@axium/server 0.37.1 → 0.37.2

package/dist/api/register.js

@@ -64,7 +64,7 @@ async function POST(request) {
         deviceType: registrationInfo.credentialDeviceType,
         backedUp: registrationInfo.credentialBackedUp,
     }).catch(withError('Failed to create passkey', 500));
-    return await createSessionData(userId);
+    return await createSessionData(userId, request);
 }
 addRoute({
     path: '/api/register',

package/dist/api/users.js

@@ -100,7 +100,7 @@ addRoute({
     path: '/api/users/:id/auth',
     params,
     async OPTIONS(request, { id: userId }) {
-        const { type } = await parseBody(request, UserAuthOptions);
+        const { type, client } = await parseBody(request, UserAuthOptions);
         const user = await getUser(userId).catch(withError('User does not exist', 404));
         if (user.isSuspended)
             error(403, 'User is suspended');
@@ -111,7 +111,7 @@ addRoute({
             rpID: config.auth.rp_id,
             allowCredentials: passkeys.map(passkey => pick(passkey, 'id', 'transports')),
         });
-        challenges.set(userId, { data: options.challenge, type });
+        challenges.set(userId, { data: options.challenge, type, client });
         return options;
     },
     async POST(request, { id: userId }) {
@@ -119,7 +119,7 @@ addRoute({
         const auth = challenges.get(userId);
         if (!auth)
             error(404, 'No challenge');
-        const { data: expectedChallenge, type } = auth;
+        const { data: expectedChallenge, type, client } = auth;
         challenges.delete(userId);
         const passkey = await getPasskey(response.id).catch(withError('Passkey does not exist', 404));
         if (passkey.userId !== userId)
@@ -137,14 +137,13 @@ addRoute({
             error(401, 'Verification failed');
         switch (type) {
             case 'login':
-                return await createSessionData(userId);
+                return await createSessionData(userId, request);
             case 'client_login':
-                /** @todo tag in DB so users can manage easier */
-                return await createSessionData(userId, { noCookie: true });
+                return await createSessionData(userId, request, { noCookie: true, clientUA: client });
             case 'action':
                 if ((Date.now() - passkey.createdAt.getTime()) / 60_000 < config.auth.passkey_probation)
                     error(403, 'You can not authorize sensitive actions with a newly created passkey');
-                return await createSessionData(userId, { elevated: true });
+                return await createSessionData(userId, request, { elevated: true });
         }
     },
 });
@@ -266,6 +265,6 @@ addRoute({
     async POST(request, { id: userId }) {
         const { token } = await parseBody(request, z.object({ token: z.string() }));
         await useVerification('login', userId, token).catch(withError('Invalid or expired verification token', 400));
-        return await createSessionData(userId);
+        return await createSessionData(userId, request);
     },
 });

package/dist/auth.d.ts

@@ -8,7 +8,7 @@ export declare function updateUser({ id, ...user }: WithRequired<Insertable<Sche
 export interface SessionInternal extends Session {
     token: string;
 }
-export declare function createSession(userId: string, elevated?: boolean): Promise<SessionInternal>;
+export declare function createSession(userId: string, name: string | null, elevated?: boolean): Promise<SessionInternal>;
 export interface SessionAndUser extends SessionInternal {
     user: UserInternal;
 }

package/dist/auth.js

@@ -13,10 +13,11 @@ export async function updateUser({ id, ...user }) {
 }
 const in30days = () => new Date(Date.now() + 2592000000);
 const in10minutes = () => new Date(Date.now() + 600000);
-export async function createSession(userId, elevated = false) {
+export async function createSession(userId, name, elevated = false) {
     const session = {
         id: randomUUID(),
         userId,
+        name,
         token: randomBytes(64).toString('base64'),
         expires: elevated ? in10minutes() : in30days(),
         elevated,

package/dist/db/schema.json

@@ -77,6 +77,16 @@
                     }
                 }
             }
+        },
+        {
+            "delta": true,
+            "alter_tables": {
+                "sessions": {
+                    "add_columns": {
+                        "name": { "type": "text" }
+                    }
+                }
+            }
         }
     ],
     "wipe": ["users", "verifications", "passkeys", "sessions", "audit_log"]

package/dist/requests.d.ts

@@ -35,11 +35,13 @@ export declare function json(data: object, init?: ResponseInit): Response;
 export declare function parseBody<const Schema extends z.ZodType>(request: Request, schema: Schema): Promise<z.infer<Schema>>;
 export declare function parseSearch<const Schema extends z.ZodType>(request: Request, schema: Schema): z.infer<Schema>;
 export declare function getToken(request: Request, sensitive?: boolean): string | undefined;
+export declare function getPrettyUA(request: Request, uaOverride?: string): Promise<string | null>;
 export interface CreateSessionOptions {
     elevated?: boolean;
     noCookie?: boolean;
+    clientUA?: string;
 }
-export declare function createSessionData(userId: string, { elevated, noCookie }?: CreateSessionOptions): Promise<Response>;
+export declare function createSessionData(userId: string, request: Request, { elevated, noCookie, clientUA }?: CreateSessionOptions): Promise<Response>;
 export declare function stripUser(user: UserInternal, includeProtected?: boolean): User;
 export declare function withError(text: string, code?: number): (e: Error | ResponseError) => never;
 export declare function handleAPIRequest(request: Request, params: Record<string, any>, route: ServerRoute): Promise<Response>;

package/dist/requests.js

@@ -62,8 +62,29 @@ export function getToken(request, sensitive = false) {
         return cookie.parse(request.headers.get('cookie') || '')[sensitive ? 'elevated_token' : 'session_token'];
     }
 }
-export async function createSessionData(userId, { elevated = false, noCookie } = {}) {
-    const { token, expires } = await createSession(userId, elevated);
+const uaParserExtension = {
+    browser: [[/(axium[- ]client)\/([\d.]+)/i], ['name', 'version']],
+};
+export async function getPrettyUA(request, uaOverride) {
+    const uaString = uaOverride || request.headers.get('User-Agent') || '';
+    try {
+        const { UAParser } = await import('ua-parser-js');
+        const ua = UAParser(uaString, uaParserExtension);
+        return [
+            ua.browser.name,
+            ua.browser.name && /axium[- ]client/i.test(ua.browser.name) ? ua.browser.version : ua.browser.major,
+            ua.os.name && ' on ' + ua.os.name,
+        ]
+            .filter(p => p)
+            .join(' ');
+    }
+    catch {
+        return null;
+    }
+}
+export async function createSessionData(userId, request, { elevated = false, noCookie, clientUA } = {}) {
+    const name = await getPrettyUA(request, clientUA);
+    const { token, expires } = await createSession(userId, name, elevated);
     const response = json({ userId, token: elevated ? '[[redacted:elevated]]' : token }, { status: 201 });
     if (noCookie)
         return response;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/server",
-	"version": "0.37.1",
+	"version": "0.37.2",
 	"author": "James Prevett <axium@jamespre.dev>",
 	"funding": {
 		"type": "individual",
@@ -66,5 +66,8 @@
 	"devDependencies": {
 		"@sveltejs/adapter-node": "^5.2.12",
 		"vite-plugin-mkcert": "^1.17.8"
+	},
+	"optionalDependencies": {
+		"ua-parser-js": "^2.0.9"
 	}
 }

package/routes/login/client/+page.ts

@@ -13,12 +13,14 @@ export async function load({ parent, url }: Omit<PageLoadEvent, 'parent'> & { pa
 	const port = parseInt(url.searchParams.get('port') ?? '!');
 	const localCallback = new URL('http://localhost');
 
+	const client = url.searchParams.get('client') ?? '';
+
 	let options,
 		error: string | null = null;
 	try {
 		if (Number.isNaN(port)) throw new Error('Invalid port number provided by local client');
 		localCallback.port = port.toString();
-		options = await fetchAPI('OPTIONS', 'users/:id/auth', { type: 'client_login' }, session.userId);
+		options = await fetchAPI('OPTIONS', 'users/:id/auth', { type: 'client_login', client }, session.userId);
 	} catch (e: any) {
 		error = e.message;
 	}