@growth-labs/auth 0.14.1 → 0.16.0

package/README.md

@@ -51,7 +51,8 @@ auth({
 3. Requires the access token `aud` to match `resource`; wrong or missing audiences remain unauthenticated
 4. If expired but refresh token valid → silent refresh, verify the new access token audience, then set new cookies
    — one exchange per token per isolate, and never on a beacon or a prefetch (those are answered as a guest / `425`, and the next real request refreshes)
-5. Populates `context.locals.user` as `User | null`
+   — a refresh token the issuer refuses is remembered in `<prefix>_rtx`; the issuer is not asked again while it matches, and the token cookies are cleared only when a document navigation ≥60s later is refused a second time
+5. Populates `context.locals.user` as `User | null`, `context.locals.authSession` with how the session resolved, and — whenever the refresh path was entered — `context.locals.authRefreshFingerprint` with a SHA-256 prefix of the presented refresh token (never the token) for joining a site's session event to the issuer's `tokenFingerprint`
 6. If path matches `gatedPaths` and `user` is null → redirect to `loginPath`
 
 **Routes:**

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAA;AAmB7B,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CA0KnB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAA;AA4B7B,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CA2OnB"}

package/dist/middleware/auth.js

@@ -1,10 +1,11 @@
 import { getConfig } from '../config-store.js';
 import '../runtime-bridge.js';
 import { resolveClientSecret } from '../utils/client-secret.js';
-import { getCookie, setTokenCookies } from '../utils/cookies.js';
+import { clearTokenCookies, getCookie, setTokenCookies } from '../utils/cookies.js';
 import { secretResolutionFailureResponse } from '../utils/fail-closed.js';
 import { resolveInternalIssuer } from '../utils/issuer.js';
 import { classifyRefreshCarrier, prefetchDeferredResponse, } from '../utils/refresh-carrier.js';
+import { clearRejectionMarker, fingerprintRefreshToken, mayConfirmRejection, parseRejectionMarker, rejectionMarkerCookieName, setRejectionMarker, } from '../utils/refresh-rejection.js';
 import { refreshTokens, verifyAccessToken } from '../utils/tokens.js';
 const PRIVATE_NO_STORE_HEADERS = [
     'Cache-Control',
@@ -66,18 +67,64 @@ export async function onRequest(context, next) {
         if (carrier !== 'consumable')
             deferredCarrier = carrier;
     }
-    if (!user && refreshToken && deferredCarrier === null) {
-        const clientId = options.clientId || context.url.hostname;
-        refreshed = await refreshTokens(issuer, refreshToken, clientId, resolvedClientSecret, options.resource, (failure) => {
-            refreshFailure = failure;
-        });
-        if (refreshed) {
-            user = {
-                id: refreshed.claims.sub,
-                email: refreshed.claims.email,
-                name: refreshed.claims.name ?? null,
-                avatarUrl: refreshed.claims.image ?? null,
-            };
+    // Confirm before clear (refresh-rejection.ts). A refresh token the issuer
+    // has refused once is remembered in a short marker cookie; while it matches,
+    // the issuer is not asked again, and only a document navigation past the
+    // confirm window may ask a second time and clear on a second refusal.
+    const documentNavigation = isDocumentNavigation(request);
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const cookieWrites = [];
+    let suppressed = false;
+    let confirmedDead = false;
+    // Name the presented refresh token, never carry it (0.16.0). Computed once
+    // the refresh path is entered — deferred, suppressed, refreshed, expired or
+    // failed — and exposed as `context.locals.authRefreshFingerprint` so a site
+    // can put the same value the issuer logs as `tokenFingerprint` on its own
+    // session event and join the two. After a successful refresh it still names
+    // the token that was PRESENTED, which is the one a later lost-rotation
+    // rejection at the issuer will name too.
+    let fingerprint;
+    if (!user && refreshToken) {
+        fingerprint = await fingerprintRefreshToken(refreshToken);
+        context.locals.authRefreshFingerprint = fingerprint;
+    }
+    if (!user && refreshToken && fingerprint && deferredCarrier === null) {
+        const marker = parseRejectionMarker(getCookie(request, rejectionMarkerCookieName(options)));
+        const marked = marker !== null && marker.fingerprint === fingerprint;
+        const confirming = marked && mayConfirmRejection(marker, nowSeconds, documentNavigation);
+        if (marked && !confirming) {
+            suppressed = true;
+        }
+        else {
+            const clientId = options.clientId || context.url.hostname;
+            refreshed = await refreshTokens(issuer, refreshToken, clientId, resolvedClientSecret, options.resource, (failure) => {
+                refreshFailure = failure;
+            });
+            if (refreshed) {
+                user = {
+                    id: refreshed.claims.sub,
+                    email: refreshed.claims.email,
+                    name: refreshed.claims.name ?? null,
+                    avatarUrl: refreshed.claims.image ?? null,
+                };
+                if (marker)
+                    cookieWrites.push((response) => clearRejectionMarker(response, options));
+            }
+            else if (refreshFailure?.reason === 'invalid_grant') {
+                if (confirming) {
+                    // Second refusal, a minute or more after the first, on a request
+                    // the member is waiting for: the token is dead. Clear it.
+                    confirmedDead = true;
+                    cookieWrites.push((response) => {
+                        clearTokenCookies(response, options);
+                        clearRejectionMarker(response, options);
+                    });
+                }
+                else {
+                    const firstSeen = { fingerprint, rejectedAt: nowSeconds };
+                    cookieWrites.push((response) => setRejectionMarker(response, options, firstSeen));
+                }
+            }
         }
     }
     // 3. Populate context.locals.user and say HOW the session resolved. A site
@@ -94,15 +141,16 @@ export async function onRequest(context, next) {
         hadRefreshToken: refreshToken !== null,
         refreshFailure,
         deferred: deferredCarrier !== null,
+        suppressed,
     });
     context.locals.authSession = session;
-    // The cookies are deliberately left alone, even when the state is `expired`.
-    // The issuer keeps refresh tokens in an eventually consistent store, so a
-    // token only seconds old can read as missing from another location and be
-    // answered invalid_grant; today that costs one anonymous page and heals on
-    // the next navigation, and clearing would turn it into a forced sign-in.
-    // Recovery never needed the clear: signing in again overwrites them.
-    const documentNavigation = isDocumentNavigation(request);
+    // A first refusal clears nothing: the issuer keeps refresh tokens in an
+    // eventually consistent store, so a token only seconds old can read as
+    // missing from another location and be answered invalid_grant, and a
+    // straggling subrequest may still carry the token a fresh sign-in replaced.
+    // Only the confirmed second refusal above clears, and the response that
+    // clears still reports `expired`, so a site's sign-in-again notice fires
+    // once; every request after it is anonymous.
     if (deferredCarrier !== null) {
         try {
             console.info('[auth] session refresh deferred', {
@@ -118,6 +166,18 @@ export async function onRequest(context, next) {
         if (deferredCarrier === 'prefetch')
             return prefetchDeferredResponse();
     }
+    else if (suppressed) {
+        try {
+            console.info('[auth] session refresh suppressed', {
+                pathname: context.url.pathname,
+                documentNavigation,
+                session,
+            });
+        }
+        catch {
+            /* a patched console must not turn a guest page into a 500 */
+        }
+    }
     else if (!user && refreshToken) {
         const failure = refreshFailure ?? { reason: 'unreported' };
         try {
@@ -126,6 +186,7 @@ export async function onRequest(context, next) {
                 pathname: context.url.pathname,
                 documentNavigation,
                 session,
+                ...(confirmedDead ? { cleared: true } : {}),
             });
         }
         catch {
@@ -138,14 +199,25 @@ export async function onRequest(context, next) {
         // one the login renderer already knows how to explain. A rejected access
         // token with no refresh token beside it (wrong audience, say) is not a
         // session that ended, and its redirect stays exactly as it always was.
-        const sessionEnded = refreshFailure?.reason === 'invalid_grant';
+        const sessionEnded = refreshFailure?.reason === 'invalid_grant' || suppressed;
         const loginUrl = new URL(`${options.loginPath}?redirect=${encodeURIComponent(context.url.pathname)}${sessionEnded ? '&error=session_expired' : ''}`, context.url.origin);
-        return Response.redirect(loginUrl.toString(), 302);
+        if (cookieWrites.length === 0)
+            return Response.redirect(loginUrl.toString(), 302);
+        // Response.redirect's headers are immutable; the marker or the clear has
+        // to ride on this redirect, so build the same 302 by hand.
+        const redirect = new Response(null, {
+            status: 302,
+            headers: { Location: loginUrl.toString() },
+        });
+        for (const write of cookieWrites)
+            write(redirect);
+        return redirect;
     }
     // 5. Continue to the page
     const response = await next();
-    // 6. If tokens were refreshed or the response must carry no-store, clone and apply.
-    if (refreshed || context.locals.synthetic === true) {
+    // 6. If tokens were refreshed, a rejection marker moved, or the response must
+    // carry no-store, clone and apply.
+    if (refreshed || cookieWrites.length > 0 || context.locals.synthetic === true) {
         const modifiedResponse = new Response(response.body, {
             status: response.status,
             statusText: response.statusText,
@@ -154,6 +226,8 @@ export async function onRequest(context, next) {
         if (refreshed) {
             setTokenCookies(modifiedResponse, options, refreshed.accessToken, refreshed.refreshToken);
         }
+        for (const write of cookieWrites)
+            write(modifiedResponse);
         if (context.locals.synthetic === true) {
             for (const header of PRIVATE_NO_STORE_HEADERS) {
                 modifiedResponse.headers.set(header, 'private, no-store');
@@ -173,6 +247,9 @@ function resolveSessionState(input) {
     // A rejected access token with no refresh token beside it cannot be revived.
     if (!input.hadRefreshToken)
         return 'expired';
+    // A refusal remembered from a moment ago is still a refusal.
+    if (input.suppressed)
+        return 'expired';
     return input.refreshFailure?.reason === 'invalid_grant' ? 'expired' : 'refresh_failed';
 }
 /** Sec-Fetch-* is authoritative where the browser sends it; Accept is the fallback. */

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EACN,sBAAsB,EACtB,wBAAwB,GAExB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAuB,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE1F,MAAM,wBAAwB,GAAG;IAChC,eAAe;IACf,mBAAmB;IACnB,8BAA8B;CACrB,CAAA;AAEV,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAC/D,IAAI,oBAAwC,CAAA;IAE5C,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;YAC1B,OAAO,+BAA+B,CAAC,OAAO,EAAE;gBAC/C,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;aACvB,CAAC,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;IACxD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7F,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACtE,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;YAChC,CAAC;QACF,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,cAAc,GAAG,IAA6B,CAAA;IAClD,IAAI,eAAe,GAA0B,IAAI,CAAA;IACjD,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,OAAO,KAAK,YAAY;YAAE,eAAe,GAAG,OAAO,CAAA;IACxD,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,SAAS,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,OAAO,CAAC,QAAQ,EAChB,CAAC,OAAO,EAAE,EAAE;YACX,cAAc,GAAG,OAAO,CAAA;QACzB,CAAC,CACD,CAAA;QACD,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAC1B,MAAM,OAAO,GAAG,mBAAmB,CAAC;QACnC,IAAI;QACJ,SAAS,EAAE,SAAS,KAAK,IAAI;QAC7B,cAAc,EAAE,WAAW,KAAK,IAAI;QACpC,eAAe,EAAE,YAAY,KAAK,IAAI;QACtC,cAAc;QACd,QAAQ,EAAE,eAAe,KAAK,IAAI;KAClC,CAAC,CAAA;IACF,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAA;IAEpC,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAExD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC/C,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;aAC9B,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,eAAe,KAAK,UAAU;YAAE,OAAO,wBAAwB,EAAE,CAAA;IACtE,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,OAAO,GAAmB,cAAc,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;QAC1E,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC7C,GAAG,OAAO;gBACV,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;gBAC9B,kBAAkB;gBAClB,OAAO;aACP,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;IACF,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,YAAY,GAAG,cAAc,EAAE,MAAM,KAAK,eAAe,CAAA;QAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GACxE,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAC3C,EAAE,EACF,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,oFAAoF;IACpF,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,IAAI,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC/C,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC1D,CAAC;QACF,CAAC;QACD,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAO5B;IACA,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,WAAW,CAAA;IACvE,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAA;IACrC,6EAA6E;IAC7E,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,SAAS,CAAA;IAC5C,OAAO,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;AACvF,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,OAAgB;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,CAAA;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,CAAA;IACpC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EACN,sBAAsB,EACtB,wBAAwB,GAExB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACN,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EAEpB,yBAAyB,EACzB,kBAAkB,GAClB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAuB,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAE1F,MAAM,wBAAwB,GAAG;IAChC,eAAe;IACf,mBAAmB;IACnB,8BAA8B;CACrB,CAAA;AAEV,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAC/D,IAAI,oBAAwC,CAAA;IAE5C,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QAC7E,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;YAC1B,OAAO,+BAA+B,CAAC,OAAO,EAAE;gBAC/C,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,YAAY,CAAC,IAAI;aACvB,CAAC,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,YAAY,CAAC,MAAM,IAAI,SAAS,CAAA;IACxD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7F,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;YACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACtE,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAA;YAChC,CAAC;QACF,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,cAAc,GAAG,IAA6B,CAAA;IAClD,IAAI,eAAe,GAA0B,IAAI,CAAA;IACjD,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,OAAO,KAAK,YAAY;YAAE,eAAe,GAAG,OAAO,CAAA;IACxD,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAChD,MAAM,YAAY,GAAwC,EAAE,CAAA;IAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,yCAAyC;IACzC,IAAI,WAA+B,CAAA;IACnC,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,WAAW,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAA;QACzD,OAAO,CAAC,MAAM,CAAC,sBAAsB,GAAG,WAAW,CAAA;IACpD,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,WAAW,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC3F,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,CAAA;QACpE,MAAM,UAAU,GAAG,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAExF,IAAI,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3B,UAAU,GAAG,IAAI,CAAA;QAClB,CAAC;aAAM,CAAC;YACP,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;YACzD,SAAS,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,OAAO,CAAC,QAAQ,EAChB,CAAC,OAAO,EAAE,EAAE;gBACX,cAAc,GAAG,OAAO,CAAA;YACzB,CAAC,CACD,CAAA;YACD,IAAI,SAAS,EAAE,CAAC;gBACf,IAAI,GAAG;oBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;oBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;oBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;oBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;iBACzC,CAAA;gBACD,IAAI,MAAM;oBAAE,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;YACrF,CAAC;iBAAM,IAAI,cAAc,EAAE,MAAM,KAAK,eAAe,EAAE,CAAC;gBACvD,IAAI,UAAU,EAAE,CAAC;oBAChB,iEAAiE;oBACjE,0DAA0D;oBAC1D,aAAa,GAAG,IAAI,CAAA;oBACpB,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;wBAC9B,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;wBACpC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;oBACxC,CAAC,CAAC,CAAA;gBACH,CAAC;qBAAM,CAAC;oBACP,MAAM,SAAS,GAA2B,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;oBACjF,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;gBAClF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAC1B,MAAM,OAAO,GAAG,mBAAmB,CAAC;QACnC,IAAI;QACJ,SAAS,EAAE,SAAS,KAAK,IAAI;QAC7B,cAAc,EAAE,WAAW,KAAK,IAAI;QACpC,eAAe,EAAE,YAAY,KAAK,IAAI;QACtC,cAAc;QACd,QAAQ,EAAE,eAAe,KAAK,IAAI;QAClC,UAAU;KACV,CAAC,CAAA;IACF,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAA;IAEpC,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC/C,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;aAC9B,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,eAAe,KAAK,UAAU;YAAE,OAAO,wBAAwB,EAAE,CAAA;IACtE,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACjD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;gBAC9B,kBAAkB;gBAClB,OAAO;aACP,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;IACF,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,OAAO,GAAmB,cAAc,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;QAC1E,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAC7C,GAAG,OAAO;gBACV,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;gBAC9B,kBAAkB;gBAClB,OAAO;gBACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;QAC9D,CAAC;IACF,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,YAAY,GAAG,cAAc,EAAE,MAAM,KAAK,eAAe,IAAI,UAAU,CAAA;QAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GACxE,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAC3C,EAAE,EACF,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;QACjF,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;YACnC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE;SAC1C,CAAC,CAAA;QACF,KAAK,MAAM,KAAK,IAAI,YAAY;YAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACjD,OAAO,QAAQ,CAAA;IAChB,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,8EAA8E;IAC9E,mCAAmC;IACnC,IAAI,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC/E,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,IAAI,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QAC1F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,YAAY;YAAE,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACzD,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACvC,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC/C,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC1D,CAAC;QACF,CAAC;QACD,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAQ5B;IACA,IAAI,KAAK,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,WAAW,CAAA;IACvE,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAA;IACrC,6EAA6E;IAC7E,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,SAAS,CAAA;IAC5C,6DAA6D;IAC7D,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACtC,OAAO,KAAK,CAAC,cAAc,EAAE,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;AACvF,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,OAAgB;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,CAAA;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,CAAA;IACpC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/types.d.ts

@@ -140,10 +140,12 @@ export interface TokenExchangeResult {
  * may pass; `deferred` holds a refresh token this request deliberately did not
  * spend, because it is a beacon or a prefetch whose response the browser would
  * not apply (0.14.0) — the next consumable request refreshes, so treat it as a
- * guest request and nothing more. NONE is proof the session is dead (the
- * issuer's token store is eventually consistent), so never clear cookies on
- * them: signing in again overwrites the cookies, and the middleware itself
- * clears nothing.
+ * guest request and nothing more. NONE is proof the session is dead on its own
+ * (the issuer's token store is eventually consistent), so a site never clears
+ * cookies on them. The middleware clears the token cookies only after a second
+ * `invalid_grant` on a document navigation a minute or more after the first
+ * (0.15.0, `<prefix>_rtx` marker); that response still reports `expired`, and
+ * every request after it is `anonymous`.
  */
 export type AuthSessionState = 'anonymous' | 'verified' | 'refreshed' | 'expired' | 'refresh_failed' | 'deferred';
 declare global {
@@ -151,6 +153,18 @@ declare global {
         interface Locals {
             user: User | null;
             authSession?: AuthSessionState;
+            /**
+             * 16-hex SHA-256 prefix of the refresh token this request presented
+             * (0.16.0). Set only when the refresh path was entered — `authSession`
+             * is `refreshed`, `expired`, `refresh_failed` or `deferred` — and never
+             * when the access token verified or no refresh token was present. It
+             * is the value the issuer logs as `tokenFingerprint` on
+             * `oauth.token_refresh.rejected` and the value carried in the
+             * `{prefix}_rtx` marker: credential-linked, never person-linked, and
+             * the same token after a successful rotation. A site may write it on
+             * a session-outcome analytics event; it must never write the token.
+             */
+            authRefreshFingerprint?: string;
             synthetic?: boolean;
         }
     }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAA;AACpC,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEtC,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,SAAS,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,MAAM,CAAA;IACtD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC7C,iBAAiB,EAAE,MAAM,CAAA;IACzB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC5C,gBAAgB,EAAE,MAAM,CAAA;IACxB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACvC,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAA;AAE/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,kBAAkB,CAAA;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,6BAA6B,KAAK,kBAAkB,CAAA;AACnG,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,4BAA4B,KAAK,kBAAkB,CAAA;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,kBAAkB,CAAA;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,kBAAkB,CAAA;AAC3F,MAAM,MAAM,wBAAwB,GAAG,CACtC,OAAO,EAAE,+BAA+B,KACpC,kBAAkB,CAAA;AAEvB;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,cAAc,CAAC,EAAE,gBAAgB,CAAA;IACjC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;IAC1D,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GACzB,WAAW,GACX,UAAU,GACV,WAAW,GACX,SAAS,GACT,gBAAgB,GAChB,UAAU,CAAA;AAGb,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,MAAM;YACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;YACjB,WAAW,CAAC,EAAE,gBAAgB,CAAA;YAC9B,SAAS,CAAC,EAAE,OAAO,CAAA;SACnB;KACD;CACD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAA;AACpC,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEtC,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,SAAS,CAAC,EAAE,aAAa,GAAG,iBAAiB,GAAG,MAAM,CAAA;IACtD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC7C,iBAAiB,EAAE,MAAM,CAAA;IACzB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC5C,gBAAgB,EAAE,MAAM,CAAA;IACxB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACvC,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,iBAAiB,CAAA;CACxB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAA;AAE/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,oBAAoB,KAAK,kBAAkB,CAAA;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,6BAA6B,KAAK,kBAAkB,CAAA;AACnG,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,4BAA4B,KAAK,kBAAkB,CAAA;AACjG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,kBAAkB,CAAA;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,kBAAkB,CAAA;AAC3F,MAAM,MAAM,wBAAwB,GAAG,CACtC,OAAO,EAAE,+BAA+B,KACpC,kBAAkB,CAAA;AAEvB;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,cAAc,CAAC,EAAE,gBAAgB,CAAA;IACjC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,aAAa,CAAC,EAAE,qBAAqB,CAAA;IACrC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB,QAAQ,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAA;IAC1D,MAAM,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;CACD;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,gBAAgB,GACzB,WAAW,GACX,UAAU,GACV,WAAW,GACX,SAAS,GACT,gBAAgB,GAChB,UAAU,CAAA;AAGb,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,GAAG,CAAC;QACb,UAAU,MAAM;YACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;YACjB,WAAW,CAAC,EAAE,gBAAgB,CAAA;YAC9B;;;;;;;;;;eAUG;YACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;YAC/B,SAAS,CAAC,EAAE,OAAO,CAAA;SACnB;KACD;CACD"}

package/dist/utils/refresh-rejection.d.ts

@@ -0,0 +1,23 @@
+import type { ResolvedAuthOptions } from '../options.js';
+/** Seconds between the first rejection and the one that may clear. Past KV's convergence. */
+export declare const REFRESH_REJECTION_CONFIRM_AFTER_SECONDS = 60;
+/** How long a rejection is remembered. Long enough for a second navigation, short enough to forget. */
+export declare const REFRESH_REJECTION_MARKER_MAX_AGE_SECONDS = 900;
+export interface RefreshRejectionMarker {
+    fingerprint: string;
+    /** Unix seconds when the first rejection was seen. */
+    rejectedAt: number;
+}
+export declare function rejectionMarkerCookieName(options: Pick<ResolvedAuthOptions, 'cookiePrefix'>): string;
+/** SHA-256 hex prefix of the refresh token: names it without carrying it. */
+export declare function fingerprintRefreshToken(refreshToken: string): Promise<string>;
+export declare function parseRejectionMarker(value: string | null): RefreshRejectionMarker | null;
+export declare function formatRejectionMarker(marker: RefreshRejectionMarker): string;
+/**
+ * Whether this request may ask the issuer a second time and clear on refusal:
+ * a document navigation, carrying the marked token, past the confirm window.
+ */
+export declare function mayConfirmRejection(marker: RefreshRejectionMarker, nowSeconds: number, documentNavigation: boolean): boolean;
+export declare function setRejectionMarker(response: Response, options: ResolvedAuthOptions, marker: RefreshRejectionMarker): void;
+export declare function clearRejectionMarker(response: Response, options: ResolvedAuthOptions): void;
+//# sourceMappingURL=refresh-rejection.d.ts.map

package/dist/utils/refresh-rejection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-rejection.d.ts","sourceRoot":"","sources":["../../src/utils/refresh-rejection.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGxD,6FAA6F;AAC7F,eAAO,MAAM,uCAAuC,KAAK,CAAA;AACzD,uGAAuG;AACvG,eAAO,MAAM,wCAAwC,MAAM,CAAA;AAK3D,MAAM,WAAW,sBAAsB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,GAChD,MAAM,CAER;AAED,6EAA6E;AAC7E,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMnF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,sBAAsB,GAAG,IAAI,CAOxF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAE5E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,UAAU,EAAE,MAAM,EAClB,kBAAkB,EAAE,OAAO,GACzB,OAAO,CAIT;AAYD,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,sBAAsB,GAC5B,IAAI,CAKN;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAK3F"}

package/dist/utils/refresh-rejection.js

@@ -0,0 +1,89 @@
+// Confirm before clear.
+//
+// 0.13.0 chose never to clear a cookie on invalid_grant, for two recorded
+// reasons (packages #626): the issuer keeps refresh tokens in Workers KV, so a
+// token seconds old can read as missing from another colo and be refused once;
+// and a subrequest still carrying the OLD refresh token can arrive after the
+// member has just signed in again, and a clear on its response would wipe the
+// new session. Both are real. Neither needs a dead token re-presented on every
+// request for hours, which is what 407 issuer rejections from 29 tokens in a
+// day were (2026-09-20).
+//
+// So the middleware keeps a short marker of the rejection instead:
+//
+//   1. The first invalid_grant for a refresh token sets `<prefix>_rtx` holding a
+//      SHA-256 prefix of that token and the time. Nothing else changes: the
+//      session is `expired`, the notice a site shows still fires, no cookie is
+//      cleared.
+//   2. While the marker matches the presented token, requests do not ask the
+//      issuer again; they report `expired` at once. That ends the amplification.
+//   3. A document navigation at least CONFIRM_AFTER seconds later asks once
+//      more. A second invalid_grant clears the token cookies and the marker; a
+//      success clears the marker and carries on.
+//
+// A straggler can never clear: it is a subrequest, and its marker names the old
+// token, not the new one. A consistency miss can never clear: the second ask
+// happens after KV has converged, succeeds, and drops the marker. The marker
+// carries a digest, never a token, and its only power is to hurry the clearing
+// of the cookies it sits beside.
+import { setCookie } from './cookies.js';
+/** Seconds between the first rejection and the one that may clear. Past KV's convergence. */
+export const REFRESH_REJECTION_CONFIRM_AFTER_SECONDS = 60;
+/** How long a rejection is remembered. Long enough for a second navigation, short enough to forget. */
+export const REFRESH_REJECTION_MARKER_MAX_AGE_SECONDS = 900;
+const FINGERPRINT_HEX_LENGTH = 16;
+const MARKER_PATTERN = /^([0-9a-f]{16})\.(\d{1,12})$/;
+export function rejectionMarkerCookieName(options) {
+    return `${options.cookiePrefix}_rtx`;
+}
+/** SHA-256 hex prefix of the refresh token: names it without carrying it. */
+export async function fingerprintRefreshToken(refreshToken) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(refreshToken));
+    return [...new Uint8Array(digest)]
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('')
+        .slice(0, FINGERPRINT_HEX_LENGTH);
+}
+export function parseRejectionMarker(value) {
+    if (!value)
+        return null;
+    const match = MARKER_PATTERN.exec(value);
+    if (!match)
+        return null;
+    const rejectedAt = Number(match[2]);
+    if (!Number.isSafeInteger(rejectedAt))
+        return null;
+    return { fingerprint: match[1], rejectedAt };
+}
+export function formatRejectionMarker(marker) {
+    return `${marker.fingerprint}.${marker.rejectedAt}`;
+}
+/**
+ * Whether this request may ask the issuer a second time and clear on refusal:
+ * a document navigation, carrying the marked token, past the confirm window.
+ */
+export function mayConfirmRejection(marker, nowSeconds, documentNavigation) {
+    return (documentNavigation && nowSeconds - marker.rejectedAt >= REFRESH_REJECTION_CONFIRM_AFTER_SECONDS);
+}
+function markerAttributes(options) {
+    return {
+        path: '/',
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        ...(options.sessionCookieDomain && { domain: options.sessionCookieDomain }),
+    };
+}
+export function setRejectionMarker(response, options, marker) {
+    setCookie(response, rejectionMarkerCookieName(options), formatRejectionMarker(marker), {
+        ...markerAttributes(options),
+        maxAge: REFRESH_REJECTION_MARKER_MAX_AGE_SECONDS,
+    });
+}
+export function clearRejectionMarker(response, options) {
+    setCookie(response, rejectionMarkerCookieName(options), '', {
+        ...markerAttributes(options),
+        maxAge: 0,
+    });
+}
+//# sourceMappingURL=refresh-rejection.js.map

package/dist/utils/refresh-rejection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-rejection.js","sourceRoot":"","sources":["../../src/utils/refresh-rejection.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,+EAA+E;AAC/E,gBAAgB;AAChB,6EAA6E;AAC7E,iFAAiF;AACjF,4EAA4E;AAC5E,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,iCAAiC;AAGjC,OAAO,EAAyB,SAAS,EAAE,MAAM,cAAc,CAAA;AAE/D,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAA;AACzD,uGAAuG;AACvG,MAAM,CAAC,MAAM,wCAAwC,GAAG,GAAG,CAAA;AAE3D,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC,MAAM,cAAc,GAAG,8BAA8B,CAAA;AAQrD,MAAM,UAAU,yBAAyB,CACxC,OAAkD;IAElD,OAAO,GAAG,OAAO,CAAC,YAAY,MAAM,CAAA;AACrC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,YAAoB;IACjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IAC5F,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IACnE,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,CAAA;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAClC,MAA8B,EAC9B,UAAkB,EAClB,kBAA2B;IAE3B,OAAO,CACN,kBAAkB,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,uCAAuC,CAC/F,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA4B;IACrD,OAAO;QACN,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;KAC3E,CAAA;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,QAAkB,EAClB,OAA4B,EAC5B,MAA8B;IAE9B,SAAS,CAAC,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE;QACtF,GAAG,gBAAgB,CAAC,OAAO,CAAC;QAC5B,MAAM,EAAE,wCAAwC;KAChD,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAkB,EAAE,OAA4B;IACpF,SAAS,CAAC,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE;QAC3D,GAAG,gBAAgB,CAAC,OAAO,CAAC;QAC5B,MAAM,EAAE,CAAC;KACT,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/auth",
-  "version": "0.14.1",
+  "version": "0.16.0",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {

package/src/middleware/auth.ts

@@ -2,7 +2,7 @@ import { getConfig } from '../config-store.js'
 import '../runtime-bridge.js'
 import type { AuthSessionState, User } from '../types.js'
 import { resolveClientSecret } from '../utils/client-secret.js'
-import { getCookie, setTokenCookies } from '../utils/cookies.js'
+import { clearTokenCookies, getCookie, setTokenCookies } from '../utils/cookies.js'
 import { secretResolutionFailureResponse } from '../utils/fail-closed.js'
 import { resolveInternalIssuer } from '../utils/issuer.js'
 import {
@@ -10,6 +10,15 @@ import {
 	prefetchDeferredResponse,
 	type RefreshCarrier,
 } from '../utils/refresh-carrier.js'
+import {
+	clearRejectionMarker,
+	fingerprintRefreshToken,
+	mayConfirmRejection,
+	parseRejectionMarker,
+	type RefreshRejectionMarker,
+	rejectionMarkerCookieName,
+	setRejectionMarker,
+} from '../utils/refresh-rejection.js'
 import { type RefreshFailure, refreshTokens, verifyAccessToken } from '../utils/tokens.js'
 
 const PRIVATE_NO_STORE_HEADERS = [
@@ -80,24 +89,68 @@ export async function onRequest(
 		const carrier = classifyRefreshCarrier(request)
 		if (carrier !== 'consumable') deferredCarrier = carrier
 	}
-	if (!user && refreshToken && deferredCarrier === null) {
-		const clientId = options.clientId || context.url.hostname
-		refreshed = await refreshTokens(
-			issuer,
-			refreshToken,
-			clientId,
-			resolvedClientSecret,
-			options.resource,
-			(failure) => {
-				refreshFailure = failure
-			},
-		)
-		if (refreshed) {
-			user = {
-				id: refreshed.claims.sub,
-				email: refreshed.claims.email,
-				name: refreshed.claims.name ?? null,
-				avatarUrl: refreshed.claims.image ?? null,
+
+	// Confirm before clear (refresh-rejection.ts). A refresh token the issuer
+	// has refused once is remembered in a short marker cookie; while it matches,
+	// the issuer is not asked again, and only a document navigation past the
+	// confirm window may ask a second time and clear on a second refusal.
+	const documentNavigation = isDocumentNavigation(request)
+	const nowSeconds = Math.floor(Date.now() / 1000)
+	const cookieWrites: Array<(response: Response) => void> = []
+	let suppressed = false
+	let confirmedDead = false
+	// Name the presented refresh token, never carry it (0.16.0). Computed once
+	// the refresh path is entered — deferred, suppressed, refreshed, expired or
+	// failed — and exposed as `context.locals.authRefreshFingerprint` so a site
+	// can put the same value the issuer logs as `tokenFingerprint` on its own
+	// session event and join the two. After a successful refresh it still names
+	// the token that was PRESENTED, which is the one a later lost-rotation
+	// rejection at the issuer will name too.
+	let fingerprint: string | undefined
+	if (!user && refreshToken) {
+		fingerprint = await fingerprintRefreshToken(refreshToken)
+		context.locals.authRefreshFingerprint = fingerprint
+	}
+	if (!user && refreshToken && fingerprint && deferredCarrier === null) {
+		const marker = parseRejectionMarker(getCookie(request, rejectionMarkerCookieName(options)))
+		const marked = marker !== null && marker.fingerprint === fingerprint
+		const confirming = marked && mayConfirmRejection(marker, nowSeconds, documentNavigation)
+
+		if (marked && !confirming) {
+			suppressed = true
+		} else {
+			const clientId = options.clientId || context.url.hostname
+			refreshed = await refreshTokens(
+				issuer,
+				refreshToken,
+				clientId,
+				resolvedClientSecret,
+				options.resource,
+				(failure) => {
+					refreshFailure = failure
+				},
+			)
+			if (refreshed) {
+				user = {
+					id: refreshed.claims.sub,
+					email: refreshed.claims.email,
+					name: refreshed.claims.name ?? null,
+					avatarUrl: refreshed.claims.image ?? null,
+				}
+				if (marker) cookieWrites.push((response) => clearRejectionMarker(response, options))
+			} else if (refreshFailure?.reason === 'invalid_grant') {
+				if (confirming) {
+					// Second refusal, a minute or more after the first, on a request
+					// the member is waiting for: the token is dead. Clear it.
+					confirmedDead = true
+					cookieWrites.push((response) => {
+						clearTokenCookies(response, options)
+						clearRejectionMarker(response, options)
+					})
+				} else {
+					const firstSeen: RefreshRejectionMarker = { fingerprint, rejectedAt: nowSeconds }
+					cookieWrites.push((response) => setRejectionMarker(response, options, firstSeen))
+				}
 			}
 		}
 	}
@@ -116,17 +169,17 @@ export async function onRequest(
 		hadRefreshToken: refreshToken !== null,
 		refreshFailure,
 		deferred: deferredCarrier !== null,
+		suppressed,
 	})
 	context.locals.authSession = session
 
-	// The cookies are deliberately left alone, even when the state is `expired`.
-	// The issuer keeps refresh tokens in an eventually consistent store, so a
-	// token only seconds old can read as missing from another location and be
-	// answered invalid_grant; today that costs one anonymous page and heals on
-	// the next navigation, and clearing would turn it into a forced sign-in.
-	// Recovery never needed the clear: signing in again overwrites them.
-	const documentNavigation = isDocumentNavigation(request)
-
+	// A first refusal clears nothing: the issuer keeps refresh tokens in an
+	// eventually consistent store, so a token only seconds old can read as
+	// missing from another location and be answered invalid_grant, and a
+	// straggling subrequest may still carry the token a fresh sign-in replaced.
+	// Only the confirmed second refusal above clears, and the response that
+	// clears still reports `expired`, so a site's sign-in-again notice fires
+	// once; every request after it is anonymous.
 	if (deferredCarrier !== null) {
 		try {
 			console.info('[auth] session refresh deferred', {
@@ -139,6 +192,16 @@ export async function onRequest(
 		// A prefetched document rendered as a guest would be shown to the member
 		// on navigation as if they had signed out; a non-2xx is dropped instead.
 		if (deferredCarrier === 'prefetch') return prefetchDeferredResponse()
+	} else if (suppressed) {
+		try {
+			console.info('[auth] session refresh suppressed', {
+				pathname: context.url.pathname,
+				documentNavigation,
+				session,
+			})
+		} catch {
+			/* a patched console must not turn a guest page into a 500 */
+		}
 	} else if (!user && refreshToken) {
 		const failure: RefreshFailure = refreshFailure ?? { reason: 'unreported' }
 		try {
@@ -147,6 +210,7 @@ export async function onRequest(
 				pathname: context.url.pathname,
 				documentNavigation,
 				session,
+				...(confirmedDead ? { cleared: true } : {}),
 			})
 		} catch {
 			/* a patched console must not turn a guest page into a 500 */
@@ -159,21 +223,30 @@ export async function onRequest(
 		// one the login renderer already knows how to explain. A rejected access
 		// token with no refresh token beside it (wrong audience, say) is not a
 		// session that ended, and its redirect stays exactly as it always was.
-		const sessionEnded = refreshFailure?.reason === 'invalid_grant'
+		const sessionEnded = refreshFailure?.reason === 'invalid_grant' || suppressed
 		const loginUrl = new URL(
 			`${options.loginPath}?redirect=${encodeURIComponent(context.url.pathname)}${
 				sessionEnded ? '&error=session_expired' : ''
 			}`,
 			context.url.origin,
 		)
-		return Response.redirect(loginUrl.toString(), 302)
+		if (cookieWrites.length === 0) return Response.redirect(loginUrl.toString(), 302)
+		// Response.redirect's headers are immutable; the marker or the clear has
+		// to ride on this redirect, so build the same 302 by hand.
+		const redirect = new Response(null, {
+			status: 302,
+			headers: { Location: loginUrl.toString() },
+		})
+		for (const write of cookieWrites) write(redirect)
+		return redirect
 	}
 
 	// 5. Continue to the page
 	const response = await next()
 
-	// 6. If tokens were refreshed or the response must carry no-store, clone and apply.
-	if (refreshed || context.locals.synthetic === true) {
+	// 6. If tokens were refreshed, a rejection marker moved, or the response must
+	// carry no-store, clone and apply.
+	if (refreshed || cookieWrites.length > 0 || context.locals.synthetic === true) {
 		const modifiedResponse = new Response(response.body, {
 			status: response.status,
 			statusText: response.statusText,
@@ -182,6 +255,7 @@ export async function onRequest(
 		if (refreshed) {
 			setTokenCookies(modifiedResponse, options, refreshed.accessToken, refreshed.refreshToken)
 		}
+		for (const write of cookieWrites) write(modifiedResponse)
 		if (context.locals.synthetic === true) {
 			for (const header of PRIVATE_NO_STORE_HEADERS) {
 				modifiedResponse.headers.set(header, 'private, no-store')
@@ -200,12 +274,15 @@ function resolveSessionState(input: {
 	hadRefreshToken: boolean
 	refreshFailure: RefreshFailure | null
 	deferred: boolean
+	suppressed: boolean
 }): AuthSessionState {
 	if (input.user) return input.refreshed ? 'refreshed' : 'verified'
 	if (!input.hadAccessToken && !input.hadRefreshToken) return 'anonymous'
 	if (input.deferred) return 'deferred'
 	// A rejected access token with no refresh token beside it cannot be revived.
 	if (!input.hadRefreshToken) return 'expired'
+	// A refusal remembered from a moment ago is still a refusal.
+	if (input.suppressed) return 'expired'
 	return input.refreshFailure?.reason === 'invalid_grant' ? 'expired' : 'refresh_failed'
 }
 

package/src/types.ts

@@ -158,10 +158,12 @@ export interface TokenExchangeResult {
  * may pass; `deferred` holds a refresh token this request deliberately did not
  * spend, because it is a beacon or a prefetch whose response the browser would
  * not apply (0.14.0) — the next consumable request refreshes, so treat it as a
- * guest request and nothing more. NONE is proof the session is dead (the
- * issuer's token store is eventually consistent), so never clear cookies on
- * them: signing in again overwrites the cookies, and the middleware itself
- * clears nothing.
+ * guest request and nothing more. NONE is proof the session is dead on its own
+ * (the issuer's token store is eventually consistent), so a site never clears
+ * cookies on them. The middleware clears the token cookies only after a second
+ * `invalid_grant` on a document navigation a minute or more after the first
+ * (0.15.0, `<prefix>_rtx` marker); that response still reports `expired`, and
+ * every request after it is `anonymous`.
  */
 export type AuthSessionState =
 	| 'anonymous'
@@ -177,6 +179,18 @@ declare global {
 		interface Locals {
 			user: User | null
 			authSession?: AuthSessionState
+			/**
+			 * 16-hex SHA-256 prefix of the refresh token this request presented
+			 * (0.16.0). Set only when the refresh path was entered — `authSession`
+			 * is `refreshed`, `expired`, `refresh_failed` or `deferred` — and never
+			 * when the access token verified or no refresh token was present. It
+			 * is the value the issuer logs as `tokenFingerprint` on
+			 * `oauth.token_refresh.rejected` and the value carried in the
+			 * `{prefix}_rtx` marker: credential-linked, never person-linked, and
+			 * the same token after a successful rotation. A site may write it on
+			 * a session-outcome analytics event; it must never write the token.
+			 */
+			authRefreshFingerprint?: string
 			synthetic?: boolean
 		}
 	}

package/src/utils/refresh-rejection.ts

@@ -0,0 +1,115 @@
+// Confirm before clear.
+//
+// 0.13.0 chose never to clear a cookie on invalid_grant, for two recorded
+// reasons (packages #626): the issuer keeps refresh tokens in Workers KV, so a
+// token seconds old can read as missing from another colo and be refused once;
+// and a subrequest still carrying the OLD refresh token can arrive after the
+// member has just signed in again, and a clear on its response would wipe the
+// new session. Both are real. Neither needs a dead token re-presented on every
+// request for hours, which is what 407 issuer rejections from 29 tokens in a
+// day were (2026-09-20).
+//
+// So the middleware keeps a short marker of the rejection instead:
+//
+//   1. The first invalid_grant for a refresh token sets `<prefix>_rtx` holding a
+//      SHA-256 prefix of that token and the time. Nothing else changes: the
+//      session is `expired`, the notice a site shows still fires, no cookie is
+//      cleared.
+//   2. While the marker matches the presented token, requests do not ask the
+//      issuer again; they report `expired` at once. That ends the amplification.
+//   3. A document navigation at least CONFIRM_AFTER seconds later asks once
+//      more. A second invalid_grant clears the token cookies and the marker; a
+//      success clears the marker and carries on.
+//
+// A straggler can never clear: it is a subrequest, and its marker names the old
+// token, not the new one. A consistency miss can never clear: the second ask
+// happens after KV has converged, succeeds, and drops the marker. The marker
+// carries a digest, never a token, and its only power is to hurry the clearing
+// of the cookies it sits beside.
+
+import type { ResolvedAuthOptions } from '../options.js'
+import { type CookieAttributes, setCookie } from './cookies.js'
+
+/** Seconds between the first rejection and the one that may clear. Past KV's convergence. */
+export const REFRESH_REJECTION_CONFIRM_AFTER_SECONDS = 60
+/** How long a rejection is remembered. Long enough for a second navigation, short enough to forget. */
+export const REFRESH_REJECTION_MARKER_MAX_AGE_SECONDS = 900
+
+const FINGERPRINT_HEX_LENGTH = 16
+const MARKER_PATTERN = /^([0-9a-f]{16})\.(\d{1,12})$/
+
+export interface RefreshRejectionMarker {
+	fingerprint: string
+	/** Unix seconds when the first rejection was seen. */
+	rejectedAt: number
+}
+
+export function rejectionMarkerCookieName(
+	options: Pick<ResolvedAuthOptions, 'cookiePrefix'>,
+): string {
+	return `${options.cookiePrefix}_rtx`
+}
+
+/** SHA-256 hex prefix of the refresh token: names it without carrying it. */
+export async function fingerprintRefreshToken(refreshToken: string): Promise<string> {
+	const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(refreshToken))
+	return [...new Uint8Array(digest)]
+		.map((byte) => byte.toString(16).padStart(2, '0'))
+		.join('')
+		.slice(0, FINGERPRINT_HEX_LENGTH)
+}
+
+export function parseRejectionMarker(value: string | null): RefreshRejectionMarker | null {
+	if (!value) return null
+	const match = MARKER_PATTERN.exec(value)
+	if (!match) return null
+	const rejectedAt = Number(match[2])
+	if (!Number.isSafeInteger(rejectedAt)) return null
+	return { fingerprint: match[1], rejectedAt }
+}
+
+export function formatRejectionMarker(marker: RefreshRejectionMarker): string {
+	return `${marker.fingerprint}.${marker.rejectedAt}`
+}
+
+/**
+ * Whether this request may ask the issuer a second time and clear on refusal:
+ * a document navigation, carrying the marked token, past the confirm window.
+ */
+export function mayConfirmRejection(
+	marker: RefreshRejectionMarker,
+	nowSeconds: number,
+	documentNavigation: boolean,
+): boolean {
+	return (
+		documentNavigation && nowSeconds - marker.rejectedAt >= REFRESH_REJECTION_CONFIRM_AFTER_SECONDS
+	)
+}
+
+function markerAttributes(options: ResolvedAuthOptions): CookieAttributes {
+	return {
+		path: '/',
+		httpOnly: true,
+		secure: true,
+		sameSite: 'lax',
+		...(options.sessionCookieDomain && { domain: options.sessionCookieDomain }),
+	}
+}
+
+export function setRejectionMarker(
+	response: Response,
+	options: ResolvedAuthOptions,
+	marker: RefreshRejectionMarker,
+): void {
+	setCookie(response, rejectionMarkerCookieName(options), formatRejectionMarker(marker), {
+		...markerAttributes(options),
+		maxAge: REFRESH_REJECTION_MARKER_MAX_AGE_SECONDS,
+	})
+}
+
+export function clearRejectionMarker(response: Response, options: ResolvedAuthOptions): void {
+	setCookie(response, rejectionMarkerCookieName(options), '', {
+		...markerAttributes(options),
+		maxAge: 0,
+	})
+}