Feat/session-name #6

Merged

BothimTV merged 2 commits from feat/session-name into main

2026-01-30 19:28:30 +00:00

BothimTV commented

2026-01-30 19:27:12 +00:00

(Migrated from github.com)

Summary by CodeRabbit

Release Notes

New Features
- Enhanced login flow: users now provide a display name when creating a passkey for better session identification.
- New Sessions management dashboard in the admin panel enables viewing all active sessions with details and batch deactivation capabilities.
Bug Fixes
- Extended CORS configuration to properly support DELETE requests.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

## Summary by CodeRabbit ## Release Notes * **New Features** * Enhanced login flow: users now provide a display name when creating a passkey for better session identification. * New Sessions management dashboard in the admin panel enables viewing all active sessions with details and batch deactivation capabilities. * **Bug Fixes** * Extended CORS configuration to properly support DELETE requests. ✏️ Tip: You can customize this high-level summary in your review settings.

coderabbitai[bot] commented

2026-01-30 19:27:22 +00:00

(Migrated from github.com)

📝 Walkthrough

Walkthrough

This PR adds session management functionality to the platform by introducing a "name" field to the Session database model, updating authentication flows to capture and store display names, implementing GET and DELETE API endpoints for session management, and providing a frontend UI for administrators to view and manage active sessions with token masking and batch deletion.

Changes

Cohort / File(s)	Summary
Database Schema Updates `backend/prisma/migrations/20260130123000_add_session_name/migration.sql`, `backend/prisma/schema.prisma`	Added "name" TEXT column to Session table with default value 'OLD SESSION', expanding schema to support session naming.
PasskeyLogin Utility `backend/src/util/PasskeyLogin.ts`	Restructured internal map from storing `PublicKeyCredentialRequestOptionsJSON` to storing `{ options, name }` objects; updated `set()` and `get()` method signatures to handle display names alongside credential options.
Authentication Routes `backend/src/routes/auth/POST.ts`, `backend/src/routes/auth/PATCH.ts`	Extended POST to require and validate a "name" field in request body; updated PATCH to generate session tokens via UUID, retrieve names from stored options, and insert session records with both token and name; both now pass display name to PasskeyLogin.
Session Management Routes `backend/src/routes/sessions/GET.ts`, `backend/src/routes/sessions/DELETE.ts`, `backend/src/routes/passkeys/PATCH.ts`	Added new GET endpoint to retrieve masked session tokens sorted by creation time; added new DELETE endpoint to batch-delete sessions via token matching (substring or exact); updated passkeys PATCH to use raw SQL insert for admin sessions with "Admin" name.
Backend Configuration `backend/src/index.ts`	Updated CORS configuration to include DELETE HTTP method in allowed cross-origin requests.
Frontend Login UI `frontend/src/pages/login.vue`	Added displayName input field with validation; updated POST payload to include name parameter; introduced reactive type state for success/error feedback and disabled login button until name is provided.
Frontend Session Management `frontend/src/pages/verwaltung/sessions.vue`, `frontend/src/pages/verwaltung/index.vue`	Created new sessions management page with data table displaying session tokens (masked), names, roles, and creation times; implemented Deauth Selected action for batch deletion with loading and snackbar feedback; added navigation link in Verwaltung index.
Frontend Type Definitions `frontend/src/typed-router.d.ts`	Added module declaration for vue-router/auto-resolver; expanded RouteRecordInfo type parameters across all routes; added entries for new routes `/verwaltung/mail` and `/verwaltung/sessions`; converted routes and views properties to union types in _RouteFileInfoMap.

Sequence Diagram(s)

sequenceDiagram
    participant Client as Client (Browser)
    participant AuthAPI as Auth API
    participant PasskeyMgr as PasskeyLogin
    participant Database as Database
    
    Note over Client,Database: Authentication with Session Creation
    
    Client->>AuthAPI: POST /auth with name, role, credentials
    AuthAPI->>AuthAPI: Validate name field
    AuthAPI->>PasskeyMgr: set(id, options, displayName)
    PasskeyMgr->>PasskeyMgr: Store {options, name}
    
    Client->>AuthAPI: PATCH /auth with credential verification
    AuthAPI->>PasskeyMgr: get(id) → {options, name}
    PasskeyMgr-->>AuthAPI: Return stored object with name
    AuthAPI->>AuthAPI: Verify credential against challenge
    AuthAPI->>AuthAPI: Generate sessionToken (UUID)
    AuthAPI->>Database: INSERT Session (sessionToken, name, role)
    Database-->>AuthAPI: Session created
    AuthAPI-->>Client: Return sessionToken
    
    Note over Client,Database: Session Management
    
    Client->>AuthAPI: GET /sessions with auth token
    AuthAPI->>Database: SELECT all sessions ORDER BY createdAt DESC
    Database-->>AuthAPI: Return sessions
    AuthAPI->>AuthAPI: Mask tokens (first 4 + last 4 chars)
    AuthAPI-->>Client: Return masked sessions
    
    Client->>AuthAPI: DELETE /sessions with tokens array
    AuthAPI->>Database: DELETE WHERE sessionToken in (tokens)
    Database-->>AuthAPI: Confirm deleted count
    AuthAPI-->>Client: Return {ok: true, deleted: count}

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~40 minutes

Poem

🐰 A bunny hops through sessions with glee,
Each one now has a name, don't you see!
Login with flair, pick a title with pride,
Then manage them all with the admin guide. ✨

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

<details> <summary>📝 Walkthrough</summary> ## Walkthrough This PR adds session management functionality to the platform by introducing a "name" field to the Session database model, updating authentication flows to capture and store display names, implementing GET and DELETE API endpoints for session management, and providing a frontend UI for administrators to view and manage active sessions with token masking and batch deletion. ## Changes |Cohort / File(s)|Summary| |---|---| |**Database Schema Updates** `backend/prisma/migrations/20260130123000_add_session_name/migration.sql`, `backend/prisma/schema.prisma`|Added "name" TEXT column to Session table with default value 'OLD SESSION', expanding schema to support session naming.| |**PasskeyLogin Utility** `backend/src/util/PasskeyLogin.ts`|Restructured internal map from storing `PublicKeyCredentialRequestOptionsJSON` to storing `{ options, name }` objects; updated `set()` and `get()` method signatures to handle display names alongside credential options.| |**Authentication Routes** `backend/src/routes/auth/POST.ts`, `backend/src/routes/auth/PATCH.ts`|Extended POST to require and validate a "name" field in request body; updated PATCH to generate session tokens via UUID, retrieve names from stored options, and insert session records with both token and name; both now pass display name to PasskeyLogin.| |**Session Management Routes** `backend/src/routes/sessions/GET.ts`, `backend/src/routes/sessions/DELETE.ts`, `backend/src/routes/passkeys/PATCH.ts`|Added new GET endpoint to retrieve masked session tokens sorted by creation time; added new DELETE endpoint to batch-delete sessions via token matching (substring or exact); updated passkeys PATCH to use raw SQL insert for admin sessions with "Admin" name.| |**Backend Configuration** `backend/src/index.ts`|Updated CORS configuration to include DELETE HTTP method in allowed cross-origin requests.| |**Frontend Login UI** `frontend/src/pages/login.vue`|Added displayName input field with validation; updated POST payload to include name parameter; introduced reactive type state for success/error feedback and disabled login button until name is provided.| |**Frontend Session Management** `frontend/src/pages/verwaltung/sessions.vue`, `frontend/src/pages/verwaltung/index.vue`|Created new sessions management page with data table displaying session tokens (masked), names, roles, and creation times; implemented Deauth Selected action for batch deletion with loading and snackbar feedback; added navigation link in Verwaltung index.| |**Frontend Type Definitions** `frontend/src/typed-router.d.ts`|Added module declaration for vue-router/auto-resolver; expanded RouteRecordInfo type parameters across all routes; added entries for new routes `/verwaltung/mail` and `/verwaltung/sessions`; converted routes and views properties to union types in _RouteFileInfoMap.| ## Sequence Diagram(s) ```mermaid sequenceDiagram participant Client as Client (Browser) participant AuthAPI as Auth API participant PasskeyMgr as PasskeyLogin participant Database as Database Note over Client,Database: Authentication with Session Creation Client->>AuthAPI: POST /auth with name, role, credentials AuthAPI->>AuthAPI: Validate name field AuthAPI->>PasskeyMgr: set(id, options, displayName) PasskeyMgr->>PasskeyMgr: Store {options, name} Client->>AuthAPI: PATCH /auth with credential verification AuthAPI->>PasskeyMgr: get(id) → {options, name} PasskeyMgr-->>AuthAPI: Return stored object with name AuthAPI->>AuthAPI: Verify credential against challenge AuthAPI->>AuthAPI: Generate sessionToken (UUID) AuthAPI->>Database: INSERT Session (sessionToken, name, role) Database-->>AuthAPI: Session created AuthAPI-->>Client: Return sessionToken Note over Client,Database: Session Management Client->>AuthAPI: GET /sessions with auth token AuthAPI->>Database: SELECT all sessions ORDER BY createdAt DESC Database-->>AuthAPI: Return sessions AuthAPI->>AuthAPI: Mask tokens (first 4 + last 4 chars) AuthAPI-->>Client: Return masked sessions Client->>AuthAPI: DELETE /sessions with tokens array AuthAPI->>Database: DELETE WHERE sessionToken in (tokens) Database-->>AuthAPI: Confirm deleted count AuthAPI-->>Client: Return {ok: true, deleted: count} ``` ## Estimated code review effort 🎯 3 (Moderate) | ⏱️ ~40 minutes ## Poem > 🐰 *A bunny hops through sessions with glee,* > *Each one now has a name, don't you see!* > *Login with flair, pick a title with pride,* > *Then manage them all with the admin guide.* ✨ </details>   --- > [!NOTE] > <details> > <summary>🎁 Summarized by CodeRabbit Free</summary> > > Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting <https://app.coderabbit.ai/login>. > > </details> Comment `@coderabbitai help` to get the list of available commands and usage tips.

Commenting is not possible because the repository is archived.

No reviewers