@everystack/auth 0.4.4 → 0.4.6

package/CHANGELOG.md

@@ -0,0 +1,128 @@
+# Changelog
+
+All notable changes to `@everystack/auth` are documented here.
+
+Format based on [Keep a Changelog](https://keepachangelog.com/).
+
+## [0.4.5] - 2026-09-16
+
+### Added
+
+- auto-generated changelogs from conventional commits
+- automate the version-drift check — a manual note is not a gate
+
+## [0.4.4] - 2026-08-15
+
+### Fixed
+
+- compile owner-scoped `manage` to write policies + add `internal` flag for functions
+
+## [0.4.3] - 2026-08-12
+
+### Fixed
+
+- link workspace siblings instead of resolving them from the registry
+- the softDelete guard asked about visibility, not about DELETE
+- close the gate findings — the rule was still one grant short
+
+## [0.4.2] - 2026-08-04
+
+### Added
+
+- declare the SECURITY DEFINER functions, so db:reconcile can see them
+- writtenBy: 'functions' must have functions, checked at composition
+
+## [0.4.1] - 2026-08-04
+
+### Fixed
+
+- pin React to a single 19.2.0 across the monorepo
+- guard npm publish on workspace-dep packages; cli 0.3.8
+- republish @everystack/auth as 0.4.0, aligned to model 0.4.x
+- revoke PUBLIC EXECUTE on the seven functions that shipped open
+
+## [0.3.1] - 2026-06-30
+
+### Added
+
+- token-gated wrapper functions confirm_email + reset_password
+- anon-safe session wrappers sign_in_session + sign_up_session
+- least-priv signin + signup via anon session wrappers
+- least-priv refresh — rotate as anon, read identity via RLS
+- create profile as an invoker insert under RLS, atomically
+- wire least-priv auth — session wrappers, grants, RLS
+- least-priv confirmEmail + resetPassword via token-gated wrappers
+- least-priv changePassword via auth.change_password wrapper
+- forgot-password + signup-confirmation mint on the worker
+- own the seven auth tables as v3 Models
+- export package Modules
+
+### Fixed
+
+- pin search_path on the core SECURITY DEFINER functions
+- extensionless relative imports (repo convention; Metro resolution)
+- generateAuthGrantsSQL — the generated migration grants its own roles
+
+## [0.2.5] - 2026-06-18
+
+### Fixed
+
+- fail closed on cookie auth without allowedOrigins
+
+## [0.2.4] - 2026-06-17
+
+### Added
+
+- IAM auth for web deploys, replace Sharp layer with SST bundling
+- add DB-backed refresh token rotation
+- add OAuth sign-in with pluggable providers
+- wire RBAC end-to-end from database to admin guard
+- add mode: postgres — pgcrypto auth via postgres.js
+- runtime-agnostic HS256 JWT with conformance vectors
+- SQL twin (pgcrypto) — jwt_sign / jwt_sign_raw / jwt_verify
+- drop jose, native RS256+JWKS OIDC verifier
+- cff generator — verify HS256 JWTs at the edge
+- bcrypt cost 12 password hashing (OWASP-aligned)
+- cookie-based SSR authentication
+- compact CFF verifier + dead code stripping for 10KB budget
+- add plugin architecture for composable Lambda handlers
+- add auth plugin with layered security and client credentials
+- replace publicPaths with requireAuth pattern
+- add @everystack/auth/testing — JWT helpers, role tokens, and test user seeding
+- add CSRF Origin validation, remove sessions alias
+- default Supabase-compatible schema, example app migration, docs
+- add email confirmation, password recovery, and change-password flows
+- product-analytics producer — track() + /track route + auth emitters
+- consolidate drizzle migrations + logging schema updates
+
+### Fixed
+
+- transactional signup, shared handler factory, drop dead routes
+- normalize bcrypt prefix and strip MIME newlines in SQL functions
+- configurable bcrypt cost, default 10 (OWASP minimum)
+- require crypto module in CFF verifiers, strip routeSite
+- update CFF verifier tests for crypto require
+- resolve 7 high-priority security findings from red team audit
+- resolve 7 medium-priority security findings from red team audit
+- resolve 9 low/medium-priority security findings from red team audit
+- resolve auth test failures and logging build error
+- pin all dependency versions to lockfile-resolved values
+- accept JWT tokens without typ header (RFC 7519 §5.1)
+- worker function discovery and log group resolution for SQS subscribers
+- stamp the app audience on first-party tokens
+- skip edge auth for non-API paths when tableFromPath is enabled
+
+### Changed
+
+- extract server infra into @expo-stack/server + @expo-stack/auth packages
+- migrate all package schemas to everyschema canonical tables
+- drop type module from all packages, switch Jest to CJS mode
+- consolidate Jest configs into shared base
+- replace sessions STI with dedicated refresh_tokens table
+
+### Documentation
+
+- rewrite documentation around V1→V2→V3 progressive complexity model
+- update all documentation to reflect full API surface
+- document zero-dep envelope, edge verification, SQL twin
+- prepare documentation for open-source release

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -18,7 +18,8 @@
   },
   "files": [
     "src",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "exports": {
     ".": {
@@ -107,7 +108,7 @@
   },
   "dependencies": {
     "bcryptjs": "3.0.3",
-    "@everystack/model": "0.4.17"
+    "@everystack/model": "0.4.19"
   },
   "peerDependencies": {
     "@everystack/api": ">=0.1.0",
@@ -136,8 +137,8 @@
     "postgres": "3.4.9",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/api": "0.4.0",
-    "@everystack/server": "0.4.26"
+    "@everystack/server": "0.4.32",
+    "@everystack/api": "0.4.2"
   },
   "scripts": {
     "test": "jest",

package/src/api.ts

@@ -34,17 +34,32 @@ export async function refreshAuthToken(): Promise<string | null> {
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ refreshToken }),
       });
-      if (!res.ok) return null;
+      if (!res.ok) {
+        // Server rejected the refresh token (expired/revoked/reused) — the session is over.
+        clearStoredTokens();
+        return null;
+      }
       const body = await res.json();
       localStorage.setItem(TOKEN_KEY, body.token);
       localStorage.setItem(REFRESH_KEY, body.refreshToken);
       return body.token;
-    } catch { return null; }
+    } catch {
+      // Network-level failure (e.g. offline) — the refresh token may still be
+      // valid, so don't wipe the session; just fail this attempt.
+      return null;
+    }
   })().finally(() => { activeRefresh = null; });
 
   return activeRefresh;
 }
 
+function clearStoredTokens(): void {
+  try {
+    localStorage.removeItem(TOKEN_KEY);
+    localStorage.removeItem(REFRESH_KEY);
+  } catch {}
+}
+
 export const api = createClient({
   baseUrl: '/api',
   getToken: () => {