fix(security): enforce strict revocable sessions on every JWT transport

[seonghobae]

Summary

Restack the session-revocation security boundary directly on the exact attachment-security head from #432. This clean five-file change replaces the diverged #414 branch without reintroducing historical attachment code.

• Centralize bearer, calendar, server-sent-event, and attachment-view session JWT validation in one database-backed verifier.
• Authenticate the compact HS256 signature before interpreting JOSE header or claim data.
• Require a signed HS256/JWT header, object claims, positive safe-integer subject, future safe-integer expiry, and non-negative safe-integer token_version.
• Require the subject to exist and the signed token version to equal the current database value, so logout-all revocation applies uniformly to every transport.
• Make minting fail closed for malformed subjects, token versions, fractional or unsafe lifetimes, and general-session lifetimes longer than seven days.
• Add realistic two-device regression coverage across bearer, calendar, SSE, and attachment-view routes, including forged, malformed, expired, missing-user, and stale sessions.
• Add APA 7th standards traceability under docs/doctoring/session-revocation.md and record the security change in CHANGELOG.md.

Exact scope

Relative to #432's exact head, only five files change:

• CHANGELOG.md
• docs/doctoring/session-revocation.md
• package.json
• server/auth.mjs
• tests/api/session-revocation.test.mjs

No attachment-list, Clearfolio, database-schema, UI, deployment, workflow, or dependency code is changed by this pull request.

Security and standards contract

The doctoring record maps the implementation to RFC 7519, RFC 8725, RFC 6750, and RFC 9700. This pull request does not claim to remove the existing query-token transport. It provides one strict revocation boundary until #413 replaces general session JWTs in URLs with narrowly scoped opaque grants and separately revocable calendar subscription secrets.

Verification contract

The exact current head must prove:

1. malformed signer inputs fail before token minting;
2. malformed compact tokens, signatures, JOSE headers, claim shapes, subjects, expiries, and token-version values fail on all four transports;
3. a validly signed token for a missing user fails before resource lookup;
4. two independently minted device sessions work before revocation;
5. logout-all rejects both stale sessions on bearer, calendar, SSE, and attachment-view paths;
6. the replacement session continues through the shared authentication boundary;
7. all changed production helpers retain complete JSDoc and 100% statement, branch, function, and line coverage; and
8. every repository and central required check succeeds on the exact head before an independent approval and merge.

Sequencing

This pull request intentionally targets fix/security-hono-attachment-refresh-final and remains Draft while #432 is under protected-branch review. After #432 merges, retarget or restack this exact five-file change onto develop, rerun every exact-head check, obtain an independent approval, and only then enable auto-merge.

Supersedes #414.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4025518a-8477-4da8-9080-a68e0848173f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by clean restack #443. #443 starts from #432 exact head 9746592143d4e87c03b7a95adf678e789d3d352a and preserves the intended five-file session-revocation scope without historical attachment divergence. Continue review and verification on #443.