType.PASSWORD)).resolves.toEqual({
         successful: true,
         redirectUri: '/auth/login?autoLaunch=0',
       });
 
-      expect(userTokenMock.delete).toHaveBeenCalledWith('token123');
+      expect(sessionMock.delete).toHaveBeenCalledWith('token123');
     });
 
     it('should return the default redirect if auth type is OAUTH but oauth is not enabled', async () => {
@@ -282,11 +282,11 @@ describe('AuthService', () => {
 
     it('should validate using authorization header', async () => {
       userMock.get.mockResolvedValue(userStub.user1);
-      userTokenMock.getByToken.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.getByToken.mockResolvedValue(sessionStub.valid);
       const client = { request: { headers: { authorization: 'Bearer auth_token' } } };
       await expect(sut.validate((client as Socket).request.headers, {})).resolves.toEqual({
         user: userStub.user1,
-        userToken: userTokenStub.userToken,
+        session: sessionStub.valid,
       });
     });
   });
@@ -336,37 +336,29 @@ describe('AuthService', () => {
 
   describe('validate - user token', () => {
     it('should throw if no token is found', async () => {
-      userTokenMock.getByToken.mockResolvedValue(null);
+      sessionMock.getByToken.mockResolvedValue(null);
       const headers: IncomingHttpHeaders = { 'x-immich-user-token': 'auth_token' };
       await expect(sut.validate(headers, {})).rejects.toBeInstanceOf(UnauthorizedException);
     });
 
     it('should return an auth dto', async () => {
-      userTokenMock.getByToken.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.getByToken.mockResolvedValue(sessionStub.valid);
       const headers: IncomingHttpHeaders = { cookie: 'immich_access_token=auth_token' };
       await expect(sut.validate(headers, {})).resolves.toEqual({
         user: userStub.user1,
-        userToken: userTokenStub.userToken,
+        session: sessionStub.valid,
       });
     });
 
     it('should update when access time exceeds an hour', async () => {
-      userTokenMock.getByToken.mockResolvedValue(userTokenStub.inactiveToken);
-      userTokenMock.save.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.getByToken.mockResolvedValue(sessionStub.inactive);
+      sessionMock.update.mockResolvedValue(sessionStub.valid);
       const headers: IncomingHttpHeaders = { cookie: 'immich_access_token=auth_token' };
       await expect(sut.validate(headers, {})).resolves.toEqual({
         user: userStub.user1,
-        userToken: userTokenStub.userToken,
-      });
-      expect(userTokenMock.save.mock.calls[0][0]).toMatchObject({
-        id: 'not_active',
-        token: 'auth_token',
-        userId: 'user-id',
-        createdAt: new Date('2021-01-01'),
-        updatedAt: expect.any(Date),
-        deviceOS: 'Android',
-        deviceType: 'Mobile',
+        session: sessionStub.valid,
       });
+      expect(sessionMock.update.mock.calls[0][0]).toMatchObject({ id: 'not_active', updatedAt: expect.any(Date) });
     });
   });
 
@@ -386,55 +378,6 @@ describe('AuthService', () => {
     });
   });
 
-  describe('getDevices', () => {
-    it('should get the devices', async () => {
-      userTokenMock.getAll.mockResolvedValue([userTokenStub.userToken, userTokenStub.inactiveToken]);
-      await expect(sut.getDevices(authStub.user1)).resolves.toEqual([
-        {
-          createdAt: '2021-01-01T00:00:00.000Z',
-          current: true,
-          deviceOS: '',
-          deviceType: '',
-          id: 'token-id',
-          updatedAt: expect.any(String),
-        },
-        {
-          createdAt: '2021-01-01T00:00:00.000Z',
-          current: false,
-          deviceOS: 'Android',
-          deviceType: 'Mobile',
-          id: 'not_active',
-          updatedAt: expect.any(String),
-        },
-      ]);
-
-      expect(userTokenMock.getAll).toHaveBeenCalledWith(authStub.user1.user.id);
-    });
-  });
-
-  describe('logoutDevices', () => {
-    it('should logout all devices', async () => {
-      userTokenMock.getAll.mockResolvedValue([userTokenStub.inactiveToken, userTokenStub.userToken]);
-
-      await sut.logoutDevices(authStub.user1);
-
-      expect(userTokenMock.getAll).toHaveBeenCalledWith(authStub.user1.user.id);
-      expect(userTokenMock.delete).toHaveBeenCalledWith('not_active');
-      expect(userTokenMock.delete).not.toHaveBeenCalledWith('token-id');
-    });
-  });
-
-  describe('logoutDevice', () => {
-    it('should logout the device', async () => {
-      accessMock.authDevice.checkOwnerAccess.mockResolvedValue(new Set(['token-1']));
-
-      await sut.logoutDevice(authStub.user1, 'token-1');
-
-      expect(accessMock.authDevice.checkOwnerAccess).toHaveBeenCalledWith(authStub.user1.user.id, new Set(['token-1']));
-      expect(userTokenMock.delete).toHaveBeenCalledWith('token-1');
-    });
-  });
-
   describe('getMobileRedirect', () => {
     it('should pass along the query params', () => {
       expect(sut.getMobileRedirect('http://immich.app?code=123&state=456')).toEqual('app.immich:/?code=123&state=456');
@@ -463,7 +406,7 @@ describe('AuthService', () => {
       configMock.load.mockResolvedValue(systemConfigStub.noAutoRegister);
       userMock.getByEmail.mockResolvedValue(userStub.user1);
       userMock.update.mockResolvedValue(userStub.user1);
-      userTokenMock.create.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.create.mockResolvedValue(sessionStub.valid);
 
       await expect(sut.callback({ url: 'http://immich/auth/login?code=abc123' }, loginDetails)).resolves.toEqual(
         loginResponseStub.user1oauth,
@@ -478,7 +421,7 @@ describe('AuthService', () => {
       userMock.getByEmail.mockResolvedValue(null);
       userMock.getAdmin.mockResolvedValue(userStub.user1);
       userMock.create.mockResolvedValue(userStub.user1);
-      userTokenMock.create.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.create.mockResolvedValue(sessionStub.valid);
 
       await expect(sut.callback({ url: 'http://immich/auth/login?code=abc123' }, loginDetails)).resolves.toEqual(
         loginResponseStub.user1oauth,
@@ -491,7 +434,7 @@ describe('AuthService', () => {
     it('should use the mobile redirect override', async () => {
       configMock.load.mockResolvedValue(systemConfigStub.override);
       userMock.getByOAuthId.mockResolvedValue(userStub.user1);
-      userTokenMock.create.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.create.mockResolvedValue(sessionStub.valid);
 
       await sut.callback({ url: `app.immich:/?code=abc123` }, loginDetails);
 
@@ -501,7 +444,7 @@ describe('AuthService', () => {
     it('should use the mobile redirect override for ios urls with multiple slashes', async () => {
       configMock.load.mockResolvedValue(systemConfigStub.override);
       userMock.getByOAuthId.mockResolvedValue(userStub.user1);
-      userTokenMock.create.mockResolvedValue(userTokenStub.userToken);
+      sessionMock.create.mockResolvedValue(sessionStub.valid);
 
       await sut.callback({ url: `app.immich:///?code=abc123` }, loginDetails);
 

server/src/services/auth.service.ts

@@ -19,11 +19,10 @@ import {
   LOGIN_URL,
   MOBILE_REDIRECT,
 } from 'src/constants';
-import { AccessCore, Permission } from 'src/cores/access.core';
+import { AccessCore } from 'src/cores/access.core';
 import { SystemConfigCore } from 'src/cores/system-config.core';
 import { UserCore } from 'src/cores/user.core';
 import {
-  AuthDeviceResponseDto,
   AuthDto,
   ChangePasswordDto,
   LoginCredentialDto,
@@ -34,7 +33,6 @@ import {
   OAuthConfigDto,
   SignUpDto,
   mapLoginResponse,
-  mapUserToken,
 } from 'src/dtos/auth.dto';
 import { UserResponseDto, mapUser } from 'src/dtos/user.dto';
 import { SystemConfig } from 'src/entities/system-config.entity';
@@ -44,9 +42,9 @@ import { IKeyRepository } from 'src/interfaces/api-key.interface';
 import { ICryptoRepository } from 'src/interfaces/crypto.interface';
 import { ILibraryRepository } from 'src/interfaces/library.interface';
 import { ILoggerRepository } from 'src/interfaces/logger.interface';
+import { ISessionRepository } from 'src/interfaces/session.interface';
 import { ISharedLinkRepository } from 'src/interfaces/shared-link.interface';
 import { ISystemConfigRepository } from 'src/interfaces/system-config.interface';
-import { IUserTokenRepository } from 'src/interfaces/user-token.interface';
 import { IUserRepository } from 'src/interfaces/user.interface';
 import { HumanReadableSize } from 'src/utils/bytes';
 
@@ -85,7 +83,7 @@ export class AuthService {
     @Inject(ILibraryRepository) libraryRepository: ILibraryRepository,
     @Inject(ILoggerRepository) private logger: ILoggerRepository,
     @Inject(IUserRepository) private userRepository: IUserRepository,
-    @Inject(IUserTokenRepository) private userTokenRepository: IUserTokenRepository,
+    @Inject(ISessionRepository) private sessionRepository: ISessionRepository,
     @Inject(ISharedLinkRepository) private sharedLinkRepository: ISharedLinkRepository,
     @Inject(IKeyRepository) private keyRepository: IKeyRepository,
   ) {
@@ -120,8 +118,8 @@ export class AuthService {
   }
 
   async logout(auth: AuthDto, authType: AuthType): Promise<LogoutResponseDto> {
-    if (auth.userToken) {
-      await this.userTokenRepository.delete(auth.userToken.id);
+    if (auth.session) {
+      await this.sessionRepository.delete(auth.session.id);
     }
 
     return {
@@ -164,8 +162,9 @@ export class AuthService {
 
   async validate(headers: IncomingHttpHeaders, params: Record<string, string>): Promise<AuthDto> {
     const shareKey = (headers['x-immich-share-key'] || params.key) as string;
-    const userToken = (headers['x-immich-user-token'] ||
-      params.userToken ||
+    const session = (headers['x-immich-user-token'] ||
+      headers['x-immich-session-token'] ||
+      params.sessionKey ||
       this.getBearerToken(headers) ||
       this.getCookieToken(headers)) as string;
     const apiKey = (headers[IMMICH_API_KEY_HEADER] || params.apiKey) as string;
@@ -174,8 +173,8 @@ export class AuthService {
       return this.validateSharedLink(shareKey);
     }
 
-    if (userToken) {
-      return this.validateUserToken(userToken);
+    if (session) {
+      return this.validateSession(session);
     }
 
     if (apiKey) {
@@ -185,26 +184,6 @@ export class AuthService {
     throw new UnauthorizedException('Authentication required');
   }
 
-  async getDevices(auth: AuthDto): Promise<AuthDeviceResponseDto[]> {
-    const userTokens = await this.userTokenRepository.getAll(auth.user.id);
-    return userTokens.map((userToken) => mapUserToken(userToken, auth.userToken?.id));
-  }
-
-  async logoutDevice(auth: AuthDto, id: string): Promise<void> {
-    await this.access.requirePermission(auth, Permission.AUTH_DEVICE_DELETE, id);
-    await this.userTokenRepository.delete(id);
-  }
-
-  async logoutDevices(auth: AuthDto): Promise<void> {
-    const devices = await this.userTokenRepository.getAll(auth.user.id);
-    for (const device of devices) {
-      if (device.id === auth.userToken?.id) {
-        continue;
-      }
-      await this.userTokenRepository.delete(device.id);
-    }
-  }
-
   getMobileRedirect(url: string) {
     return `${MOBILE_REDIRECT}?${url.split('?')[1] || ''}`;
   }
@@ -408,19 +387,19 @@ export class AuthService {
     return this.cryptoRepository.compareBcrypt(inputPassword, user.password);
   }
 
-  private async validateUserToken(tokenValue: string): Promise<AuthDto> {
+  private async validateSession(tokenValue: string): Promise<AuthDto> {
     const hashedToken = this.cryptoRepository.hashSha256(tokenValue);
-    let userToken = await this.userTokenRepository.getByToken(hashedToken);
+    let session = await this.sessionRepository.getByToken(hashedToken);
 
-    if (userToken?.user) {
+    if (session?.user) {
       const now = DateTime.now();
-      const updatedAt = DateTime.fromJSDate(userToken.updatedAt);
+      const updatedAt = DateTime.fromJSDate(session.updatedAt);
       const diff = now.diff(updatedAt, ['hours']);
       if (diff.hours > 1) {
-        userToken = await this.userTokenRepository.save({ ...userToken, updatedAt: new Date() });
+        session = await this.sessionRepository.update({ id: session.id, updatedAt: new Date() });
       }
 
-      return { user: userToken.user, userToken };
+      return { user: session.user, session: session };
     }
 
     throw new UnauthorizedException('Invalid user token');
@@ -430,7 +409,7 @@ export class AuthService {
     const key = this.cryptoRepository.newPassword(32);
     const token = this.cryptoRepository.hashSha256(key);
 
-    await this.userTokenRepository.create({
+    await this.sessionRepository.create({
       token,
       user,
       deviceOS: loginDetails.deviceOS,

server/src/services/index.ts

@@ -18,6 +18,7 @@ import { PartnerService } from 'src/services/partner.service';
 import { PersonService } from 'src/services/person.service';
 import { SearchService } from 'src/services/search.service';
 import { ServerInfoService } from 'src/services/server-info.service';
+import { SessionService } from 'src/services/session.service';
 import { SharedLinkService } from 'src/services/shared-link.service';
 import { SmartInfoService } from 'src/services/smart-info.service';
 import { StorageTemplateService } from 'src/services/storage-template.service';
@@ -50,6 +51,7 @@ export const services = [
   PersonService,
   SearchService,
   ServerInfoService,
+  SessionService,
   SharedLinkService,
   SmartInfoService,
   StorageService,

server/src/services/session.service.spec.ts

@@ -0,0 +1,77 @@
+import { ILoggerRepository } from 'src/interfaces/logger.interface';
+import { ISessionRepository } from 'src/interfaces/session.interface';
+import { SessionService } from 'src/services/session.service';
+import { authStub } from 'test/fixtures/auth.stub';
+import { sessionStub } from 'test/fixtures/session.stub';
+import { IAccessRepositoryMock, newAccessRepositoryMock } from 'test/repositories/access.repository.mock';
+import { newLoggerRepositoryMock } from 'test/repositories/logger.repository.mock';
+import { newSessionRepositoryMock } from 'test/repositories/session.repository.mock';
+import { Mocked } from 'vitest';
+
+describe('SessionService', () => {
+  let sut: SessionService;
+  let accessMock: Mocked<IAccessRepositoryMock>;
+  let loggerMock: Mocked<ILoggerRepository>;
+  let sessionMock: Mocked<ISessionRepository>;
+
+  beforeEach(() => {
+    accessMock = newAccessRepositoryMock();
+    loggerMock = newLoggerRepositoryMock();
+    sessionMock = newSessionRepositoryMock();
+
+    sut = new SessionService(accessMock, loggerMock, sessionMock);
+  });
+
+  it('should be defined', () => {
+    expect(sut).toBeDefined();
+  });
+
+  describe('getAll', () => {
+    it('should get the devices', async () => {
+      sessionMock.getByUserId.mockResolvedValue([sessionStub.valid, sessionStub.inactive]);
+      await expect(sut.getAll(authStub.user1)).resolves.toEqual([
+        {
+          createdAt: '2021-01-01T00:00:00.000Z',
+          current: true,
+          deviceOS: '',
+          deviceType: '',
+          id: 'token-id',
+          updatedAt: expect.any(String),
+        },
+        {
+          createdAt: '2021-01-01T00:00:00.000Z',
+          current: false,
+          deviceOS: 'Android',
+          deviceType: 'Mobile',
+          id: 'not_active',
+          updatedAt: expect.any(String),
+        },
+      ]);
+
+      expect(sessionMock.getByUserId).toHaveBeenCalledWith(authStub.user1.user.id);
+    });
+  });
+
+  describe('logoutDevices', () => {
+    it('should logout all devices', async () => {
+      sessionMock.getByUserId.mockResolvedValue([sessionStub.inactive, sessionStub.valid]);
+
+      await sut.deleteAll(authStub.user1);
+
+      expect(sessionMock.getByUserId).toHaveBeenCalledWith(authStub.user1.user.id);
+      expect(sessionMock.delete).toHaveBeenCalledWith('not_active');
+      expect(sessionMock.delete).not.toHaveBeenCalledWith('token-id');
+    });
+  });
+
+  describe('logoutDevice', () => {
+    it('should logout the device', async () => {
+      accessMock.authDevice.checkOwnerAccess.mockResolvedValue(new Set(['token-1']));
+
+      await sut.delete(authStub.user1, 'token-1');
+
+      expect(accessMock.authDevice.checkOwnerAccess).toHaveBeenCalledWith(authStub.user1.user.id, new Set(['token-1']));
+      expect(sessionMock.delete).toHaveBeenCalledWith('token-1');
+    });
+  });
+});

server/src/services/session.service.ts

@@ -0,0 +1,41 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { AccessCore, Permission } from 'src/cores/access.core';
+import { AuthDto } from 'src/dtos/auth.dto';
+import { SessionResponseDto, mapSession } from 'src/dtos/session.dto';
+import { IAccessRepository } from 'src/interfaces/access.interface';
+import { ILoggerRepository } from 'src/interfaces/logger.interface';
+import { ISessionRepository } from 'src/interfaces/session.interface';
+
+@Injectable()
+export class SessionService {
+  private access: AccessCore;
+
+  constructor(
+    @Inject(IAccessRepository) accessRepository: IAccessRepository,
+    @Inject(ILoggerRepository) private logger: ILoggerRepository,
+    @Inject(ISessionRepository) private sessionRepository: ISessionRepository,
+  ) {
+    this.logger.setContext(SessionService.name);
+    this.access = AccessCore.create(accessRepository);
+  }
+
+  async getAll(auth: AuthDto): Promise<SessionResponseDto[]> {
+    const sessions = await this.sessionRepository.getByUserId(auth.user.id);
+    return sessions.map((session) => mapSession(session, auth.session?.id));
+  }
+
+  async delete(auth: AuthDto, id: string): Promise<void> {
+    await this.access.requirePermission(auth, Permission.AUTH_DEVICE_DELETE, id);
+    await this.sessionRepository.delete(id);
+  }
+
+  async deleteAll(auth: AuthDto): Promise<void> {
+    const sessions = await this.sessionRepository.getByUserId(auth.user.id);
+    for (const session of sessions) {
+      if (session.id === auth.session?.id) {
+        continue;
+      }
+      await this.sessionRepository.delete(session.id);
+    }
+  }
+}