Update package-lock.json

[TheOneWhoBurns]

Summary by CodeRabbit

• Refactor
  • Authentication system refactored from cookie-based signing to token-based session management for improved security and robustness.
  • Session handling now uses centralized tracking with independent session cleanup capabilities.

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

Replaces HMAC-based cookie signing with a token-backed operator session system. Introduces an operator_sessions database table, converts getVerifiedOperatorId to asynchronous token lookup, and updates all affected routes to create, verify, and delete sessions through the new token-based flow.

Changes

Cohort / File(s)	Summary
Core Auth & Schema src/lib/server/auth.ts, src/lib/server/db/schema.ts	Replaces signCookieValue/verifyCookieValue with createOperatorSession/deleteOperatorSessions. Adds operator_sessions table with token, operatorId, and createdAt fields. Makes getVerifiedOperatorId asynchronous and token-based via cookie lookup and database verification.
Route Handlers: Session Creation & Auth src/routes/api/shifts/start/+server.ts, src/routes/api/shifts/logout/+server.ts	Updates session creation to use createOperatorSession with new operatorSession cookie. Logout now conditionally invokes deleteOperatorSessions when operatorId exists before deleting cookie.
Route Handlers: Verification & Cleanup src/routes/api/shifts/close/+server.ts, src/routes/api/shifts/end/+server.ts, src/routes/api/store-sales/+server.ts	Awaits async getVerifiedOperatorId calls. Replaces operatorId cookie deletion with operatorSession cookie. Close endpoint additionally invokes deleteOperatorSessions after exports.
Route Handlers: Layout & Home src/routes/+layout.server.ts, src/routes/+page.server.ts	Awaits async getVerifiedOperatorId call and updates cookie key from operatorId to operatorSession where sessions are cleared.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant Server as Server (start/+server.ts)
    participant Auth as Auth Module
    participant DB as operator_sessions Table

    Client->>Server: POST /api/shifts/start
    Server->>Auth: createOperatorSession(operatorId)
    Auth->>DB: INSERT token with operatorId
    DB-->>Auth: Return session token
    Auth-->>Server: Session token
    Server->>Client: Set operatorSession cookie with token

    Client->>Server: Subsequent request with operatorSession cookie
    Server->>Auth: getVerifiedOperatorId(cookies)
    Auth->>DB: SELECT operatorId WHERE token = cookie
    DB-->>Auth: operatorId or null
    Auth-->>Server: Verified operatorId or null
    alt Session valid
        Server->>Server: Process request
    else Session invalid
        Server->>Client: Delete operatorSession cookie
    end

Loading

sequenceDiagram
    participant Client
    participant Server as Server (logout endpoint)
    participant Auth as Auth Module
    participant DB as operator_sessions Table

    Client->>Server: POST /api/shifts/logout
    Server->>Auth: getVerifiedOperatorId(cookies)
    Auth->>DB: SELECT operatorId WHERE token = cookie
    DB-->>Auth: operatorId or null
    alt operatorId exists
        Auth-->>Server: Return operatorId
        Server->>Auth: deleteOperatorSessions(operatorId)
        Auth->>DB: DELETE all sessions WHERE operatorId
        DB-->>Auth: Sessions deleted
    else operatorId null
        Auth-->>Server: Return null
    end
    Server->>Client: Delete operatorSession cookie
    Server->>Client: Return success

Loading

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly Related PRs

• Move rate limiting to PostgreSQL, HMAC-sign operator cookie #37: Both PRs modify the operator authentication flow in src/lib/server/auth.ts—one introduces HMAC-signed cookies while this PR replaces that approach with token-based sessions backed by the database.

Poem

🐰 Hops of delight through session tokens bright,
No more cookie secrets hidden from sight,
A table of sessions, async and true,
The rabbit declares: "Auth flows are new!" 🎉

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch claude/fix-login-session-issue-gs3nR

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}