feat: implement logout functionality and enhance session management

Author: Lasim

cookies.txt

@@ -0,0 +1,4 @@
+# Netscape HTTP Cookie File
+# https://curl.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+

services/backend/src/db/index.ts

@@ -364,6 +364,23 @@ export function getDbStatus() {
     };
 }
 
+// Function to force schema regeneration (useful for development)
+export function regenerateSchema(): void {
+  if (currentDbConfig) {
+    console.log('[INFO] Forcing schema regeneration...');
+    dbSchema = generateSchema(currentDbConfig.type);
+    
+    // Recreate the database instance with new schema
+    if (dbConnection && currentDbConfig.type === 'sqlite') {
+      dbInstance = drizzleSqliteAdapter(dbConnection as SqliteDriver.Database, { schema: dbSchema, logger: false });
+    } else if (dbConnection && currentDbConfig.type === 'postgres') {
+      dbInstance = drizzlePgAdapter(dbConnection as PgPool, { schema: dbSchema, logger: false });
+    }
+    
+    console.log('[INFO] Schema regenerated successfully.');
+  }
+}
+
 // Define a more specific type for DatabaseExtension if possible, or use 'any' for now.
 interface DatabaseExtensionWithTables extends DatabaseExtension {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any

services/backend/src/db/schema.sqlite.ts

@@ -37,15 +37,15 @@ export const authUser = sqliteTable('authUser', {
 export const authSession = sqliteTable('authSession', {
   id: text('id').primaryKey(),
   user_id: text('user_id').notNull().references(() => authUser.id, { onDelete: 'cascade' }),
-  expires_at: integer('expires_at', { mode: 'number' }).notNull(),
+  expires_at: integer('expires_at').notNull(),
 });
 
 export const authKey = sqliteTable('authKey', {
   id: text('id').primaryKey(),
   user_id: text('user_id').notNull().references(() => authUser.id, { onDelete: 'cascade' }),
   primary_key: text('primary_key').notNull(),
   hashed_password: text('hashed_password'),
-  expires: integer('expires', { mode: 'number' }),
+  expires: integer('expires'),
 });
 
 export const teams = sqliteTable('teams', {

services/backend/src/db/schema.ts

@@ -49,15 +49,15 @@ export const authUserTableColumns = {
 export const authSessionTableColumns = {
   id: (columnBuilder: any) => columnBuilder('id').primaryKey(),
   user_id: (columnBuilder: any) => columnBuilder('user_id').notNull(), // Foreign key to authUser.id
-  expires_at: (columnBuilder: any) => columnBuilder('expires_at', { mode: 'number' }).notNull(), // Lucia v3 uses expires_at
+  expires_at: (columnBuilder: any) => columnBuilder('expires_at').notNull(), // Lucia v3 uses expires_at as integer timestamp
 };
 
 export const authKeyTableColumns = {
   id: (columnBuilder: any) => columnBuilder('id').primaryKey(), // e.g., 'email:user@example.com' or 'github:123456'
   user_id: (columnBuilder: any) => columnBuilder('user_id').notNull(), // Foreign key to authUser.id
   primary_key: (columnBuilder: any) => columnBuilder('primary_key').notNull(),
   hashed_password: (columnBuilder: any) => columnBuilder('hashed_password'), // Nullable for OAuth keys
-  expires: (columnBuilder: any) => columnBuilder('expires', { mode: 'number' }), // Nullable, for things like password reset
+  expires: (columnBuilder: any) => columnBuilder('expires'), // Nullable, for things like password reset
 };
 
 export const teamsTableColumns = {

services/backend/src/fastify/plugins/index.ts

@@ -5,7 +5,8 @@ import fastifyCors from '@fastify/cors'
 export const registerFastifyPlugins = async (server: FastifyInstance): Promise<void> => {
   // Build allowed origins array
   const defaultOrigins = [
-    'http://localhost:5174', // Vite dev server (actual dev port)
+    'http://localhost:5173', // Vite dev server (correct dev port)
+    'http://localhost:5174', // Alternative Vite dev server port
     'http://localhost:3000', // Frontend production (if served from same port)
     'http://localhost:4173', // Vite preview
   ];

services/backend/src/hooks/authHook.ts

@@ -1,6 +1,6 @@
 import type { FastifyRequest, FastifyReply, HookHandlerDoneFunction } from 'fastify';
 import { getLucia } from '../lib/lucia';
-import { getDbStatus } from '../db';
+import { getDbStatus, getSchema } from '../db';
 import type { User, Session } from 'lucia';
 
 // Augment FastifyRequest to include user and session
@@ -28,23 +28,30 @@ export async function authHook(
   try {
     const lucia = getLucia();
     const sessionId = lucia.readSessionCookie(request.headers.cookie ?? '');
+    
     if (!sessionId) {
+      request.log.debug('Auth hook: No session cookie found');
       request.user = null;
       request.session = null;
       return; // Proceed as unauthenticated
     }
 
+    request.log.debug(`Auth hook: Found session ID: ${sessionId}`);
     const { session, user } = await lucia.validateSession(sessionId);
 
     if (session && session.fresh) {
       // Session was refreshed, send new cookie
+      request.log.debug(`Auth hook: Session ${sessionId} is fresh, sending new cookie`);
       const sessionCookie = lucia.createSessionCookie(session.id);
       reply.setCookie(sessionCookie.name, sessionCookie.value, sessionCookie.attributes);
     }
     if (!session) {
       // Invalid session, clear cookie
+      request.log.debug(`Auth hook: Session ${sessionId} is invalid, clearing cookie`);
       const sessionCookie = lucia.createBlankSessionCookie();
       reply.setCookie(sessionCookie.name, sessionCookie.value, sessionCookie.attributes);
+    } else {
+      request.log.debug(`Auth hook: Session ${sessionId} is valid for user ${user?.id}`);
     }
 
     request.user = user;

services/backend/src/lib/lucia.ts

@@ -2,7 +2,7 @@ import { Lucia } from 'lucia';
 import { DrizzlePostgreSQLAdapter, DrizzleSQLiteAdapter } from '@lucia-auth/adapter-drizzle';
 import { GitHub } from 'arctic';
 
-import { getDb, getSchema, getDbStatus } from '../db'; // Assuming db/index.ts exports these
+import { getDb, getSchema, getDbStatus, regenerateSchema } from '../db'; // Assuming db/index.ts exports these
 import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import type { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
 
@@ -25,6 +25,14 @@ function initializeLucia(): Lucia {
     throw new Error('Database dialect not determined. Ensure database is initialized before using Lucia.');
   }
 
+  // Force schema regeneration to pick up any schema fixes
+  try {
+    regenerateSchema();
+    console.log('[INFO] Schema regenerated for Lucia initialization');
+  } catch (error) {
+    console.log('[INFO] Schema regeneration skipped - using existing schema');
+  }
+
   const db = getDb();
   const schema = getSchema();
 
@@ -43,6 +51,9 @@ function initializeLucia(): Lucia {
       authUserTable
     );
   } else if (dialect === 'sqlite') {
+    // For SQLite, ensure we're using the correct table structure
+    // Lucia expects: session table with id, user_id, expires_at
+    // and user table with id
     adapter = new DrizzleSQLiteAdapter(
       db as BetterSQLite3Database, // Cast based on dialect
       authSessionTable,
@@ -57,10 +68,13 @@ function initializeLucia(): Lucia {
       name: 'session', // Important to use a generic name for production
       expires: false, // session cookies have very long lifespan (2 years)
       attributes: {
-        // set to `true` when using HTTPS
+        // For development: use secure: false with sameSite: 'lax' and domain: 'localhost'
+        // For production: use secure: true with sameSite: 'none' for cross-origin
         secure: process.env.NODE_ENV === 'production',
-        sameSite: 'lax',
-        // domain: 'yourdomain.com' // set if using a custom domain
+        sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
+        path: '/', // Explicitly set path to root
+        // Set domain to localhost in development to allow cross-port communication
+        domain: process.env.NODE_ENV === 'production' ? undefined : 'localhost',
       },
     },
     getUserAttributes: (attributes: DatabaseUserAttributes) => {
@@ -105,6 +119,11 @@ export function resetLucia(): void {
   luciaInstance = null;
 }
 
+// Force reset on module reload in development
+if (process.env.NODE_ENV !== 'production') {
+  resetLucia();
+}
+
 // Getter function for GitHub OAuth instance
 export function getGithubAuth(): GitHub {
   if (!githubAuthInstance) {

services/backend/src/routes/auth/loginEmail.ts

@@ -12,6 +12,11 @@ export default async function loginEmailRoute(fastify: FastifyInstance) {
     async (request, reply: FastifyReply) => {
       const { login, password } = request.body;
 
+      // Validate required fields
+      if (!login || !password) {
+        return reply.status(400).send({ error: 'Email/username and password are required.' });
+      }
+
       try {
         const db = getDb();
         const schema = getSchema();

services/backend/src/routes/auth/logout.ts

@@ -1,39 +1,84 @@
 import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
 import { getLucia } from '../../lib/lucia';
+import { getDb, getSchema } from '../../db';
+import { eq } from 'drizzle-orm';
 
 export default async function logoutRoute(fastify: FastifyInstance) {
   fastify.post(
     '/logout',
     async (request: FastifyRequest, reply: FastifyReply) => {
-      const sessionId = getLucia().readSessionCookie(request.headers.cookie ?? '');
+      // The global authHook should have already populated request.session if a valid session exists.
+      // It also handles creating a blank session cookie if the session was invalid.
+      const lucia = getLucia();
 
-      if (!sessionId) {
-        // No session cookie, so user is effectively logged out or was never logged in.
-        // It's good practice to still clear any potential lingering cookie on the client.
-        const sessionCookie = getLucia().createBlankSessionCookie();
-        reply.setCookie(sessionCookie.name, sessionCookie.value, sessionCookie.attributes);
+      // Log session information for debugging
+      fastify.log.info(`Logout attempt - Session exists: ${!!request.session}, Session ID: ${request.session?.id || 'none'}`);
+
+      if (!request.session) {
+        // No active session found by authHook, but let's check if there's a session cookie
+        // and manually clean it up if Lucia validation failed
+        const sessionId = lucia.readSessionCookie(request.headers.cookie ?? '');
+        
+        if (sessionId) {
+          fastify.log.info(`Found session cookie ${sessionId} but authHook couldn't validate it - attempting manual cleanup`);
+          
+          try {
+            // Try to manually delete the session from database
+            const db = getDb();
+            const schema = getSchema();
+            const authSessionTable = schema.authSession;
+            
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const result = await (db as any).delete(authSessionTable).where(eq(authSessionTable.id, sessionId));
+            fastify.log.info(`Manually deleted session ${sessionId} from database`);
+          } catch (dbError) {
+            fastify.log.error(dbError, 'Failed to manually delete session from database');
+          }
+        }
+        
+        // Send a blank cookie to ensure client-side cookie is cleared
+        const blankCookie = lucia.createBlankSessionCookie();
+        reply.setCookie(blankCookie.name, blankCookie.value, blankCookie.attributes);
+        fastify.log.info('No active session to logout - sending blank cookie');
         return reply.status(200).send({ message: 'No active session to logout or already logged out.' });
       }
 
       try {
-        const { session } = await getLucia().validateSession(sessionId);
-
-        if (session) {
-          await getLucia().invalidateSession(session.id);
-        }
+        const sessionId = request.session.id;
+        fastify.log.info(`Attempting to invalidate session: ${sessionId}`);
+        
+        // Invalidate the session identified by authHook.
+        await lucia.invalidateSession(sessionId);
+        fastify.log.info(`Session ${sessionId} invalidated successfully`);
 
-        // Always send a blank cookie to ensure client-side cookie is cleared
-        const sessionCookie = getLucia().createBlankSessionCookie();
-        reply.setCookie(sessionCookie.name, sessionCookie.value, sessionCookie.attributes);
+        // Send a blank cookie to ensure client-side cookie is cleared.
+        const blankCookie = lucia.createBlankSessionCookie();
+        reply.setCookie(blankCookie.name, blankCookie.value, blankCookie.attributes);
+        fastify.log.info('Blank cookie sent to clear client session');
 
         return reply.status(200).send({ message: 'Logged out successfully.' });
 
       } catch (error) {
-        fastify.log.error(error, 'Error during logout:');
-        // Even if there's an error (e.g., session already invalid), try to clear the cookie.
-        const sessionCookie = getLucia().createBlankSessionCookie();
-        reply.setCookie(sessionCookie.name, sessionCookie.value, sessionCookie.attributes);
-        return reply.status(500).send({ error: 'An error occurred during logout.' });
+        fastify.log.error(error, 'Error during logout (invalidating session from authHook):');
+        
+        // If Lucia invalidation failed, try manual database cleanup
+        const sessionId = request.session.id;
+        try {
+          const db = getDb();
+          const schema = getSchema();
+          const authSessionTable = schema.authSession;
+          
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          await (db as any).delete(authSessionTable).where(eq(authSessionTable.id, sessionId));
+          fastify.log.info(`Manually deleted session ${sessionId} after Lucia invalidation failed`);
+        } catch (dbError) {
+          fastify.log.error(dbError, 'Failed to manually delete session after Lucia error');
+        }
+        
+        // Even if there's an error, try to clear the cookie.
+        const blankCookie = lucia.createBlankSessionCookie();
+        reply.setCookie(blankCookie.name, blankCookie.value, blankCookie.attributes);
+        return reply.status(200).send({ message: 'Logged out successfully (with fallback cleanup).' });
       }
     }
   );

services/frontend/src/i18n/index.ts

@@ -1,13 +1,14 @@
 import { createI18n } from 'vue-i18n'
-import en from './locales/en'
+// Import the merged English messages from the new structure
+import enMessages from './locales/en' // This will now import from locales/en/index.ts
 
 // Create i18n instance with English as the default language
 const i18n = createI18n({
   legacy: false,
   locale: 'en',
   fallbackLocale: 'en',
   messages: {
-    en,
+    en: enMessages, // Use the merged messages directly
   },
 })