feat: migrate session store to Redis (#79)

.env.example

@@ -82,6 +82,11 @@ NEXT_PUBLIC_DISCORD_CLIENT_ID=your_discord_client_id
 # then right-click your name → Copy User ID.
 BOT_OWNER_IDS=your_discord_user_id
 
+# ── Session Storage ──────────────────────────
+
+# Redis URL for session storage (optional — falls back to in-memory)
+# REDIS_URL=redis://localhost:6379
+
 # ── Optional Integrations ────────────────────
 
 # mem0 API key for user long-term memory (optional — memory features disabled without it)

package.json

@@ -26,6 +26,7 @@
     "discord.js": "^14.25.1",
     "dotenv": "^17.3.1",
     "express": "^5.2.1",
+    "ioredis": "^5.9.3",
     "jsonwebtoken": "^9.0.3",
     "mem0ai": "^2.2.2",
     "node-pg-migrate": "^8.0.4",

src/api/middleware/auth.js

@@ -34,7 +34,7 @@ export function isValidSecret(secret) {
  * @returns {import('express').RequestHandler} Express middleware function
  */
 export function requireAuth() {
-  return (req, res, next) => {
+  return async (req, res, next) => {
     // Try API secret first
     const apiSecret = req.headers['x-api-secret'];
     if (apiSecret) {
@@ -59,7 +59,7 @@ export function requireAuth() {
     }
 
     // Try OAuth2 JWT
-    if (handleOAuthJwt(req, res, next)) {
+    if (await handleOAuthJwt(req, res, next)) {
       return;
     }
 

src/api/middleware/oauth.js

@@ -12,7 +12,7 @@ import { handleOAuthJwt } from './oauthJwt.js';
  * @returns {import('express').RequestHandler} Express middleware function
  */
 export function requireOAuth() {
-  return (req, res, next) => {
-    return handleOAuthJwt(req, res, next, { missingTokenError: 'No token provided' });
+  return async (req, res, next) => {
+    await handleOAuthJwt(req, res, next, { missingTokenError: 'No token provided' });
   };
 }

src/api/middleware/oauthJwt.js

@@ -25,9 +25,10 @@ export function getBearerToken(authHeader) {
  * @param {import('express').Response} res - Express response
  * @param {import('express').NextFunction} next - Express next callback
  * @param {{ missingTokenError?: string }} [options] - Behavior options
- * @returns {boolean} True if middleware chain has been handled, false if no Bearer token was provided and no missing-token error was requested
+ * @returns {Promise<boolean>} True if middleware chain has been handled, false if no Bearer token
+ *   was provided and no missing-token error was requested
  */
-export function handleOAuthJwt(req, res, next, options = {}) {
+export async function handleOAuthJwt(req, res, next, options = {}) {
   const token = getBearerToken(req.headers.authorization);
   if (!token) {
     if (options.missingTokenError) {
@@ -37,7 +38,7 @@ export function handleOAuthJwt(req, res, next, options = {}) {
     return false;
   }
 
-  const result = verifyJwtToken(token);
+  const result = await verifyJwtToken(token);
   if (result.error) {
     if (result.status === 500) {
       error('SESSION_SECRET not configured — cannot verify OAuth token', {

src/api/middleware/verifyJwt.js

@@ -34,25 +34,34 @@ function getSecret() {
  * Verify a JWT token and validate the associated server-side session.
  *
  * @param {string} token - The JWT Bearer token to verify
- * @returns {{ user: Object } | { error: string, status: number }}
+ * @returns {Promise<{ user: Object } | { error: string, status: number }>}
  *   On success: `{ user }` with the decoded JWT payload.
  *   On failure: `{ error, status }` with an error message and HTTP status code.
  */
-export function verifyJwtToken(token) {
+export async function verifyJwtToken(token) {
   let secret;
   try {
     secret = getSecret();
   } catch {
     return { error: 'Session not configured', status: 500 };
   }
 
+  let decoded;
   try {
-    const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
-    if (!getSessionToken(decoded.userId)) {
-      return { error: 'Session expired or revoked', status: 401 };
-    }
-    return { user: decoded };
+    decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
   } catch {
     return { error: 'Invalid or expired token', status: 401 };
   }
+
+  let sessionToken;
+  try {
+    sessionToken = await getSessionToken(decoded.userId);
+  } catch {
+    return { error: 'Session lookup failed', status: 503 };
+  }
+
+  if (!sessionToken) {
+    return { error: 'Session expired or revoked', status: 401 };
+  }
+  return { user: decoded };
 }

src/api/routes/auth.js

@@ -229,7 +229,7 @@ router.get('/discord/callback', async (req, res) => {
     }
 
     // Store access token server-side (never in the JWT)
-    sessionStore.set(user.id, accessToken);
+    await sessionStore.set(user.id, accessToken);
 
     // Create JWT with user info only (no access token — stored server-side)
     const token = jwt.sign(
@@ -269,7 +269,14 @@ router.get('/discord/callback', async (req, res) => {
  */
 router.get('/me', requireOAuth(), async (req, res) => {
   const { userId, username, avatar } = req.user;
-  const accessToken = sessionStore.get(userId);
+
+  let accessToken;
+  try {
+    accessToken = await sessionStore.get(userId);
+  } catch (err) {
+    error('Redis error fetching session in /me', { error: err.message, userId });
+    return res.status(503).json({ error: 'Session store unavailable' });
+  }
 
   let guilds = [];
   if (accessToken) {
@@ -291,8 +298,16 @@ router.get('/me', requireOAuth(), async (req, res) => {
 /**
  * POST /logout — Invalidate the user's server-side session
  */
-router.post('/logout', requireOAuth(), (req, res) => {
-  sessionStore.delete(req.user.userId);
+router.post('/logout', requireOAuth(), async (req, res) => {
+  try {
+    await sessionStore.delete(req.user.userId);
+  } catch (err) {
+    error('Redis error deleting session on logout', {
+      error: err.message,
+      userId: req.user.userId,
+    });
+    // User's intent is to log out — succeed anyway
+  }
   res.json({ message: 'Logged out successfully' });
 });
 

src/api/routes/guilds.js

@@ -172,14 +172,23 @@ function formatBucketLabel(bucket, interval) {
  * @returns {boolean} `true` if the user has any of the specified permission flags on the guild, `false` otherwise.
  */
 async function hasOAuthGuildPermission(user, guildId, anyOfFlags) {
-  const accessToken = getSessionToken(user?.userId);
-  if (!accessToken) return false;
-  const guilds = await fetchUserGuilds(user.userId, accessToken);
-  const guild = guilds.find((g) => g.id === guildId);
-  if (!guild) return false;
-  const permissions = Number(guild.permissions);
-  if (Number.isNaN(permissions)) return false;
-  return (permissions & anyOfFlags) !== 0;
+  try {
+    const accessToken = await getSessionToken(user?.userId);
+    if (!accessToken) return false;
+    const guilds = await fetchUserGuilds(user.userId, accessToken);
+    const guild = guilds.find((g) => g.id === guildId);
+    if (!guild) return false;
+    const permissions = Number(guild.permissions);
+    if (Number.isNaN(permissions)) return false;
+    return (permissions & anyOfFlags) !== 0;
+  } catch (err) {
+    error('Redis error in hasOAuthGuildPermission', {
+      error: err.message,
+      userId: user?.userId,
+      guildId,
+    });
+    throw err;
+  }
 }
 
 /**
@@ -307,7 +316,16 @@ router.get('/', async (req, res) => {
       return res.json(ownerGuilds);
     }
 
-    const accessToken = getSessionToken(req.user?.userId);
+    let accessToken;
+    try {
+      accessToken = await getSessionToken(req.user?.userId);
+    } catch (err) {
+      error('Redis error fetching session token in GET /guilds', {
+        error: err.message,
+        userId: req.user?.userId,
+      });
+      return res.status(503).json({ error: 'Session store unavailable' });
+    }
     if (!accessToken) {
       return res.status(401).json({ error: 'Missing access token' });
     }

src/api/routes/health.js

@@ -105,8 +105,9 @@ router.get('/', async (req, res) => {
         const pool = getRestartPool();
         if (pool) {
           const rows = await getRestarts(pool, 20);
-          body.restarts = rows.map(r => ({
-            timestamp: r.timestamp instanceof Date ? r.timestamp.toISOString() : String(r.timestamp),
+          body.restarts = rows.map((r) => ({
+            timestamp:
+              r.timestamp instanceof Date ? r.timestamp.toISOString() : String(r.timestamp),
             reason: r.reason || 'unknown',
             version: r.version ?? null,
             uptimeBefore: r.uptime_seconds ?? null,