groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-07-26 19:21:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

User password changes invalidate sessions

Browse source
This commit is contained in:
advplyr 2026-07-23 17:21:25 -05:00
parent a6cde926ee
commit c900676be7
5 changed files with 112 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

16
server/auth/TokenManager.js
View file

@ -464,14 +464,19 @@ class TokenManager {
* @param {import('../models/User')} user
* @param {import('express').Request} req
* @param {import('express').Response} res
* @returns {Promise<string>} accessToken only if user is current user and refresh token is valid
* @returns {Promise<{ accessToken:string, refreshToken:string }|null>} new tokens for the current session if kept alive
*/
async invalidateJwtSessionsForUser(user, req, res) {
const currentRefreshToken = req.cookies.refresh_token
const currentRefreshToken = req.cookies.refresh_token || req.headers['x-refresh-token']
if (req.user.id === user.id && currentRefreshToken) {
// Current user is the same as the user to invalidate sessions for
// So rotate token for current session
const currentSession = await Database.sessionModel.findOne({ where: { refreshToken: currentRefreshToken } })
const currentSession = await Database.sessionModel.findOne({
where: {
userId: user.id,
[Op.or]: [{ refreshToken: currentRefreshToken }, { lastRefreshToken: currentRefreshToken }]
}
})
if (currentSession) {
const newTokens = await this.rotateTokensForSession(currentSession, user, req, res, false)
@ -485,7 +490,10 @@ class TokenManager {
}
})
return newTokens.accessToken
return {
accessToken: newTokens.accessToken,
refreshToken: newTokens.refreshToken
}
} else {
Logger.error(`[TokenManager] No session found to rotate tokens`)
}