@bhooai/nexus-auth 2.0.11 → 2.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bhooai/nexus-auth",
-    "version": "2.0.11",
+    "version": "2.0.12",
     "publishConfig": {
         "access": "public"
     },

package/src/csrf.ts

@@ -68,6 +68,29 @@ export function issueCsrfToken(ctx: RequestContext, options: CsrfOptions = {}):
   return issueToken(ctx, options.cookieName ?? 'nexus_csrf', options.cookie ?? { path: '/', sameSite: 'lax', secure: false });
 }
 
+/**
+ * Read the existing double-submit cookie token WITHOUT rotating it. Returns the
+ * current `nexus_csrf` value, or undefined when no cookie is present. Use this
+ * (not `issueCsrfToken`) when you only need to expose the token, so the cookie
+ * stays stable and previously-issued tokens keep matching.
+ */
+export function getCsrfToken(ctx: RequestContext, options: CsrfOptions = {}): string | undefined {
+  return readCookie(ctx, options.cookieName ?? 'nexus_csrf');
+}
+
+/**
+ * Verify a mutation's CSRF token against the double-submit cookie. The token may
+ * be carried either as an argument (`csrf`) or in the `X-CSRF-Token` header; only
+ * one needs to match the cookie (never both). Both channels stay cookie-bound:
+ * the provided token must equal the `nexus_csrf` cookie value.
+ */
+export function verifyMutationCsrf(ctx: RequestContext, argToken: string | undefined, headerToken?: string | undefined, options: CsrfOptions = {}): boolean {
+  const cookieToken = readCookie(ctx, options.cookieName ?? 'nexus_csrf');
+  if (!cookieToken) return false;
+  const provided = argToken ?? headerToken;
+  return !!provided && timingSafeEqual(cookieToken, provided);
+}
+
 /** CSRF + origin check for the WebSocket upgrade request (no CORS preflight). */
 export function checkWsUpgrade(headers: Record<string, string | string[] | undefined>, options: CsrfOptions = {}): void {
   const trusted = options.trustedOrigins ?? [];