GRO-653: Implement portal session middleware and server-side audit logging #283

Closed

the-dogfather-cto[bot] wants to merge 1 commits from feature/gro-632-impersonation-session-hardening into main

Author	SHA1	Message	Date
Flea Flicker	1745265fe3	GRO-653: Implement portal session middleware and server-side audit logging - Add validatePortalSession middleware (apps/api/src/middleware/portalSession.ts) - Reads X-Impersonation-Session-Id header - Queries impersonationSessions for active session with status='active' - Validates expiresAt > new Date() (strict >, consistent everywhere) - Sets portalClientId and portalSessionId on Hono context - Returns 401 Unauthorized for missing/invalid/expired sessions - Add portalAuditMiddleware (apps/api/src/middleware/portalAudit.ts) - Runs after validatePortalSession via middleware chain - Inserts impersonationAuditLogs entry on all portal requests - action: 'METHOD /path', pageVisited: c.req.path, metadata: { method, statusCode } - Swallows errors (logs to console, does not break user request) - Apply middleware to all portal routes in portal.ts - Replace all 11 getClientIdFromSession() calls with c.get('portalClientId') - Replace 3 inline session queries in waitlist routes (POST/PATCH/DELETE) - Remove getClientIdFromSession() helper (no longer needed) - Remove unused 'and' import - Add portalSession.test.ts with tests for validatePortalSession and portalAuditMiddleware Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-14 16:34:33 +00:00

Author

SHA1

Message

Date

Flea Flicker

1745265fe3

GRO-653: Implement portal session middleware and server-side audit logging

- Add validatePortalSession middleware (apps/api/src/middleware/portalSession.ts)
  - Reads X-Impersonation-Session-Id header
  - Queries impersonationSessions for active session with status='active'
  - Validates expiresAt > new Date() (strict >, consistent everywhere)
  - Sets portalClientId and portalSessionId on Hono context
  - Returns 401 Unauthorized for missing/invalid/expired sessions
- Add portalAuditMiddleware (apps/api/src/middleware/portalAudit.ts)
  - Runs after validatePortalSession via middleware chain
  - Inserts impersonationAuditLogs entry on all portal requests
  - action: 'METHOD /path', pageVisited: c.req.path, metadata: { method, statusCode }
  - Swallows errors (logs to console, does not break user request)
- Apply middleware to all portal routes in portal.ts
  - Replace all 11 getClientIdFromSession() calls with c.get('portalClientId')
  - Replace 3 inline session queries in waitlist routes (POST/PATCH/DELETE)
  - Remove getClientIdFromSession() helper (no longer needed)
  - Remove unused 'and' import
- Add portalSession.test.ts with tests for validatePortalSession and portalAuditMiddleware

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-04-14 16:34:33 +00:00

GRO-653: Implement portal session middleware and server-side audit logging #283

1 Commits