Session model

import { createJwtSessionModule } from 'kavachos/auth'; 

export const jwtSessions = createJwtSessionModule({
  secret: process.env.SESSION_SECRET!, // HS256 by default
  issuer: 'https://auth.example.com', 
  audience: 'https://app.example.com',
  accessTokenTtl: 900, // 15 minutes
  refreshTokenTtl: 604_800, // 7 days
  customClaims: (user) => ({ role: user.role, orgId: user.orgId }), 
}, kavach.db);

const result = await jwtSessions.createSession({
  id: user.id,
  email: user.email,
  name: user.name,
});

if (!result.success) {
  return Response.json({ error: result.error }, { status: 500 });
}

const { accessToken, refreshToken, expiresIn } = result.data; 
// Store refreshToken in an httpOnly cookie or secure storage
// Send accessToken to the client for use in Authorization headers

const authHeader = req.headers.get('authorization') ?? '';
const token = authHeader.replace('Bearer ', '');

const result = await jwtSessions.verifySession(token); 

if (!result.success) {
  return Response.json({ error: result.error }, { status: 401 });
}

const { userId, email, claims } = result.data; 

const result = await jwtSessions.refreshSession(refreshToken); 

if (!result.success) {
  // REFRESH_TOKEN_EXPIRED, REFRESH_TOKEN_USED, REFRESH_TOKEN_NOT_FOUND
  return Response.json({ error: result.error }, { status: 401 });
}

const { accessToken, refreshToken: newRefreshToken, expiresIn } = result.data;
// Return newRefreshToken to the client to replace the old one

import { createSessionFreshnessModule } from 'kavachos'; 

export const freshness = createSessionFreshnessModule({
  freshAge: 300, // 5 minutes
});

import { sessions } from '@/lib/kavach';
import { freshness } from '@/lib/freshness';

export async function POST(req: Request): Promise<Response> {
  const cookieHeader = req.headers.get('cookie') ?? '';
  const result = await sessions.validateSession(cookieHeader);

  if (!result.success) {
    return Response.json({ error: result.error }, { status: 401 });
  }

  const staleResponse = freshness.guard(result.data.session); 
  if (staleResponse) return staleResponse; // 403 SESSION_STALE if too old

  // Session is fresh, safe to proceed with the sensitive operation
  // ...
}

import { generateCsrfToken, validateCsrfToken, validateOrigin } from 'kavachos'; 

// On page load or sign-in response, set a CSRF cookie
const csrfToken = generateCsrfToken(); 
// Return it in a Set-Cookie header: SameSite=Strict, NOT httpOnly
// Also send it in the response body so the client can store it

// On each mutating request (POST, PUT, DELETE, PATCH)
const headerToken = req.headers.get('x-csrf-token') ?? '';
const cookieToken = parseCookies(req.headers.get('cookie') ?? '')['kavach_csrf'] ?? '';

const valid = validateCsrfToken(headerToken, cookieToken); 
if (!valid) {
  return Response.json(
    { error: { code: 'CSRF_INVALID', message: 'CSRF token mismatch' } },
    { status: 403 },
  );
}

// Also validate the Origin header to defend against subdomain takeover
const originOk = validateOrigin(req, ['https://app.example.com']); 
if (!originOk) {
  return Response.json(
    { error: { code: 'ORIGIN_MISMATCH', message: 'Request origin not allowed' } },
    { status: 403 },
  );
}

const result = await sessions.createSession(userId, {
  metadata: { 
    ipAddress: req.headers.get('x-forwarded-for') ?? 'unknown', 
    userAgent: req.headers.get('user-agent') ?? 'unknown', 
    deviceType: parseDeviceType(req.headers.get('user-agent')), 
    appVersion: req.headers.get('x-app-version'), 
  },
});

const result = await sessions.validateSession(cookieHeader);

if (result.success) {
  const { session } = result.data;
  console.log(session.metadata.deviceType, session.metadata.ipAddress);
}