@loomup/astro 0.1.15 → 0.1.17

package/README.md

@@ -52,6 +52,13 @@ Package exports:
 - `@loomup/astro/middleware` — authentication middleware.
 - `@loomup/astro/auth` — lower-level cookie authentication helpers.
 
+The server client accepts both JSON token responses and Loomup `cookie_mode`
+responses, where the rotated refresh credential is supplied only in an upstream
+`Set-Cookie` header. It writes both credentials to application-owned HttpOnly
+cookies before updating the session. An incomplete token exchange throws
+`LoomupError` with code `invalid_response` and status `502`, leaving the existing
+session unchanged. Call server auth methods before response headers are sent.
+
 ## Coordinated browser sessions
 
 `createAuthenticatedProject()` coordinates cookie refresh within a tab and

package/dist/auth.js

@@ -1,6 +1,7 @@
 /** Same-origin Astro auth endpoint for Loomup-backed applications. */
 import { LoomupError } from "@loomup/client";
 import { readTokens, writeTokens } from "./cookies.js";
+import { normalizeAuthTokens } from "./authTokens.js";
 import { createServerClient, resolveServerUrl, } from "./server.js";
 const OAUTH_VERIFIER_COOKIE = "loomup-oauth-verifier";
 const OAUTH_RETURN_COOKIE = "loomup-oauth-return";
@@ -38,22 +39,6 @@ function publicSession(user) {
 function joinUrl(base, path) {
     return `${base.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
 }
-function upstreamCookie(headers, name) {
-    const extended = headers;
-    const values = typeof extended.getSetCookie === "function"
-        ? extended.getSetCookie()
-        : typeof extended.getAll === "function"
-            ? extended.getAll("Set-Cookie")
-            : [headers.get("Set-Cookie") ?? ""];
-    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const pattern = new RegExp(`(?:^|,\\s*)${escaped}=([^;]*)`);
-    for (const value of values) {
-        const match = pattern.exec(value);
-        if (match?.[1])
-            return match[1].replace(/^"|"$/g, "");
-    }
-    return undefined;
-}
 async function upstreamRequest(baseUrl, method, path, body, accessToken, serviceKey) {
     const headers = { Accept: "application/json" };
     if (body !== undefined)
@@ -79,28 +64,20 @@ async function upstreamRequest(baseUrl, method, path, body, accessToken, service
         const code = envelope?.error?.code;
         throw new LoomupError(String(message || upstream.statusText), typeof code === "string" ? code : undefined, upstream.status);
     }
-    if (!envelope || !("data" in envelope)) {
+    if (!envelope || typeof envelope !== "object" || Array.isArray(envelope) || !("data" in envelope)) {
         throw new LoomupError("invalid response from Loomup", "invalid_response", 502);
     }
     return { data: envelope.data, response: upstream };
 }
-async function authExchange(baseUrl, cookies, options, path, body, currentRefresh) {
+async function authExchange(baseUrl, cookies, options, path, body) {
     const { data, response: upstream } = await upstreamRequest(baseUrl, "POST", path, body, undefined, options.client?.serviceKey);
-    const accessToken = typeof data.access_token === "string"
-        ? data.access_token
-        : upstreamCookie(upstream.headers, "loomup_access");
-    const refreshToken = typeof data.refresh_token === "string"
-        ? data.refresh_token
-        : upstreamCookie(upstream.headers, "loomup_refresh") ?? currentRefresh;
-    if (!accessToken || !refreshToken) {
-        throw new LoomupError("Loomup auth response did not include a complete session", "invalid_response", 502);
-    }
+    const tokens = normalizeAuthTokens(data, upstream.headers);
     writeTokens(cookies, {
-        access_token: accessToken,
-        refresh_token: refreshToken,
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
         expires_in: typeof data.expires_in === "number" ? data.expires_in : undefined,
     }, options.cookies);
-    return { accessToken, user: data.user };
+    return { accessToken: tokens.access_token, user: data.user };
 }
 async function userForAccess(baseUrl, accessToken) {
     const { data } = await upstreamRequest(baseUrl, "GET", "/auth/me", undefined, accessToken);
@@ -120,7 +97,7 @@ async function sessionFromCookies(baseUrl, cookies, options) {
     if (!tokens.refresh) {
         throw new LoomupError("authentication required", "unauthorized", 401);
     }
-    const session = await authExchange(baseUrl, cookies, options, "/auth/refresh", { refresh_token: tokens.refresh }, tokens.refresh);
+    const session = await authExchange(baseUrl, cookies, options, "/auth/refresh", { refresh_token: tokens.refresh });
     return {
         accessToken: session.accessToken,
         user: session.user ?? (await userForAccess(baseUrl, session.accessToken)),
@@ -173,7 +150,7 @@ async function proxyToLoomup(context, options, baseUrl, action) {
         if (!tokens.refresh) {
             throw new LoomupError("authentication required", "unauthorized", 401);
         }
-        await authExchange(baseUrl, context.cookies, options, "/auth/refresh", { refresh_token: tokens.refresh }, tokens.refresh);
+        await authExchange(baseUrl, context.cookies, options, "/auth/refresh", { refresh_token: tokens.refresh });
         tokens = readTokens(context.cookies, options.cookies?.names);
     }
     if (!tokens.access) {
@@ -299,7 +276,7 @@ export function createLoomupAuthHandler(options = {}) {
                     const refreshToken = readTokens(context.cookies, options.cookies?.names).refresh;
                     if (!refreshToken)
                         throw new LoomupError("no refresh token", "no_refresh", 401);
-                    const session = await authExchange(url, context.cookies, options, "/auth/refresh", { refresh_token: refreshToken }, refreshToken);
+                    const session = await authExchange(url, context.cookies, options, "/auth/refresh", { refresh_token: refreshToken });
                     const user = session.user ?? (await userForAccess(url, session.accessToken));
                     return response(publicSession(user));
                 }

package/dist/authTokens.d.ts

@@ -0,0 +1,11 @@
+export declare function assertSessionTokens(tokens: {
+    access_token?: unknown;
+    refresh_token?: unknown;
+}): asserts tokens is {
+    access_token: string;
+    refresh_token: string;
+};
+export declare function normalizeAuthTokens(data: unknown, headers: Headers): {
+    access_token: string;
+    refresh_token: string;
+};

package/dist/authTokens.js

@@ -0,0 +1,40 @@
+/** Server-only normalization of Loomup JSON and HttpOnly cookie credentials. */
+import { LoomupError } from "@loomup/client";
+function credential(value) {
+    return typeof value === "string" && value.trim() ? value : undefined;
+}
+function upstreamCookie(headers, name) {
+    const extended = headers;
+    const values = typeof extended.getSetCookie === "function"
+        ? extended.getSetCookie()
+        : typeof extended.getAll === "function"
+            ? extended.getAll("Set-Cookie")
+            : [headers.get("Set-Cookie") ?? ""];
+    // Match cookie boundaries, without splitting commas inside Expires dates.
+    const pattern = new RegExp(`(?:^|,\\s*)${name}=([^;,]*)`);
+    for (const value of values) {
+        const match = pattern.exec(value);
+        const token = credential(match?.[1]?.replace(/^"|"$/g, ""));
+        if (token)
+            return token;
+    }
+    return undefined;
+}
+export function assertSessionTokens(tokens) {
+    if (!credential(tokens.access_token) || !credential(tokens.refresh_token)) {
+        throw new LoomupError("Loomup auth response did not include a complete session", "invalid_response", 502);
+    }
+}
+export function normalizeAuthTokens(data, headers) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+        throw new LoomupError("invalid response from Loomup", "invalid_response", 502);
+    }
+    const payload = data;
+    const tokens = {
+        ...payload,
+        access_token: credential(payload.access_token) ?? upstreamCookie(headers, "loomup_access"),
+        refresh_token: credential(payload.refresh_token) ?? upstreamCookie(headers, "loomup_refresh"),
+    };
+    assertSessionTokens(tokens);
+    return tokens;
+}

package/dist/cookies.d.ts

@@ -1,6 +1,3 @@
-/**
- * Cookie helpers for Loomup auth tokens in Astro SSR.
- */
 export declare const DEFAULT_ACCESS_COOKIE = "loomup-access";
 export declare const DEFAULT_REFRESH_COOKIE = "loomup-refresh";
 /** Minimal cookie API compatible with AstroCookies (and easy to mock in tests). */

package/dist/cookies.js

@@ -1,6 +1,7 @@
 /**
  * Cookie helpers for Loomup auth tokens in Astro SSR.
  */
+import { assertSessionTokens } from "./authTokens.js";
 export const DEFAULT_ACCESS_COOKIE = "loomup-access";
 export const DEFAULT_REFRESH_COOKIE = "loomup-refresh";
 export function resolveCookieNames(names) {
@@ -23,6 +24,7 @@ export function readTokens(cookies, names) {
     };
 }
 export function writeTokens(cookies, tokens, options) {
+    assertSessionTokens(tokens);
     const n = resolveCookieNames(options?.names);
     const path = options?.path ?? "/";
     const secure = isSecureDefault(options?.secure);

package/dist/server.d.ts

@@ -2,7 +2,7 @@
  * Server-side Loomup client for Astro (SSR frontmatter, endpoints, middleware).
  * Persists access/refresh tokens in httpOnly cookies.
  */
-import { LoomupClient, type AuthTokens, type AuthSignUpResult, type CreateClientOptions, type DefaultTableMap, type LoomupProject, type OAuthAuthorizeInput, type OAuthExchangeInput } from "@loomup/client";
+import { LoomupClient, type AuthTokens, type CreateClientOptions, type DefaultTableMap, type LoomupProject, type OAuthAuthorizeInput, type OAuthExchangeInput } from "@loomup/client";
 import { type CookieOptions, type CookieStore } from "./cookies.js";
 export type { CookieNames, CookieOptions, CookieStore, CookieWriteOptions, } from "./cookies.js";
 export { DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, clearTokens, readTokens, resolveCookieNames, writeTokens, } from "./cookies.js";
@@ -43,18 +43,9 @@ export declare class ServerLoomupClient<TMap = DefaultTableMap, TInsertMap = {
     constructor(cookieStore: CookieStore, options: CreateClientOptions & {
         cookieOptions?: CookieOptions;
     });
-    private persistFromTokens;
+    protected applyTokens(data: AuthTokens): void;
+    protected normalizeResponse(method: string, path: string, payload: unknown, response: Response): unknown;
     private clearCookieTokens;
-    signUp(creds: {
-        email: string;
-        password: string;
-    }): Promise<AuthSignUpResult>;
-    signIn(creds: {
-        email: string;
-        password: string;
-    }): Promise<AuthTokens>;
-    refresh(): Promise<AuthTokens>;
-    exchangeOAuthCode(input: OAuthExchangeInput): Promise<AuthTokens>;
     signOut(): Promise<void>;
     setToken(token: string | undefined): void;
     setRefreshToken(token: string | undefined): void;
@@ -66,11 +57,11 @@ export declare class ServerLoomupClient<TMap = DefaultTableMap, TInsertMap = {
         signUp: (creds: {
             email: string;
             password: string;
-        }) => Promise<AuthSignUpResult>;
+        }) => Promise<import("@loomup/client").AuthSignUpResult>;
         register: (creds: {
             email: string;
             password: string;
-        }) => Promise<AuthSignUpResult>;
+        }) => Promise<import("@loomup/client").AuthSignUpResult>;
         signIn: (creds: {
             email: string;
             password: string;

package/dist/server.js

@@ -4,6 +4,15 @@
  */
 import { LoomupClient, projectFromClient, } from "@loomup/client";
 import { asCookieStore, clearTokens, readTokens, writeTokens, } from "./cookies.js";
+import { normalizeAuthTokens } from "./authTokens.js";
+const TOKEN_EXCHANGE_PATHS = new Set([
+    "/auth/register",
+    "/auth/login",
+    "/auth/refresh",
+    "/auth/oauth/exchange",
+    "/auth/email-verification/confirm",
+    "/auth/invitations/accept",
+]);
 export { DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, clearTokens, readTokens, resolveCookieNames, writeTokens, } from "./cookies.js";
 export { LoomupError, createClient, StorageBucket, encodeObjectPath, normalizeStorageUpload, } from "@loomup/client";
 export { fileAndPathFromFormData, uploadFromFormData, storageDownloadResponse, } from "./objectStorage.js";
@@ -33,35 +42,33 @@ export class ServerLoomupClient extends LoomupClient {
         this.cookieOptions = options.cookieOptions;
         this.mirroredRefresh = options.refreshToken;
     }
-    persistFromTokens(data) {
+    applyTokens(data) {
+        // Validate and persist before changing core state or notifying observers.
+        writeTokens(this.cookieStore, {
+            ...data,
+            // Core setSession uses zero when the caller has no expiry metadata.
+            expires_in: data.expires_in === 0 ? undefined : data.expires_in,
+        }, this.cookieOptions);
         this.mirroredRefresh = data.refresh_token;
-        writeTokens(this.cookieStore, data, this.cookieOptions);
+        super.applyTokens(data);
+    }
+    normalizeResponse(method, path, payload, response) {
+        if (method.toUpperCase() !== "POST" || !TOKEN_EXCHANGE_PATHS.has(path))
+            return payload;
+        const envelope = payload && typeof payload === "object" && !Array.isArray(payload)
+            ? payload
+            : {};
+        const data = envelope.data;
+        if (path === "/auth/register" && data && typeof data === "object"
+            && "verification_required" in data && data.verification_required === true
+            && !("access_token" in data))
+            return payload;
+        return { ...envelope, data: normalizeAuthTokens(data, response.headers) };
     }
     clearCookieTokens() {
         this.mirroredRefresh = undefined;
         clearTokens(this.cookieStore, this.cookieOptions);
     }
-    async signUp(creds) {
-        const data = await super.signUp(creds);
-        if ("access_token" in data)
-            this.persistFromTokens(data);
-        return data;
-    }
-    async signIn(creds) {
-        const data = await super.signIn(creds);
-        this.persistFromTokens(data);
-        return data;
-    }
-    async refresh() {
-        const data = await super.refresh();
-        this.persistFromTokens(data);
-        return data;
-    }
-    async exchangeOAuthCode(input) {
-        const data = await super.exchangeOAuthCode(input);
-        this.persistFromTokens(data);
-        return data;
-    }
     async signOut() {
         await super.signOut();
         this.clearCookieTokens();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomup/astro",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Astro integration and SSR helpers for Loomup Realtime",
   "type": "module",
   "main": "dist/index.js",
@@ -37,7 +37,7 @@
     "prepack": "npm run build"
   },
   "peerDependencies": {
-    "@loomup/client": "^0.1.0",
+    "@loomup/client": "^0.1.17",
     "astro": ">=4.0.0"
   },
   "peerDependenciesMeta": {