diff --git a/server/auth/sessions/app.ts b/server/auth/sessions/app.ts index 18ea072b..62850453 100644 --- a/server/auth/sessions/app.ts +++ b/server/auth/sessions/app.ts @@ -11,7 +11,7 @@ import { users } from "@server/db/schema"; import db from "@server/db"; -import { eq } from "drizzle-orm"; +import { eq, inArray } from "drizzle-orm"; import config from "@server/lib/config"; import type { RandomReader } from "@oslojs/crypto/random"; import { generateRandomString } from "@oslojs/crypto/random"; @@ -95,12 +95,36 @@ export async function validateSessionToken( } export async function invalidateSession(sessionId: string): Promise { - await db.delete(resourceSessions).where(eq(resourceSessions.userSessionId, sessionId)); - await db.delete(sessions).where(eq(sessions.sessionId, sessionId)); + try { + await db.transaction(async (trx) => { + await trx + .delete(resourceSessions) + .where(eq(resourceSessions.userSessionId, sessionId)); + await trx.delete(sessions).where(eq(sessions.sessionId, sessionId)); + }); + } catch (e) { + logger.error("Failed to invalidate session", e); + } } export async function invalidateAllSessions(userId: string): Promise { - await db.delete(sessions).where(eq(sessions.userId, userId)); + try { + await db.transaction(async (trx) => { + const userSessions = await trx + .select() + .from(sessions) + .where(eq(sessions.userId, userId)); + await trx.delete(resourceSessions).where( + inArray( + resourceSessions.userSessionId, + userSessions.map((s) => s.sessionId) + ) + ); + await trx.delete(sessions).where(eq(sessions.userId, userId)); + }); + } catch (e) { + logger.error("Failed to all invalidate user sessions", e); + } } export function serializeSessionCookie( diff --git a/server/routers/auth/resetPassword.ts b/server/routers/auth/resetPassword.ts index 97b283c6..ac1b6600 100644 --- a/server/routers/auth/resetPassword.ts +++ b/server/routers/auth/resetPassword.ts @@ -149,8 +149,6 @@ export async function resetPassword( const passwordHash = await hashPassword(newPassword); - await invalidateAllSessions(resetRequest[0].userId); - await db.transaction(async (trx) => { await trx .update(users) @@ -162,11 +160,21 @@ export async function resetPassword( .where(eq(passwordResetTokens.email, email)); }); - await sendEmail(ConfirmPasswordReset({ email }), { - from: config.getNoReplyEmail(), - to: email, - subject: "Password Reset Confirmation" - }); + try { + await invalidateAllSessions(resetRequest[0].userId); + } catch (e) { + logger.error("Failed to invalidate user sessions", e); + } + + try { + await sendEmail(ConfirmPasswordReset({ email }), { + from: config.getNoReplyEmail(), + to: email, + subject: "Password Reset Confirmation" + }); + } catch (e) { + logger.error("Failed to send password reset confirmation email", e); + } return response(res, { data: null,