@absolutejs/auth 0.63.0 → 0.65.0

package/dist/credentials/config.d.ts

@@ -21,6 +21,10 @@ export type CredentialEmailMessage = {
 export type CredentialsConfig<UserType> = {
     checkBreachesOnLogin?: boolean;
     credentialStore: CredentialStore;
+    /** When `trustedOrigins` is set, whether an untrusted Origin is REJECTED
+     *  (default true) or merely reported via `onUntrustedOrigin` (false = a
+     *  report-only rollout that never blocks). */
+    enforceTrustedOrigins?: boolean;
     getUserByEmail: (email: string) => Promise<UserType | null | undefined> | UserType | null | undefined;
     isMfaRequired?: (user: UserType, context?: {
         headers: Record<string, string | undefined>;
@@ -56,6 +60,13 @@ export type CredentialsConfig<UserType> = {
         user: UserType;
     }) => void | Promise<void>;
     onSendEmail: (message: CredentialEmailMessage) => void | Promise<void>;
+    /** Called on login/register when the request's Origin is not in
+     *  `trustedOrigins`. Fires whether or not `enforceTrustedOrigins` blocks the
+     *  request, so it can drive a report-only rollout (log/surface the Origin). */
+    onUntrustedOrigin?: (context: {
+        origin: string | null;
+        request: Request;
+    }) => void | Promise<void>;
     passwordPolicy?: PasswordPolicy;
     registerRoute?: RouteString;
     /** When true, registration creates the account but NOT a session, and login is

package/dist/credentials/login.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs, trustedOrigins }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, cookieSecure, credentialStore, enforceTrustedOrigins, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, onUntrustedOrigin, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs, trustedOrigins }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/credentials/register.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, onCreateCredentialUser, onCredentialsLoginSuccess, onExistingAccount, onRegistrationSuccess, onSendEmail, passwordPolicy, registerRoute, requireEmailVerification, revealRegistrationConflicts, sessionDurationMs, trustedOrigins, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsRegister: <UserType>({ authSessionStore, cookieSecure, credentialStore, enforceTrustedOrigins, onCreateCredentialUser, onCredentialsLoginSuccess, onExistingAccount, onRegistrationSuccess, onSendEmail, onUntrustedOrigin, passwordPolicy, registerRoute, requireEmailVerification, revealRegistrationConflicts, sessionDurationMs, trustedOrigins, verificationTokenDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/csrf.d.ts

@@ -1 +1,10 @@
 export declare const isTrustedOrigin: (request: Request, trustedOrigins?: readonly string[]) => boolean;
+export declare const resolveOriginAllowed: ({ enforce, onUntrustedOrigin, request, trustedOrigins }: {
+    enforce?: boolean;
+    onUntrustedOrigin?: (context: {
+        origin: string | null;
+        request: Request;
+    }) => void | Promise<void>;
+    request: Request;
+    trustedOrigins?: readonly string[];
+}) => Promise<boolean>;

package/dist/index.d.ts

@@ -3442,6 +3442,7 @@ export { createFederatedTokenStore, getOrRefreshFederatedTokens } from './federa
 export type { FederatedTokenRefresher, FederatedTokenSet, FederatedTokenStore } from './federation/tokenStore';
 export { decodeSessionUserRecord, type AuthSessionStore, type SessionUserDecoder } from './session/types';
 export { isAuthIntent, isUserSessionId, isValidUser } from './typeGuards';
+export { readSessionCookie } from './session/cookieReader';
 export { AuthIdentityConflictError } from './errors';
 export { sessionStore } from './session/state';
 export { createInMemoryAuthSessionStore } from './session/inMemoryStore';

package/dist/index.js

@@ -5153,6 +5153,20 @@ var isTrustedOrigin = (request, trustedOrigins) => {
   const origin = request.headers.get("origin");
   return origin !== null && trustedOrigins.includes(origin);
 };
+var resolveOriginAllowed = async ({
+  enforce = true,
+  onUntrustedOrigin,
+  request,
+  trustedOrigins
+}) => {
+  if (isTrustedOrigin(request, trustedOrigins))
+    return true;
+  await onUntrustedOrigin?.({
+    origin: request.headers.get("origin"),
+    request
+  });
+  return enforce === false;
+};
 
 // src/credentials/import.ts
 init_crypto();
@@ -5349,12 +5363,14 @@ var credentialsLogin = ({
   checkBreachesOnLogin,
   cookieSecure,
   credentialStore,
+  enforceTrustedOrigins,
   getUserByEmail,
   isMfaRequired,
   lockoutGuard,
   loginRoute = "/auth/login",
   onCredentialsLoginError,
   onCredentialsLoginSuccess,
+  onUntrustedOrigin,
   passwordVerifier,
   rehashOnLogin = false,
   requireEmailVerification = false,
@@ -5367,7 +5383,12 @@ var credentialsLogin = ({
   status,
   store: { session, unregisteredSession }
 }) => withSpan("auth.credentials.login", undefined, async (span) => {
-  if (!isTrustedOrigin(request, trustedOrigins)) {
+  if (!await resolveOriginAllowed({
+    enforce: enforceTrustedOrigins,
+    onUntrustedOrigin,
+    request,
+    trustedOrigins
+  })) {
     return status("Forbidden", "Request origin is not allowed");
   }
   const headerBag = {};
@@ -5525,11 +5546,13 @@ var credentialsRegister = ({
   authSessionStore,
   cookieSecure,
   credentialStore,
+  enforceTrustedOrigins,
   onCreateCredentialUser,
   onCredentialsLoginSuccess,
   onExistingAccount,
   onRegistrationSuccess,
   onSendEmail,
+  onUntrustedOrigin,
   passwordPolicy,
   registerRoute = "/auth/register",
   requireEmailVerification = false,
@@ -5544,7 +5567,12 @@ var credentialsRegister = ({
   status,
   store: { session }
 }) => withSpan("auth.credentials.register", undefined, async () => {
-  if (!isTrustedOrigin(request, trustedOrigins)) {
+  if (!await resolveOriginAllowed({
+    enforce: enforceTrustedOrigins,
+    onUntrustedOrigin,
+    request,
+    trustedOrigins
+  })) {
     return status("Forbidden", "Request origin is not allowed");
   }
   const normalizedEmail = email.trim().toLowerCase();
@@ -24637,6 +24665,23 @@ var decodeSessionUserRecord = (value) => {
     throw new TypeError("Persisted session user must be an object");
   return value;
 };
+// src/session/cookieReader.ts
+var SESSION_COOKIE_NAME = "user_session_id";
+var SESSION_COOKIE_PATTERN = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE_NAME}=([^;]*)`);
+var readSessionCookie = (request) => {
+  const header = request.headers.get("cookie");
+  if (header === null)
+    return null;
+  const match = header.match(SESSION_COOKIE_PATTERN);
+  const value = match?.[1];
+  if (value === undefined)
+    return null;
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
 // src/session/inMemoryStore.ts
 var cloneSessionData = (value) => ({
   ...value
@@ -37679,6 +37724,7 @@ export {
   resolveProviderClientConfiguration,
   resolvePostLogoutRedirect,
   resolvePermissions,
+  resolveOriginAllowed,
   resolveOAuthTokenExpiresAt,
   resolveOAuthAuthorization,
   resolveCookieSecure,
@@ -37696,6 +37742,7 @@ export {
   recordLoginAttempt,
   readUserInfoBearer,
   readSessionRing,
+  readSessionCookie,
   pushAuthorizationRequest,
   pruneInactiveUsers,
   providersFromEnv,
@@ -38100,5 +38147,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=A719E0625663B7E664756E2164756E21
+//# debugId=1D72B0CC5FBF9E2F64756E2164756E21
 //# sourceMappingURL=index.js.map