@devmoods/express-extras 0.52.0 → 0.52.2

package/dist/auth/token.js

@@ -95,17 +95,18 @@ export function extractAccessTokenFromRequest(req) {
  * If the provided token is `null` the cookie will be cleared.
  */
 export function setAccessTokenCookie(res, token) {
+    const sameSite = (config.value.AUTH_COOKIE_SAME_SITE || 'strict');
     if (token == null) {
         res.cookie(ACCESS_TOKEN_COOKIE_NAME, v4(), {
             expires: new Date(1970, 0, 1),
-            sameSite: 'strict',
+            sameSite,
             secure: process.env.NODE_ENV === 'production',
         });
     }
     else {
         res.cookie(ACCESS_TOKEN_COOKIE_NAME, token, {
             httpOnly: true,
-            sameSite: 'strict',
+            sameSite,
             secure: process.env.NODE_ENV === 'production',
         });
     }

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import { type RequestHandler, Router } from 'express';
+import { type RequestHandler, type Response, type Request, Router } from 'express';
 import { TokenStorage, type AnyUser, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
 import { type RedisClient } from './redis.js';
 export * from './auth/types.js';
@@ -14,6 +14,7 @@ export interface CreateAuth<UserModel extends AnyUser> {
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
+    logout: (req: Request, res: Response) => Promise<void>;
 }
 export declare class RedisTokenStorage extends TokenStorage {
     private readonly redis;

package/dist/auth.js

@@ -52,9 +52,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         }
         return accessToken;
     };
-    const logout = async (res, sessionId) => {
-        await tokenStorage.invalidate(sessionId);
-        setAccessTokenCookie(res, null);
+    const logout = async (req, res) => {
+        const token = extractAccessTokenFromRequest(req);
+        if (token) {
+            await tokenStorage.invalidate(sha256(token));
+            setAccessTokenCookie(res, null);
+        }
     };
     // Make timing attacks harder
     const jitter = (duration = 0) => new Promise((resolve) => void setTimeout(resolve, Math.max((0.5 - duration) * 1000, 200)));
@@ -80,10 +83,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             return filterUser(user);
         }));
         router.get('/logout', route(async (req, res) => {
-            const token = extractAccessTokenFromRequest(req);
-            if (token) {
-                await logout(res, sha256(token));
-            }
+            await logout(req, res);
             res.redirect(loginUrl);
         }));
         /**
@@ -139,12 +139,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                         logger.warn('request with invalid access token');
                         return next();
                     }
-                    await logout(res, sessionId);
+                    await logout(req, res);
                     throw new InvalidToken('session token expired');
                 }
                 const decoded = decodeAccessToken(token);
                 if (decoded.v !== sessionTokenVersion) {
-                    await logout(res, token);
+                    await logout(req, res);
                     throw new InvalidToken('Invalid token version');
                 }
                 let user;
@@ -152,7 +152,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     user = await getUserById(decoded.uid);
                 }
                 catch {
-                    await logout(res, token);
+                    await logout(req, res);
                     throw new InvalidToken('User not found');
                 }
                 const tokenLifetimeMs = decoded.exp * 1000 - decoded.iat * 1000;
@@ -241,5 +241,6 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
+        logout,
     };
 }

package/dist/cache.d.ts

@@ -19,5 +19,8 @@ export declare function createCache(adapter: CacheAdapter): {
     get: (key: string) => Promise<any>;
     clear: (key?: string) => Promise<void>;
     wrap: <T>(key: string, options: CacheOptions | number | null, fn: () => Promise<T>) => Promise<T>;
-    decorate: <T, Arguments extends any[]>(options: CacheOptions | number | null, fn: (...args: Arguments) => T | Promise<T>) => (...args: Arguments) => Promise<T>;
+    decorate: <T, Arguments extends any[]>(options: CacheOptions | number | null, fn: (...args: Arguments) => T | Promise<T>) => {
+        (...args: Arguments): Promise<T>;
+        clear(...args: Arguments): Promise<void>;
+    };
 };

package/dist/cache.js

@@ -69,11 +69,14 @@ export function createCache(adapter) {
         return result;
     }
     function cachedFn(options, fn) {
-        return async (...args) => {
+        const getCacheKey = (...args) => {
             const baseKey = typeof options === 'object' && options != null
                 ? options.key
                 : undefined;
-            const cacheKey = `${baseKey ?? Buffer.from(fn.toString()).toString('hex')}-${JSON.stringify(args)}`;
+            return `${baseKey ?? Buffer.from(fn.toString()).toString('hex')}-${hashKey(args)}`;
+        };
+        const wrapped = async (...args) => {
+            const cacheKey = getCacheKey(...args);
             const cachedValue = await adapter.get(cacheKey);
             if (cachedValue != null) {
                 return cachedValue;
@@ -85,6 +88,8 @@ export function createCache(adapter) {
             await adapter.set(cacheKey, result, expiresMs);
             return result;
         };
+        wrapped.clear = (...args) => adapter.clear(getCacheKey(...args));
+        return wrapped;
     }
     return {
         set: adapter.set.bind(adapter),
@@ -94,3 +99,22 @@ export function createCache(adapter) {
         decorate: cachedFn,
     };
 }
+function hashKey(obj) {
+    return JSON.stringify(obj, (key, value) => {
+        if (value === null || value === undefined) {
+            return String(value);
+        }
+        if (typeof value === 'object') {
+            if (Array.isArray(value)) {
+                return value;
+            }
+            return Object.keys(value)
+                .sort()
+                .reduce((result, item) => {
+                result[item] = value[item];
+                return result;
+            }, {});
+        }
+        return value;
+    });
+}

package/dist/config.d.ts

@@ -6,6 +6,7 @@ export declare const config: {
         AUTH_TOKEN_EXPIRES_IN: number;
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
         AUTH_SECRET: string;
+        AUTH_COOKIE_SAME_SITE: string;
         REDIS_URL: string;
         REDIS_KEY_PREFIX: string;
         POSTGRES_URL: string;
@@ -37,6 +38,7 @@ export declare function extendConfig<T extends Record<string, unknown>>(appConfi
         AUTH_TOKEN_EXPIRES_IN: number;
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
         AUTH_SECRET: string;
+        AUTH_COOKIE_SAME_SITE: string;
         REDIS_URL: string;
         REDIS_KEY_PREFIX: string;
         POSTGRES_URL: string;

package/dist/config.js

@@ -9,6 +9,7 @@ const baseConfig = {
     AUTH_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TOKEN_EXPIRES', 3600 * 24 * 30), // 30 days
     AUTH_TEMP_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TEMP_TOKEN_EXPIRES', 3600),
     AUTH_SECRET: readEnv('AUTH_JWT_SECRET', ''),
+    AUTH_COOKIE_SAME_SITE: readEnv('AUTH_COOKIE_SAME_SITE', 'strict'),
     REDIS_URL: readEnv('REDIS_URL', ''),
     REDIS_KEY_PREFIX: readEnv('REDIS_KEY_PREFIX', ''),
     POSTGRES_URL: readEnv('POSTGRES_URL', ''),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",