# Step 1: Login and save Session A
curl -c session_a.txt -X POST https://target.com/api/login \
     -H 'Content-Type: application/json' \
     -d '{"email":"test@test.com","password":"test123"}'

# Step 2: Login again and save Session B (same credentials)
curl -c session_b.txt -X POST https://target.com/api/login \
     -H 'Content-Type: application/json' \
     -d '{"email":"test@test.com","password":"test123"}'

# Step 3: Test both simultaneously
echo "=== Session A ==="
curl -b session_a.txt https://target.com/api/me

echo "=== Session B ==="
curl -b session_b.txt https://target.com/api/me

# SECURE:     Session A returns 401 after Session B login
# VULNERABLE: Both return 200 with same user_id

# Create 5 sessions in a loop
for i in 1 2 3 4 5; do
  curl -c "session_${i}.txt" -s -o /dev/null \
       -X POST https://target.com/api/login \
       -H 'Content-Type: application/json' \
       -d '{"email":"test@test.com","password":"test123"}'
  echo "Created session $i"
done

# Test all 5 simultaneously
for i in 1 2 3 4 5; do
  code=$(curl -b "session_${i}.txt" -s -o /dev/null -w '%{http_code}' \
         https://target.com/api/me)
  echo "Session $i: HTTP $code"
done

# SECURE:  Only 1 session active (or limited to N)
# VULNERABLE: All 5 return 200 → no session limit

# Issue JWT_1
JWT_1=$(curl -s -X POST https://target.com/api/auth/login \
        -d '{"email":"test@test.com","password":"test123"}' \
        | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")

# Issue JWT_2 from same account
JWT_2=$(curl -s -X POST https://target.com/api/auth/login \
        -d '{"email":"test@test.com","password":"test123"}' \
        | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")

# Test JWT_1 (should be invalidated when JWT_2 was issued)
curl -H "Authorization: Bearer $JWT_1" https://target.com/api/me

# Test JWT_2
curl -H "Authorization: Bearer $JWT_2" https://target.com/api/me

# SECURE:     JWT_1 returns 401 after JWT_2 issued (token versioning)
# VULNERABLE: Both JWTs return 200 → no JWT concurrency control

# If admin credentials are obtained (via phishing, breach, etc.)
# Test concurrent session specifically for admin account

# Attacker session:
curl -c attacker_admin.txt -X POST https://target.com/api/login \
     -d '{"email":"admin@target.com","password":"Admin123!"}'

# Verify admin access via attacker session:
curl -b attacker_admin.txt https://target.com/api/admin/users
# 200 OK → attacker has full admin access

# Meanwhile real admin is still logged in with their own session
# BOTH sessions are valid simultaneously
# Admin has no notification, no forced logout, no awareness
# Severity: HIGH (full app control, completely silent)

# Issue JWT_OLD at time T1
# User continues using app with JWT_OLD
# Attacker later obtains credentials → issues JWT_NEW at T2
# JWT_OLD remains valid (no token version increment)

# Test: JWT_OLD still works after JWT_NEW issued?
curl -H "Authorization: Bearer JWT_OLD" https://target.com/api/me
# 200 OK → JWT_OLD still valid → concurrent JWT access

# Secure fix: maintain token_version per user
# Every new login: user.token_version++
# Every JWT validation: reject if jwt.version < user.token_version

# Without concurrent session limits:
# 1. Credential stuffing attack runs — tests thousands of accounts
# 2. Valid credentials found → attacker logs in
# 3. Victim is ALREADY logged in (their existing session)
# 4. No account lockout triggered (attacker got it right first try)
# 5. No notification sent (no concurrent session alert)
# 6. Both sessions valid indefinitely
# 7. Victim has zero indication of compromise
# 8. Attacker monitors victim's activity silently for days
#
# This is why concurrent session control matters:
# It ensures that at least the victim gets kicked out or notified
# forcing a detection event when credentials are stolen

// On every login — invalidate all previous sessions for this user
app.post('/api/login', async (req, res) => {
    const user = await authenticate(req.body.email, req.body.password);
    if (!user) return res.status(401).json({error: 'Invalid credentials'});

    // SINGLE SESSION ENFORCEMENT:
    // Delete ALL existing sessions for this user first
    await db.query(
        'DELETE FROM sessions WHERE user_id = ?',
        [user.id]
    );

    // Create new session
    req.session.regenerate((err) => {
        req.session.userId = user.id;
        req.session.loginTime = Date.now();
        res.json({success: true});
    });

    // Send login notification email
    await sendLoginAlert(user.email, req.ip, req.headers['user-agent']);
});

// JWT payload includes token version
const token = jwt.sign({
    user_id: user.id,
    token_version: user.token_version  // increment on every login
}, process.env.JWT_SECRET, {expiresIn: '15m'});

// On login: increment token_version in DB
await db.query(
    'UPDATE users SET token_version = token_version + 1 WHERE id = ?',
    [user.id]
);

// On every authenticated request: verify token version
function authenticate(req, res, next) {
    const decoded = jwt.verify(token, secret);
    const user = await db.query('SELECT token_version FROM users WHERE id=?', [decoded.user_id]);

    if (decoded.token_version < user.token_version) {
        return res.status(401).json({error: 'Session superseded'});
    }
    next();
}