@dotpress/auth 1.1.2 → 1.2.0

package/dist/lib/handlers.js

@@ -3,6 +3,7 @@ import bcrypt from 'bcryptjs';
 import { getSettings } from './settings.js';
 import { getRequestIp } from './ip.js';
 import { generateTokensForUser, generateTokensFromRefreshToken, } from './tokens.js';
+import { setAuthCookies, clearAuthCookies, extractTokensFromRequest, calculateExpiration, } from './cookies.js';
 export const registerHandlers = (plugin) => {
     const authGroup = plugin.addGroup('/auth');
     const settings = getSettings();
@@ -15,15 +16,18 @@ export const registerHandlers = (plugin) => {
                 password: z.string(),
                 client: z.string().optional(),
                 aud: settings.aud?.required ? z.string() : z.string().optional(),
+                mode: z.enum(['body', 'cookie']).optional(),
             }),
             response: z.object({
                 userId: z.string(),
                 accessToken: z.string(),
                 refreshToken: z.string(),
+                expiresIn: z.number(),
+                expiresAt: z.string(),
             }),
         }),
-        handler: async ({ req }) => {
-            const { username, password, client, aud } = req.body;
+        handler: async ({ req, res }) => {
+            const { username, password, client, aud, mode } = req.body;
             const ipAddress = getRequestIp(req);
             const user = await settings.dataProvider.findUserIdentifiers(username);
             if (!user) {
@@ -76,10 +80,15 @@ export const registerHandlers = (plugin) => {
                     ipAddress: ipAddress || '',
                 });
             }
+            if (mode === 'cookie') {
+                setAuthCookies(res, { accessToken, refreshToken }, settings.accessTokenTTL);
+            }
+            const expiration = calculateExpiration(settings.accessTokenTTL);
             return {
                 userId: user.userId,
                 accessToken,
                 refreshToken,
+                ...expiration,
             };
         },
     });
@@ -87,27 +96,48 @@ export const registerHandlers = (plugin) => {
         method: 'post',
         path: '/refresh',
         schema: (z) => ({
-            body: z.object({
-                accessToken: z.string(),
-                refreshToken: z.string(),
-            }),
+            body: z
+                .object({
+                accessToken: z.string().optional(),
+                refreshToken: z.string().optional(),
+            })
+                .optional(),
             response: z.object({
                 userId: z.string(),
                 accessToken: z.string(),
                 refreshToken: z.string(),
+                expiresIn: z.number(),
+                expiresAt: z.string(),
             }),
         }),
-        handler: async ({ req }) => {
-            const { accessToken, refreshToken } = req.body;
+        handler: async ({ req, res }) => {
+            // Extract tokens from cookies or body (auto-detect)
+            const extractedTokens = extractTokensFromRequest(req);
+            if (!extractedTokens) {
+                return unauthorizedError('NO_TOKENS_PROVIDED');
+            }
+            const { accessToken, refreshToken } = extractedTokens;
             try {
                 const tokens = await generateTokensFromRefreshToken({
                     accessToken,
                     refreshToken,
                 });
+                // Set cookies if the request came with cookies (auto-detect mode)
+                const mode = req.cookies?.[settings.cookies?.refreshTokenName || 'dotpress_refresh_token']
+                    ? 'cookie'
+                    : 'body';
+                if (mode === 'cookie') {
+                    setAuthCookies(res, {
+                        accessToken: tokens.accessToken,
+                        refreshToken: tokens.refreshToken,
+                    }, settings.accessTokenTTL);
+                }
+                const expiration = calculateExpiration(settings.accessTokenTTL);
                 return {
                     userId: tokens.userId,
                     accessToken: tokens.accessToken,
                     refreshToken: tokens.refreshToken,
+                    ...expiration,
                 };
             }
             catch (e) {
@@ -135,12 +165,13 @@ export const registerHandlers = (plugin) => {
     authGroup.defineRoute({
         method: 'post',
         path: '/logout',
-        handler: async ({ req }) => {
+        handler: async ({ req, res }) => {
             const userId = req.user?.id || '';
             if (!userId) {
                 return unauthorizedError();
             }
             await settings.dataProvider.revokeTokens(userId);
+            clearAuthCookies(res);
             return { success: true };
         },
     });

package/dist/lib/middleware.js

@@ -1,9 +1,8 @@
 import { getSettings } from './settings.js';
 import { validateAndDecodeAccessToken } from './tokens.js';
+import { extractAccessToken } from './cookies.js';
 export const attachAuthenticatedUser = async (req, _res, next) => {
-    const accessToken = req.headers && req.headers.authorization
-        ? req.headers.authorization.replace('Bearer ', '')
-        : '';
+    const accessToken = extractAccessToken(req);
     if (!accessToken) {
         next();
         return;

package/dist/types/types.d.ts

@@ -10,10 +10,23 @@ export type KeyPairSettings = {
     secretKey: string;
     publicKey: string;
 };
+export type CookieSettings = {
+    enabled?: boolean;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    domain?: string;
+    path?: string;
+    accessTokenName?: string;
+    refreshTokenName?: string;
+    accessTokenInCookie?: boolean;
+};
+export type AuthMode = 'body' | 'cookie';
 export type AuthSettings = {
     accessTokenTTL: number;
     refreshTokenTTLInDays: number;
     issuer: string;
+    cookies?: CookieSettings;
     onLoginFailed?: (e: LoginFailedEvent) => Promise<void>;
     onLoginSuccess?: (e: LoginSuccessEvent) => Promise<void>;
     aud?: {
@@ -45,6 +58,13 @@ export type TokenPair = {
     accessToken: string;
     refreshToken: string;
 };
+export type TokenResponse = {
+    userId: string;
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    expiresAt: string;
+};
 export type CreateTokenPayload = {
     sub: string;
     username: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotpress/auth",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "JWT Authentication plugin for Dotpress library",
   "author": "Renaud Guyon",
   "license": "MIT",
@@ -31,6 +31,7 @@
     "test:watch": "vitest watch"
   },
   "peerDependencies": {
+    "cookie-parser": "^1.4.7",
     "dotpress": "^1",
     "zod": "^3"
   },
@@ -42,6 +43,7 @@
   "devDependencies": {
     "@eslint/js": "^9.24.0",
     "@types/bcrypt": "^5.0.2",
+    "@types/cookie-parser": "^1.4.7",
     "@types/express": "^4.17.21",
     "@types/jsonwebtoken": "^9.0.9",
     "@types/request-ip": "^0.0.41",