@broberg/sso 0.10.1 → 0.12.0

package/README.md

@@ -204,8 +204,9 @@ run 3× in production; this package's own Hono adapter now does the same, after
 answering every failed callback with one message containing the word *"or"*.
 
 **Mount the Hono adapter on 0.3.0 or later and you get all of this for free** —
-the signed window, the longer cookie, and three distinct answers
-(`login_expired` · `no_login_in_progress` · `bad_login_cookie`). **On 0.2.3–0.2.5
+the signed window, the longer cookie, and three distinct causes
+(`expired` · `absent` · `unreadable`). **Since 0.12.0 the browser no longer sees
+all three by default**: see *What a refused login tells the browser* below. **On 0.2.3–0.2.5
 the adapter had the signed window but still used ONE number for both**, so it
 answered every failed callback with a single message containing the word *"or"*.
 Take the core and nothing is passed on your behalf, on any version. Reported by broberg-id, who found their own framework-free
@@ -474,5 +475,52 @@ access token itself (a 401 from BID). It is never a 500.
 `SsoAppApiError` (`.status`, BID's `.code`; `status` is null when BID did not
 answer). All extend `SsoError`. No message ever contains a token.
 
+**The user menu follows (since 0.11.0, F095.5).** Every successful
+`accountRoutes` answer re-signs the session cookie with the name and picture BID
+returned (`ssoRoutes().refreshSessionProfile`). sub, sid, iat and exp are kept,
+and Max-Age is what is left of the session: the lifetime is never extended.
+Nothing is written when nothing changed, and nothing is written on a refusal.
+A reload therefore shows the new name in the menu without a new login. A GET also
+picks up a change the user made in BID itself.
+
 Mail, password, passkeys, two-factor and sessions stay in BID: link to the
 profile's `account_url` in a new tab.
+
+## What a refused login tells the browser (changed in 0.12.0)
+
+**Changed default: the browser now gets ONE answer, `login_failed`, for an expired
+login AND an unreadable cookie.** Through 0.11.0 it got `login_expired` and
+`bad_login_cookie` separately. `no_login_in_progress` is unchanged.
+
+| cause | your app / log (`onCallbackRefused`) | browser, default `"single"` | browser, `"granular"` |
+|---|---|---|---|
+| no login started here | `absent` | `no_login_in_progress` | `no_login_in_progress` |
+| took too long | `expired` | `login_failed` | `login_expired` |
+| signature did not hold | `unreadable` | `login_failed` | `bad_login_cookie` |
+
+**Why.** The order in `parseTransaction` is what makes this matter, and it is not
+obvious until you read the function: the signature is checked FIRST, and the age
+only after it held. So `login_expired` is a positive confirmation that the
+cookie's HMAC held against the CURRENT secret, and `bad_login_cookie` denies it.
+Someone holding a cookie they FOUND (a log, a shared machine, a backup) could ask
+whether it is still live, see the moment the secret rotates, and see whether two
+environments share a secret. It does not help anyone forge anything. It is a
+fact the server gave away for free. Reported by helpdesk, 22 September 2026.
+
+**The operator still gets all three.** `onCallbackRefused(cause, c)` receives the
+precise cause on every refusal; without it the adapter writes
+`[@broberg/sso] /callback refused: <cause>` with `console.warn`. Watch for
+`unreadable` on real users: that is what a rotated `SSO_COOKIE_SECRET` looks like.
+
+```ts
+ssoRoutes({
+  onCallbackRefused: (cause) => log.warn({ cause }, "sso callback refused"),
+  // callbackErrors: "granular", // opt in: «dit login udløb» in the browser
+});
+```
+
+**What the opt-in costs.** `callbackErrors: "granular"` gives the browser the
+three codes back, so it can say *"your login expired, try again"*. The price is
+the one bit above, for anyone with a found cookie. Fine for an internal app behind
+a VPN; think twice on the open internet.
+

package/dist/hono.cjs

@@ -821,6 +821,8 @@ function ssoRoutes(options = {}) {
   }
   const onStoreError = backchannel?.onStoreError ?? "reject";
   const tokenStore = options.tokenStore;
+  const callbackErrors = options.callbackErrors ?? "single";
+  const onCallbackRefused = options.onCallbackRefused ?? ((cause) => console.warn(`[@broberg/sso] /callback refused: ${cause}`));
   async function liveSession(c) {
     const session = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
     if (!session || !backchannel) return session;
@@ -907,7 +909,13 @@ function ssoRoutes(options = {}) {
           message: "This browser's login cookie could not be read. Begin again from the login page."
         }
       };
-      const { status, ...body } = failures[parsed.reason];
+      await onCallbackRefused(parsed.reason, c);
+      const shown = callbackErrors === "single" && parsed.reason !== "absent" ? {
+        status: 400,
+        error: "login_failed",
+        message: "This login could not be completed. Begin again from the login page."
+      } : failures[parsed.reason];
+      const { status, ...body } = shown;
       c.header("Set-Cookie", cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }));
       return c.json(body, status);
     }
@@ -1048,7 +1056,24 @@ function ssoRoutes(options = {}) {
       refreshing.delete(sid);
     }
   }
-  return { app, attach, require: require2, client, config, getAccessToken };
+  async function refreshSessionProfile(c, profile) {
+    const live = await liveSession(c);
+    if (!live) return;
+    const next = { ...live };
+    if (profile.name) next.name = profile.name;
+    else delete next.name;
+    if (profile.picture) next.picture = profile.picture;
+    else delete next.picture;
+    if (next.name === live.name && next.picture === live.picture) return;
+    const left = live.exp - Math.floor(Date.now() / 1e3);
+    if (left <= 0) return;
+    c.header(
+      "Set-Cookie",
+      cookieHeader(config.cookieName, await signSession(next, config.cookieSecret), { maxAge: left, secure: isSecure(c) }),
+      { append: true }
+    );
+  }
+  return { app, attach, require: require2, client, config, getAccessToken, refreshSessionProfile };
 }
 async function parseTransaction(raw, secret) {
   if (raw === void 0) return { ok: false, reason: "absent" };
@@ -1109,14 +1134,18 @@ function accountRoutes(sso) {
     }
     await next();
   });
-  app.get("/profile", async (c) => c.json(await client.getProfile(await sso.getAccessToken(c))));
+  const answer = async (c, profile) => {
+    if (sso.refreshSessionProfile) await sso.refreshSessionProfile(c, profile);
+    return c.json(profile);
+  };
+  app.get("/profile", async (c) => answer(c, await client.getProfile(await sso.getAccessToken(c))));
   app.post("/profile", async (c) => {
     const token = await sso.getAccessToken(c);
     const body = await c.req.json().catch(() => null);
     if (typeof body?.name !== "string") {
       return c.json({ error: "invalid_request", error_description: '"name" must be a string' }, 400);
     }
-    return c.json(await client.updateProfile(token, body.name));
+    return answer(c, await client.updateProfile(token, body.name));
   });
   app.post("/profile/avatar", async (c) => {
     const token = await sso.getAccessToken(c);
@@ -1130,9 +1159,9 @@ function accountRoutes(sso) {
     }
     const bytes = await readCapped(c, MAX_AVATAR_BYTES);
     if (!bytes) return c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413);
-    return c.json(await client.uploadAvatar(token, bytes, type));
+    return answer(c, await client.uploadAvatar(token, bytes, type));
   });
-  app.post("/profile/avatar/remove", async (c) => c.json(await client.removeAvatar(await sso.getAccessToken(c))));
+  app.post("/profile/avatar/remove", async (c) => answer(c, await client.removeAvatar(await sso.getAccessToken(c))));
   app.onError((err, c) => {
     c.header("Cache-Control", "no-store");
     const e = err;