feat(auth): session list and revocation

Track session metadata (createdAt, userAgent, ip, lastUsedAt). Add API
for listing and revoking sessions. Settings page shows active sessions
with "Revoke" per session and "Log out everywhere else" option.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/lib/server/auth.ts

@@ -65,13 +65,21 @@ export async function verifyPassword(
 	return valid ? toUser(user) : null;
 }
 
-export async function createSession(userId: number): Promise<string> {
+export async function createSession(
+	userId: number,
+	meta?: { userAgent?: string; ip?: string }
+): Promise<string> {
 	const token = randomBytes(32).toString('hex');
+	const now = new Date();
 	db.insert(sessions)
 		.values({
 			id: token,
 			userId,
-			expiresAt: new Date(Date.now() + SESSION_DURATION_MS)
+			expiresAt: new Date(Date.now() + SESSION_DURATION_MS),
+			createdAt: now,
+			userAgent: meta?.userAgent || null,
+			ip: meta?.ip || null,
+			lastUsedAt: now
 		})
 		.run();
 	return token;
@@ -108,6 +116,12 @@ export async function validateSession(
 		return { valid: false };
 	}
 
+	// Update lastUsedAt
+	db.update(sessions)
+		.set({ lastUsedAt: new Date() })
+		.where(eq(sessions.id, token))
+		.run();
+
 	return {
 		valid: true,
 		user: {
@@ -127,6 +141,54 @@ export async function cleanExpiredSessions(): Promise<void> {
 	db.delete(sessions).where(lt(sessions.expiresAt, new Date())).run();
 }
 
+export type SessionInfo = {
+	id: string;
+	createdAt: Date | null;
+	userAgent: string | null;
+	ip: string | null;
+	lastUsedAt: Date | null;
+	expiresAt: Date;
+	isCurrent: boolean;
+};
+
+export function listUserSessions(userId: number, currentToken: string): SessionInfo[] {
+	return db
+		.select()
+		.from(sessions)
+		.where(eq(sessions.userId, userId))
+		.all()
+		.map((s) => ({
+			id: s.id,
+			createdAt: s.createdAt,
+			userAgent: s.userAgent,
+			ip: s.ip,
+			lastUsedAt: s.lastUsedAt,
+			expiresAt: s.expiresAt,
+			isCurrent: s.id === currentToken
+		}));
+}
+
+export function revokeSession(userId: number, sessionId: string): boolean {
+	const session = db
+		.select()
+		.from(sessions)
+		.where(and(eq(sessions.id, sessionId), eq(sessions.userId, userId)))
+		.get();
+	if (!session) return false;
+	db.delete(sessions).where(eq(sessions.id, sessionId)).run();
+	return true;
+}
+
+export function revokeAllSessions(userId: number, exceptToken?: string): void {
+	if (exceptToken) {
+		sqlite
+			.prepare('DELETE FROM sessions WHERE user_id = ? AND id != ?')
+			.run(userId, exceptToken);
+	} else {
+		db.delete(sessions).where(eq(sessions.userId, userId)).run();
+	}
+}
+
 // --- User CRUD (admin operations) ---
 
 export async function createUser(

src/lib/server/db/index.ts

@@ -36,7 +36,11 @@ sqlite.exec(`
 	CREATE TABLE IF NOT EXISTS sessions (
 		id TEXT PRIMARY KEY,
 		user_id INTEGER NOT NULL REFERENCES users(id),
-		expires_at INTEGER NOT NULL
+		expires_at INTEGER NOT NULL,
+		created_at INTEGER,
+		user_agent TEXT,
+		ip TEXT,
+		last_used_at INTEGER
 	);
 
 	CREATE TABLE IF NOT EXISTS notes (
@@ -141,6 +145,19 @@ if (!hasEmail) {
 	}
 }
 
+// Migration: add session tracking columns
+const sessionColumns = sqlite
+	.prepare("PRAGMA table_info('sessions')")
+	.all() as { name: string }[];
+if (!sessionColumns.some((col) => col.name === 'created_at')) {
+	sqlite.exec(`
+		ALTER TABLE sessions ADD COLUMN created_at INTEGER;
+		ALTER TABLE sessions ADD COLUMN user_agent TEXT;
+		ALTER TABLE sessions ADD COLUMN ip TEXT;
+		ALTER TABLE sessions ADD COLUMN last_used_at INTEGER;
+	`);
+}
+
 // Create indexes AFTER migration ensures columns exist
 sqlite.exec(`
 	CREATE INDEX IF NOT EXISTS notes_user_id_idx ON notes(user_id);

src/lib/server/db/schema.ts

@@ -16,7 +16,11 @@ export const sessions = sqliteTable('sessions', {
 	userId: integer('user_id')
 		.references(() => users.id)
 		.notNull(),
-	expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull()
+	expiresAt: integer('expires_at', { mode: 'timestamp' }).notNull(),
+	createdAt: integer('created_at', { mode: 'timestamp' }),
+	userAgent: text('user_agent'),
+	ip: text('ip'),
+	lastUsedAt: integer('last_used_at', { mode: 'timestamp' })
 });
 
 export const notes = sqliteTable(

src/lib/server/db/test-helpers.ts

@@ -27,7 +27,11 @@ export function createTestDb() {
 		CREATE TABLE sessions (
 			id TEXT PRIMARY KEY,
 			user_id INTEGER NOT NULL REFERENCES users(id),
-			expires_at INTEGER NOT NULL
+			expires_at INTEGER NOT NULL,
+			created_at INTEGER,
+			user_agent TEXT,
+			ip TEXT,
+			last_used_at INTEGER
 		);
 
 		CREATE TABLE notes (

src/routes/api/auth/login/+server.ts

@@ -27,7 +27,8 @@ export const POST: RequestHandler = async ({ request, cookies, getClientAddress
 
 	recordLoginAttempt(ip, email, true);
 
-	const token = await createSession(user.id);
+	const userAgent = request.headers.get('user-agent') || undefined;
+	const token = await createSession(user.id, { userAgent, ip });
 	cookies.set('session', token, {
 		path: '/',
 		httpOnly: true,

src/routes/api/auth/sessions/+server.ts

@@ -0,0 +1,33 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types.js';
+import { getUserId } from '$lib/server/api-utils.js';
+import { listUserSessions, revokeSession, revokeAllSessions } from '$lib/server/auth.js';
+
+export const GET: RequestHandler = async (event) => {
+	const userId = getUserId(event);
+	const currentToken = event.cookies.get('session') || '';
+	const sessions = listUserSessions(userId, currentToken);
+	return json(sessions);
+};
+
+export const DELETE: RequestHandler = async (event) => {
+	const userId = getUserId(event);
+	const { sessionId, all } = await event.request.json();
+
+	if (all) {
+		const currentToken = event.cookies.get('session') || '';
+		revokeAllSessions(userId, currentToken);
+		return json({ success: true });
+	}
+
+	if (!sessionId) {
+		throw error(400, 'sessionId is required');
+	}
+
+	const revoked = revokeSession(userId, sessionId);
+	if (!revoked) {
+		throw error(404, 'Session not found');
+	}
+
+	return json({ success: true });
+};

src/routes/api/auth/setup/+server.ts

@@ -2,7 +2,7 @@ import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types.js';
 import { setupUser, createSession, isSetupComplete } from '$lib/server/auth.js';
 
-export const POST: RequestHandler = async ({ request, cookies }) => {
+export const POST: RequestHandler = async ({ request, cookies, getClientAddress }) => {
 	const alreadySetup = await isSetupComplete();
 	if (alreadySetup) {
 		throw error(400, 'Setup already completed');
@@ -23,7 +23,9 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
 		throw error(500, 'Failed to create user');
 	}
 
-	const token = await createSession(user.id);
+	const userAgent = request.headers.get('user-agent') || undefined;
+	const ip = getClientAddress();
+	const token = await createSession(user.id, { userAgent, ip });
 	cookies.set('session', token, {
 		path: '/',
 		httpOnly: true,

src/routes/settings/+page.svelte

@@ -2,6 +2,16 @@
 	import { goto } from '$app/navigation';
 	import PasswordStrengthMeter from '$lib/components/PasswordStrengthMeter.svelte';
 
+	type SessionInfo = {
+		id: string;
+		createdAt: string | null;
+		userAgent: string | null;
+		ip: string | null;
+		lastUsedAt: string | null;
+		expiresAt: string;
+		isCurrent: boolean;
+	};
+
 	let { data } = $props();
 
 	let displayName = $state(data.user?.displayName || '');
@@ -15,6 +25,63 @@
 	let passwordMsg = $state('');
 	let passwordError = $state(false);
 
+	let activeSessions = $state<SessionInfo[]>([]);
+	let sessionsLoaded = $state(false);
+
+	async function loadSessions() {
+		try {
+			const res = await fetch('/api/auth/sessions');
+			if (res.ok) activeSessions = await res.json();
+			sessionsLoaded = true;
+		} catch {
+			// ignore
+		}
+	}
+
+	async function revokeSession(sessionId: string) {
+		try {
+			await fetch('/api/auth/sessions', {
+				method: 'DELETE',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ sessionId })
+			});
+			activeSessions = activeSessions.filter((s) => s.id !== sessionId);
+		} catch {
+			// ignore
+		}
+	}
+
+	async function revokeAllOtherSessions() {
+		try {
+			await fetch('/api/auth/sessions', {
+				method: 'DELETE',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ all: true })
+			});
+			activeSessions = activeSessions.filter((s) => s.isCurrent);
+		} catch {
+			// ignore
+		}
+	}
+
+	function formatAgent(ua: string | null): string {
+		if (!ua) return 'Unknown';
+		if (ua.includes('Firefox')) return 'Firefox';
+		if (ua.includes('Edg/')) return 'Edge';
+		if (ua.includes('Chrome')) return 'Chrome';
+		if (ua.includes('Safari')) return 'Safari';
+		return ua.slice(0, 40);
+	}
+
+	function formatDate(d: string | null): string {
+		if (!d) return 'Unknown';
+		return new Date(d).toLocaleString();
+	}
+
+	$effect(() => {
+		loadSessions();
+	});
+
 	async function saveProfile() {
 		profileMsg = '';
 		try {
@@ -157,6 +224,53 @@
 		</div>
 	</section>
 
+	<!-- Active Sessions -->
+	<section class="mb-8 rounded-lg border border-gray-200 bg-white p-6 dark:border-gray-700 dark:bg-gray-800">
+		<div class="mb-4 flex items-center justify-between">
+			<h2 class="text-lg font-semibold text-gray-800 dark:text-gray-100">Active Sessions</h2>
+			{#if activeSessions.length > 1}
+				<button
+					onclick={revokeAllOtherSessions}
+					class="text-xs text-red-600 hover:text-red-700 dark:text-red-400"
+				>
+					Log out everywhere else
+				</button>
+			{/if}
+		</div>
+
+		{#if !sessionsLoaded}
+			<p class="text-sm text-gray-500">Loading sessions...</p>
+		{:else if activeSessions.length === 0}
+			<p class="text-sm text-gray-500">No active sessions</p>
+		{:else}
+			<div class="space-y-3">
+				{#each activeSessions as session (session.id)}
+					<div class="flex items-center justify-between rounded-lg border border-gray-100 p-3 dark:border-gray-700">
+						<div>
+							<p class="text-sm font-medium text-gray-800 dark:text-gray-100">
+								{formatAgent(session.userAgent)}
+								{#if session.isCurrent}
+									<span class="ml-2 rounded bg-green-100 px-2 py-0.5 text-xs text-green-800 dark:bg-green-900/30 dark:text-green-200">current</span>
+								{/if}
+							</p>
+							<p class="text-xs text-gray-500 dark:text-gray-400">
+								{session.ip || 'Unknown IP'} · Last active {formatDate(session.lastUsedAt)}
+							</p>
+						</div>
+						{#if !session.isCurrent}
+							<button
+								onclick={() => revokeSession(session.id)}
+								class="rounded px-3 py-1 text-xs text-red-600 hover:bg-red-50 dark:text-red-400 dark:hover:bg-red-900/20"
+							>
+								Revoke
+							</button>
+						{/if}
+					</div>
+				{/each}
+			</div>
+		{/if}
+	</section>
+
 	<!-- Admin: User Management Link -->
 	{#if data.user?.role === 'admin'}
 		<section class="rounded-lg border border-gray-200 bg-white p-6 dark:border-gray-700 dark:bg-gray-800">