feat: revoke operator sessions on logout (#268)

src/dashboard_auth.py

@@ -12,6 +12,8 @@ from dataclasses import dataclass
 
 from fastapi import Request
 
+from src.session_store import SessionStore, SessionStoreError
+
 SESSION_COOKIE = "stackchain_session"
 CSRF_COOKIE = "stackchain_csrf"
 DEFAULT_TTL_SECONDS = 8 * 60 * 60
@@ -22,6 +24,7 @@ INSECURE_LOCAL_MODE = "insecure-local"
 
 @dataclass(frozen=True)
 class Session:
+    session_id: str
     csrf: str
     expires_at: int
 
@@ -76,17 +79,31 @@ def _decode(value: str) -> bytes:
     return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))
 
 
+def _session_store(now: int | None = None) -> SessionStore:
+    database = os.getenv(
+        "STACKCHAIN_SESSION_DB",
+        os.path.join(os.getenv("STACKCHAIN_STATE_DIR", ".stackchain-state"), "sessions.sqlite3"),
+    )
+    current = time.time if now is None else lambda: now
+    return SessionStore(database, clock=current)
+
+
 def issue_session(now: int | None = None) -> tuple[str, Session]:
     issued_at = int(time.time() if now is None else now)
     ttl = int(os.getenv("STACKCHAIN_DASHBOARD_SESSION_TTL_SECONDS", str(DEFAULT_TTL_SECONDS)))
-    session = Session(csrf=secrets.token_urlsafe(24), expires_at=issued_at + max(1, ttl))
+    session = Session(
+        session_id=secrets.token_urlsafe(32),
+        csrf=secrets.token_urlsafe(24),
+        expires_at=issued_at + max(1, ttl),
+    )
     payload = json.dumps(
-        {"csrf": session.csrf, "exp": session.expires_at},
+        {"csrf": session.csrf, "exp": session.expires_at, "sid": session.session_id},
         separators=(",", ":"),
         sort_keys=True,
     ).encode()
     encoded = _encode(payload)
     signature = _encode(hmac.new(_secret(), encoded.encode(), hashlib.sha256).digest())
+    _session_store(now).activate(session.session_id, session.expires_at)
     return f"{encoded}.{signature}", session
 
 
@@ -99,13 +116,27 @@ def verify_session(value: str | None, now: int | None = None) -> Session | None:
         return None
     try:
         payload = json.loads(_decode(encoded))
-        session = Session(csrf=payload["csrf"], expires_at=int(payload["exp"]))
+        session = Session(
+            session_id=payload["sid"],
+            csrf=payload["csrf"],
+            expires_at=int(payload["exp"]),
+        )
     except (ValueError, TypeError, KeyError, json.JSONDecodeError):
         return None
     current = int(time.time() if now is None else now)
-    if session.expires_at <= current or not isinstance(session.csrf, str) or not session.csrf:
+    if (
+        session.expires_at <= current
+        or not isinstance(session.session_id, str)
+        or not session.session_id
+        or not isinstance(session.csrf, str)
+        or not session.csrf
+    ):
         return None
-    return session
+    return session if _session_store(now).is_active(session.session_id, session.expires_at) else None
+
+
+def revoke_session(session: Session) -> None:
+    _session_store().revoke(session.session_id)
 
 
 def request_session(request: Request) -> Session | None:

src/main.py

@@ -455,7 +455,14 @@ async def require_operator_session(request: Request, call_next):
         or path.startswith("/static/")
         or (path == "/api/v1/session" and request.method == "POST")
     )
-    session = dashboard_auth.request_session(request)
+    try:
+        session = dashboard_auth.request_session(request)
+    except dashboard_auth.SessionStoreError:
+        return JSONResponse(
+            {"detail": "Session registry is temporarily unavailable"},
+            status_code=503,
+            headers={"Cache-Control": "no-store"},
+        )
     if not public and session is None:
         if path.startswith("/api/"):
             return JSONResponse(
@@ -519,7 +526,14 @@ async def sign_in(payload: DashboardSignIn, request: Request, response: Response
         payload.access_token, configured_token
     ):
         raise HTTPException(status_code=401, detail="Invalid access token")
-    signed, session = dashboard_auth.issue_session()
+    try:
+        signed, session = dashboard_auth.issue_session()
+    except dashboard_auth.SessionStoreError:
+        return JSONResponse(
+            {"detail": "Session registry is temporarily unavailable"},
+            status_code=503,
+            headers={"Cache-Control": "no-store"},
+        )
     path = dashboard_auth.cookie_path(request)
     max_age = max(1, session.expires_at - int(time.time()))
     response.set_cookie(
@@ -555,6 +569,15 @@ async def session_status(request: Request):
 
 @app.delete("/api/v1/session")
 async def sign_out(request: Request, response: Response):
+    session = request.state.dashboard_session
+    try:
+        dashboard_auth.revoke_session(session)
+    except dashboard_auth.SessionStoreError:
+        return JSONResponse(
+            {"detail": "Session registry is temporarily unavailable"},
+            status_code=503,
+            headers={"Cache-Control": "no-store"},
+        )
     path = dashboard_auth.cookie_path(request)
     response.delete_cookie(
         dashboard_auth.SESSION_COOKIE,

src/session_store.py

@@ -0,0 +1,79 @@
+"""Durable active-session registry used to revoke signed operator sessions."""
+
+import hashlib
+import sqlite3
+from pathlib import Path
+from typing import Callable
+
+
+class SessionStoreError(RuntimeError):
+    """Raised when session state cannot be read or changed safely."""
+
+
+class SessionStore:
+    def __init__(
+        self,
+        path: str | Path,
+        *,
+        clock: Callable[[], float],
+        lock_timeout_seconds: float = 0.1,
+    ) -> None:
+        self.path = Path(path)
+        self.clock = clock
+        self.lock_timeout_seconds = lock_timeout_seconds
+
+    @staticmethod
+    def _digest(session_id: str) -> str:
+        return hashlib.sha256(session_id.encode()).hexdigest()
+
+    def _connect(self) -> sqlite3.Connection:
+        try:
+            self.path.parent.mkdir(parents=True, exist_ok=True)
+            connection = sqlite3.connect(self.path, timeout=self.lock_timeout_seconds)
+            connection.execute(
+                """
+                CREATE TABLE IF NOT EXISTS active_sessions (
+                    session_hash TEXT PRIMARY KEY,
+                    expires_at INTEGER NOT NULL
+                )
+                """
+            )
+            return connection
+        except (OSError, sqlite3.Error) as exc:
+            raise SessionStoreError("Session registry is temporarily unavailable") from exc
+
+    def activate(self, session_id: str, expires_at: int) -> None:
+        try:
+            with self._connect() as connection:
+                connection.execute(
+                    "DELETE FROM active_sessions WHERE expires_at <= ?", (int(self.clock()),)
+                )
+                connection.execute(
+                    "INSERT INTO active_sessions(session_hash, expires_at) VALUES (?, ?)",
+                    (self._digest(session_id), expires_at),
+                )
+        except (OSError, sqlite3.Error) as exc:
+            raise SessionStoreError("Session registry is temporarily unavailable") from exc
+
+    def is_active(self, session_id: str, expires_at: int) -> bool:
+        now = int(self.clock())
+        try:
+            with self._connect() as connection:
+                connection.execute("DELETE FROM active_sessions WHERE expires_at <= ?", (now,))
+                row = connection.execute(
+                    "SELECT expires_at FROM active_sessions WHERE session_hash = ?",
+                    (self._digest(session_id),),
+                ).fetchone()
+        except (OSError, sqlite3.Error) as exc:
+            raise SessionStoreError("Session registry is temporarily unavailable") from exc
+        return row is not None and row[0] == expires_at and expires_at > now
+
+    def revoke(self, session_id: str) -> None:
+        try:
+            with self._connect() as connection:
+                connection.execute(
+                    "DELETE FROM active_sessions WHERE session_hash = ?",
+                    (self._digest(session_id),),
+                )
+        except (OSError, sqlite3.Error) as exc:
+            raise SessionStoreError("Session registry is temporarily unavailable") from exc