@meistrari/auth-nuxt 3.18.0 → 3.19.0

package/dist/runtime/server/routes/auth/refresh.js

@@ -1,6 +1,8 @@
 import { createError, useRuntimeConfig } from "#imports";
 import { defineEventHandler, deleteCookie, getCookie, setCookie } from "h3";
+import { parseTokenExpiry } from "../../../helpers/token.js";
 import { createNuxtAuthClient } from "../../../shared.js";
+import { planRefreshFailure, shouldWriteTokens } from "../../utils/refresh-upstream.js";
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig();
   const authConfig = config.public.telaAuth;
@@ -12,44 +14,62 @@ export default defineEventHandler(async (event) => {
       message: "No refresh token found"
     });
   }
+  const authClient = createNuxtAuthClient(
+    authConfig.apiUrl,
+    () => null,
+    () => refreshToken
+  );
+  let accessToken;
+  let newRefreshToken;
+  let user;
+  let organization;
+  let assurance;
   try {
-    const authClient = createNuxtAuthClient(
-      authConfig.apiUrl,
-      () => null,
-      () => refreshToken
-    );
-    const { accessToken, refreshToken: newRefreshToken, user, organization, assurance } = await authClient.application.refreshAccessToken(refreshToken);
-    setCookie(event, "tela-access-token", accessToken, {
-      secure: !import.meta.dev,
-      sameSite: "lax",
-      maxAge: 60 * 15,
-      // 15 minutes
-      priority: "high",
-      path: "/"
-    });
-    setCookie(event, "tela-refresh-token", newRefreshToken, {
-      secure: !import.meta.dev,
-      sameSite: "lax",
-      httpOnly: true,
-      maxAge: 60 * 60 * 24 * 7,
-      // 7 days
-      priority: "high",
-      path: "/"
-    });
-    return {
-      success: true,
-      user,
-      organization,
-      assurance
-    };
+    ({ accessToken, refreshToken: newRefreshToken, user, organization, assurance } = await authClient.application.refreshAccessToken(refreshToken));
   } catch (error) {
-    console.error("[Auth Refresh] Token refresh error:", error);
-    deleteCookie(event, "tela-access-token", { path: "/" });
-    deleteCookie(event, "tela-refresh-token", { path: "/" });
+    const plan = planRefreshFailure(error);
+    console.error(`[Auth Refresh] Token refresh error (responding ${plan.statusCode}):`, error);
+    if (plan.deleteCookies) {
+      deleteCookie(event, "tela-access-token", { path: "/" });
+      deleteCookie(event, "tela-refresh-token", { path: "/" });
+    }
     throw createError({
-      statusCode: 401,
-      statusMessage: "Unauthorized",
-      message: "Failed to refresh access token"
+      statusCode: plan.statusCode,
+      statusMessage: plan.statusMessage,
+      message: plan.message
+    });
+  }
+  const currentAccessToken = getCookie(event, "tela-access-token");
+  if (!shouldWriteTokens({ accessToken, refreshToken: newRefreshToken, currentAccessToken })) {
+    console.error("[Auth Refresh] Upstream returned unusable tokens, refusing to overwrite cookies");
+    throw createError({
+      statusCode: 503,
+      statusMessage: "Service Unavailable",
+      message: "REFRESH_UPSTREAM_UNAVAILABLE"
     });
   }
+  setCookie(event, "tela-access-token", accessToken, {
+    secure: !import.meta.dev,
+    sameSite: "lax",
+    maxAge: 60 * 15,
+    // 15 minutes
+    priority: "high",
+    path: "/"
+  });
+  setCookie(event, "tela-refresh-token", newRefreshToken, {
+    secure: !import.meta.dev,
+    sameSite: "lax",
+    httpOnly: true,
+    maxAge: 60 * 60 * 24 * 7,
+    // 7 days
+    priority: "high",
+    path: "/"
+  });
+  return {
+    success: true,
+    user,
+    organization,
+    assurance,
+    accessTokenExpiresAt: parseTokenExpiry(accessToken)
+  };
 });

package/dist/runtime/server/utils/refresh-upstream.d.ts

@@ -0,0 +1,28 @@
+/** How the `/auth/refresh` route should respond to an upstream failure */
+export interface RefreshFailurePlan {
+    statusCode: number;
+    statusMessage: string;
+    message: string;
+    /** Only a definitive auth failure may destroy the session cookies */
+    deleteCookies: boolean;
+}
+/**
+ * Maps an upstream refresh failure to the HTTP response the route should
+ * send, so the browser can distinguish "session revoked" (401, cookies
+ * deleted) from "API briefly down" (429/503, cookies kept).
+ */
+export declare function planRefreshFailure(error: unknown): RefreshFailurePlan;
+/**
+ * Guards cookie writes after a successful upstream refresh
+ *
+ * Rejects empty, undecodable, and already-expired tokens, plus access
+ * tokens strictly older than the one currently in the cookie — a delayed
+ * response must not overwrite a newer rotation. Grace-window reissues
+ * return the same token (equal `exp`), which stays writable.
+ */
+export declare function shouldWriteTokens(input: {
+    accessToken: string | null | undefined;
+    refreshToken: string | null | undefined;
+    currentAccessToken?: string | null;
+    nowMs?: number;
+}): boolean;

package/dist/runtime/server/utils/refresh-upstream.js

@@ -0,0 +1,46 @@
+import { RefreshTokenExpiredError } from "@meistrari/auth-core";
+import { classifyRefreshStatus, extractHttpStatus } from "../../helpers/refresh-policy.js";
+import { parseTokenExpiry } from "../../helpers/token.js";
+export function planRefreshFailure(error) {
+  const status = extractHttpStatus(error);
+  const isAuthFailure = error instanceof RefreshTokenExpiredError || error?.code === "REFRESH_TOKEN_EXPIRED" || status !== void 0 && classifyRefreshStatus(status) === "auth";
+  if (isAuthFailure) {
+    return {
+      statusCode: 401,
+      statusMessage: "Unauthorized",
+      message: "REFRESH_TOKEN_EXPIRED",
+      deleteCookies: true
+    };
+  }
+  if (status === 429) {
+    return {
+      statusCode: 429,
+      statusMessage: "Too Many Requests",
+      message: "REFRESH_RATE_LIMITED",
+      deleteCookies: false
+    };
+  }
+  return {
+    statusCode: 503,
+    statusMessage: "Service Unavailable",
+    message: "REFRESH_UPSTREAM_UNAVAILABLE",
+    deleteCookies: false
+  };
+}
+export function shouldWriteTokens(input) {
+  const { accessToken, refreshToken, currentAccessToken, nowMs = Date.now() } = input;
+  if (!accessToken || !refreshToken) {
+    return false;
+  }
+  const expiry = parseTokenExpiry(accessToken);
+  if (expiry === null || expiry <= nowMs) {
+    return false;
+  }
+  if (currentAccessToken) {
+    const currentExpiry = parseTokenExpiry(currentAccessToken);
+    if (currentExpiry !== null && expiry < currentExpiry) {
+      return false;
+    }
+  }
+  return true;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-nuxt",
-  "version": "3.18.0",
+  "version": "3.19.0",
   "type": "module",
   "exports": {
     ".": {
@@ -36,11 +36,11 @@
     "docs": "nuxt-module-build prepare && typedoc"
   },
   "dependencies": {
-    "@meistrari/auth-core": "1.28.0",
+    "@meistrari/auth-core": "1.29.0",
     "jose": "6.1.3"
   },
   "peerDependencies": {
-    "nuxt": "^3.0.0 || ^4.0.0",
+    "nuxt": "^3.10.0 || ^4.0.0",
     "vue": "^3.0.0"
   },
   "devDependencies": {