port: feat: add session management page (list active sessions + revoke) (upstream #4841)#164
Merged
Conversation
Add a Settings > Sessions page listing the current user's active and expired login sessions with IP address, device, and timestamps, plus a revoke (force logout) action for any session other than the current one. Backend (apps/dokploy/server/api/routers/user.ts): - listSessions: returns the caller's own sessions joined with user data, ordered by creation date (metadata only; the session token is never selected or returned) - revokeSession: deletes a session by id after verifying the caller owns it, and blocks self-revocation of the current session Ported from upstream Dokploy#4841. Adapted for the fork: upstream exposed these as admin endpoints over ALL users' sessions; here both are protectedProcedures strictly scoped to the caller's own sessions, and a session owned by another user is reported as NOT_FOUND so the endpoint never confirms its existence. isCurrent is computed in JS to keep the tRPC return type a plain boolean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports upstream Dokploy/dokploy#4841 by @daniloneto into the fork.
Summary
Adds a Settings → Sessions page listing the signed-in user's active and expired login sessions with IP address, device (parsed from user-agent), and timestamps, plus a revoke (force logout) action for every session except the current one. Navigation entry lives under Users (gated by
member.read, matching upstream's placement).Security adaptation (fork divergence)
The task's security requirement is that these endpoints only ever touch the current user's own sessions. Upstream exposes them as admin endpoints over all users' sessions, so they were adapted:
listSessionsadminProcedure, all users' sessionsprotectedProcedure,where userId = ctx.user.idonlyrevokeSessionadminProcedure, any session (self blocked)protectedProcedure, deletes only aftertargetSession.userId === ctx.user.id; self-revocation blockedNOT_FOUND(never confirms another user's session exists)isCurrentis computed in JS (s.id === ctx.session.id) rather than as a SQLeq(...)expression, so the tRPC return type stays a plainboolean(drizzle typed the SQL expression asunknown). Works with the fork's better-auth 1.6.23 + 30-day sessions — the page reads realsessionrows and revocation deletes the row.The frontend component, page, sidebar entry, and validation test are applied verbatim from upstream.
Verification
pnpm --filter=dokploy typecheck— clean.pnpm exec vitest __test__/api/session-management.test.ts --run— 3 passed.Credit: @daniloneto (upstream Dokploy#4841).