@finueva/auth 0.18.0 → 0.18.1

package/dist/index.js

@@ -2291,7 +2291,7 @@ const passkeyClient = () => {
 	};
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_dfcdb59639d9fe73412dad0223379a88/node_modules/@chiballc/utils/dist/index.mjs
+//#region ../../node_modules/.pnpm/@chiballc+utils@2.5.1_@hono+zod-openapi@1.5.1_hono@4.13.0_zod@4.4.3__hono@4.13.0_magic-_80fa16dd1813631ddeb36d2ee29b8660/node_modules/@chiballc/utils/dist/index.mjs
 function isPromise(arg) {
 	return arg && typeof arg.then === "function";
 }
@@ -3683,6 +3683,18 @@ function unique(items, key) {
 	if (new Set(items.map(key)).size !== items.length) throw authorityUnavailable();
 	return items;
 }
+function credentialSessionId(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return void 0;
+	try {
+		const base64 = parts[1].replaceAll("-", "+").replaceAll("_", "/");
+		const decoded = atob(base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "="));
+		const payload = JSON.parse(decoded);
+		return isObject(payload) && typeof payload.sid === "string" && payload.sid.length > 0 ? payload.sid : void 0;
+	} catch {
+		return;
+	}
+}
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -4509,7 +4521,7 @@ function normalizeUserApiCredential(value, startedAt) {
 		expiresAt: new Date(startedAt + value.expiresIn * 1e3)
 	};
 }
-function createUserApiCredentialCache(issue, now) {
+function createUserApiCredentialCache(issue, now, currentSessionId = () => void 0) {
 	let generation = 0;
 	let cached;
 	let pending;
@@ -4519,6 +4531,12 @@ function createUserApiCredentialCache(issue, now) {
 	});
 	return {
 		hasAuthority: () => Boolean(cached || pending),
+		retainSession(sessionId) {
+			if (cached?.sessionId === sessionId && !pending) return;
+			generation += 1;
+			cached = void 0;
+			pending = void 0;
+		},
 		clear() {
 			generation += 1;
 			cached = void 0;
@@ -4542,10 +4560,14 @@ function createUserApiCredentialCache(issue, now) {
 				const value = normalizeUserApiCredential(await issue(applicationId), startedAt);
 				if (epoch !== generation) throw new AuthError("state_conflict", 409);
 				if (now() < startedAt || value.expiresAt.getTime() <= now()) throw new AuthError("authentication_required", 401);
+				const sessionId = credentialSessionId(value.token);
+				const observed = currentSessionId();
+				if (observed !== void 0 && sessionId !== void 0 && sessionId !== observed) throw new AuthError("authentication_required", 401);
 				cached = {
 					applicationId,
 					token: value.token,
-					expiresAt: value.expiresAt.getTime()
+					expiresAt: value.expiresAt.getTime(),
+					sessionId
 				};
 				return value;
 			})().finally(() => {
@@ -4578,7 +4600,7 @@ function createAuthClient(options) {
 		method: "POST",
 		headers: { "content-type": "application/json; charset=utf-8" },
 		body: { applicationId }
-	}), now);
+	}), now, () => sessionId);
 	const betterAuth = createAuthClient$1({
 		baseURL: authOrigin,
 		basePath: "/api/v1/auth",
@@ -4740,9 +4762,12 @@ function createAuthClient(options) {
 		credentialGeneration += 1;
 	}
 	function updateSession(session) {
-		const unboundCredential = !sessionId && (credential || credentialRequests.size > 0 || userApiCredentials.hasAuthority());
 		const changedSession = sessionId === void 0 ? !sessionAuthorityObserved || session !== null : !session || session.id !== sessionId || session.user.id !== sessionUserId;
-		if (!session || unboundCredential || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
+		if (!session || sessionId && (session.id !== sessionId || session.user.id !== sessionUserId)) clearCredential();
+		else if (!sessionId) {
+			if (credential && credential.sessionId !== session.id) credential = void 0;
+			userApiCredentials.retainSession(session.id);
+		}
 		if (changedSession || recentAuthenticationStartAttempt && (recentAuthenticationStartAttempt.sessionId !== session?.id || recentAuthenticationStartAttempt.userId !== session?.user.id)) recentAuthenticationStartAttempt = void 0;
 		if (changedSession) sessionAuthorityEpoch += 1;
 		sessionAuthorityObserved = true;
@@ -5390,9 +5415,12 @@ function createAuthClient(options) {
 					if (error) throw error;
 					const nextCredential = normalizeDriveCredential(result, now());
 					if (generation !== credentialGeneration) throw new AuthError("authentication_required", 401);
+					const issuedFor = credentialSessionId(nextCredential.token);
+					if (sessionId !== void 0 && issuedFor !== void 0 && issuedFor !== sessionId) throw new AuthError("authentication_required", 401);
 					if (selectedWorkspaceKey === workspaceKey) credential = {
 						key: workspaceKey,
-						value: nextCredential
+						value: nextCredential,
+						sessionId: issuedFor
 					};
 					return nextCredential;
 				})().finally(() => {