@maestro-js/auth 1.0.0-alpha.24 → 1.0.0-alpha.25

package/dist/index.d.ts

@@ -14,6 +14,12 @@ interface RememberMeTokenRecordType<Id, DeviceContext> {
     verifierHash: string;
     expirationDate: Iso.Instant | null;
     rotatedDate: Iso.Instant | null;
+    /**
+     * When the token chain was first issued (at login). Successor rows produced by `rotateBySelector`
+     * must inherit this value rather than resetting it, so it always reflects the original grant time.
+     * Used to reject cookies whose chain predates a credential invalidation.
+     */
+    createdDate: Iso.Instant;
 }
 interface RememberMeOptionsType<Id, DeviceContext> {
     maxRememberMeSeconds: number;
@@ -23,7 +29,7 @@ interface RememberMeOptionsType<Id, DeviceContext> {
     rotateBySelector(selector: string, token: {
         verifierHash: string;
         selector: string;
-    }): Promise<void>;
+    }): Promise<boolean>;
     revokeBySelector(selector: string): Promise<void>;
     revokeByAuthenticatableId(id: Id): Promise<void>;
     validateDeviceContext?(creatingDeviceContext: DeviceContext, currentDeviceContext: DeviceContext): Promise<boolean> | boolean;
@@ -129,6 +135,13 @@ declare namespace Auth {
                 id: Id | null;
                 cookie: string | null;
             }>;
+            /**
+             * Delete all stored remember-me token rows for an authenticatable. `authenticate` already
+             * rejects any chain issued before `credentialsInvalidBefore`, so credential-invalidating
+             * flows (e.g. password reset) are secure without this; call it to immediately clean up the
+             * rows instead of leaving them to expire. No-op when remember-me is not configured.
+             */
+            revokeRememberMeTokens(id: Id): Promise<void>;
         };
         interface AuthServiceConfig<Id, Credentials, DeviceContext> {
             name: string;

package/dist/index.js

@@ -20,6 +20,7 @@ function createRememberMeProvider({
       deviceContext: options.deviceContext,
       expirationDate: options.expirationDate,
       rotatedDate: null,
+      createdDate: instantFns.now(),
       selector,
       verifierHash
     });
@@ -49,16 +50,19 @@ function createRememberMeProvider({
     if (validateDeviceContext && !await validateDeviceContext(record.deviceContext, deviceContext)) {
       return null;
     }
-    return record.authenticatableId;
+    return { id: record.authenticatableId, tokenCreatedDate: record.createdDate };
   }
   async function rotate(previousSelector) {
     const selector = crypto.randomBytes(16).toString("base64url");
     const verifier = crypto.randomBytes(32).toString("base64url");
     const verifierHash = await hash.hash(verifier);
-    await db.rotateBySelector(previousSelector, {
+    const claimed = await db.rotateBySelector(previousSelector, {
       selector,
       verifierHash
     });
+    if (!claimed) {
+      return null;
+    }
     return { selector, verifier };
   }
   async function revoke(token) {
@@ -180,19 +184,25 @@ function create(config) {
       if (!rememberMeToken) {
         return NO_AUTH;
       }
-      const id = await rememberMeProvider.validate({ token: rememberMeToken, deviceContext });
-      if (!id) {
+      const validated = await rememberMeProvider.validate({ token: rememberMeToken, deviceContext });
+      if (!validated) {
         return NO_AUTH;
       }
-      const authenticatable = await config.getAuthenticatableById(id);
+      const authenticatable = await config.getAuthenticatableById(validated.id);
       if (!authenticatable) {
         return NO_AUTH;
       }
+      if (authenticatable.credentialsInvalidBefore && validated.tokenCreatedDate < authenticatable.credentialsInvalidBefore) {
+        return NO_AUTH;
+      }
       const newRememberMeToken = await rememberMeProvider.rotate(rememberMeToken.selector);
       session.set(ID_SESSION_KEY, authenticatable.id);
       session.set(AUTH_PROVIDER_NAME_SESSION_KEY, config.name);
       session.set(SESSION_CREATED_DATE_KEY, instantFns2.now());
       session.regenerate();
+      if (!newRememberMeToken) {
+        return { id: authenticatable.id, cookie: null };
+      }
       return {
         id: authenticatable.id,
         cookie: getCookie({
@@ -246,6 +256,11 @@ function create(config) {
       session
     });
   }
+  async function revokeRememberMeTokens(id) {
+    if (config.rememberMeOptions) {
+      await rememberMeProvider.revokeAll(id);
+    }
+  }
   function getCookie({ rememberMeCookieValue }) {
     if (rememberMeCookieValue) {
       return buildSetCookieHeader({
@@ -268,7 +283,8 @@ function create(config) {
     loginById,
     authenticate,
     logout,
-    logoutOtherDevices
+    logoutOtherDevices,
+    revokeRememberMeTokens
   };
 }
 var registry = ServiceRegistry.createRegistry(
@@ -285,7 +301,8 @@ function provider(key) {
     loginById: service.loginById,
     authenticate: service.authenticate,
     logout: service.logout,
-    logoutOtherDevices: service.logoutOtherDevices
+    logoutOtherDevices: service.logoutOtherDevices,
+    revokeRememberMeTokens: service.revokeRememberMeTokens
   };
 }
 var AuthBase = {

package/package.json

@@ -7,7 +7,7 @@
       "default": "./dist/index.js"
     }
   },
-  "version": "1.0.0-alpha.24",
+  "version": "1.0.0-alpha.25",
   "publishConfig": {
     "access": "public"
   },
@@ -16,18 +16,18 @@
   ],
   "dependencies": {
     "iso-fns2": "npm:iso-fns@2.0.0-alpha.26",
-    "@maestro-js/service-registry": "1.0.0-alpha.24"
+    "@maestro-js/service-registry": "1.0.0-alpha.25"
   },
   "peerDependencies": {
-    "@maestro-js/session": "1.0.0-alpha.24",
-    "@maestro-js/hash": "1.0.0-alpha.24",
-    "@maestro-js/crypt": "1.0.0-alpha.24"
+    "@maestro-js/crypt": "1.0.0-alpha.25",
+    "@maestro-js/hash": "1.0.0-alpha.25",
+    "@maestro-js/session": "1.0.0-alpha.25"
   },
   "devDependencies": {
     "@types/node": "^22.19.11",
-    "@maestro-js/session": "1.0.0-alpha.24",
-    "@maestro-js/crypt": "1.0.0-alpha.24",
-    "@maestro-js/hash": "1.0.0-alpha.24"
+    "@maestro-js/session": "1.0.0-alpha.25",
+    "@maestro-js/crypt": "1.0.0-alpha.25",
+    "@maestro-js/hash": "1.0.0-alpha.25"
   },
   "license": "UNLICENSED",
   "engines": {