@devmoods/express-extras 0.44.0 → 0.44.1

package/dist/auth.js

@@ -170,7 +170,7 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
                 await redis.del(token);
             }
             setAccessTokenCookie(res, null);
-            res.redirect('/');
+            res.redirect(loginUrl);
         }));
         /**
          * Check that a reset token is valid.
@@ -230,25 +230,32 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
                     throw new InvalidToken('token expired');
                 }
                 const decoded = decodeAuthToken(token);
+                let user;
                 try {
-                    const user = await getUserByToken(decoded);
-                    if (options.isAuthorized && !(await options.isAuthorized(user))) {
-                        throw Forbidden('Permission denied');
-                    }
-                    setCurrentUser(user);
+                    user = await getUserByToken(decoded);
                 }
                 catch {
                     throw new InvalidToken('User not found');
                 }
+                if (options.isAuthorized && !(await options.isAuthorized(user))) {
+                    throw new PermissionDenied('Permission denied');
+                }
+                setCurrentUser(user);
                 next();
             }
             catch (error) {
                 logger.error(error);
+                if (error instanceof PermissionDenied) {
+                    if (req.accepts('html')) {
+                        return res.redirect(loginUrl);
+                    }
+                    return next(Forbidden('Permission denied'));
+                }
                 if (error instanceof InvalidToken) {
                     if (req.accepts('html')) {
                         return res.redirect(loginUrl);
                     }
-                    next(Unauthorized('Invalid token'));
+                    return next(Unauthorized('Invalid token'));
                 }
                 next(error);
             }
@@ -347,6 +354,12 @@ class InvalidToken extends Error {
         this.name = 'Invalid Token';
     }
 }
+class PermissionDenied extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'Permission Denied';
+    }
+}
 /**
  * Compare two password hashes using bcrypt.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",