@monocloud/auth-node-core 0.1.8 → 0.1.10

package/dist/index.d.mts

@@ -436,7 +436,7 @@ interface MonoCloudOptionsBase {
    *
    * @defaultValue true
    */
-  userInfo: boolean;
+  fetchUserInfo: boolean;
   /**
    * Refetch user profile data whenever the application's `UserInfo` endpoint is invoked.
    *
@@ -503,6 +503,15 @@ interface MonoCloudOptionsBase {
    * @defaultValue false
    */
   allowQueryParamOverrides?: boolean;
+  /**
+   * Determines how user profile is updated when the session is updated.
+   *
+   * When enabled, the session user profile is fully replaced with a newly constructed profile
+   * derived from the latest ID token and, if applicable, the UserInfo response.
+   *
+   * @defaultValue false
+   */
+  strictProfileSync?: boolean;
   /**
    * Invoked when a back-channel logout request is received.
    */
@@ -569,7 +578,7 @@ interface MonoCloudSessionOptions extends Partial<Omit<MonoCloudSessionOptionsBa
  * | `MONOCLOUD_AUTH_RESPONSE_TIMEOUT` | Maximum time (in milliseconds) to wait for responses from the authentication service. |
  * | `MONOCLOUD_AUTH_ALLOW_QUERY_PARAM_OVERRIDES` | Allows authorization parameters (such as `scope`, `resource`, or `prompt`) to be overridden via URL query parameters. |
  * | `MONOCLOUD_AUTH_POST_LOGOUT_REDIRECT_URI` | URL users are redirected to after a successful logout. |
- * | `MONOCLOUD_AUTH_USER_INFO` | Determines whether user profile data is fetched from the `UserInfo` endpoint after authorization. |
+ * | `MONOCLOUD_AUTH_FETCH_USER_INFO` | Determines whether user profile data is fetched from the `UserInfo` endpoint after authorization. |
  * | `MONOCLOUD_AUTH_REFETCH_USER_INFO` | If `true`, user information is re-fetched on each userinfo request. |
  * | `MONOCLOUD_AUTH_ID_TOKEN_SIGNING_ALG` | Expected signing algorithm for ID tokens (for example, `RS256`). |
  * | `MONOCLOUD_AUTH_FILTERED_ID_TOKEN_CLAIMS` | Space-separated list of ID token claims excluded from the session object. |
@@ -791,7 +800,7 @@ interface CallbackOptions {
   /**
    * When `true`, fetches user profile data from the `UserInfo` endpoint after the authorization code exchange completes.
    */
-  userInfo?: boolean;
+  fetchUserInfo?: boolean;
   /**
    * Redirect URI sent to the token endpoint during the authorization code exchange.
    *
@@ -848,6 +857,17 @@ interface GetTokensOptions extends RefreshGrantOptions$1 {
    */
   refetchUserInfo?: boolean;
 }
+/**
+ * Options used to control session retrieval behavior when calling `getSession()`.
+ *
+ * @category Types
+ */
+interface GetSessionOptions {
+  /**
+   * When enabled, re-fetches user information from the `UserInfo` endpoint and updates the current session.
+   */
+  refetchUserInfo?: boolean;
+}
 //#endregion
 //#region src/monocloud-node-core-client.d.ts
 /**
@@ -951,10 +971,11 @@ declare class MonoCloudCoreClient {
    *
    * @param request - MonoCloud cookie request object.
    * @param response - MonoCloud cookie response object.
+   * @param options - Optional configuration to control session retrieval behavior.
    *
    * @returns Session or `undefined`.
    */
-  getSession(request: IMonoCloudCookieRequest, response: IMonoCloudCookieResponse): Promise<MonoCloudSession$1 | undefined>;
+  getSession(request: IMonoCloudCookieRequest, response: IMonoCloudCookieResponse, options?: GetSessionOptions): Promise<MonoCloudSession$1 | undefined>;
   /**
    * Updates the current user's session with new data.
    *
@@ -996,5 +1017,5 @@ declare class MonoCloudCoreClient {
   private validateOptions;
 }
 //#endregion
-export { type AccessToken, type Address, type ApplicationState, type AuthState, type AuthenticateOptions, type Authenticators, type AuthorizationParams, type CallbackOptions, type CallbackParams, type ClientAuthMethod, type CodeChallengeMethod, type CookieOptions, type DisplayOptions, type EndSessionParameters, type GetTokensOptions, type Group, type IMonoCloudCookieRequest, type IMonoCloudCookieResponse, type IdTokenClaims, type Indicator, type IssuerMetadata, type Jwk, type Jwks, type JwsHeaderParameters, MonoCloudAuthBaseError, type MonoCloudClientOptions, type MonoCloudCookieOptions, MonoCloudCoreClient, MonoCloudHttpError, MonoCloudOPError, type MonoCloudOptions, type MonoCloudOptionsBase, type MonoCloudRequest, type MonoCloudResponse, type MonoCloudRoutes, type MonoCloudSession, type MonoCloudSessionOptions, type MonoCloudSessionOptionsBase, type MonoCloudSessionStore, type MonoCloudStateOptions, type MonoCloudStatePartialOptions, MonoCloudTokenError, type MonoCloudTokens, type MonoCloudUser, MonoCloudValidationError, type OnBackChannelLogout, type OnCoreSessionCreating, type OnError, type OnSessionCreating, type OnSetApplicationState, type ParResponse, type Prompt, type PushedAuthorizationParams, type RefetchUserInfoOptions, type RefreshGrantOptions, type RefreshSessionOptions, type ResponseModes, type ResponseTypes, type SameSiteValues, type SecurityAlgorithms, type SerializeOptions, type SessionLifetime, type SetCookie, type SignInOptions, type SignOutOptions, type Tokens, type UserInfoOptions, type UserinfoResponse };
+export { type AccessToken, type Address, type ApplicationState, type AuthState, type AuthenticateOptions, type Authenticators, type AuthorizationParams, type CallbackOptions, type CallbackParams, type ClientAuthMethod, type CodeChallengeMethod, type CookieOptions, type DisplayOptions, type EndSessionParameters, type GetSessionOptions, type GetTokensOptions, type Group, type IMonoCloudCookieRequest, type IMonoCloudCookieResponse, type IdTokenClaims, type Indicator, type IssuerMetadata, type Jwk, type Jwks, type JwsHeaderParameters, MonoCloudAuthBaseError, type MonoCloudClientOptions, type MonoCloudCookieOptions, MonoCloudCoreClient, MonoCloudHttpError, MonoCloudOPError, type MonoCloudOptions, type MonoCloudOptionsBase, type MonoCloudRequest, type MonoCloudResponse, type MonoCloudRoutes, type MonoCloudSession, type MonoCloudSessionOptions, type MonoCloudSessionOptionsBase, type MonoCloudSessionStore, type MonoCloudStateOptions, type MonoCloudStatePartialOptions, MonoCloudTokenError, type MonoCloudTokens, type MonoCloudUser, MonoCloudValidationError, type OnBackChannelLogout, type OnCoreSessionCreating, type OnError, type OnSessionCreating, type OnSetApplicationState, type ParResponse, type Prompt, type PushedAuthorizationParams, type RefetchUserInfoOptions, type RefreshGrantOptions, type RefreshSessionOptions, type ResponseModes, type ResponseTypes, type SameSiteValues, type SecurityAlgorithms, type SerializeOptions, type SessionLifetime, type SetCookie, type SignInOptions, type SignOutOptions, type Tokens, type UserInfoOptions, type UserinfoResponse };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -230,7 +230,7 @@ const DEFAULT_OPTIONS = {
 	clockSkew: 60,
 	responseTimeout: 1e4,
 	usePar: false,
-	userInfo: true,
+	fetchUserInfo: true,
 	refetchUserInfo: false,
 	federatedSignOut: true,
 	defaultAuthParams: {
@@ -238,6 +238,7 @@ const DEFAULT_OPTIONS = {
 		responseType: "code"
 	},
 	allowQueryParamOverrides: true,
+	strictProfileSync: false,
 	session: {
 		cookie: {
 			httpOnly: true,
@@ -370,9 +371,10 @@ const optionsSchema = Joi.object({
 	usePar: boolRequired,
 	postLogoutRedirectUri: stringOptional.uri({ allowRelative: true }),
 	federatedSignOut: boolRequired,
-	userInfo: boolRequired,
+	fetchUserInfo: boolRequired,
 	refetchUserInfo: boolRequired,
 	allowQueryParamOverrides: boolRequired,
+	strictProfileSync: boolRequired,
 	defaultAuthParams: authParamSchema,
 	resources: Joi.array().items(indicatorOptionsSchema).optional(),
 	session: sessionSchema,
@@ -394,7 +396,7 @@ const signInOptionsSchema = Joi.object({
 	onError: funcOptional
 });
 const callbackOptionsSchema = Joi.object({
-	userInfo: boolOptional,
+	fetchUserInfo: boolOptional,
 	redirectUri: stringOptional.uri(),
 	onError: funcOptional
 });
@@ -415,6 +417,7 @@ const getTokensOptionsSchema = Joi.object({
 	resource: resourceValidationSchema.optional(),
 	scopes: scopesValidationSchema.optional()
 });
+const getSessionOptionsSchema = Joi.object({ refetchUserInfo: boolOptional });
 
 //#endregion
 //#region src/options/get-options.ts
@@ -437,9 +440,10 @@ const getOptions = (options, throwOnError = true) => {
 	const MONOCLOUD_AUTH_USE_PAR = process.env.MONOCLOUD_AUTH_USE_PAR;
 	const MONOCLOUD_AUTH_POST_LOGOUT_REDIRECT_URI = process.env.MONOCLOUD_AUTH_POST_LOGOUT_REDIRECT_URI;
 	const MONOCLOUD_AUTH_FEDERATED_SIGNOUT = process.env.MONOCLOUD_AUTH_FEDERATED_SIGNOUT;
-	const MONOCLOUD_AUTH_USER_INFO = process.env.MONOCLOUD_AUTH_USER_INFO;
+	const MONOCLOUD_AUTH_FETCH_USER_INFO = process.env.MONOCLOUD_AUTH_FETCH_USER_INFO;
 	const MONOCLOUD_AUTH_REFETCH_USER_INFO = process.env.MONOCLOUD_AUTH_REFETCH_USER_INFO;
 	const MONOCLOUD_AUTH_ALLOW_QUERY_PARAM_OVERRIDES = process.env.MONOCLOUD_AUTH_ALLOW_QUERY_PARAM_OVERRIDES;
+	const MONOCLOUD_AUTH_REFETCH_STRICT_PROFILE_SYNC = process.env.MONOCLOUD_AUTH_REFETCH_STRICT_PROFILE_SYNC;
 	const MONOCLOUD_AUTH_SESSION_COOKIE_NAME = process.env.MONOCLOUD_AUTH_SESSION_COOKIE_NAME;
 	const MONOCLOUD_AUTH_SESSION_COOKIE_PATH = process.env.MONOCLOUD_AUTH_SESSION_COOKIE_PATH;
 	const MONOCLOUD_AUTH_SESSION_COOKIE_DOMAIN = process.env.MONOCLOUD_AUTH_SESSION_COOKIE_DOMAIN;
@@ -486,9 +490,10 @@ const getOptions = (options, throwOnError = true) => {
 		usePar: (options === null || options === void 0 ? void 0 : options.usePar) ?? getBoolean(MONOCLOUD_AUTH_USE_PAR) ?? DEFAULT_OPTIONS.usePar,
 		postLogoutRedirectUri: (options === null || options === void 0 ? void 0 : options.postLogoutRedirectUri) ?? MONOCLOUD_AUTH_POST_LOGOUT_REDIRECT_URI,
 		federatedSignOut: (options === null || options === void 0 ? void 0 : options.federatedSignOut) ?? getBoolean(MONOCLOUD_AUTH_FEDERATED_SIGNOUT) ?? DEFAULT_OPTIONS.federatedSignOut,
-		userInfo: (options === null || options === void 0 ? void 0 : options.userInfo) ?? getBoolean(MONOCLOUD_AUTH_USER_INFO) ?? DEFAULT_OPTIONS.userInfo,
+		fetchUserInfo: (options === null || options === void 0 ? void 0 : options.fetchUserInfo) ?? getBoolean(MONOCLOUD_AUTH_FETCH_USER_INFO) ?? DEFAULT_OPTIONS.fetchUserInfo,
 		refetchUserInfo: (options === null || options === void 0 ? void 0 : options.refetchUserInfo) ?? getBoolean(MONOCLOUD_AUTH_REFETCH_USER_INFO) ?? DEFAULT_OPTIONS.refetchUserInfo,
 		allowQueryParamOverrides: (options === null || options === void 0 ? void 0 : options.allowQueryParamOverrides) ?? getBoolean(MONOCLOUD_AUTH_ALLOW_QUERY_PARAM_OVERRIDES) ?? DEFAULT_OPTIONS.allowQueryParamOverrides,
+		strictProfileSync: (options === null || options === void 0 ? void 0 : options.strictProfileSync) ?? getBoolean(MONOCLOUD_AUTH_REFETCH_STRICT_PROFILE_SYNC) ?? DEFAULT_OPTIONS.strictProfileSync,
 		session: {
 			cookie: {
 				name: (options === null || options === void 0 || (_options$session = options.session) === null || _options$session === void 0 || (_options$session = _options$session.cookie) === null || _options$session === void 0 ? void 0 : _options$session.name) ?? MONOCLOUD_AUTH_SESSION_COOKIE_NAME ?? DEFAULT_OPTIONS.session.cookie.name,
@@ -724,7 +729,7 @@ var MonoCloudCoreClient = class {
 				idTokenNonce: monoCloudState.nonce,
 				idTokenMaxAge: monoCloudState.maxAge,
 				idTokenClockTolerance: 5,
-				fetchUserInfo: (callbackOptions === null || callbackOptions === void 0 ? void 0 : callbackOptions.userInfo) ?? this.options.userInfo,
+				fetchUserInfo: (callbackOptions === null || callbackOptions === void 0 ? void 0 : callbackOptions.fetchUserInfo) ?? this.options.fetchUserInfo,
 				filteredIdTokenClaims: this.options.filteredIdTokenClaims,
 				onSessionCreating: async (s, i, u) => {
 					var _this$options$onSessi, _this$options;
@@ -791,7 +796,10 @@ var MonoCloudCoreClient = class {
 				response.sendJson(session.user);
 				return response.done();
 			}
-			const newSession = await this.oidcClient.refetchUserInfo(defaultToken, session, { onSessionCreating: (_this$options$onSessi2 = this.options.onSessionCreating) === null || _this$options$onSessi2 === void 0 ? void 0 : _this$options$onSessi2.bind(this) });
+			const newSession = await this.oidcClient.refetchUserInfo(defaultToken, session, {
+				onSessionCreating: (_this$options$onSessi2 = this.options.onSessionCreating) === null || _this$options$onSessi2 === void 0 ? void 0 : _this$options$onSessi2.bind(this),
+				strictProfileSync: this.options.strictProfileSync
+			});
 			if (!await this.sessionService.updateSession(request, response, newSession)) {
 				response.setNoCache();
 				response.noContent();
@@ -929,11 +937,26 @@ var MonoCloudCoreClient = class {
 	*
 	* @param request - MonoCloud cookie request object.
 	* @param response - MonoCloud cookie response object.
+	* @param options - Optional configuration to control session retrieval behavior.
 	*
 	* @returns Session or `undefined`.
 	*/
-	getSession(request, response) {
-		return this.sessionService.getSession(request, response);
+	async getSession(request, response, options) {
+		var _this$options$onSessi3;
+		if (options) {
+			const { error } = getSessionOptionsSchema.validate(options, { abortEarly: true });
+			if (error) throw new MonoCloudValidationError$1(error.details[0].message);
+		}
+		const session = await this.sessionService.getSession(request, response);
+		if (!(options === null || options === void 0 ? void 0 : options.refetchUserInfo) || !session) return session;
+		const defaultToken = findToken(session.accessTokens, this.options.defaultAuthParams.resource, session.authorizedScopes);
+		if (!defaultToken) throw new MonoCloudValidationError$1("Access token not found");
+		const newSession = await this.oidcClient.refetchUserInfo(defaultToken, session, {
+			onSessionCreating: (_this$options$onSessi3 = this.options.onSessionCreating) === null || _this$options$onSessi3 === void 0 ? void 0 : _this$options$onSessi3.bind(this),
+			strictProfileSync: this.options.strictProfileSync
+		});
+		await this.sessionService.updateSession(request, response, newSession);
+		return newSession;
 	}
 	/**
 	* Updates the current user's session with new data.
@@ -1000,7 +1023,7 @@ var MonoCloudCoreClient = class {
 		let { idToken } = session;
 		let { refreshToken } = session;
 		if ((options === null || options === void 0 ? void 0 : options.forceRefresh) || !token || tokenExpired) {
-			var _this$options$onSessi3;
+			var _this$options$onSessi4;
 			if (!refreshToken && token && tokenExpired) throw new MonoCloudTokenError$1("No refresh token available to refresh the expired access token");
 			const updatedSession = await this.oidcClient.refreshSession(session, {
 				fetchUserInfo: (options === null || options === void 0 ? void 0 : options.refetchUserInfo) ?? this.options.refetchUserInfo,
@@ -1012,7 +1035,8 @@ var MonoCloudCoreClient = class {
 					scopes
 				},
 				filteredIdTokenClaims: this.options.filteredIdTokenClaims,
-				onSessionCreating: (_this$options$onSessi3 = this.options.onSessionCreating) === null || _this$options$onSessi3 === void 0 ? void 0 : _this$options$onSessi3.bind(this)
+				onSessionCreating: (_this$options$onSessi4 = this.options.onSessionCreating) === null || _this$options$onSessi4 === void 0 ? void 0 : _this$options$onSessi4.bind(this),
+				strictProfileSync: this.options.strictProfileSync
 			});
 			await this.sessionService.updateSession(request, response, updatedSession);
 			token = findToken(updatedSession === null || updatedSession === void 0 ? void 0 : updatedSession.accessTokens, resource, findTokenScopes);