@cauthyhq/node 1.2.0 → 1.2.1

package/dist/index.mjs

@@ -54,9 +54,12 @@ async function unseal(sealed, key) {
   }
 }
 async function unsealAny(sealed, ring) {
-  for (const key of ring) {
-    const value = await unseal(sealed, key);
-    if (value !== null) return value;
+  return (await unsealIndexed(sealed, ring))?.value ?? null;
+}
+async function unsealIndexed(sealed, ring) {
+  for (let index = 0; index < ring.length; index++) {
+    const value = await unseal(sealed, ring[index]);
+    if (value !== null) return { value, index };
   }
   return null;
 }
@@ -2304,12 +2307,13 @@ function byKey(given) {
   }
   const legacySecret = env3("CAUTHY_SECRET") || void 0;
   const legacyRoot = env3("PACT_ROOT_KEY") || void 0;
+  const legacyRootPrevious = legacyRoot ? env3("PACT_ROOT_KEY_PREVIOUS") || void 0 : void 0;
   if (legacySecret) deprecated("CAUTHY_SECRET beside CAUTHY_KEY", "It is read only for sessions made before the move: remove it after the rotation window.");
   if (legacyRoot) deprecated("PACT_ROOT_KEY beside CAUTHY_KEY", "It is read only for sessions made before the move: remove it, the keys option and its table after the rotation window.");
   if (given.keys && !(legacyRoot && given.contract)) {
     throw new CauthyConfigError("with CAUTHY_KEY the application keeps no key store: remove keys (it is read only beside PACT_ROOT_KEY and a contract, while moving)");
   }
-  return { key, previous, legacySecret, legacyRoot };
+  return { key, previous, legacySecret, legacyRoot, legacyRootPrevious };
 }
 var UnknownOriginError = class extends Error {
   constructor(origin, registered) {
@@ -2349,6 +2353,12 @@ function byContract(given) {
   return { contract, root, previous: given.rootKeyPrevious ?? env3("PACT_ROOT_KEY_PREVIOUS") };
 }
 var toldOfHeader = false;
+var toldOfUnopened = false;
+function toldUnopened() {
+  if (toldOfUnopened) return;
+  toldOfUnopened = true;
+  console.warn("@cauthyhq/node: a session cookie arrived that no key of this application opens; it was cleared and the person is signed out. Moving to CAUTHY_KEY, keep the secret that sealed the old sessions (CAUTHY_SECRET, or PACT_ROOT_KEY and PACT_ROOT_KEY_PREVIOUS) beside it for the rotation window; rotating the key, set CAUTHY_KEY_PREVIOUS.");
+}
 function createCauthy(given = {}) {
   const keyed = byKey(given);
   const pacted = given.contract && !keyed ? byContract(given) : void 0;
@@ -2370,11 +2380,11 @@ function createCauthy(given = {}) {
   }, () => void 0);
   const derived = pacted ? deriveKeys(pacted.root, pacted.previous) : void 0;
   const single = derived || fromKey ? void 0 : keyOf(secret).then((k) => [k]);
-  const legacyRings = keyed?.legacyRoot ? deriveKeys(keyed.legacyRoot) : void 0;
+  const legacyRings = keyed?.legacyRoot ? deriveKeys(keyed.legacyRoot, keyed.legacyRootPrevious) : void 0;
   const legacySingle = keyed?.legacySecret ? keyOf(keyed.legacySecret) : void 0;
   const withLegacy = async (own, purpose) => [
     ...await own,
-    ...legacyRings ? [(await legacyRings[purpose])[0]] : [],
+    ...legacyRings ? await legacyRings[purpose] : [],
     ...legacySingle ? [await legacySingle] : []
   ];
   const cookieKeys = fromKey ? withLegacy(fromKey.cookie, "cookie") : derived?.cookie ?? single;
@@ -2540,10 +2550,11 @@ function createCauthy(given = {}) {
   async function read(request) {
     const had = readCookies(request.headers.get("cookie"));
     const raw = readParts(had, cookieName);
-    if (raw === null) return { had, value: null, present: false };
-    const value = await unsealAny(raw, await cookieKeys);
+    if (raw === null) return { had, value: null, present: false, stale: false };
+    const opened = await unsealIndexed(raw, await cookieKeys);
+    const value = opened?.value ?? null;
     const sound = value !== null && typeof value.at === "string" && typeof value.rt === "string" && typeof value.exp === "number";
-    return { had, value: sound ? value : null, present: true };
+    return { had, value: sound ? value : null, present: true, stale: sound && opened.index > 0 };
   }
   async function write(request, s, had) {
     return writeParts(cookieName, await seal(s, (await cookieKeys)[0]), attrs(request, s.p === 1 ? PERSISTENT_SECONDS : void 0), had);
@@ -2580,12 +2591,13 @@ function createCauthy(given = {}) {
     return running;
   }
   async function resolve2(request) {
-    const { had, value, present } = await read(request);
+    const { had, value, present, stale } = await read(request);
     if (value === null) {
+      if (present) toldUnopened();
       return { session: null, status: "unauthenticated", cookies: present ? clearParts(cookieName, attrs(request, 0), had) : [] };
     }
     if (unverified(value.u)) return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };
-    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: [] };
+    if (fresh(value)) return { session: toSession(value), status: "authenticated", cookies: stale ? await write(request, value, had) : [] };
     const renewed = await renew(value);
     if (renewed === "ended") {
       return { session: null, status: "unauthenticated", cookies: clearParts(cookieName, attrs(request, 0), had) };