@binary1702/auth 0.2.4 → 0.2.5

package/INSTALL.md

@@ -27,7 +27,7 @@ Every page and API route is now behind sign-in. Get the user anywhere on the ser
 ```ts
 import { requireUser } from "@binary1702/auth/next"
 
-const user = await requireUser()   // { id, username } or throws 401
+const user = await requireUser()   // { id, email } or throws 401
 ```
 
 ## URLs you get
@@ -44,7 +44,9 @@ From the terminal:
 
 ```bash
 npx @binary1702/auth add-user
-npx @binary1702/auth set-password
+npx @binary1702/auth set-password          # also ends their sessions
+npx @binary1702/auth remove-user
+npx @binary1702/auth sign-out-everywhere
 npx @binary1702/auth list-users
 ```
 

package/PROMPT.md

@@ -4,7 +4,7 @@ Copy everything below the line into an AI coding agent running inside the Next.j
 
 ---
 
-Install `@binary1702/auth` in this project. It adds username + password auth to a Next.js App Router app. Follow these steps exactly and report the result of each.
+Install `@binary1702/auth` in this project. It adds email + password auth to a Next.js App Router app. Follow these steps exactly and report the result of each.
 
 ## Before you start
 
@@ -22,7 +22,7 @@ Run, in the project root:
 npx @binary1702/auth
 ```
 
-It is interactive. It asks for the Postgres connection string, then a username and a password for the first user. If you cannot answer prompts, run it and hand control to me.
+It is interactive. It asks for the Postgres connection string, then an email and a password for the first user. If you cannot answer prompts, run it and hand control to me.
 
 It does the following, skipping anything already done:
 
@@ -33,7 +33,7 @@ It does the following, skipping anything already done:
 ✓ app/auth/[...path]/route.ts            → export { GET, POST } from "@binary1702/auth/next"
 ✓ proxy.ts                               → guard in front of every route
 ✓ auth_users table ready                 → in the database
-✓ user "<name>" created
+✓ user "<email>" created
 ```
 
 If `proxy.ts` or `middleware.ts` already existed, the CLI does not touch it and prints a snippet instead. Merge the snippet into the existing file: call the package's `proxy` for the paths you want protected and keep the matcher inline. On Next 15 the file is `middleware.ts`, same content.
@@ -47,8 +47,8 @@ Start the dev server and check with real HTTP requests:
 | `GET /` with no cookie | redirect to `/auth/sign-in` |
 | `GET /auth/sign-in` | 200, HTML form |
 | `GET /api/<any>` with no cookie | 401 JSON |
-| `POST /auth/sign-in` JSON `{ "username", "password" }` | 200 `{ user }` and `Set-Cookie: auth_session=…; HttpOnly` |
-| `GET /auth/session` with that cookie | `{ user: { id, username } }` |
+| `POST /auth/sign-in` JSON `{ "email", "password" }` | 200 `{ user }` and `Set-Cookie: auth_session=…; HttpOnly` |
+| `GET /auth/session` with that cookie | `{ user: { id, email } }` |
 | `GET /auth/sign-out` | cookie cleared, redirect to sign-in |
 
 Then open `/auth/sign-in` in the browser, sign in, confirm you land on `/`.
@@ -60,7 +60,7 @@ Wherever the app needs the current user on the server:
 ```ts
 import { requireUser } from "@binary1702/auth/next"
 
-const user = await requireUser()   // { id, username } or throws AuthError (401)
+const user = await requireUser()   // { id, email } or throws AuthError (401)
 ```
 
 `getUser()` returns `null` instead of throwing. Both work in route handlers, server components and server actions.

package/README.md

@@ -1,6 +1,6 @@
 # @binary1702/auth
 
-Username + password auth for Next.js. Plug and play.
+Email + password auth for Next.js. Plug and play.
 
 ```bash
 npx @binary1702/auth
@@ -33,10 +33,10 @@ You will be asked for one thing: your Postgres connection string (Neon). Everyth
   ✓ auth_users table ready
 
   Create the first user:
-  Username: ben
+  Email: ben@example.com
   Password:
   Password again:
-  ✓ user "ben" created
+  ✓ user "ben@example.com" created
 
 Done. Start the dev server and open /auth/sign-in.
 ```
@@ -55,7 +55,7 @@ Every page and API route is now behind sign-in. To know who the user is:
 import { requireUser } from "@binary1702/auth/next"
 
 export async function GET() {
-  const user = await requireUser()   // { id, username }
+  const user = await requireUser()   // { id, email }
   // ...
 }
 ```
@@ -65,7 +65,7 @@ That is the only line you ever write by hand.
 ```ts
 import { getUser } from "@binary1702/auth/next"
 
-const user = await getUser()   // { id, username } or null, never throws
+const user = await getUser()   // { id, email } or null
 ```
 
 Works in route handlers, server components, and server actions.
@@ -92,9 +92,11 @@ Two ways in. Pick one or use both.
 **From the terminal** (always works):
 
 ```bash
-npx @binary1702/auth add-user           # prompts for username and password
-npx @binary1702/auth add-user gladys    # username given
-npx @binary1702/auth set-password ben
+npx @binary1702/auth add-user                                   # prompts for email and password
+npx @binary1702/auth add-user gladys@example.com                # email given
+npx @binary1702/auth set-password ben@example.com               # also signs them out everywhere
+npx @binary1702/auth remove-user ben@example.com                # delete; their sessions end too
+npx @binary1702/auth sign-out-everywhere ben@example.com        # end every session, keep the account
 npx @binary1702/auth list-users
 ```
 
@@ -105,10 +107,11 @@ npx @binary1702/auth list-users
 | nothing set | Nobody. Except on a fresh install with zero users: `/auth/sign-in` sends you to create the first account. |
 | `AUTH_SIGNUP=open` | Anyone. The sign-in page gets a "Create one" link. |
 | `AUTH_SIGNUP=open` + `AUTH_INVITE_CODE=secret` | Anyone who knows the code. The form gets an invite field. |
+| `AUTH_EMAIL_DOMAIN=example.com` | Combine with any of the above: only `@example.com` emails can sign up. |
 
-Rules on the form: username 2 to 32 characters (letters, numbers, `. _ -`), password at least 8. Accounts are created and signed in immediately. Nothing to approve.
+Rules on the form: a valid email address, password at least 8. Accounts are created and signed in immediately. Nothing to approve.
 
-Programmatic: `POST /auth/sign-up` as JSON `{ username, password, invite? }` returns `200 { user }` and the cookie, or `400 / 403 / 404 / 409` with `{ error }`.
+Programmatic: `POST /auth/sign-up` as JSON `{ email, password, invite? }` returns `200 { user }` and the cookie, or `400 / 403 / 404 / 409` with `{ error }`.
 
 ---
 
@@ -150,6 +153,7 @@ If you already had a `proxy.ts`, the CLI leaves it alone and prints the snippet
 Both live in `.env.local`. Copy both to your host (Vercel, etc.) when you deploy.
 
 Rotating `AUTH_SECRET` signs everyone out. That is the revoke-all button.
+For one user: `sign-out-everywhere`, `set-password` or `remove-user`.
 
 ---
 
@@ -158,23 +162,28 @@ Rotating `AUTH_SECRET` signs everyone out. That is the revoke-all button.
 Five primitives around one cookie. Nothing else.
 
 ```
-auth_users (id, username, password_hash, created_at)   identity   one table, owned by the package
+auth_users (id, email, password_hash, created_at,
+            session_epoch)                              identity   one table, owned by the package
 scrypt                                                  proof      node:crypto, no dependency
-signed JWT in an httpOnly cookie, 7 days                session    stateless, zero DB reads per request
+signed JWT in an httpOnly cookie, 7 days, carries the
+  user's session_epoch                                  session    revoked when the epoch moves on
 proxy.ts                                                guard      verifies the cookie signature only
+getUser() / requireUser()                               gate       signature + one lookup by id
 /auth/sign-in  /auth/sign-out  /auth/session            lifecycle  one route file
 ```
 
 ```
 Request
   ├─ proxy.ts         cookie valid? → continue   else → redirect (page) or 401 (api)
-  ├─ /auth/sign-in    POST username+password → verify hash → set cookie → redirect
-  └─ your route       requireUser() → reads cookie → { id, username }
+  ├─ /auth/sign-in    POST email+password → verify hash → set cookie → redirect
+  └─ your route       requireUser() → reads cookie → user still exists, epoch matches? → { id, email }
 ```
 
 **Authentication only.** The package tells you `user.id`. What that user may see or edit is your app's job. Keeping that boundary is what keeps this package small enough to never break.
 
-**Trade-off you should know.** The session is a signed token, not a database row. That is why the proxy costs nothing per request. The cost is that one session cannot be revoked before it expires. Change `AUTH_SECRET` to revoke all of them.
+**Two gates.** The proxy checks only the token's signature, so it costs nothing per request. `getUser()` / `requireUser()` also look the user up by id and compare the token's `session_epoch` with the database's. Deleting a user, changing their password or `sign-out-everywhere` moves the epoch on (or removes the row), and every older token stops working there. A revoked token still passes the proxy and can load a page, but it gets no user and no data: treat `null` / 401 as "go to `/auth/sign-out`", which clears the cookie and lands on sign-in.
+
+Tokens signed before 0.2.5 carry no epoch and count as 0, so upgrading signs nobody out. The `session_epoch` column is added automatically on first start.
 
 ---
 
@@ -185,8 +194,8 @@ Request
 | Export | |
 |---|---|
 | `GET`, `POST` | Route handlers. Mount at `app/auth/[...path]/route.ts`. |
-| `requireUser()` | `Promise<{ id, username }>`. Throws `AuthError` (status 401) if signed out. |
-| `getUser()` | `Promise<{ id, username } \| null>`. Never throws. |
+| `requireUser()` | `Promise<{ id, email }>`. Throws `AuthError` (status 401) if signed out, deleted or revoked. |
+| `getUser()` | `Promise<{ id, email } \| null>`. Null if signed out, deleted or revoked. One database lookup; throws only if the database is unreachable. |
 | `unauthorized(err)` | Turns an `AuthError` into a 401 JSON response. Rethrows anything else. |
 | `AuthError` | The error class. Has `.status = 401`. |
 
@@ -223,7 +232,7 @@ const { user } = await fetch("/auth/session").then((r) => r.json())
 await fetch("/auth/sign-in", {
   method: "POST",
   headers: { "content-type": "application/json" },
-  body: JSON.stringify({ username, password }),
+  body: JSON.stringify({ email, password }),
 })   // 200 { user } or 401 { error }
 
 // sign out
@@ -236,7 +245,7 @@ Or just link to `/auth/sign-out`.
 
 ## Custom sign-in page
 
-The built-in page is plain HTML with light and dark mode. If you want your own, make any page with a form that POSTs `username` and `password` to `/auth/sign-in`, and put it anywhere under `/auth/` so the proxy lets it through. Optional hidden field `next` for where to go after.
+The built-in page is plain HTML with light and dark mode. If you want your own, make any page with a form that POSTs `email` and `password` to `/auth/sign-in`, and put it anywhere under `/auth/` so the proxy lets it through. Optional hidden field `next` for where to go after.
 
 ---
 

package/dist/cli.js

@@ -14,8 +14,10 @@
 //   7. create the first user
 //
 // Subcommands:
-//   add-user [name]       create another user
-//   set-password [name]   change a password
+//   add-user [email]              create another user
+//   set-password [email]          change a password (signs them out everywhere)
+//   remove-user [email]           delete a user (signs them out everywhere)
+//   sign-out-everywhere [email]   end every session of a user
 //   list-users
 // ─────────────────────────────────────────────────────────────
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from "node:fs";
@@ -246,13 +248,16 @@ async function main() {
     if (cmd === "help" || cmd === "--help" || cmd === "-h") {
         console.log(`  npx ${PKG}                    set up auth in this project (safe to re-run)
   npx ${PKG} add-user [email]   create a user
-  npx ${PKG} set-password [email]
+  npx ${PKG} set-password [email]          also signs them out everywhere
+  npx ${PKG} remove-user [email]           delete; also signs them out everywhere
+  npx ${PKG} sign-out-everywhere [email]   end every session of a user
   npx ${PKG} list-users
 `);
         return;
     }
     stepProject();
-    if (cmd === "add-user" || cmd === "set-password" || cmd === "list-users") {
+    const USER_CMDS = ["add-user", "set-password", "remove-user", "sign-out-everywhere", "list-users"];
+    if (USER_CMDS.includes(cmd)) {
         await stepEnv();
         const d = await db();
         if (cmd === "add-user")
@@ -268,7 +273,20 @@ async function main() {
                 fail("Password must be at least 8 characters.");
             const { hashPassword } = await import("./core/password.js");
             const ok = await d.setPassword(email, await hashPassword(password));
-            ok ? done(`password updated for "${email}"`) : fail(`No user "${email}".`);
+            ok ? done(`password updated for "${email}", old sessions ended`) : fail(`No user "${email}".`);
+        }
+        if (cmd === "remove-user" || cmd === "sign-out-everywhere") {
+            const email = (arg ?? (await ask("Email"))).trim().toLowerCase();
+            if (cmd === "remove-user") {
+                const sure = await ask(`Delete "${email}"? This cannot be undone. Type the email again`);
+                if (sure.trim().toLowerCase() !== email)
+                    fail("Not deleted.");
+                (await d.removeUser(email)) ? done(`user "${email}" deleted, sessions ended`) : fail(`No user "${email}".`);
+            }
+            else {
+                ;
+                (await d.revokeSessions(email)) ? done(`every session of "${email}" ended`) : fail(`No user "${email}".`);
+            }
         }
         console.log();
         return;

package/dist/core/db.d.ts

@@ -5,12 +5,22 @@ type Row = {
     id: string;
     email: string;
     password_hash: string;
+    epoch: number;
 };
 export declare function findUser(email: string): Promise<Row | null>;
-export declare function createUser(email: string, passwordHash: string): Promise<User>;
+export declare function createUser(email: string, passwordHash: string): Promise<User & {
+    epoch: number;
+}>;
+/** The user's current session_epoch, or null if the user is gone */
+export declare function sessionEpoch(id: string): Promise<number | null>;
+/** Revoke every session of this user. False if there is no such user. */
+export declare function revokeSessions(email: string): Promise<boolean>;
+/** Delete the user. Their sessions die with the row. False if none. */
+export declare function removeUser(email: string): Promise<boolean>;
 export declare function countUsers(): Promise<number>;
 export declare function listUsers(): Promise<(User & {
     created_at: string;
 })[]>;
+/** Change a password. Also revokes every session, old password's included. */
 export declare function setPassword(email: string, passwordHash: string): Promise<boolean>;
 export { TABLE };

package/dist/core/db.js

@@ -1,7 +1,12 @@
 // ─────────────────────────────────────────────────────────────
 // Storage. One table, owned by this package.
 //
-//   auth_users (id, email, password_hash, created_at)
+//   auth_users (id, email, password_hash, created_at, session_epoch)
+//
+// session_epoch: every session token carries the value it was signed
+// under, and is only good while they match (see core/session.ts).
+// +1 revokes every session of that user; deleting the row revokes
+// them too, since there is nothing left to match.
 //
 // ensureSchema() is idempotent and memoized per process, so route
 // handlers can call it on every request for free after the first.
@@ -22,6 +27,10 @@ export function ensureSchema() {
         password_hash TEXT NOT NULL,
         created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
       )
+    `;
+        // Added in 0.2.5: installs from before get it on their next start
+        await sql() `
+      ALTER TABLE auth_users ADD COLUMN IF NOT EXISTS session_epoch INT NOT NULL DEFAULT 0
     `;
     })().catch((err) => {
         _schema = null; // let the next call retry
@@ -31,7 +40,7 @@ export function ensureSchema() {
 export async function findUser(email) {
     await ensureSchema();
     const rows = (await sql() `
-    SELECT id, email, password_hash FROM auth_users WHERE email = ${email}
+    SELECT id, email, password_hash, session_epoch AS epoch FROM auth_users WHERE email = ${email}
   `);
     return rows[0] ?? null;
 }
@@ -40,10 +49,38 @@ export async function createUser(email, passwordHash) {
     const [row] = (await sql() `
     INSERT INTO auth_users (email, password_hash)
     VALUES (${email}, ${passwordHash})
-    RETURNING id, email
+    RETURNING id, email, session_epoch AS epoch
   `);
     return row;
 }
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The user's current session_epoch, or null if the user is gone */
+export async function sessionEpoch(id) {
+    // A non-UUID would make Postgres throw on the cast; it can't be a user
+    if (!UUID.test(id))
+        return null;
+    await ensureSchema();
+    const rows = (await sql() `
+    SELECT session_epoch FROM auth_users WHERE id = ${id}
+  `);
+    return rows[0]?.session_epoch ?? null;
+}
+/** Revoke every session of this user. False if there is no such user. */
+export async function revokeSessions(email) {
+    await ensureSchema();
+    const rows = (await sql() `
+    UPDATE auth_users SET session_epoch = session_epoch + 1 WHERE email = ${email} RETURNING id
+  `);
+    return rows.length > 0;
+}
+/** Delete the user. Their sessions die with the row. False if none. */
+export async function removeUser(email) {
+    await ensureSchema();
+    const rows = (await sql() `
+    DELETE FROM auth_users WHERE email = ${email} RETURNING id
+  `);
+    return rows.length > 0;
+}
 export async function countUsers() {
     await ensureSchema();
     const [row] = (await sql() `SELECT COUNT(*)::int AS n FROM auth_users`);
@@ -55,10 +92,13 @@ export async function listUsers() {
     SELECT id, email, created_at FROM auth_users ORDER BY created_at
   `);
 }
+/** Change a password. Also revokes every session, old password's included. */
 export async function setPassword(email, passwordHash) {
     await ensureSchema();
     const rows = (await sql() `
-    UPDATE auth_users SET password_hash = ${passwordHash} WHERE email = ${email} RETURNING id
+    UPDATE auth_users
+    SET password_hash = ${passwordHash}, session_epoch = session_epoch + 1
+    WHERE email = ${email} RETURNING id
   `);
     return rows.length > 0;
 }

package/dist/core/session.d.ts

@@ -2,5 +2,16 @@ export type User = {
     id: string;
     email: string;
 };
-export declare function signSession(user: User, secret: string): Promise<string>;
-export declare function verifySession(token: string, secret: string): Promise<User | null>;
+/** What a valid token says: who, and under which epoch it was signed */
+export type Claim = User & {
+    epoch: number;
+};
+export declare function signSession(user: User & {
+    epoch?: number;
+}, secret: string): Promise<string>;
+export declare function verifySession(token: string, secret: string): Promise<Claim | null>;
+/**
+ * The revocation rule. `epoch` is the user's current session_epoch,
+ * or null when the user no longer exists.
+ */
+export declare function isCurrent(claim: Claim, epoch: number | null): boolean;

package/dist/core/session.js

@@ -1,15 +1,23 @@
 // ─────────────────────────────────────────────────────────────
 // Session token. A signed JWT (HS256) carried in an httpOnly cookie.
 //
-// Stateless: verifying needs the secret only, never the database.
-// That is what lets the proxy run on every request at zero cost.
-// Trade-off: a token cannot be revoked before it expires (7 days).
+// Two gates, two costs:
+//   signature  verifySession()  needs the secret only, never the
+//              database. The proxy runs this on every request, free.
+//   epoch      isCurrent()      the token carries the user's
+//              session_epoch from when it was signed. getUser() looks
+//              the user up and compares. Deleting the user (no row) or
+//              bumping the epoch (password change, sign-out-everywhere)
+//              makes every older token stop matching: revocation.
+//
+// So a revoked token still passes the proxy and loads a page shell,
+// but getUser()/requireUser() say no, and those guard the data.
 // ─────────────────────────────────────────────────────────────
 import { SignJWT, jwtVerify } from "jose";
 import { SESSION_DAYS } from "./config.js";
 const key = (secret) => new TextEncoder().encode(secret);
 export async function signSession(user, secret) {
-    return new SignJWT({ email: user.email })
+    return new SignJWT({ email: user.email, ep: user.epoch ?? 0 })
         .setProtectedHeader({ alg: "HS256" })
         .setSubject(user.id)
         .setIssuedAt()
@@ -21,9 +29,19 @@ export async function verifySession(token, secret) {
         const { payload } = await jwtVerify(token, key(secret), { algorithms: ["HS256"] });
         if (typeof payload.sub !== "string" || typeof payload.email !== "string")
             return null;
-        return { id: payload.sub, email: payload.email };
+        // Tokens from before epochs existed carry no `ep`: they count as 0,
+        // so upgrading the package signs nobody out
+        const epoch = typeof payload.ep === "number" ? payload.ep : 0;
+        return { id: payload.sub, email: payload.email, epoch };
     }
     catch {
         return null;
     }
 }
+/**
+ * The revocation rule. `epoch` is the user's current session_epoch,
+ * or null when the user no longer exists.
+ */
+export function isCurrent(claim, epoch) {
+    return epoch !== null && claim.epoch === epoch;
+}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { hashPassword, verifyPassword } from "./core/password.ts";
-export { signSession, verifySession, type User } from "./core/session.ts";
-export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.ts";
+export { isCurrent, signSession, verifySession, type Claim, type User } from "./core/session.ts";
+export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword, sessionEpoch, revokeSessions, removeUser } from "./core/db.ts";
 export { signInPage, signUpPage } from "./core/html.ts";
 export { signupPolicy, validateCredentials, type SignupPolicy } from "./core/signup.ts";
 export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";

package/dist/index.js

@@ -1,8 +1,8 @@
 // Core primitives. Framework-free. Use these if you are not on Next.js
 // or want to build your own handlers.
 export { hashPassword, verifyPassword } from "./core/password.js";
-export { signSession, verifySession } from "./core/session.js";
-export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.js";
+export { isCurrent, signSession, verifySession } from "./core/session.js";
+export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword, sessionEpoch, revokeSessions, removeUser } from "./core/db.js";
 export { signInPage, signUpPage } from "./core/html.js";
 export { signupPolicy, validateCredentials } from "./core/signup.js";
 export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";

package/dist/next/index.d.ts

@@ -5,7 +5,7 @@ export declare class AuthError extends Error {
     status: number;
     constructor(message?: string);
 }
-/** Current user from the session cookie, or null. Never touches the database. */
+/** Current user from the session cookie, or null if signed out, deleted or revoked. */
 export declare function getUser(): Promise<User | null>;
 /** Current user, or throw AuthError (status 401). */
 export declare function requireUser(): Promise<User>;

package/dist/next/index.js

@@ -16,13 +16,14 @@
 // Use anywhere on the server:
 //   const user = await requireUser()   // { id, email } or throws AuthError(401)
 //   const user = await getUser()       // { id, email } or null
+// Both check the database: a deleted user or a revoked session is null.
 // ─────────────────────────────────────────────────────────────
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
 import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_UP_PATH, getSecret } from "../core/config.js";
-import { signSession, verifySession } from "../core/session.js";
+import { isCurrent, signSession, verifySession } from "../core/session.js";
 import { hashPassword, verifyPassword } from "../core/password.js";
-import { countUsers, createUser, findUser } from "../core/db.js";
+import { countUsers, createUser, findUser, sessionEpoch } from "../core/db.js";
 import { signInPage, signUpPage } from "../core/html.js";
 import { signupPolicy, validateCredentials } from "../core/signup.js";
 export class AuthError extends Error {
@@ -32,12 +33,23 @@ export class AuthError extends Error {
         this.name = "AuthError";
     }
 }
-/** Current user from the session cookie, or null. Never touches the database. */
-export async function getUser() {
-    const token = (await cookies()).get(COOKIE_NAME)?.value;
+/**
+ * The full check, for anything that hands out data: a valid signature,
+ * AND the user still exists with the epoch the token was signed under.
+ * One indexed lookup by primary key. (The proxy skips the lookup; see
+ * core/session.ts for why that is safe.)
+ */
+async function userFromToken(token) {
     if (!token)
         return null;
-    return verifySession(token, getSecret());
+    const claim = await verifySession(token, getSecret());
+    if (!claim || !isCurrent(claim, await sessionEpoch(claim.id)))
+        return null;
+    return { id: claim.id, email: claim.email };
+}
+/** Current user from the session cookie, or null if signed out, deleted or revoked. */
+export async function getUser() {
+    return userFromToken((await cookies()).get(COOKIE_NAME)?.value);
 }
 /** Current user, or throw AuthError (status 401). */
 export async function requireUser() {
@@ -83,13 +95,13 @@ async function readBody(req) {
     };
 }
 async function currentUser(req) {
-    const token = req.cookies.get(COOKIE_NAME)?.value;
-    return token ? verifySession(token, getSecret()) : null;
+    return userFromToken(req.cookies.get(COOKIE_NAME)?.value);
 }
 /** Sign the user in on a response: cookie + redirect (form) or JSON (fetch). */
 async function signedIn(req, user, next, json) {
     const token = await signSession(user, getSecret());
-    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
+    const body = { user: { id: user.id, email: user.email } };
+    const res = json ? NextResponse.json(body) : NextResponse.redirect(new URL(next, req.url), 303);
     res.cookies.set(COOKIE_NAME, token, cookieOptions());
     return res;
 }
@@ -155,7 +167,7 @@ export async function POST(req, ctx) {
                 return NextResponse.json({ error: "Wrong email or password" }, { status: 401 });
             return backTo(req, SIGN_IN_PATH, "1", next);
         }
-        return signedIn(req, { id: row.id, email: row.email }, next, json);
+        return signedIn(req, { id: row.id, email: row.email, epoch: row.epoch }, next, json);
     }
     if (route === "sign-up") {
         const { email, password, invite, next, json } = await readBody(req);

package/dist/next/proxy.js

@@ -6,6 +6,11 @@
 //   no/invalid cookie + /api request  → 401 JSON
 //   valid cookie                      → continue
 //
+// A cheap first gate, not the last one: a revoked session (deleted
+// user, changed password) still has a valid signature and passes here.
+// getUser()/requireUser() check the database and refuse it, so no data
+// leaks; the app should treat their null/401 as "go sign in".
+//
 // The CLI writes proxy.ts with an inline `config.matcher`, because
 // Next reads the matcher statically and ignores a re-exported one.
 // This function also guards those paths itself, so a missing matcher

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@binary1702/auth",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Email + password auth for Next.js. One command: npx @binary1702/auth",
   "type": "module",
   "repository": {