@hyperfixation/auth 0.1.0 → 0.1.2

package/dist/policy.d.ts

@@ -34,6 +34,8 @@ export interface AccessRequest extends AccessPaths {
     /** Raise the bar above what the route alone demands. Never lowers `/admin/*`. */
     factor?: SessionFactor;
     role?: string;
+    /** The clock the ban expiry is read against. Injectable so a test can sit on an instant. */
+    now?: () => number;
 }
 /**
  * The first segment, with a leading `/api` stripped, so `/api/admin/users` is admin territory

package/dist/policy.js

@@ -7,6 +7,21 @@ export const DEFAULT_SIGN_IN_PATH = "/auth/sign-in";
 export const DEFAULT_STEP_UP_PATH = "/auth/passkey";
 /** The role `/admin/*` requires, and the one `bootstrapAdmin` grants. */
 export const ADMIN_ROLE = "admin";
+/**
+ * The same rule the notifier's SQL applies — `banned IS TRUE AND (ban_expires IS NULL OR
+ * ban_expires > now())`. A ban with a lapsed expiry is over even though the column still says
+ * `true`: nothing sweeps the row, so the expiry is what decides. An unreadable `ban_expires`
+ * keeps the ban, because the alternative is letting a bad value un-ban someone.
+ */
+function banIsActive(user, now) {
+    if (user.banned !== true)
+        return false;
+    const expires = user.banExpires;
+    if (expires === null || expires === undefined)
+        return true;
+    const at = expires instanceof Date ? expires.getTime() : Date.parse(expires);
+    return Number.isNaN(at) || at > now;
+}
 /**
  * The first segment, with a leading `/api` stripped, so `/api/admin/users` is admin territory
  * to a route handler exactly as `/admin/users` is to a layout. Stripping `/api` is also what
@@ -56,7 +71,7 @@ export function evaluateAccess(request) {
         return refuse("no-session", signIn);
     // A ban lands on the user row while their sessions are still live; it has to be read here or
     // a banned admin keeps the tab they already had open.
-    if (session.user.banned === true)
+    if (banIsActive(session.user, (request.now ?? Date.now)()))
         return refuse("banned", signIn);
     if (requiredRole !== undefined && !hasRole(session.user, requiredRole)) {
         return { outcome: "not-found", refusal: "missing-role" };

package/dist/session.d.ts

@@ -13,6 +13,11 @@ export interface SessionUser {
     email?: string;
     role?: string | null;
     banned?: boolean | null;
+    /**
+     * When the ban lapses. better-auth hands this back as a `Date` from the database and as an
+     * ISO string once it has been through JSON, so both shapes have to read the same here.
+     */
+    banExpires?: Date | string | null;
 }
 /** What the guard needs of a session; better-auth's `session` is a superset. */
 export interface AuthSession {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperfixation/auth",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "license": "MIT",
   "description": "better-auth factory, session-factor policy, requireSession, and the bootstrap user",
   "repository": {
@@ -24,15 +24,15 @@
     "!dist/**/*.test.*"
   ],
   "devDependencies": {
-    "@hyperfixation/eslint-config": "0.1.0",
-    "@hyperfixation/testing": "0.1.0",
+    "@hyperfixation/eslint-config": "0.1.2",
+    "@hyperfixation/testing": "0.1.2",
     "@microsoft/api-extractor": "^7.59.1",
     "@types/pg": "^8.23.1",
     "eslint": "^10.10.0"
   },
   "dependencies": {
     "@better-auth/passkey": "1.7.5",
-    "@hyperfixation/db": "0.1.0",
+    "@hyperfixation/db": "0.1.2",
     "@simplewebauthn/server": "13.3.3",
     "better-auth": "1.7.5",
     "drizzle-orm": "^0.45.2",