Method validateSessionToken

src/node/services/serverAuthService.ts:425–498

(
    sessionToken: string,
    opts?: ValidateSessionTokenOptions
  )

  }

  async validateSessionToken(
    sessionToken: string,
    opts?: ValidateSessionTokenOptions
  ): Promise<{ sessionId: string } | null> {
    const normalizedToken = normalizeOptionalString(sessionToken);
    if (!normalizedToken) {
      return null;
    }

    const tokenHash = hashSessionToken(normalizedToken);
    const now = Date.now();
    const normalizedUserAgent = normalizeOptionalString(opts?.userAgent);
    const normalizedIpAddress = normalizeIpAddress(opts?.ipAddress);

    await using _lock = await this.sessionsMutex.acquire();

    const data = await this.loadPersistedSessionsLocked();
    const session = data.sessions.find((candidate) => candidate.tokenHash === tokenHash);
    if (!session) {
      return null;
    }

    const sessionAgeMs = now - session.createdAtMs;
    const sessionExpired =
      !Number.isFinite(session.createdAtMs) ||
      !Number.isFinite(sessionAgeMs) ||
      sessionAgeMs >= SERVER_AUTH_SESSION_MAX_AGE_MS;
    if (sessionExpired) {
      data.sessions = data.sessions.filter((candidate) => candidate.id !== session.id);

      try {
        await this.savePersistedSessionsLocked(data);
      } catch (error) {
        // Validation should still fail closed for expired sessions even if pruning
        // persistence fails.
        log.warn("Failed to prune expired server auth session", {
          sessionId: session.id,
          error: getErrorMessage(error),
        });
      }

      return null;
    }

    const shouldPersistLastUsed =
      !Number.isFinite(session.lastUsedAtMs) ||
      now - session.lastUsedAtMs >= SESSION_LAST_USED_PERSIST_INTERVAL_MS;

    const shouldPersistUserAgent = normalizedUserAgent && session.userAgent !== normalizedUserAgent;
    const shouldPersistIpAddress = normalizedIpAddress && session.ipAddress !== normalizedIpAddress;

    if (shouldPersistLastUsed || shouldPersistUserAgent || shouldPersistIpAddress) {
      session.lastUsedAtMs = now;
      if (normalizedUserAgent) {
        session.userAgent = normalizedUserAgent;
        session.label = buildSessionLabel(normalizedUserAgent);
      }
      if (normalizedIpAddress) {