الـ Sessions في Redis: تسجيل دخول تقدر تلغيه في أي وقت

import express from "express";
import cookieParser from "cookie-parser";
import { redis, createSession, readSession, destroySession, ttlOf } from "./sessions.js";

await redis.flushall();
const app = express();
app.use(express.json());
app.use(cookieParser());

const COOKIE = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };

app.use(async (req, res, next) => {
  req.session = await readSession(req.cookies.sid);
  next();
});

app.post("/login", async (req, res) => {
  // (التحقق من الـ password ليه درس)
  const sid = await createSession({ userId: 7, name: req.body.name });
  res.cookie("sid", sid, COOKIE);
  res.json({ ok: true, sidLength: sid.length });
});

app.get("/me", async (req, res) => {
  if (!req.session) return res.status(401).json({ error: "سجّل دخول" });
  res.json({ ...req.session, ttl: await ttlOf(req.cookies.sid) });
});

app.post("/logout", async (req, res) => {
  await destroySession(req.cookies.sid);
  res.clearCookie("sid", COOKIE);
  res.json({ ok: true });
});

app.get("/debug/keys", async (req, res) => res.json((await redis.scan("0", "MATCH", "sess:*"))[1]));

app.listen(3000, () => console.log("http://localhost:3000"));

$ node server.js
http://localhost:3000

→ POST /login
  {"name":"mona"}
← 200 OK
  connection: keep-alive
  content-length: 26
  content-type: application/json; charset=utf-8
  etag: W/"1a-tvlo22zO3b2+XXqmkOuad20FyYM"
  keep-alive: timeout=5
  set-cookie: sid=ogBgmC3o0AEryJtcwGEwHATTwPsydLrxtzIJX2OhmEQ; Path=/; HttpOnly; Secure; SameSite=Lax
  x-powered-by: Express
{
  "ok": true,
  "sidLength": 43
}

→ GET /debug/keys
← 200 OK
[
  "sess:14b1f5d9002f89ee7763157306b10065f961ae393fa62afd04ba7cd17de26290"
]

import { spawn } from "node:child_process";
const server = spawn("node", ["server.js"], { stdio: "ignore", env: process.env });
await new Promise((r) => setTimeout(r, 800));
const base = "http://localhost:3000";
const login = await fetch(`${base}/login`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: "mona" }) });
const cookie = login.headers.get("set-cookie").split(";")[0];
const me = async () => {
  const r = await fetch(`${base}/me`, { headers: { cookie } });
  return `${r.status} ${JSON.stringify(await r.json())}`;
};
console.log("me:", await me());
await fetch(`${base}/logout`, { method: "POST", headers: { cookie } });
console.log("بعد logout:", await me());
server.kill();

$ node client.js
me: 200 {"userId":7,"name":"mona","createdAt":1792245373648,"ttl":1800}
بعد logout: 401 {"error":"سجّل دخول"}

import crypto from "node:crypto";
import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL);
await redis.flushall();
const keyOf = (sid) => "sess:" + crypto.createHash("sha256").update(sid).digest("hex");
const MAX_DEVICES = 3;


async function login(userId, device) {
  const sid = crypto.randomBytes(32).toString("base64url");
  const h = keyOf(sid);
  const set = `user:${userId}:sessions`;
  await redis
    .multi()
    .set(h, JSON.stringify({ userId, device }), "EX", 1800)
    .zadd(set, Date.now(), h)
    .exec();
  if ((await redis.zcard(set)) > MAX_DEVICES) {
    const [oldest] = await redis.zpopmin(set);
    await redis.del(oldest);
  }
  await new Promise((r) => setTimeout(r, 5)); // كل login بوقت مختلف
  return sid;
}

async function devices(userId) {
  const set = `user:${userId}:sessions`;
  const hashes = await redis.zrange(set, 0, -1);
  if (!hashes.length) return [];
  const raws = await redis.mget(hashes);
  const dead = hashes.filter((_, i) => raws[i] === null);
  if (dead.length) await redis.zrem(set, ...dead);
  return raws.filter(Boolean).map((r) => JSON.parse(r).device);
}

async function logoutOthers(userId, currentSid) {
  const set = `user:${userId}:sessions`;
  const keep = keyOf(currentSid);
  const others = (await redis.zrange(set, 0, -1)).filter((h) => h !== keep);
  if (others.length) await redis.multi().del(...others).zrem(set, ...others).exec();
}

const sids = {};
for (const d of ["phone", "laptop", "tablet", "tv"]) sids[d] = await login(7, d);
console.log(await devices(7));
await logoutOthers(7, sids.laptop);
console.log(await devices(7));
redis.disconnect();

$ node main.js
[ 'laptop', 'tablet', 'tv' ]
[ 'laptop' ]