Repository navigation
feat: Account Security & Active Sessions dashboard (#241) - #259
Open
Olumide-01 wants to merge 1 commit into
Open
Olumide-01 wants to merge 1 commit into
Olumide-01 wants to merge 1 commit into
Conversation
- Add /dashboard/security page listing active, revoked and expired sessions - Add GET /api/auth/sessions and POST /api/auth/sessions/[id]/revoke routes - Collapse refresh-token rotation chains into logical, wallet-scoped sessions - Show connected wallet address/network and surface suspicious-activity alerts - Require confirmation and server confirmation before UI reflects revocation - Implement loading, empty, error and responsive states - Add migration index for per-wallet session history and unit/route/UI tests Closes Lumina-eX#241
|
@Olumide-01 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the Account Security & Active Sessions dashboard requested in #241. Users can now review account activity, monitor active sessions, and revoke access from a dedicated security page.
Closes #241
What changed
Security dashboard UI —
app/dashboard/security//dashboard/securitypage (server wrapper +'use client'dashboard)AlertDialogbefore every revocation; UI only updates after the server confirmsAPI —
app/api/auth/sessions/GET /api/auth/sessions— wallet-scoped list + derived alertsPOST /api/auth/sessions/[id]/revoke— revokes a session, returns404/409/400/429/500with error codes for the UIService —
lib/auth/sessions.ts,lib/auth/session-types.tsreplaced_by_jti) into one logical session per login, so normal token rotation does not appear as revoked sessionsjti,token_hash)wallet_address(IDOR-safe) and only allowed on active chain tipsData —
lib/db/migrations/011_session_history_index.sqladds a(wallet_address, created_at DESC)index for indexed session history.Tests
pnpm test— added 26 tests covering the service (chain grouping, status derivation, alerts, revocation outcomes), the API routes (auth scoping, sensitive-field non-exposure, error codes) and the UI (render, empty/error states, confirm-then-revoke flow, failed revocation leaves the session active).Notes
reviews/deliverables/recommendationsand existingtscstrictness errors are pre-existing onmainand unrelated to this change (verified on a clean checkout).