@everystack/auth 0.1.0 → 0.2.1

package/README.md

@@ -164,13 +164,7 @@ import { createAuthFunction } from '@everystack/server/cdn';
 
 const auth = createAuthFunction({
   secret: $output(secret.value),
-  publicPaths: ['/api/auth/', '/api/health', '/api/updates'],
-  roles: {
-    posts:    { read: 'public',         write: 'authenticated' },
-    comments: { read: 'authenticated',  write: 'authenticated' },
-    '*':      { read: 'authenticated',  write: 'admin' },
-  },
-  roleHierarchy: ['public', 'authenticated', 'admin'],
+  requireAuth: ['/api/', '!/api/auth/', '!/api/health', '!/api/updates'],
 });
 
 new sst.aws.Router('Router', {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@everystack/auth",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "JWT authentication handlers, password hashing, and React auth context",
-  "license": "MIT",
+  "license": "AGPL-3.0-only",
   "publishConfig": {
     "access": "public"
   },
@@ -10,7 +10,6 @@
     "src",
     "README.md"
   ],
-  "type": "module",
   "exports": {
     ".": {
       "types": "./src/index.ts",
@@ -66,15 +65,29 @@
     "./cff": {
       "types": "./src/cff/index.ts",
       "default": "./src/cff/index.ts"
+    },
+    "./plugin": {
+      "types": "./src/plugin.ts",
+      "default": "./src/plugin.ts"
+    },
+    "./testing": {
+      "types": "./src/testing.ts",
+      "default": "./src/testing.ts"
     }
   },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
+  },
   "dependencies": {
-    "bcryptjs": "^3.0.3"
+    "bcryptjs": "3.0.3"
   },
   "peerDependencies": {
     "@everystack/api": ">=0.1.0",
-    "drizzle-orm": ">=0.30.0",
-    "react": ">=18.0.0"
+    "@everystack/server": ">=0.1.0",
+    "drizzle-orm": "0.41.0",
+    "react": "19.2.6"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -82,23 +95,21 @@
     },
     "@everystack/api": {
       "optional": true
+    },
+    "@everystack/server": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@types/bcryptjs": "^3.0.0",
-    "@types/jest": "^29.5.14",
-    "@types/node": "^22.0.0",
-    "@types/react": "^19.0.0",
-    "drizzle-orm": "^0.41.0",
-    "jest": "^29.7.0",
-    "postgres": "^3.4.0",
-    "ts-jest": "^29.3.0",
-    "typescript": "^5.7.0",
-    "@everystack/api": "0.1.0"
-  },
-  "scripts": {
-    "test": "NODE_OPTIONS='--experimental-vm-modules' jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
+    "@everystack/api": "workspace:*",
+    "@types/bcryptjs": "3.0.0",
+    "@types/jest": "29.5.14",
+    "@types/node": "22.19.18",
+    "@types/react": "19.2.14",
+    "drizzle-orm": "0.41.0",
+    "jest": "29.7.0",
+    "postgres": "3.4.9",
+    "ts-jest": "29.4.9",
+    "typescript": "5.9.3"
   }
-}
+}

package/src/api.ts

@@ -13,15 +13,19 @@
 
 import { createClient } from '@everystack/api/client';
 
-const TOKEN_KEY = 'everystack-token';
-const REFRESH_KEY = 'everystack-refresh';
+export const TOKEN_KEY = 'everystack-token';
+export const REFRESH_KEY = 'everystack-refresh';
 
-export const api = createClient({
-  baseUrl: '/api',
-  getToken: () => {
-    try { return localStorage.getItem(TOKEN_KEY); } catch { return null; }
-  },
-  onTokenExpired: async () => {
+/**
+ * Deduplicated token refresh — only one refresh request in flight at a time.
+ * Shared between the api client (onTokenExpired) and rpc().
+ */
+let activeRefresh: Promise<string | null> | null = null;
+
+export async function refreshAuthToken(): Promise<string | null> {
+  if (activeRefresh) return activeRefresh;
+
+  activeRefresh = (async () => {
     try {
       const refreshToken = localStorage.getItem(REFRESH_KEY);
       if (!refreshToken) return null;
@@ -36,11 +40,22 @@ export const api = createClient({
       localStorage.setItem(REFRESH_KEY, body.refreshToken);
       return body.token;
     } catch { return null; }
+  })().finally(() => { activeRefresh = null; });
+
+  return activeRefresh;
+}
+
+export const api = createClient({
+  baseUrl: '/api',
+  getToken: () => {
+    try { return localStorage.getItem(TOKEN_KEY); } catch { return null; }
   },
+  onTokenExpired: refreshAuthToken,
 });
 
 /**
  * Call an RPC function on the handler.
+ * Retries once on 401 via shared token refresh.
  */
 export async function rpc<T = unknown>(name: string, body?: unknown): Promise<T> {
   const token = (() => {
@@ -56,6 +71,25 @@ export async function rpc<T = unknown>(name: string, body?: unknown): Promise<T>
     body: body ? JSON.stringify(body) : '{}',
   });
 
+  if (res.status === 401) {
+    const newToken = await refreshAuthToken();
+    if (newToken) {
+      const retryRes = await fetch(`/api/rpc/${name}`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${newToken}`,
+        },
+        body: body ? JSON.stringify(body) : '{}',
+      });
+      if (!retryRes.ok) {
+        const err = await retryRes.json().catch(() => ({}));
+        throw new Error(err.message || `RPC ${name} failed: ${retryRes.status}`);
+      }
+      return retryRes.json();
+    }
+  }
+
   if (!res.ok) {
     const err = await res.json().catch(() => ({}));
     throw new Error(err.message || `RPC ${name} failed: ${res.status}`);

package/src/client/index.tsx

@@ -12,6 +12,7 @@
  */
 
 import React, { createContext, useContext, useState, useEffect, useCallback } from 'react';
+import { refreshAuthToken } from '../api';
 
 export interface AuthUser {
   id: string;
@@ -66,19 +67,50 @@ export const storage = {
   },
 };
 
+/**
+ * Check if a JWT access token is expired by decoding the payload.
+ * Lightweight client-side check — no crypto, just base64 decode + exp comparison.
+ */
+export function isTokenExpired(token: string): boolean {
+  try {
+    const parts = token.split('.');
+    if (parts.length !== 3) return true;
+    const payload = JSON.parse(atob(parts[1]));
+    if (typeof payload.exp !== 'number') return true;
+    return payload.exp * 1000 < Date.now();
+  } catch { return true; }
+}
+
 export function AuthProvider({ children }: { children: React.ReactNode }): React.ReactElement {
   const [user, setUser] = useState<AuthUser | null>(null);
   const [token, setToken] = useState<string | null>(null);
   const [isLoading, setIsLoading] = useState(true);
 
   useEffect(() => {
-    const savedToken = storage.getToken();
-    const savedUser = storage.getUser();
-    if (savedToken && savedUser) {
-      setToken(savedToken);
-      setUser(savedUser);
-    }
-    setIsLoading(false);
+    const init = async () => {
+      const savedToken = storage.getToken();
+      const savedUser = storage.getUser();
+
+      if (savedToken && savedUser) {
+        if (!isTokenExpired(savedToken)) {
+          setToken(savedToken);
+          setUser(savedUser);
+        } else {
+          // Token expired — attempt refresh before mounting authenticated UI
+          const newToken = await refreshAuthToken();
+          if (newToken) {
+            setToken(newToken);
+            setUser(savedUser);
+          } else {
+            storage.clear();
+          }
+        }
+      }
+
+      setIsLoading(false);
+    };
+
+    init();
   }, []);
 
   const signIn = useCallback(async (email: string, password: string) => {

package/src/cookies.ts

@@ -22,6 +22,9 @@ export interface CookieOptions {
   tokenMaxAge?: number;
   /** Refresh token max-age in seconds. Default 604800 (7 days). */
   refreshMaxAge?: number;
+  /** Origins allowed for CSRF validation on cookie-authenticated POST requests.
+   *  When set, POST requests with cookies must include a matching Origin header. */
+  allowedOrigins?: string[];
 }
 
 /**

package/src/csrf.ts

@@ -0,0 +1,57 @@
+/**
+ * CSRF Origin validation for cookie-based auth requests.
+ *
+ * When auth cookies are enabled, mutating requests (POST) must include
+ * an Origin or Referer header matching one of the allowed origins.
+ * Requests without cookies are not checked (mobile/API clients).
+ */
+
+/**
+ * Validate that the request origin is allowed.
+ * Returns null if valid, or a Response with 403 if rejected.
+ *
+ * Only checks requests that carry cookies (Cookie header present).
+ * Non-cookie requests (mobile/API) are always allowed.
+ */
+export function validateCsrfOrigin(
+  request: Request,
+  allowedOrigins?: string[],
+): Response | null {
+  // No origins configured -- skip check
+  if (!allowedOrigins || allowedOrigins.length === 0) return null;
+
+  // No cookie header -- not a cookie-based request (mobile/API)
+  if (!request.headers.get('cookie')) return null;
+
+  // Extract origin: prefer Origin header, fall back to Referer
+  let origin = request.headers.get('origin');
+  if (!origin) {
+    const referer = request.headers.get('referer');
+    if (referer) {
+      try {
+        const url = new URL(referer);
+        origin = url.origin;
+      } catch {
+        // Malformed referer -- reject
+      }
+    }
+  }
+
+  if (!origin) {
+    return Response.json(
+      { message: 'Origin header required for cookie-authenticated requests' },
+      { status: 403 },
+    );
+  }
+
+  // Normalize: lowercase, strip trailing slash
+  const normalized = origin.toLowerCase().replace(/\/+$/, '');
+  const allowed = allowedOrigins.map(o => o.toLowerCase().replace(/\/+$/, ''));
+
+  if (allowed.includes(normalized)) return null;
+
+  return Response.json(
+    { message: 'Origin not allowed' },
+    { status: 403 },
+  );
+}