@dotpress/auth 1.1.2 → 1.2.0

package/dist/__tests__/functional/handlers.test.js

@@ -110,6 +110,8 @@ describe('Handlers', () => {
                 userId: '101',
                 accessToken: 'acc-111222333',
                 refreshToken: 'ref-999888777',
+                expiresIn: expect.any(Number),
+                expiresAt: expect.any(String),
             });
         });
     });
@@ -159,6 +161,8 @@ describe('Handlers', () => {
                 userId: '102',
                 accessToken: '111222333',
                 refreshToken: '111111111',
+                expiresIn: expect.any(Number),
+                expiresAt: expect.any(String),
             });
             expect(generateTokenFn).toHaveBeenCalledTimes(1);
             expect(generateTokenFn).toHaveBeenCalledWith({

package/dist/__tests__/unit/cookies.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/unit/cookies.test.js

@@ -0,0 +1,466 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { getCookieSettings, setAuthCookies, clearAuthCookies, detectAuthMode, extractTokensFromRequest, extractAccessToken, calculateExpiration, } from '../../lib/cookies.js';
+import { setSettings } from '../../lib/settings.js';
+describe('Cookie Utilities', () => {
+    beforeEach(() => {
+        // Reset settings before each test
+        setSettings({
+            keys: {
+                secretKey: 'test-secret',
+                publicKey: 'test-public',
+            },
+            dataProvider: {
+                storeRefreshToken: vi.fn(),
+                findRefreshToken: vi.fn(),
+                markRefreshTokenAsUsed: vi.fn(),
+                revokeTokens: vi.fn(),
+                findUserById: vi.fn(),
+                findUserIdentifiers: vi.fn(),
+            },
+        });
+    });
+    describe('getCookieSettings', () => {
+        it('should return default settings when no cookies config provided', () => {
+            const settings = getCookieSettings();
+            expect(settings).toMatchObject({
+                enabled: false,
+                httpOnly: true,
+                secure: expect.any(Boolean),
+                sameSite: 'lax',
+                path: '/',
+                accessTokenName: 'dotpress_access_token',
+                refreshTokenName: 'dotpress_refresh_token',
+                accessTokenInCookie: false,
+            });
+        });
+        it('should merge custom settings with defaults', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    domain: '.example.com',
+                    accessTokenName: 'custom_access',
+                },
+            });
+            const settings = getCookieSettings();
+            expect(settings).toMatchObject({
+                enabled: true,
+                domain: '.example.com',
+                accessTokenName: 'custom_access',
+                refreshTokenName: 'dotpress_refresh_token', // Default
+            });
+        });
+    });
+    describe('setAuthCookies', () => {
+        it('should not set cookies when cookies are disabled', () => {
+            // Ensure cookies are disabled
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: false,
+                },
+            });
+            const mockRes = {
+                cookie: vi.fn(),
+            };
+            setAuthCookies(mockRes, { accessToken: 'acc-token', refreshToken: 'ref-token' }, 3600);
+            expect(mockRes.cookie).not.toHaveBeenCalled();
+        });
+        it('should set refresh token cookie when enabled', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    secure: false,
+                },
+            });
+            const mockRes = {
+                cookie: vi.fn(),
+            };
+            setAuthCookies(mockRes, { accessToken: 'acc-token', refreshToken: 'ref-token' }, 3600);
+            expect(mockRes.cookie).toHaveBeenCalledWith('dotpress_refresh_token', 'ref-token', expect.objectContaining({
+                httpOnly: true,
+                secure: false,
+                sameSite: 'lax',
+                path: '/',
+                maxAge: 3600000,
+            }));
+            // Access token should NOT be set by default
+            expect(mockRes.cookie).toHaveBeenCalledTimes(1);
+        });
+        it('should set both cookies when accessTokenInCookie is true', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    secure: false,
+                    accessTokenInCookie: true,
+                },
+            });
+            const mockRes = {
+                cookie: vi.fn(),
+            };
+            setAuthCookies(mockRes, { accessToken: 'acc-token', refreshToken: 'ref-token' }, 3600);
+            expect(mockRes.cookie).toHaveBeenCalledTimes(2);
+            expect(mockRes.cookie).toHaveBeenCalledWith('dotpress_access_token', 'acc-token', expect.any(Object));
+            expect(mockRes.cookie).toHaveBeenCalledWith('dotpress_refresh_token', 'ref-token', expect.any(Object));
+        });
+        it('should use custom cookie names', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    secure: false,
+                    accessTokenName: 'my_access',
+                    refreshTokenName: 'my_refresh',
+                },
+            });
+            const mockRes = {
+                cookie: vi.fn(),
+            };
+            setAuthCookies(mockRes, { accessToken: 'acc-token', refreshToken: 'ref-token' }, 3600);
+            expect(mockRes.cookie).toHaveBeenCalledWith('my_refresh', 'ref-token', expect.any(Object));
+        });
+        it('should set domain when configured', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    secure: false,
+                    domain: '.example.com',
+                },
+            });
+            const mockRes = {
+                cookie: vi.fn(),
+            };
+            setAuthCookies(mockRes, { accessToken: 'acc-token', refreshToken: 'ref-token' }, 3600);
+            expect(mockRes.cookie).toHaveBeenCalledWith('dotpress_refresh_token', 'ref-token', expect.objectContaining({
+                domain: '.example.com',
+            }));
+        });
+    });
+    describe('clearAuthCookies', () => {
+        it('should not clear cookies when disabled', () => {
+            // Ensure cookies are disabled
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: false,
+                },
+            });
+            const mockRes = {
+                clearCookie: vi.fn(),
+            };
+            clearAuthCookies(mockRes);
+            expect(mockRes.clearCookie).not.toHaveBeenCalled();
+        });
+        it('should clear refresh token cookie when enabled', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    secure: false,
+                },
+            });
+            const mockRes = {
+                clearCookie: vi.fn(),
+            };
+            clearAuthCookies(mockRes);
+            expect(mockRes.clearCookie).toHaveBeenCalledWith('dotpress_refresh_token', expect.objectContaining({
+                httpOnly: true,
+                secure: false,
+                sameSite: 'lax',
+                path: '/',
+            }));
+        });
+        it('should clear both cookies when accessTokenInCookie is true', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    secure: false,
+                    accessTokenInCookie: true,
+                },
+            });
+            const mockRes = {
+                clearCookie: vi.fn(),
+            };
+            clearAuthCookies(mockRes);
+            expect(mockRes.clearCookie).toHaveBeenCalledTimes(2);
+            expect(mockRes.clearCookie).toHaveBeenCalledWith('dotpress_access_token', expect.any(Object));
+            expect(mockRes.clearCookie).toHaveBeenCalledWith('dotpress_refresh_token', expect.any(Object));
+        });
+    });
+    describe('detectAuthMode', () => {
+        it('should return "cookie" when refresh token cookie is present', () => {
+            const mockReq = {
+                cookies: {
+                    dotpress_refresh_token: 'ref-token',
+                },
+            };
+            const mode = detectAuthMode(mockReq);
+            expect(mode).toBe('cookie');
+        });
+        it('should return "body" when refresh token is in body', () => {
+            const mockReq = {
+                cookies: {},
+                body: {
+                    refreshToken: 'ref-token',
+                },
+            };
+            const mode = detectAuthMode(mockReq);
+            expect(mode).toBe('body');
+        });
+        it('should prioritize cookies over body', () => {
+            const mockReq = {
+                cookies: {
+                    dotpress_refresh_token: 'cookie-ref-token',
+                },
+                body: {
+                    refreshToken: 'body-ref-token',
+                },
+            };
+            const mode = detectAuthMode(mockReq);
+            expect(mode).toBe('cookie');
+        });
+        it('should return null when no tokens found', () => {
+            const mockReq = {
+                cookies: {},
+                body: {},
+            };
+            const mode = detectAuthMode(mockReq);
+            expect(mode).toBeNull();
+        });
+        it('should work with custom cookie names', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    refreshTokenName: 'custom_refresh',
+                },
+            });
+            const mockReq = {
+                cookies: {
+                    custom_refresh: 'ref-token',
+                },
+            };
+            const mode = detectAuthMode(mockReq);
+            expect(mode).toBe('cookie');
+        });
+    });
+    describe('extractTokensFromRequest', () => {
+        it('should extract tokens from cookies', () => {
+            // Ensure cookies are enabled with default settings
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                },
+            });
+            const mockReq = {
+                cookies: {
+                    dotpress_refresh_token: 'ref-token',
+                },
+                body: {
+                    accessToken: 'acc-token-from-body',
+                },
+            };
+            const tokens = extractTokensFromRequest(mockReq);
+            expect(tokens).toEqual({
+                accessToken: 'acc-token-from-body',
+                refreshToken: 'ref-token',
+            });
+        });
+        it('should extract tokens from body when no cookies', () => {
+            const mockReq = {
+                cookies: {},
+                body: {
+                    accessToken: 'acc-token',
+                    refreshToken: 'ref-token',
+                },
+            };
+            const tokens = extractTokensFromRequest(mockReq);
+            expect(tokens).toEqual({
+                accessToken: 'acc-token',
+                refreshToken: 'ref-token',
+            });
+        });
+        it('should extract both tokens from cookies when accessTokenInCookie is true', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    accessTokenInCookie: true,
+                },
+            });
+            const mockReq = {
+                cookies: {
+                    dotpress_access_token: 'acc-token-cookie',
+                    dotpress_refresh_token: 'ref-token-cookie',
+                },
+                body: {},
+            };
+            const tokens = extractTokensFromRequest(mockReq);
+            expect(tokens).toEqual({
+                accessToken: 'acc-token-cookie',
+                refreshToken: 'ref-token-cookie',
+            });
+        });
+        it('should return null when tokens are missing', () => {
+            const mockReq = {
+                cookies: {
+                    dotpress_refresh_token: 'ref-token',
+                },
+                body: {},
+            };
+            const tokens = extractTokensFromRequest(mockReq);
+            expect(tokens).toBeNull();
+        });
+    });
+    describe('extractAccessToken', () => {
+        it('should prioritize Authorization header', () => {
+            const mockReq = {
+                headers: {
+                    authorization: 'Bearer header-token',
+                },
+                cookies: {
+                    dotpress_access_token: 'cookie-token',
+                },
+                body: {
+                    accessToken: 'body-token',
+                },
+            };
+            const token = extractAccessToken(mockReq);
+            expect(token).toBe('header-token');
+        });
+        it('should extract from cookie when no header and accessTokenInCookie is true', () => {
+            setSettings({
+                keys: {
+                    secretKey: 'test-secret',
+                    publicKey: 'test-public',
+                },
+                dataProvider: {},
+                cookies: {
+                    enabled: true,
+                    accessTokenInCookie: true,
+                },
+            });
+            const mockReq = {
+                headers: {},
+                cookies: {
+                    dotpress_access_token: 'cookie-token',
+                },
+                body: {
+                    accessToken: 'body-token',
+                },
+            };
+            const token = extractAccessToken(mockReq);
+            expect(token).toBe('cookie-token');
+        });
+        it('should extract from body as fallback', () => {
+            const mockReq = {
+                headers: {},
+                cookies: {},
+                body: {
+                    accessToken: 'body-token',
+                },
+            };
+            const token = extractAccessToken(mockReq);
+            expect(token).toBe('body-token');
+        });
+        it('should return null when no token found', () => {
+            const mockReq = {
+                headers: {},
+                cookies: {},
+                body: {},
+            };
+            const token = extractAccessToken(mockReq);
+            expect(token).toBeNull();
+        });
+        it('should handle Authorization header without Bearer prefix', () => {
+            const mockReq = {
+                headers: {
+                    authorization: 'invalid-format',
+                },
+                cookies: {},
+                body: {},
+            };
+            const token = extractAccessToken(mockReq);
+            expect(token).toBeNull();
+        });
+    });
+    describe('calculateExpiration', () => {
+        it('should calculate correct expiration timestamp', () => {
+            const expiresInSeconds = 3600;
+            const before = Date.now();
+            const result = calculateExpiration(expiresInSeconds);
+            const after = Date.now();
+            expect(result.expiresIn).toBe(3600);
+            expect(result.expiresAt).toBeDefined();
+            const expiresAt = new Date(result.expiresAt).getTime();
+            expect(expiresAt).toBeGreaterThanOrEqual(before + 3600 * 1000);
+            expect(expiresAt).toBeLessThanOrEqual(after + 3600 * 1000);
+        });
+        it('should return ISO string format for expiresAt', () => {
+            const result = calculateExpiration(1800);
+            expect(result.expiresAt).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/);
+        });
+        it('should handle different TTL values', () => {
+            const result1 = calculateExpiration(60); // 1 minute
+            const result2 = calculateExpiration(86400); // 1 day
+            expect(result1.expiresIn).toBe(60);
+            expect(result2.expiresIn).toBe(86400);
+            const date1 = new Date(result1.expiresAt);
+            const date2 = new Date(result2.expiresAt);
+            expect(date2.getTime() - date1.getTime()).toBeGreaterThan(86000000); // Roughly 1 day
+        });
+    });
+});

package/dist/index.js

@@ -1,4 +1,5 @@
 import bcrypt from 'bcryptjs';
+import cookieParser from 'cookie-parser';
 import { setSettings } from './lib/settings.js';
 import { registerHandlers } from './lib/handlers.js';
 import { attachAuthenticatedUser } from './lib/middleware.js';
@@ -7,6 +8,9 @@ export const configurePlugin = (settings) => {
     setSettings(settings);
     return (plugin) => {
         plugin.useBeforeRoutes((app) => {
+            if (settings.cookies?.enabled) {
+                app.use(cookieParser());
+            }
             app.use(attachAuthenticatedUser);
         });
         registerHandlers(plugin);

package/dist/lib/cookies.d.ts

@@ -0,0 +1,42 @@
+import type { Response, Request } from 'express';
+import type { CookieSettings, AuthMode } from '../types/types.js';
+type ResolvedCookieSettings = Required<Omit<CookieSettings, 'domain'>> & {
+    domain?: string;
+};
+export declare const getCookieSettings: () => ResolvedCookieSettings;
+/**
+ * Set authentication cookies on the response
+ */
+export declare const setAuthCookies: (res: Response, tokens: {
+    accessToken: string;
+    refreshToken: string;
+}, expiresInSeconds: number) => void;
+/**
+ * Clear authentication cookies
+ */
+export declare const clearAuthCookies: (res: Response) => void;
+/**
+ * Detect authentication mode from request
+ * Priority: cookies first, then body
+ */
+export declare const detectAuthMode: (req: Request) => AuthMode | null;
+/**
+ * Extract tokens from request based on detected mode
+ */
+export declare const extractTokensFromRequest: (req: Request) => {
+    accessToken: string;
+    refreshToken: string;
+} | null;
+/**
+ * Extract access token from request
+ * Priority: Authorization header > cookie > body
+ */
+export declare const extractAccessToken: (req: Request) => string | null;
+/**
+ * Calculate expiration timestamp
+ */
+export declare const calculateExpiration: (expiresInSeconds: number) => {
+    expiresIn: number;
+    expiresAt: string;
+};
+export {};

package/dist/lib/cookies.js

@@ -0,0 +1,136 @@
+import { getSettings } from './settings.js';
+const DEFAULT_COOKIE_SETTINGS = {
+    enabled: false,
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/',
+    accessTokenName: 'dotpress_access_token',
+    refreshTokenName: 'dotpress_refresh_token',
+    accessTokenInCookie: false,
+    domain: undefined,
+};
+export const getCookieSettings = () => {
+    const settings = getSettings();
+    return {
+        ...DEFAULT_COOKIE_SETTINGS,
+        ...settings.cookies,
+    };
+};
+/**
+ * Set authentication cookies on the response
+ */
+export const setAuthCookies = (res, tokens, expiresInSeconds) => {
+    const cookieSettings = getCookieSettings();
+    if (!cookieSettings.enabled) {
+        return;
+    }
+    const cookieOptions = {
+        httpOnly: cookieSettings.httpOnly,
+        secure: cookieSettings.secure,
+        sameSite: cookieSettings.sameSite,
+        path: cookieSettings.path,
+        domain: cookieSettings.domain,
+        maxAge: expiresInSeconds * 1000,
+    };
+    // Always set refresh token in cookie for 'cookie' mode
+    res.cookie(cookieSettings.refreshTokenName, tokens.refreshToken, cookieOptions);
+    // Optionally set access token in cookie
+    if (cookieSettings.accessTokenInCookie) {
+        res.cookie(cookieSettings.accessTokenName, tokens.accessToken, cookieOptions);
+    }
+};
+/**
+ * Clear authentication cookies
+ */
+export const clearAuthCookies = (res) => {
+    const cookieSettings = getCookieSettings();
+    if (!cookieSettings.enabled) {
+        return;
+    }
+    const cookieOptions = {
+        httpOnly: cookieSettings.httpOnly,
+        secure: cookieSettings.secure,
+        sameSite: cookieSettings.sameSite,
+        path: cookieSettings.path,
+        domain: cookieSettings.domain,
+    };
+    res.clearCookie(cookieSettings.refreshTokenName, cookieOptions);
+    if (cookieSettings.accessTokenInCookie) {
+        res.clearCookie(cookieSettings.accessTokenName, cookieOptions);
+    }
+};
+/**
+ * Detect authentication mode from request
+ * Priority: cookies first, then body
+ */
+export const detectAuthMode = (req) => {
+    const cookieSettings = getCookieSettings();
+    // Check if refresh token exists in cookies
+    if (req.cookies?.[cookieSettings.refreshTokenName]) {
+        return 'cookie';
+    }
+    // Check if refresh token exists in body
+    if (req.body?.refreshToken) {
+        return 'body';
+    }
+    return null;
+};
+/**
+ * Extract tokens from request based on detected mode
+ */
+export const extractTokensFromRequest = (req) => {
+    const mode = detectAuthMode(req);
+    const cookieSettings = getCookieSettings();
+    if (mode === 'cookie') {
+        const refreshToken = req.cookies?.[cookieSettings.refreshTokenName];
+        const accessToken = cookieSettings.accessTokenInCookie
+            ? req.cookies?.[cookieSettings.accessTokenName]
+            : req.body?.accessToken;
+        if (!refreshToken || !accessToken) {
+            return null;
+        }
+        return { accessToken, refreshToken };
+    }
+    if (mode === 'body') {
+        const { accessToken, refreshToken } = req.body || {};
+        if (!accessToken || !refreshToken) {
+            return null;
+        }
+        return { accessToken, refreshToken };
+    }
+    return null;
+};
+/**
+ * Extract access token from request
+ * Priority: Authorization header > cookie > body
+ */
+export const extractAccessToken = (req) => {
+    // Priority 1: Authorization header
+    const authHeader = req.headers.authorization;
+    if (authHeader?.startsWith('Bearer ')) {
+        return authHeader.replace('Bearer ', '');
+    }
+    const cookieSettings = getCookieSettings();
+    // Priority 2: Cookie (if enabled)
+    if (cookieSettings.enabled &&
+        cookieSettings.accessTokenInCookie &&
+        req.cookies?.[cookieSettings.accessTokenName]) {
+        return req.cookies[cookieSettings.accessTokenName];
+    }
+    // Priority 3: Body
+    if (req.body?.accessToken) {
+        return req.body.accessToken;
+    }
+    return null;
+};
+/**
+ * Calculate expiration timestamp
+ */
+export const calculateExpiration = (expiresInSeconds) => {
+    const expiresAt = new Date(Date.now() + expiresInSeconds * 1000);
+    return {
+        expiresIn: expiresInSeconds,
+        expiresAt: expiresAt.toISOString(),
+    };
+};