@absolutejs/auth 0.30.0 → 0.32.0

package/dist/mfa/challenge.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type MfaRouteProps } from './config';
-export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, sessionDurationMs }: MfaRouteProps<UserType>) => Elysia<"", {
+export declare const mfaChallenge: <UserType>({ authSessionStore, challengeRoute, cookieSecure, encryptionKey, getChallengeUser, getUserId, mfaStore, onMfaChallengeError, onMfaChallengeSuccess, sessionDurationMs }: MfaRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/mfa/config.d.ts

@@ -29,4 +29,5 @@ export type MfaConfig<UserType> = {
 };
 export type MfaRouteProps<UserType> = MfaConfig<UserType> & {
     authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
 };

package/dist/passwordless/config.d.ts

@@ -38,5 +38,6 @@ export type PasswordlessConfig<UserType> = {
 };
 export type PasswordlessRouteProps<UserType> = PasswordlessConfig<UserType> & {
     authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
     emit?: AuditEmitter;
 };

package/dist/passwordless/routes.d.ts

@@ -1,7 +1,7 @@
 import { Elysia } from 'elysia';
 import type { SessionRecord } from '../types';
 import { type PasswordlessRouteProps } from './config';
-export declare const passwordlessRoutes: <UserType>({ authSessionStore, emit, getUserByEmail, getUserId, magicLinkTokenDurationMs, onCreateUser, onPasswordlessLogin, onSendMagicLink, onSendOtp, otpDurationMs, otpLength, passwordlessRoute, passwordlessTokenStore, sessionDurationMs }: PasswordlessRouteProps<UserType>) => Elysia<"", {
+export declare const passwordlessRoutes: <UserType>({ authSessionStore, cookieSecure, emit, getUserByEmail, getUserId, magicLinkTokenDurationMs, onCreateUser, onPasswordlessLogin, onSendMagicLink, onSendOtp, otpDurationMs, otpLength, passwordlessRoute, passwordlessTokenStore, sessionDurationMs }: PasswordlessRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {} | {
         session: SessionRecord<UserType>;

package/dist/routes/authorize.d.ts

@@ -3,10 +3,11 @@ import { AuthorizeRoute, ClientProviders, OnAuthorizeError, OnAuthorizeSuccess }
 type AuthorizeProps = {
     clientProviders: ClientProviders;
     authorizeRoute?: AuthorizeRoute;
+    cookieSecure?: boolean;
     onAuthorizeSuccess: OnAuthorizeSuccess;
     onAuthorizeError: OnAuthorizeError;
 };
-export declare const authorize: ({ clientProviders, authorizeRoute, onAuthorizeSuccess, onAuthorizeError }: AuthorizeProps) => Elysia<"", {
+export declare const authorize: ({ clientProviders, authorizeRoute, cookieSecure, onAuthorizeSuccess, onAuthorizeError }: AuthorizeProps) => Elysia<"", {
     decorator: {};
     store: {};
     derive: {};

package/dist/routes/signout.d.ts

@@ -33,7 +33,7 @@ export declare const signout: <UserType>({ authSessionStore, signoutRoute, onSig
             headers: unknown;
             response: {
                 400: "Cookies are missing";
-                401: "No auth provider found" | "No user session id found";
+                401: "No user session id found";
                 200: Response;
                 422: {
                     type: "validation";

package/dist/session/anonymous.d.ts

@@ -1,9 +1,10 @@
 import type { Cookie } from 'elysia';
 import type { SessionData, SessionRecord, UserSessionId } from '../types';
 import type { AuthSessionStore } from './types';
-export declare const createAnonymousSession: <UserType>({ authSessionStore, cookie, guestUser, inMemorySession, sessionDurationMs }: {
+export declare const createAnonymousSession: <UserType>({ authSessionStore, cookie, cookieSecure, guestUser, inMemorySession, sessionDurationMs }: {
     authSessionStore?: AuthSessionStore<UserType>;
     cookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
     guestUser: UserType;
     inMemorySession: SessionRecord<UserType>;
     sessionDurationMs?: number;

package/dist/session/impersonation.d.ts

@@ -3,18 +3,20 @@ import type { AuditEvent } from '../audit/types';
 import type { SessionData, SessionRecord, UserSessionId } from '../types';
 import type { AuthSessionStore } from './types';
 type Emit = (event: AuditEvent) => Promise<void> | void;
-export declare const endImpersonation: <UserType>({ authSessionStore, cookie, emit, inMemorySession }: {
+export declare const endImpersonation: <UserType>({ authSessionStore, cookie, cookieSecure, emit, inMemorySession }: {
     authSessionStore?: AuthSessionStore<UserType>;
     cookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
     emit?: Emit;
     inMemorySession: SessionRecord<UserType>;
 }) => Promise<{
     restored: boolean;
 }>;
 export declare const isImpersonating: <UserType>(session: SessionData<UserType> | undefined) => boolean;
-export declare const startImpersonation: <UserType>({ authSessionStore, cookie, emit, getUserId, impersonator, inMemorySession, sessionDurationMs, user }: {
+export declare const startImpersonation: <UserType>({ authSessionStore, cookie, cookieSecure, emit, getUserId, impersonator, inMemorySession, sessionDurationMs, user }: {
     authSessionStore?: AuthSessionStore<UserType>;
     cookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
     emit?: Emit;
     getUserId?: (user: UserType) => string;
     impersonator: {

package/dist/session/multiSession.d.ts

@@ -1,7 +1,7 @@
 import type { Cookie } from 'elysia';
 import type { SessionRecord, UserSessionId } from '../types';
 import type { AuthSessionStore } from './types';
-export declare const addToSessionRing: (ring: Cookie<string | undefined>, sessionId: UserSessionId) => Cookie<string | undefined>;
+export declare const addToSessionRing: (ring: Cookie<string | undefined>, sessionId: UserSessionId, cookieSecure?: boolean) => Cookie<string | undefined>;
 export declare const listRingSessions: <UserType>({ authSessionStore, inMemorySession, ring }: {
     authSessionStore?: AuthSessionStore<UserType>;
     inMemorySession?: SessionRecord<UserType>;
@@ -11,15 +11,17 @@ export declare const listRingSessions: <UserType>({ authSessionStore, inMemorySe
     user: UserType;
 }[]>;
 export declare const readSessionRing: (ring: Cookie<string | undefined>) => `${string}-${string}-${string}-${string}-${string}`[];
-export declare const removeFromSessionRing: <UserType>({ activeCookie, authSessionStore, inMemorySession, ring, sessionId }: {
+export declare const removeFromSessionRing: <UserType>({ activeCookie, authSessionStore, cookieSecure, inMemorySession, ring, sessionId }: {
     activeCookie?: Cookie<UserSessionId | undefined>;
     authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
     inMemorySession?: SessionRecord<UserType>;
     ring: Cookie<string | undefined>;
     sessionId: UserSessionId;
 }) => Promise<void>;
-export declare const switchActiveSession: ({ activeCookie, ring, sessionId }: {
+export declare const switchActiveSession: ({ activeCookie, cookieSecure, ring, sessionId }: {
     activeCookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
     ring: Cookie<string | undefined>;
     sessionId: UserSessionId;
 }) => boolean;

package/dist/session/promote.d.ts

@@ -12,11 +12,12 @@ type PromoteToSessionProps<UserType> = {
     anonymous?: boolean;
     authSessionStore?: AuthSessionStore<UserType>;
     cookie: Cookie<UserSessionId | undefined>;
+    cookieSecure?: boolean;
     impersonator?: SessionData<UserType>['impersonator'];
     inMemorySession: SessionRecord<UserType>;
     samlLogout?: SessionData<UserType>['samlLogout'];
     sessionDurationMs: number;
     user: UserType;
 };
-export declare const promoteToSession: <UserType>({ anonymous, authSessionStore, cookie, impersonator, inMemorySession, samlLogout, sessionDurationMs, user }: PromoteToSessionProps<UserType>) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
+export declare const promoteToSession: <UserType>({ anonymous, authSessionStore, cookie, cookieSecure, impersonator, inMemorySession, samlLogout, sessionDurationMs, user }: PromoteToSessionProps<UserType>) => Promise<`${string}-${string}-${string}-${string}-${string}`>;
 export {};

package/dist/sso/oidcRoutes.d.ts

@@ -3,8 +3,9 @@ import type { AuthSessionStore } from '../session/types';
 import { type SSOConfig } from './config';
 type OidcRoutesProps<UserType> = SSOConfig<UserType> & {
     authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
 };
-export declare const oidcSsoRoutes: <UserType>({ authSessionStore, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, sessionDurationMs, ssoConnectionStore, ssoRoute }: OidcRoutesProps<UserType>) => Elysia<"", {
+export declare const oidcSsoRoutes: <UserType>({ authSessionStore, cookieSecure, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, sessionDurationMs, ssoConnectionStore, ssoRoute }: OidcRoutesProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/sso/samlRoutes.d.ts

@@ -4,9 +4,10 @@ import type { SessionRecord } from '../types';
 import { type SamlAdapter, type SSOConfig } from './config';
 type SamlRoutesProps<UserType> = SSOConfig<UserType> & {
     authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
     samlAdapter: SamlAdapter;
 };
-export declare const samlSsoRoutes: <UserType>({ authSessionStore, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, samlAdapter, sessionDurationMs, ssoConnectionStore, ssoRoute }: SamlRoutesProps<UserType>) => Elysia<"", {
+export declare const samlSsoRoutes: <UserType>({ authSessionStore, cookieSecure, getSsoUser, onSsoCallbackError, onSsoCallbackSuccess, samlAdapter, sessionDurationMs, ssoConnectionStore, ssoRoute }: SamlRoutesProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: SessionRecord<UserType>;

package/dist/types.d.ts

@@ -175,7 +175,11 @@ export type OnStatus<UserType> = (({ user }: {
     user: UserType | null;
 }) => void | Promise<void>) | undefined;
 export type OnSignOut<UserType> = (({ authProvider, userSessionId, session }: {
-    authProvider: string;
+    /** Set only when the session was minted by the OAuth2 `/authorize` flow —
+     *  credentials, MFA, passwordless, SSO, WebAuthn, and impersonation-minted
+     *  sessions sign out without one. Use it to revoke the upstream provider
+     *  token when present; ignore when undefined. */
+    authProvider: string | undefined;
     userSessionId: UserSessionId;
     session: SessionRecord<UserType>;
 }) => void | Promise<void>) | undefined;
@@ -187,6 +191,14 @@ export type RouteString = `/${string}`;
 export type AuthorizeRoute = `${string}/:provider${'' | `/${string}`}`;
 export type AuthConfig<UserType> = {
     providersConfiguration: OAuth2ConfigurationOptions;
+    /** Override the `Secure` attribute on every cookie the package sets (session, OAuth state,
+     *  code_verifier, SSO nonce, ring, etc.). When omitted, defaults to
+     *  `process.env.NODE_ENV === 'production'` — matching the convention used by
+     *  express-session / iron-session / lucia / better-auth, and the only way non-browser
+     *  HTTP clients (curl, SSR fetch, test runners) can round-trip cookies on a plain-HTTP
+     *  dev server. If you run prod without setting `NODE_ENV=production`, set
+     *  `cookieSecure: true` explicitly. */
+    cookieSecure?: boolean;
     authorizeRoute?: AuthorizeRoute;
     profileRoute?: RouteString;
     callbackRoute?: RouteString;
@@ -332,6 +344,7 @@ export type InsantiateUserSessionProps<UserType> = {
     user_session_id: Cookie<UserSessionId | undefined>;
     onNewUser: OnNewUser<UserType>;
     getUser: GetUser<UserType>;
+    cookieSecure?: boolean;
     resolvedAuthorization?: ResolvedOAuthAuthorization;
     sessionDurationMs?: number;
     unregisteredSessionDurationMs?: number;

package/dist/utils.d.ts

@@ -16,7 +16,8 @@ export declare const getStatus: <UserType>(session: SessionRecord<UserType>, use
     error: null;
     user: NonNullable<UserType> | null;
 }>;
-export declare const instantiateUserSession: <UserType>({ authProvider, session, user_session_id, unregisteredSession, tokenResponse, providerInstance, getUser, onNewUser, resolvedAuthorization, sessionDurationMs, unregisteredSessionDurationMs }: InsantiateUserSessionProps<UserType>) => Promise<Response | import("./types").StatusReturn | undefined>;
+export declare const instantiateUserSession: <UserType>({ authProvider, cookieSecure, session, user_session_id, unregisteredSession, tokenResponse, providerInstance, getUser, onNewUser, resolvedAuthorization, sessionDurationMs, unregisteredSessionDurationMs }: InsantiateUserSessionProps<UserType>) => Promise<Response | import("./types").StatusReturn | undefined>;
+export declare const resolveCookieSecure: (override?: boolean) => boolean;
 export declare const resolveOAuthAuthorization: ({ authProvider, providerInstance, tokenResponse, now }: {
     authProvider: ProviderOption;
     providerInstance: OAuth2Client<ProviderOption>;
@@ -34,9 +35,10 @@ export declare const validateSession: <SessionType extends Record<string, unknow
     expiresAt: number;
 }>({ user_session_id, session }: ValidateSessionProps<SessionType>) => SessionType | undefined;
 type GetUserSessionIdProps<UserType> = {
+    cookieSecure?: boolean;
     user_session_id: Cookie<UserSessionId | undefined>;
     session?: SessionRecord<UserType>;
     unregisteredSession?: UnregisteredSessionRecord;
 };
-export declare const getUserSessionId: <UserType>({ user_session_id, session, unregisteredSession }: GetUserSessionIdProps<UserType>) => `${string}-${string}-${string}-${string}-${string}`;
+export declare const getUserSessionId: <UserType>({ cookieSecure, user_session_id, session, unregisteredSession }: GetUserSessionIdProps<UserType>) => `${string}-${string}-${string}-${string}-${string}`;
 export {};

package/dist/webauthn/config.d.ts

@@ -31,5 +31,6 @@ export type WebAuthnConfig<UserType> = {
 };
 export type WebAuthnRouteProps<UserType> = WebAuthnConfig<UserType> & {
     authSessionStore?: AuthSessionStore<UserType>;
+    cookieSecure?: boolean;
     emit?: AuditEmitter;
 };

package/dist/webauthn/routes.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type WebAuthnRouteProps } from './config';
-export declare const webauthnRoutes: <UserType>({ authSessionStore, challengeDurationMs, credentialStore, emit, getUserDisplayName, getUserId, getUserName, getWebAuthnUser, onWebAuthnAuthenticated, onWebAuthnRegistered, origin, rpId, rpName, sessionDurationMs, webauthnAdapter, webauthnRoute }: WebAuthnRouteProps<UserType>) => Elysia<"", {
+export declare const webauthnRoutes: <UserType>({ authSessionStore, challengeDurationMs, cookieSecure, credentialStore, emit, getUserDisplayName, getUserId, getUserName, getWebAuthnUser, onWebAuthnAuthenticated, onWebAuthnRegistered, origin, rpId, rpName, sessionDurationMs, webauthnAdapter, webauthnRoute }: WebAuthnRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.30.0",
+	"version": "0.32.0",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {