push update socket data dan token

server/api/auth/validate-session.post.ts

@@ -1,22 +1,23 @@
 // server/api/auth/validate-session.post.ts
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
-  const sessionId = getCookie(event, 'user_session')
+  const sessionCookie = getCookie(event, 'user_session')
   
   console.log('🔍 Session validation endpoint called')
-  console.log('🍪 Session cookie exists:', !!sessionId)
+  console.log('🍪 Session cookie exists:', !!sessionCookie)
   
-  if (!sessionId) {
+  if (!sessionCookie) {
     console.log('❌ No session cookie found')
     return { valid: false, reason: 'no_session' }
   }
   
   try {
-    const { getSession, deleteSession } = await import('~/server/utils/sessionStore')
-    const session = getSession(sessionId)
+    // Decode JWT-based session from cookie
+    const sessionJson = Buffer.from(sessionCookie, 'base64').toString('utf-8');
+    const session = JSON.parse(sessionJson);
     
     if (!session) {
-      console.log('❌ Session not found in store')
+      console.log('❌ Session not found or invalid')
       deleteCookie(event, 'user_session')
       return { valid: false, reason: 'session_not_found' }
     }
@@ -24,7 +25,6 @@ export default defineEventHandler(async (event) => {
     // Check local expiry
     if (Date.now() > session.expiresAt) {
       console.log('⏰ Session has expired locally')
-      deleteSession(sessionId)
       deleteCookie(event, 'user_session')
       return { valid: false, reason: 'session_expired' }
     }
@@ -53,7 +53,6 @@ export default defineEventHandler(async (event) => {
       // If Keycloak returns 401, the session is invalid on their side
       if (keycloakError.status === 401 || keycloakError.statusCode === 401) {
         console.log('❌ Keycloak session has expired (401)')
-        deleteSession(sessionId)
         deleteCookie(event, 'user_session')
         return { valid: false, reason: 'keycloak_session_expired' }
       }