@everystack/auth 0.4.7 → 0.4.9

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to `@everystack/auth` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.9] - 2026-10-14
+
+### Fixed
+
+- break the model and auth import cycles; gate new ones
+
+### Changed
+
+- share refresh token extraction
+
+## [Unreleased]
+
+### Changed
+
+- share refresh token extraction
+
+## [0.4.8] - 2026-09-26
+
+### Fixed
+
+- revoke sessions when users are blocked
+
+## [0.4.7] - 2026-09-26
+
+### Fixed
+
+- enforce bans on refresh and signin, check password before ban
+- make the access token lifetime configurable
+- signout revokes the presented refresh token
+- refuse banned users on OAuth sign-in; signout never fails on revoke
+
+### Documentation
+
+- document signout revocation, accessTokenTtlSec and ban enforcement
+
 ## [0.4.6] - 2026-09-22
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -108,7 +108,7 @@
   },
   "dependencies": {
     "bcryptjs": "3.0.3",
-    "@everystack/model": "0.4.20"
+    "@everystack/model": "0.4.21"
   },
   "peerDependencies": {
     "@everystack/api": ">=0.1.0",
@@ -137,8 +137,8 @@
     "postgres": "3.4.9",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/server": "0.4.33",
-    "@everystack/api": "0.4.2"
+    "@everystack/server": "0.4.35",
+    "@everystack/api": "0.4.3"
   },
   "scripts": {
     "test": "jest",

package/src/account.ts

@@ -0,0 +1,44 @@
+/**
+ * Account-state and password-column helpers shared by index.ts and postgres.ts.
+ * A leaf module: index.ts imports postgres.ts, so these cannot live in index.ts.
+ */
+
+/**
+ * Why a user row may not hold a session, or null when it may. Reads row fields, not table
+ * columns, so an app schema without `bannedUntil`/`deletedAt` simply never trips it.
+ * Mirrors the SQL side: auth.sign_in filters deleted_at, auth.validate_refresh_token
+ * rejects deleted_at (P0004) and an unexpired banned_until (P0007).
+ */
+export function accountBlock(user: any): 'deleted' | 'banned' | null {
+  if (user.deletedAt) return 'deleted';
+  if (user.bannedUntil && new Date(user.bannedUntil).getTime() > Date.now()) return 'banned';
+  return null;
+}
+
+/** The refusal for a sign-in path that already proved identity (OAuth), or null to proceed.
+ *  A missing row is treated as a deleted account. */
+export function accountBlockedResponse(user: any): Response | null {
+  const block = user ? accountBlock(user) : 'deleted';
+  if (block === 'banned') return Response.json({ message: 'Account suspended' }, { status: 403 });
+  if (block === 'deleted') return Response.json({ message: 'Account disabled' }, { status: 401 });
+  return null;
+}
+
+/** Signout must always clear cookies. A failed server-side revoke is logged, never thrown:
+ *  only the error's code or message is logged, never the token. */
+export function warnRevokeFailed(err: unknown): void {
+  const e = err as { code?: string; message?: string } | undefined;
+  // eslint-disable-next-line no-console
+  console.warn('[everystack/auth] signout: refresh token revocation failed:', e?.code ?? e?.message ?? 'unknown error');
+}
+
+/**
+ * Build insert values with the correct password column name.
+ * Checks which column exists on the Drizzle table definition.
+ */
+export function withPassword(users: any, values: Record<string, any>, hash: string | null): Record<string, any> {
+  if ('encryptedPassword' in users) {
+    return { ...values, encryptedPassword: hash };
+  }
+  return { ...values, passwordHash: hash };
+}

package/src/index.ts

@@ -38,7 +38,9 @@ import type { OAuthProvider, OAuthUserInfo } from './oauth';
 export type { OAuthProvider, OAuthUserInfo } from './oauth';
 export { createAppleProvider, createGoogleProvider } from './oauth';
 import { createPostgresAuthHandlers } from './postgres';
-import { getRefreshFromCookies, readPresentedRefreshToken } from './cookies';
+import { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './account';
+export { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './account';
+import { readPresentedRefreshToken } from './cookies';
 import { authResponse, signoutResponse } from './response';
 import type { CookieConfig } from './response';
 import type { EnrichClaimsFn } from './plugin';
@@ -63,45 +65,6 @@ export function getPasswordHash(user: any): string | null {
   return user.encryptedPassword ?? user.passwordHash ?? null;
 }
 
-/**
- * Build insert values with the correct password column name.
- * Checks which column exists on the Drizzle table definition.
- */
-/**
- * Why a user row may not hold a session, or null when it may. Reads row fields, not table
- * columns, so an app schema without `bannedUntil`/`deletedAt` simply never trips it.
- * Mirrors the SQL side: auth.sign_in filters deleted_at, auth.validate_refresh_token
- * rejects deleted_at (P0004) and an unexpired banned_until (P0007).
- */
-export function accountBlock(user: any): 'deleted' | 'banned' | null {
-  if (user.deletedAt) return 'deleted';
-  if (user.bannedUntil && new Date(user.bannedUntil).getTime() > Date.now()) return 'banned';
-  return null;
-}
-
-/** The refusal for a sign-in path that already proved identity (OAuth), or null to proceed.
- *  A missing row is treated as a deleted account. */
-export function accountBlockedResponse(user: any): Response | null {
-  const block = user ? accountBlock(user) : 'deleted';
-  if (block === 'banned') return Response.json({ message: 'Account suspended' }, { status: 403 });
-  if (block === 'deleted') return Response.json({ message: 'Account disabled' }, { status: 401 });
-  return null;
-}
-
-/** Signout must always clear cookies. A failed server-side revoke is logged, never thrown:
- *  only the error's code or message is logged, never the token. */
-export function warnRevokeFailed(err: unknown): void {
-  const e = err as { code?: string; message?: string } | undefined;
-  // eslint-disable-next-line no-console
-  console.warn('[everystack/auth] signout: refresh token revocation failed:', e?.code ?? e?.message ?? 'unknown error');
-}
-
-export function withPassword(users: any, values: Record<string, any>, hash: string | null): Record<string, any> {
-  if ('encryptedPassword' in users) {
-    return { ...values, encryptedPassword: hash };
-  }
-  return { ...values, passwordHash: hash };
-}
 
 export interface TokenPayload {
   sub: string;
@@ -656,17 +619,7 @@ export function createAuthHandlers(
       const csrfError = csrfCheck(request, options?.cookies);
       if (csrfError) return csrfError;
 
-      // Read refresh token from JSON body (mobile) or cookie (web SSR)
-      let refreshToken: string | undefined;
-      try {
-        const body = await request.clone().json();
-        refreshToken = body?.refreshToken;
-      } catch {
-        // Empty body is fine — fall through to cookie
-      }
-      if (!refreshToken) {
-        refreshToken = getRefreshFromCookies(request.headers.get('cookie')) ?? undefined;
-      }
+      const refreshToken = await readPresentedRefreshToken(request);
       if (!refreshToken) {
         return Response.json(
           { message: 'refreshToken is required' },

package/src/models/functions.ts

@@ -39,8 +39,9 @@
  * hand-patch a body here.
  */
 
-import { defineFunction, arg, can, sql } from '@everystack/model';
+import { defineFunction, defineTrigger, arg, can, sql } from '@everystack/model';
 import { DEFAULT_ACCESS_TOKEN_TTL_SEC, resolveAccessTokenTtl } from '../sql';
+import { User } from './user';
 
 export const changePasswordFn = defineFunction('auth.change_password', {
   args: [arg('p_current_password', 'text'), arg('p_new_password', 'text')],
@@ -849,6 +850,36 @@ END;
 `,
 });
 
+/** Removes every session as soon as an account becomes unavailable. */
+export const revokeRefreshTokensOnUserBlockFn = defineFunction('auth.revoke_refresh_tokens_on_user_block', {
+  returns: 'trigger',
+  language: 'plpgsql',
+  security: 'definer',
+  searchPath: ['auth', 'public', 'pg_temp'],
+  body: sql`
+BEGIN
+  DELETE FROM auth.refresh_tokens WHERE user_id = NEW.id;
+  RETURN NEW;
+END;`,
+});
+
+/** The blocking transition is the durable revocation point; validation keeps its raise contract. */
+export const revokeRefreshTokensOnUserBlockTrigger = defineTrigger('users_revoke_refresh_tokens_on_block', {
+  on: User,
+  timing: 'after',
+  events: ['update'],
+  of: ['banned_until', 'deleted_at'],
+  forEach: 'row',
+  condition: sql`
+    (NEW.deleted_at IS NOT NULL AND OLD.deleted_at IS NULL)
+    OR (
+      NEW.banned_until > now()
+      AND (OLD.banned_until IS NULL OR OLD.banned_until <= now())
+    )
+  `,
+  execute: revokeRefreshTokensOnUserBlockFn,
+});
+
 export const verifyJwtFn = defineFunction('auth.verify_jwt', {
   args: [arg('p_token', 'text')],
   returns: 'jsonb',
@@ -979,6 +1010,7 @@ export const coreFunctions = [hashPasswordFn, verifyPasswordFn, signJwtFn, verif
 /** The refresh-token family (RFC 6819 rotation). Always on. */
 export const refreshTokenFunctions = [
   issueRefreshTokenFn, validateRefreshTokenFn, revokeRefreshTokensFn, signOutFn, cleanupRefreshTokensFn,
+  revokeRefreshTokensOnUserBlockFn,
 ];
 
 /** `auth.uid()` / `auth.role()` / `auth.jwt()` — called FROM RLS policies, so granted to the
@@ -1041,3 +1073,8 @@ export function authFunctions(opts: AuthFunctionOptions = {}) {
     ...(opts.jwtWrappers === true ? jwtWrapperFunctionsFor(opts.accessTokenTtlSec) : []),
   ];
 }
+
+/** The auth module's complete derived layer: functions plus lifecycle bindings. */
+export function authDerived(opts: AuthFunctionOptions = {}) {
+  return [...authFunctions(opts), revokeRefreshTokensOnUserBlockTrigger];
+}

package/src/models/index.ts

@@ -25,7 +25,7 @@ import { Device } from './device';
 import { MfaFactor } from './mfa-factor';
 import { MfaChallenge } from './mfa-challenge';
 import { OneTimeToken } from './one-time-token';
-import { authFunctions, type AuthFunctionOptions } from './functions';
+import { authDerived, type AuthFunctionOptions } from './functions';
 
 export * from './functions';
 
@@ -51,7 +51,7 @@ export function defineAuthModule(opts: AuthFunctionOptions = {}): Module {
   return defineModule({
     models: authModels,
     extensions: ['pgcrypto'],
-    derived: authFunctions(opts),
+    derived: authDerived(opts),
   });
 }
 

package/src/postgres.ts

@@ -18,9 +18,9 @@ import { createJwt } from './jwt';
 import { hmacNode } from './jwt/hmac-node';
 import type { RefreshTokenOptions } from './refresh';
 import type { AuthHandlers, AuthOptions, TokenPayload } from './index';
-import { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './index';
+import { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './account';
 import type { OAuthProvider } from './oauth';
-import { getRefreshFromCookies, readPresentedRefreshToken } from './cookies';
+import { readPresentedRefreshToken } from './cookies';
 import { authResponse, signoutResponse } from './response';
 import type { CookieConfig } from './response';
 import { validateCsrfOrigin } from './csrf';
@@ -436,17 +436,7 @@ export function createPostgresAuthHandlers(
       const csrfError = csrfCheck(request, options?.cookies);
       if (csrfError) return csrfError;
 
-      // Read refresh token from JSON body (mobile) or cookie (web SSR)
-      let refreshToken: string | undefined;
-      try {
-        const body = await request.clone().json();
-        refreshToken = body?.refreshToken;
-      } catch {
-        // Empty body is fine — fall through to cookie
-      }
-      if (!refreshToken) {
-        refreshToken = getRefreshFromCookies(request.headers.get('cookie')) ?? undefined;
-      }
+      const refreshToken = await readPresentedRefreshToken(request);
       if (!refreshToken) {
         return Response.json(
           { message: 'refreshToken is required' },

package/src/sql.ts

@@ -358,6 +358,33 @@ $$;
 
 REVOKE EXECUTE ON FUNCTION auth.validate_refresh_token FROM PUBLIC;`;
 
+const REVOKE_REFRESH_TOKENS_ON_USER_BLOCK = `\
+CREATE OR REPLACE FUNCTION auth.revoke_refresh_tokens_on_user_block()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = auth, public, pg_temp
+AS $$
+BEGIN
+  DELETE FROM auth.refresh_tokens WHERE user_id = NEW.id;
+  RETURN NEW;
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION auth.revoke_refresh_tokens_on_user_block FROM PUBLIC;
+
+CREATE TRIGGER users_revoke_refresh_tokens_on_block
+AFTER UPDATE OF banned_until, deleted_at ON auth.users
+FOR EACH ROW
+WHEN (
+  (NEW.deleted_at IS NOT NULL AND OLD.deleted_at IS NULL)
+  OR (
+    NEW.banned_until > now()
+    AND (OLD.banned_until IS NULL OR OLD.banned_until <= now())
+  )
+)
+EXECUTE FUNCTION auth.revoke_refresh_tokens_on_user_block();`;
+
 const REVOKE_REFRESH_TOKENS = `\
 CREATE OR REPLACE FUNCTION auth.revoke_refresh_tokens(
   p_user_id UUID,
@@ -1091,7 +1118,10 @@ export function generateCoreSQL(): string {
 
 /** issue + validate + revoke + sign_out + cleanup refresh tokens (RFC 6819) */
 export function generateRefreshTokenSQL(): string {
-  return [ISSUE_REFRESH_TOKEN, '', VALIDATE_REFRESH_TOKEN, '', REVOKE_REFRESH_TOKENS, '', SIGN_OUT, '', CLEANUP_REFRESH_TOKENS]
+  return [
+    ISSUE_REFRESH_TOKEN, '', VALIDATE_REFRESH_TOKEN, '', REVOKE_REFRESH_TOKENS_ON_USER_BLOCK, '',
+    REVOKE_REFRESH_TOKENS, '', SIGN_OUT, '', CLEANUP_REFRESH_TOKENS,
+  ]
     .join('\n')
     .trimEnd() + '\n';
 }