@devmoods/express-extras 0.52.1 → 0.52.2

package/dist/auth/token.js

@@ -95,17 +95,18 @@ export function extractAccessTokenFromRequest(req) {
  * If the provided token is `null` the cookie will be cleared.
  */
 export function setAccessTokenCookie(res, token) {
+    const sameSite = (config.value.AUTH_COOKIE_SAME_SITE || 'strict');
     if (token == null) {
         res.cookie(ACCESS_TOKEN_COOKIE_NAME, v4(), {
             expires: new Date(1970, 0, 1),
-            sameSite: config.value.AUTH_COOKIE_SAME_SITE,
+            sameSite,
             secure: process.env.NODE_ENV === 'production',
         });
     }
     else {
         res.cookie(ACCESS_TOKEN_COOKIE_NAME, token, {
             httpOnly: true,
-            sameSite: config.value.AUTH_COOKIE_SAME_SITE,
+            sameSite,
             secure: process.env.NODE_ENV === 'production',
         });
     }

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import { type RequestHandler, Router } from 'express';
+import { type RequestHandler, type Response, type Request, Router } from 'express';
 import { TokenStorage, type AnyUser, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
 import { type RedisClient } from './redis.js';
 export * from './auth/types.js';
@@ -14,6 +14,7 @@ export interface CreateAuth<UserModel extends AnyUser> {
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
+    logout: (req: Request, res: Response) => Promise<void>;
 }
 export declare class RedisTokenStorage extends TokenStorage {
     private readonly redis;

package/dist/auth.js

@@ -52,9 +52,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         }
         return accessToken;
     };
-    const logout = async (res, sessionId) => {
-        await tokenStorage.invalidate(sessionId);
-        setAccessTokenCookie(res, null);
+    const logout = async (req, res) => {
+        const token = extractAccessTokenFromRequest(req);
+        if (token) {
+            await tokenStorage.invalidate(sha256(token));
+            setAccessTokenCookie(res, null);
+        }
     };
     // Make timing attacks harder
     const jitter = (duration = 0) => new Promise((resolve) => void setTimeout(resolve, Math.max((0.5 - duration) * 1000, 200)));
@@ -80,10 +83,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             return filterUser(user);
         }));
         router.get('/logout', route(async (req, res) => {
-            const token = extractAccessTokenFromRequest(req);
-            if (token) {
-                await logout(res, sha256(token));
-            }
+            await logout(req, res);
             res.redirect(loginUrl);
         }));
         /**
@@ -139,12 +139,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                         logger.warn('request with invalid access token');
                         return next();
                     }
-                    await logout(res, sessionId);
+                    await logout(req, res);
                     throw new InvalidToken('session token expired');
                 }
                 const decoded = decodeAccessToken(token);
                 if (decoded.v !== sessionTokenVersion) {
-                    await logout(res, token);
+                    await logout(req, res);
                     throw new InvalidToken('Invalid token version');
                 }
                 let user;
@@ -152,7 +152,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     user = await getUserById(decoded.uid);
                 }
                 catch {
-                    await logout(res, token);
+                    await logout(req, res);
                     throw new InvalidToken('User not found');
                 }
                 const tokenLifetimeMs = decoded.exp * 1000 - decoded.iat * 1000;
@@ -241,5 +241,6 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
+        logout,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.52.1",
+  "version": "0.52.2",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",