@devmoods/express-extras 0.52.1 → 0.52.3

package/dist/auth/token.js

@@ -95,17 +95,18 @@ export function extractAccessTokenFromRequest(req) {
  * If the provided token is `null` the cookie will be cleared.
  */
 export function setAccessTokenCookie(res, token) {
+    const sameSite = (config.value.AUTH_COOKIE_SAME_SITE || 'strict');
     if (token == null) {
         res.cookie(ACCESS_TOKEN_COOKIE_NAME, v4(), {
             expires: new Date(1970, 0, 1),
-            sameSite: config.value.AUTH_COOKIE_SAME_SITE,
+            sameSite,
             secure: process.env.NODE_ENV === 'production',
         });
     }
     else {
         res.cookie(ACCESS_TOKEN_COOKIE_NAME, token, {
             httpOnly: true,
-            sameSite: config.value.AUTH_COOKIE_SAME_SITE,
+            sameSite,
             secure: process.env.NODE_ENV === 'production',
         });
     }

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import { type RequestHandler, Router } from 'express';
+import { type RequestHandler, type Response, type Request, Router } from 'express';
 import { TokenStorage, type AnyUser, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
 import { type RedisClient } from './redis.js';
 export * from './auth/types.js';
@@ -14,6 +14,7 @@ export interface CreateAuth<UserModel extends AnyUser> {
     createTemporaryToken(user: UserModel): Promise<string>;
     verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
+    logout: (req: Request, res: Response) => Promise<void>;
 }
 export declare class RedisTokenStorage extends TokenStorage {
     private readonly redis;

package/dist/auth.js

@@ -52,9 +52,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         }
         return accessToken;
     };
-    const logout = async (res, sessionId) => {
-        await tokenStorage.invalidate(sessionId);
-        setAccessTokenCookie(res, null);
+    const logout = async (req, res) => {
+        const token = extractAccessTokenFromRequest(req);
+        if (token) {
+            await tokenStorage.invalidate(sha256(token));
+            setAccessTokenCookie(res, null);
+        }
     };
     // Make timing attacks harder
     const jitter = (duration = 0) => new Promise((resolve) => void setTimeout(resolve, Math.max((0.5 - duration) * 1000, 200)));
@@ -80,10 +83,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             return filterUser(user);
         }));
         router.get('/logout', route(async (req, res) => {
-            const token = extractAccessTokenFromRequest(req);
-            if (token) {
-                await logout(res, sha256(token));
-            }
+            await logout(req, res);
             res.redirect(loginUrl);
         }));
         /**
@@ -139,12 +139,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                         logger.warn('request with invalid access token');
                         return next();
                     }
-                    await logout(res, sessionId);
+                    await logout(req, res);
                     throw new InvalidToken('session token expired');
                 }
                 const decoded = decodeAccessToken(token);
                 if (decoded.v !== sessionTokenVersion) {
-                    await logout(res, token);
+                    await logout(req, res);
                     throw new InvalidToken('Invalid token version');
                 }
                 let user;
@@ -152,7 +152,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     user = await getUserById(decoded.uid);
                 }
                 catch {
-                    await logout(res, token);
+                    await logout(req, res);
                     throw new InvalidToken('User not found');
                 }
                 const tokenLifetimeMs = decoded.exp * 1000 - decoded.iat * 1000;
@@ -241,5 +241,6 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
+        logout,
     };
 }

package/dist/csrf.d.ts

@@ -1,16 +1,16 @@
 import { type RequestHandler, type Request, type Response } from 'express';
 export declare const getCsrfSecret: () => string;
 export interface CsrfMiddlewareOptions {
-    excempt?: boolean;
+    exempt?: boolean;
     cookieName?: string;
     sessionIdentifier?: (req: Request) => string;
 }
 interface CsrfOptions {
-    excempt: boolean;
+    exempt: boolean;
     cookieName: string;
     sessionIdentifier: string;
 }
-export declare function csrf({ excempt, sessionIdentifier, cookieName, }?: CsrfMiddlewareOptions): RequestHandler;
+export declare function csrf({ exempt, sessionIdentifier, cookieName, }?: CsrfMiddlewareOptions): RequestHandler;
 export declare function setCsrfOptions(options: CsrfOptions): void;
 interface TokenOptions {
     overwrite?: boolean;

package/dist/csrf.js

@@ -16,7 +16,7 @@ export const getCsrfSecret = () => {
     }
     return secret;
 };
-export function csrf({ excempt = false, sessionIdentifier, cookieName, } = {}) {
+export function csrf({ exempt = false, sessionIdentifier, cookieName, } = {}) {
     return (req, res, next) => {
         const existingOptions = useCsrfOptions();
         setCsrfOptions({
@@ -24,7 +24,7 @@ export function csrf({ excempt = false, sessionIdentifier, cookieName, } = {}) {
             sessionIdentifier: sessionIdentifier
                 ? sessionIdentifier(req)
                 : existingOptions.sessionIdentifier,
-            excempt,
+            exempt,
         });
         next();
     };
@@ -35,7 +35,7 @@ export function setCsrfOptions(options) {
 }
 function useCsrfOptions() {
     return (useContext(CSRF_CONTEXT_KEY) || {
-        excempt: true,
+        exempt: true,
         cookieName: defaultCookieName(),
         sessionIdentifier: '',
     });
@@ -109,8 +109,8 @@ const validateRequest = (req) => {
 };
 export function doubleCsrfProtection(req) {
     return async () => {
-        const { excempt } = useCsrfOptions();
-        if (excempt) {
+        const { exempt } = useCsrfOptions();
+        if (exempt) {
             return;
         }
         if (ignoredMethods.has(req.method)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.52.1",
+  "version": "0.52.3",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -46,27 +46,27 @@
   "devDependencies": {
     "@devmoods/eslint-config": "^2.6.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.13.0",
+    "@types/node": "22.13.4",
     "@types/supertest": "^6.0.2",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^3.0.4",
+    "@vitest/coverage-v8": "^3.0.5",
     "arktype": "^2.0.4",
     "cookiejar": "^2.1.4",
-    "eslint": "^9.19.0",
+    "eslint": "^9.20.1",
     "faktory-worker": "^4.6.0",
-    "prettier": "3.4.2",
+    "prettier": "3.5.1",
     "supertest": "7.0.0",
     "ts-node": "10.9.2",
     "tsx": "^4.19.2",
     "typescript": "5.7.3",
-    "vite": "^6.0.11",
-    "vitest": "^3.0.4",
+    "vite": "^6.1.0",
+    "vitest": "^3.0.5",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^8.53.0",
-    "@sentry/profiling-node": "^8.53.0",
+    "@sentry/node": "^9.1.0",
+    "@sentry/profiling-node": "^9.1.0",
     "@types/bcrypt": "^5.0.2",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.0",
@@ -87,7 +87,7 @@
     "helmet": "^8.0.0",
     "jsonwebtoken": "^9.0.2",
     "nodemailer": "^6.10.0",
-    "pg": "^8.13.1",
+    "pg": "^8.13.3",
     "redis": "^4.7.0",
     "sonda": "^0.7.1",
     "sql-formatter": "^15.4.10",