Add session version handling

src/routes/settings.js

@@ -20,6 +20,14 @@ const passwordValidator = (body) => {
     return {value: {currentPassword, newPassword}};
 };
 
+const currentPasswordValidator = (body) => {
+    const currentPassword = String(body?.currentPassword || "");
+    if (!currentPassword) return {error: "Current password is required"};
+    return {value: {currentPassword}};
+};
+
+const destroySession = (req) => new Promise((resolve) => req.session.destroy(() => resolve()));
+
 export function createSettingsRouter({repositories}) {
     const router = express.Router();
     router.use(requireLogin);
@@ -59,8 +67,38 @@ export function createSettingsRouter({repositories}) {
         if (!valid) return res.status(403).json({error: "Current password is incorrect"});
         const hashed = await bcrypt.hash(newPassword, 10);
         repositories.updatePassword(hashed, username);
+        const updatedUser = repositories.incrementSessionVersion(username);
+        req.session.sessionVersion = Number(updatedUser.session_version || 0);
         return res.json({message: "Password updated"});
     });
 
+    router.post("/settings/logout-all-sessions", (req, res) => {
+        repositories.incrementSessionVersion(req.session.user);
+        req.session.destroy(() => res.json({message: "All sessions logged out"}));
+    });
+
+    router.get("/settings/export", (req, res) => {
+        const user = repositories.getUser(req.session.user);
+        if (!user) return res.status(404).json({error: "User not found"});
+        return res.json({
+            account: {
+                username: user.username,
+                exportedAt: new Date().toISOString(),
+                workspace: repositories.exportWorkspace(req.session.user)
+            }
+        });
+    });
+
+    router.delete("/settings/account", validateBody(currentPasswordValidator), async (req, res) => {
+        const username = req.session.user;
+        const user = repositories.getUser(username);
+        if (!user) return res.status(404).json({error: "User not found"});
+        const valid = await bcrypt.compare(req.validatedBody.currentPassword, user.password);
+        if (!valid) return res.status(403).json({error: "Current password is incorrect"});
+        repositories.deleteUser(username);
+        await destroySession(req);
+        return res.json({message: "Account deleted"});
+    });
+
     return router;
 }