mono
63e0457886
Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.
21 lines
735 B
TypeScript
21 lines
735 B
TypeScript
// Kept transport-independent so all late session completions use the same rule.
|
|
export type SessionIdentity = {
|
|
accessToken: string
|
|
user: { id: number }
|
|
}
|
|
|
|
export function isSameSession(expected: SessionIdentity | null, current: SessionIdentity | null) {
|
|
return Boolean(expected && current && expected.accessToken === current.accessToken && expected.user.id === current.user.id)
|
|
}
|
|
|
|
export function createSessionRequestGuard(readCurrent: () => SessionIdentity | null) {
|
|
let generation = 0
|
|
return {
|
|
invalidate() { generation += 1 },
|
|
begin(session: SessionIdentity) {
|
|
const requestGeneration = ++generation
|
|
return () => generation === requestGeneration && isSameSession(session, readCurrent())
|
|
},
|
|
}
|
|
}
|