@everystack/auth 0.4.8 → 0.4.9

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@everystack/auth` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.9] - 2026-10-14
+
+### Fixed
+
+- break the model and auth import cycles; gate new ones
+
+### Changed
+
+- share refresh token extraction
+
+## [Unreleased]
+
+### Changed
+
+- share refresh token extraction
+
 ## [0.4.8] - 2026-09-26
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/auth",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "JWT authentication handlers, password hashing, and React auth context",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -108,7 +108,7 @@
   },
   "dependencies": {
     "bcryptjs": "3.0.3",
-    "@everystack/model": "0.4.20"
+    "@everystack/model": "0.4.21"
   },
   "peerDependencies": {
     "@everystack/api": ">=0.1.0",
@@ -137,8 +137,8 @@
     "postgres": "3.4.9",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/server": "0.4.33",
-    "@everystack/api": "0.4.2"
+    "@everystack/server": "0.4.35",
+    "@everystack/api": "0.4.3"
   },
   "scripts": {
     "test": "jest",

package/src/account.ts

@@ -0,0 +1,44 @@
+/**
+ * Account-state and password-column helpers shared by index.ts and postgres.ts.
+ * A leaf module: index.ts imports postgres.ts, so these cannot live in index.ts.
+ */
+
+/**
+ * Why a user row may not hold a session, or null when it may. Reads row fields, not table
+ * columns, so an app schema without `bannedUntil`/`deletedAt` simply never trips it.
+ * Mirrors the SQL side: auth.sign_in filters deleted_at, auth.validate_refresh_token
+ * rejects deleted_at (P0004) and an unexpired banned_until (P0007).
+ */
+export function accountBlock(user: any): 'deleted' | 'banned' | null {
+  if (user.deletedAt) return 'deleted';
+  if (user.bannedUntil && new Date(user.bannedUntil).getTime() > Date.now()) return 'banned';
+  return null;
+}
+
+/** The refusal for a sign-in path that already proved identity (OAuth), or null to proceed.
+ *  A missing row is treated as a deleted account. */
+export function accountBlockedResponse(user: any): Response | null {
+  const block = user ? accountBlock(user) : 'deleted';
+  if (block === 'banned') return Response.json({ message: 'Account suspended' }, { status: 403 });
+  if (block === 'deleted') return Response.json({ message: 'Account disabled' }, { status: 401 });
+  return null;
+}
+
+/** Signout must always clear cookies. A failed server-side revoke is logged, never thrown:
+ *  only the error's code or message is logged, never the token. */
+export function warnRevokeFailed(err: unknown): void {
+  const e = err as { code?: string; message?: string } | undefined;
+  // eslint-disable-next-line no-console
+  console.warn('[everystack/auth] signout: refresh token revocation failed:', e?.code ?? e?.message ?? 'unknown error');
+}
+
+/**
+ * Build insert values with the correct password column name.
+ * Checks which column exists on the Drizzle table definition.
+ */
+export function withPassword(users: any, values: Record<string, any>, hash: string | null): Record<string, any> {
+  if ('encryptedPassword' in users) {
+    return { ...values, encryptedPassword: hash };
+  }
+  return { ...values, passwordHash: hash };
+}

package/src/index.ts

@@ -38,7 +38,9 @@ import type { OAuthProvider, OAuthUserInfo } from './oauth';
 export type { OAuthProvider, OAuthUserInfo } from './oauth';
 export { createAppleProvider, createGoogleProvider } from './oauth';
 import { createPostgresAuthHandlers } from './postgres';
-import { getRefreshFromCookies, readPresentedRefreshToken } from './cookies';
+import { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './account';
+export { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './account';
+import { readPresentedRefreshToken } from './cookies';
 import { authResponse, signoutResponse } from './response';
 import type { CookieConfig } from './response';
 import type { EnrichClaimsFn } from './plugin';
@@ -63,45 +65,6 @@ export function getPasswordHash(user: any): string | null {
   return user.encryptedPassword ?? user.passwordHash ?? null;
 }
 
-/**
- * Build insert values with the correct password column name.
- * Checks which column exists on the Drizzle table definition.
- */
-/**
- * Why a user row may not hold a session, or null when it may. Reads row fields, not table
- * columns, so an app schema without `bannedUntil`/`deletedAt` simply never trips it.
- * Mirrors the SQL side: auth.sign_in filters deleted_at, auth.validate_refresh_token
- * rejects deleted_at (P0004) and an unexpired banned_until (P0007).
- */
-export function accountBlock(user: any): 'deleted' | 'banned' | null {
-  if (user.deletedAt) return 'deleted';
-  if (user.bannedUntil && new Date(user.bannedUntil).getTime() > Date.now()) return 'banned';
-  return null;
-}
-
-/** The refusal for a sign-in path that already proved identity (OAuth), or null to proceed.
- *  A missing row is treated as a deleted account. */
-export function accountBlockedResponse(user: any): Response | null {
-  const block = user ? accountBlock(user) : 'deleted';
-  if (block === 'banned') return Response.json({ message: 'Account suspended' }, { status: 403 });
-  if (block === 'deleted') return Response.json({ message: 'Account disabled' }, { status: 401 });
-  return null;
-}
-
-/** Signout must always clear cookies. A failed server-side revoke is logged, never thrown:
- *  only the error's code or message is logged, never the token. */
-export function warnRevokeFailed(err: unknown): void {
-  const e = err as { code?: string; message?: string } | undefined;
-  // eslint-disable-next-line no-console
-  console.warn('[everystack/auth] signout: refresh token revocation failed:', e?.code ?? e?.message ?? 'unknown error');
-}
-
-export function withPassword(users: any, values: Record<string, any>, hash: string | null): Record<string, any> {
-  if ('encryptedPassword' in users) {
-    return { ...values, encryptedPassword: hash };
-  }
-  return { ...values, passwordHash: hash };
-}
 
 export interface TokenPayload {
   sub: string;
@@ -656,17 +619,7 @@ export function createAuthHandlers(
       const csrfError = csrfCheck(request, options?.cookies);
       if (csrfError) return csrfError;
 
-      // Read refresh token from JSON body (mobile) or cookie (web SSR)
-      let refreshToken: string | undefined;
-      try {
-        const body = await request.clone().json();
-        refreshToken = body?.refreshToken;
-      } catch {
-        // Empty body is fine — fall through to cookie
-      }
-      if (!refreshToken) {
-        refreshToken = getRefreshFromCookies(request.headers.get('cookie')) ?? undefined;
-      }
+      const refreshToken = await readPresentedRefreshToken(request);
       if (!refreshToken) {
         return Response.json(
           { message: 'refreshToken is required' },

package/src/postgres.ts

@@ -18,9 +18,9 @@ import { createJwt } from './jwt';
 import { hmacNode } from './jwt/hmac-node';
 import type { RefreshTokenOptions } from './refresh';
 import type { AuthHandlers, AuthOptions, TokenPayload } from './index';
-import { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './index';
+import { accountBlock, accountBlockedResponse, warnRevokeFailed, withPassword } from './account';
 import type { OAuthProvider } from './oauth';
-import { getRefreshFromCookies, readPresentedRefreshToken } from './cookies';
+import { readPresentedRefreshToken } from './cookies';
 import { authResponse, signoutResponse } from './response';
 import type { CookieConfig } from './response';
 import { validateCsrfOrigin } from './csrf';
@@ -436,17 +436,7 @@ export function createPostgresAuthHandlers(
       const csrfError = csrfCheck(request, options?.cookies);
       if (csrfError) return csrfError;
 
-      // Read refresh token from JSON body (mobile) or cookie (web SSR)
-      let refreshToken: string | undefined;
-      try {
-        const body = await request.clone().json();
-        refreshToken = body?.refreshToken;
-      } catch {
-        // Empty body is fine — fall through to cookie
-      }
-      if (!refreshToken) {
-        refreshToken = getRefreshFromCookies(request.headers.get('cookie')) ?? undefined;
-      }
+      const refreshToken = await readPresentedRefreshToken(request);
       if (!refreshToken) {
         return Response.json(
           { message: 'refreshToken is required' },