@broberg/sso 0.10.1 → 0.12.0

package/dist/hono.d.cts

@@ -439,7 +439,28 @@ interface SsoRoutesOptions {
      * Without it, login behaves exactly as in 0.8.0 and the tokens are dropped.
      */
     tokenStore?: TokenStore;
+    /**
+     * What the BROWSER is told when /callback refuses a login (F084.55, 0.12.0).
+     * "single" (default): an expired login and an unreadable cookie get the SAME
+     *   answer, `login_failed`. The two differ only in whether the cookie's
+     *   signature held against the current secret, and a stranger holding a
+     *   FOUND cookie must not be able to ask that.
+     * "granular": the 0.3.0–0.11.0 behaviour — `login_expired` and
+     *   `bad_login_cookie` told apart. For an app that knows its threat model
+     *   (e.g. internal, behind a VPN) and wants «dit login udløb» in the browser.
+     * `no_login_in_progress` is its own answer either way: it depends on no secret.
+     */
+    callbackErrors?: "single" | "granular";
+    /**
+     * Receives the PRECISE cause of every refused callback, whatever the browser
+     * was told — this is the operator's channel. `unreadable` on a real user's
+     * browser is what a rotated SSO_COOKIE_SECRET looks like from outside.
+     * Without it, the cause is written with console.warn so the log still has it.
+     */
+    onCallbackRefused?: (cause: CallbackRefusal, c: Context) => void | Promise<void>;
 }
+/** Why /callback refused: no login started here · too old · signature did not hold. */
+type CallbackRefusal = "absent" | "expired" | "unreadable";
 declare function ssoRoutes(options?: SsoRoutesOptions): {
     app: Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
     attach: MiddlewareHandler;
@@ -447,6 +468,10 @@ declare function ssoRoutes(options?: SsoRoutesOptions): {
     client: SsoClient;
     config: SsoConfig;
     getAccessToken: (c: Context) => Promise<string>;
+    refreshSessionProfile: (c: Context, profile: {
+        name: string | null;
+        picture: string | null;
+    }) => Promise<void>;
 };
 /** Why a login transaction could not be read back. Three states, three answers. */
 type TransactionFailure = "absent" | "expired" | "unreadable";
@@ -456,6 +481,15 @@ declare function getSession(c: Context): SessionPayload | null;
 interface AccountRoutesInput {
     client: Pick<SsoClient, "getProfile" | "updateProfile" | "uploadAvatar" | "removeAvatar">;
     getAccessToken(c: Context): Promise<string>;
+    /**
+     * F095.5 — re-sign the session cookie with the profile BID answered, so the
+     * user menu shows the new name and picture on the next page load. ssoRoutes
+     * provides it; optional so an older or hand-built input still works.
+     */
+    refreshSessionProfile?(c: Context, profile: {
+        name: string | null;
+        picture: string | null;
+    }): Promise<void>;
 }
 /**
  * The signed-in user's own name and picture, for the app's account page.
@@ -476,4 +510,4 @@ interface AccountRoutesInput {
  */
 declare function accountRoutes(sso: AccountRoutesInput): Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
 
-export { type AccountRoutesInput, type BackchannelOptions, type BackchannelStore, type SsoRoutesOptions, type TransactionFailure, accountRoutes, getSession, ssoRoutes };
+export { type AccountRoutesInput, type BackchannelOptions, type BackchannelStore, type CallbackRefusal, type SsoRoutesOptions, type TransactionFailure, accountRoutes, getSession, ssoRoutes };

package/dist/hono.d.ts

@@ -439,7 +439,28 @@ interface SsoRoutesOptions {
      * Without it, login behaves exactly as in 0.8.0 and the tokens are dropped.
      */
     tokenStore?: TokenStore;
+    /**
+     * What the BROWSER is told when /callback refuses a login (F084.55, 0.12.0).
+     * "single" (default): an expired login and an unreadable cookie get the SAME
+     *   answer, `login_failed`. The two differ only in whether the cookie's
+     *   signature held against the current secret, and a stranger holding a
+     *   FOUND cookie must not be able to ask that.
+     * "granular": the 0.3.0–0.11.0 behaviour — `login_expired` and
+     *   `bad_login_cookie` told apart. For an app that knows its threat model
+     *   (e.g. internal, behind a VPN) and wants «dit login udløb» in the browser.
+     * `no_login_in_progress` is its own answer either way: it depends on no secret.
+     */
+    callbackErrors?: "single" | "granular";
+    /**
+     * Receives the PRECISE cause of every refused callback, whatever the browser
+     * was told — this is the operator's channel. `unreadable` on a real user's
+     * browser is what a rotated SSO_COOKIE_SECRET looks like from outside.
+     * Without it, the cause is written with console.warn so the log still has it.
+     */
+    onCallbackRefused?: (cause: CallbackRefusal, c: Context) => void | Promise<void>;
 }
+/** Why /callback refused: no login started here · too old · signature did not hold. */
+type CallbackRefusal = "absent" | "expired" | "unreadable";
 declare function ssoRoutes(options?: SsoRoutesOptions): {
     app: Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
     attach: MiddlewareHandler;
@@ -447,6 +468,10 @@ declare function ssoRoutes(options?: SsoRoutesOptions): {
     client: SsoClient;
     config: SsoConfig;
     getAccessToken: (c: Context) => Promise<string>;
+    refreshSessionProfile: (c: Context, profile: {
+        name: string | null;
+        picture: string | null;
+    }) => Promise<void>;
 };
 /** Why a login transaction could not be read back. Three states, three answers. */
 type TransactionFailure = "absent" | "expired" | "unreadable";
@@ -456,6 +481,15 @@ declare function getSession(c: Context): SessionPayload | null;
 interface AccountRoutesInput {
     client: Pick<SsoClient, "getProfile" | "updateProfile" | "uploadAvatar" | "removeAvatar">;
     getAccessToken(c: Context): Promise<string>;
+    /**
+     * F095.5 — re-sign the session cookie with the profile BID answered, so the
+     * user menu shows the new name and picture on the next page load. ssoRoutes
+     * provides it; optional so an older or hand-built input still works.
+     */
+    refreshSessionProfile?(c: Context, profile: {
+        name: string | null;
+        picture: string | null;
+    }): Promise<void>;
 }
 /**
  * The signed-in user's own name and picture, for the app's account page.
@@ -476,4 +510,4 @@ interface AccountRoutesInput {
  */
 declare function accountRoutes(sso: AccountRoutesInput): Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
 
-export { type AccountRoutesInput, type BackchannelOptions, type BackchannelStore, type SsoRoutesOptions, type TransactionFailure, accountRoutes, getSession, ssoRoutes };
+export { type AccountRoutesInput, type BackchannelOptions, type BackchannelStore, type CallbackRefusal, type SsoRoutesOptions, type TransactionFailure, accountRoutes, getSession, ssoRoutes };

package/dist/hono.js

@@ -819,6 +819,8 @@ function ssoRoutes(options = {}) {
   }
   const onStoreError = backchannel?.onStoreError ?? "reject";
   const tokenStore = options.tokenStore;
+  const callbackErrors = options.callbackErrors ?? "single";
+  const onCallbackRefused = options.onCallbackRefused ?? ((cause) => console.warn(`[@broberg/sso] /callback refused: ${cause}`));
   async function liveSession(c) {
     const session = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
     if (!session || !backchannel) return session;
@@ -905,7 +907,13 @@ function ssoRoutes(options = {}) {
           message: "This browser's login cookie could not be read. Begin again from the login page."
         }
       };
-      const { status, ...body } = failures[parsed.reason];
+      await onCallbackRefused(parsed.reason, c);
+      const shown = callbackErrors === "single" && parsed.reason !== "absent" ? {
+        status: 400,
+        error: "login_failed",
+        message: "This login could not be completed. Begin again from the login page."
+      } : failures[parsed.reason];
+      const { status, ...body } = shown;
       c.header("Set-Cookie", cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }));
       return c.json(body, status);
     }
@@ -1046,7 +1054,24 @@ function ssoRoutes(options = {}) {
       refreshing.delete(sid);
     }
   }
-  return { app, attach, require: require2, client, config, getAccessToken };
+  async function refreshSessionProfile(c, profile) {
+    const live = await liveSession(c);
+    if (!live) return;
+    const next = { ...live };
+    if (profile.name) next.name = profile.name;
+    else delete next.name;
+    if (profile.picture) next.picture = profile.picture;
+    else delete next.picture;
+    if (next.name === live.name && next.picture === live.picture) return;
+    const left = live.exp - Math.floor(Date.now() / 1e3);
+    if (left <= 0) return;
+    c.header(
+      "Set-Cookie",
+      cookieHeader(config.cookieName, await signSession(next, config.cookieSecret), { maxAge: left, secure: isSecure(c) }),
+      { append: true }
+    );
+  }
+  return { app, attach, require: require2, client, config, getAccessToken, refreshSessionProfile };
 }
 async function parseTransaction(raw, secret) {
   if (raw === void 0) return { ok: false, reason: "absent" };
@@ -1107,14 +1132,18 @@ function accountRoutes(sso) {
     }
     await next();
   });
-  app.get("/profile", async (c) => c.json(await client.getProfile(await sso.getAccessToken(c))));
+  const answer = async (c, profile) => {
+    if (sso.refreshSessionProfile) await sso.refreshSessionProfile(c, profile);
+    return c.json(profile);
+  };
+  app.get("/profile", async (c) => answer(c, await client.getProfile(await sso.getAccessToken(c))));
   app.post("/profile", async (c) => {
     const token = await sso.getAccessToken(c);
     const body = await c.req.json().catch(() => null);
     if (typeof body?.name !== "string") {
       return c.json({ error: "invalid_request", error_description: '"name" must be a string' }, 400);
     }
-    return c.json(await client.updateProfile(token, body.name));
+    return answer(c, await client.updateProfile(token, body.name));
   });
   app.post("/profile/avatar", async (c) => {
     const token = await sso.getAccessToken(c);
@@ -1128,9 +1157,9 @@ function accountRoutes(sso) {
     }
     const bytes = await readCapped(c, MAX_AVATAR_BYTES);
     if (!bytes) return c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413);
-    return c.json(await client.uploadAvatar(token, bytes, type));
+    return answer(c, await client.uploadAvatar(token, bytes, type));
   });
-  app.post("/profile/avatar/remove", async (c) => c.json(await client.removeAvatar(await sso.getAccessToken(c))));
+  app.post("/profile/avatar/remove", async (c) => answer(c, await client.removeAvatar(await sso.getAccessToken(c))));
   app.onError((err, c) => {
     c.header("Cache-Control", "no-store");
     const e = err;