@nestjs/authentication 0.0.1 → 0.1.0

package/dist/mfa/mfa.service.d.ts

@@ -37,6 +37,12 @@ export declare class MfaService {
     constructor(storage: AuthenticationStorage, options?: {
         mfa?: MfaOptions;
     }, events?: AuthenticationEvents);
+    /**
+     * Whether the user has a confirmed authenticator. Without the `mfa`
+     * option, MFA is off: `false`, without reading the store, even for a user
+     * who enrolled through another app sharing the user database. Every app
+     * that signs those users in must configure `mfa` if any of them does.
+     */
     isEnrolled(userId: string): Promise<boolean>;
     /**
      * Starts an enrollment. Throws {@link MfaAlreadyEnrolledError} when the user
@@ -97,7 +103,11 @@ export declare class MfaService {
     private seal;
     private open;
     private matchingStep;
-    /** Read at each call, never in the constructor: the registry locks once the module starts. */
+    /**
+     * Read at each call, never in the constructor: the registry locks once the
+     * module starts. Without the `mfa` option it throws before reading: MFA is
+     * off, and the production guard asks for no `MfaStore`.
+     */
     private get store();
     private get maxAttempts();
     private now;

package/dist/mfa/mfa.service.js

@@ -71,7 +71,7 @@ let MfaService = MfaService_1 = class MfaService {
         this.options = options?.mfa;
         this.lockoutWindow = durationOr(this.options?.lockoutWindow, '15m');
         if (!this.options) {
-            return; // MFA unused: isEnrolled() works, enrollment throws
+            return; // MFA off: isEnrolled() answers false, everything else throws, and the store is never read
         }
         if (this.options.encryption === undefined) {
             throw new Error('MFA: `mfa.encryption` is required. TOTP secrets cannot be hashed, so a store dump would let anyone ' +
@@ -86,7 +86,16 @@ let MfaService = MfaService_1 = class MfaService {
         requireIntegerOption(this.options.window, 'mfa.window', { min: 0, max: 10 });
         requireIntegerOption(this.options.recoveryCodes, 'mfa.recoveryCodes', { min: 1 });
     }
+    /**
+     * Whether the user has a confirmed authenticator. Without the `mfa`
+     * option, MFA is off: `false`, without reading the store, even for a user
+     * who enrolled through another app sharing the user database. Every app
+     * that signs those users in must configure `mfa` if any of them does.
+     */
     async isEnrolled(userId) {
+        if (!this.options) {
+            return false;
+        }
         // Truthy, not `=== true`: a store that reads the flag back as `1` must not skip the second factor.
         return !!(await this.store.getTotp(userId))?.confirmed;
     }
@@ -211,7 +220,7 @@ let MfaService = MfaService_1 = class MfaService {
         this.failed(userId, 'recovery-code', attempt);
         return false;
     }
-    remainingRecoveryCodes(userId) {
+    async remainingRecoveryCodes(userId) {
         return this.store.countRecoveryCodes(userId);
     }
     /**
@@ -271,15 +280,9 @@ let MfaService = MfaService_1 = class MfaService {
         this.events.emit({ type: 'mfa-failed', userId, method, failures: attempt, locked: attempt >= this.maxAttempts });
     }
     seal(userId, secret) {
-        if (!this.options) {
-            throw new Error('MFA is not configured: add `mfa: { encryption: … }` to the AuthenticationModule options');
-        }
         return this.cipher ? this.cipher.encrypt(secret, `totp.${userId}`) : secret;
     }
     open(userId, stored) {
-        if (!this.options) {
-            throw new Error('MFA is not configured: add `mfa: { encryption: … }` to the AuthenticationModule options');
-        }
         if (!this.cipher) {
             return { plaintext: stored, needsReencrypt: false };
         }
@@ -322,8 +325,15 @@ let MfaService = MfaService_1 = class MfaService {
         }
         return found;
     }
-    /** Read at each call, never in the constructor: the registry locks once the module starts. */
+    /**
+     * Read at each call, never in the constructor: the registry locks once the
+     * module starts. Without the `mfa` option it throws before reading: MFA is
+     * off, and the production guard asks for no `MfaStore`.
+     */
     get store() {
+        if (!this.options) {
+            throw new Error('MFA is not configured: add `mfa: { encryption: … }` to the AuthenticationModule options');
+        }
         return this.storage.mfa;
     }
     get maxAttempts() {

package/dist/oidc/oidc.client.d.ts

@@ -5,7 +5,7 @@ import type { OidcTransaction, OidcClientOptions } from '../interfaces/oidc.inte
  * PKCE (S256), `state` and `nonce`.
  *
  * Checks, in order: IdP error, `iss` response parameter (RFC 9207, mix-up
- * defence), token response shape, ID token signature (JWKS, RS256/ES256,
+ * defence), token response shape, ID token signature (JWKS, RS256/ES256 by default,
  * alg/key binding), `iss`, `aud`, `azp`, `exp`, `iat`, `nonce`, and that
  * userinfo's `sub` matches the ID token's (OIDC Core §5.3.2).
  */

package/dist/oidc/oidc.client.js

@@ -29,7 +29,7 @@ function assertSecureUrl(value, what) {
  * PKCE (S256), `state` and `nonce`.
  *
  * Checks, in order: IdP error, `iss` response parameter (RFC 9207, mix-up
- * defence), token response shape, ID token signature (JWKS, RS256/ES256,
+ * defence), token response shape, ID token signature (JWKS, RS256/ES256 by default,
  * alg/key binding), `iss`, `aud`, `azp`, `exp`, `iat`, `nonce`, and that
  * userinfo's `sub` matches the ID token's (OIDC Core §5.3.2).
  */

package/dist/session/in-memory-session.store.d.ts

@@ -15,6 +15,7 @@ export declare class InMemorySessionStore implements SessionStore {
         lastActiveAt: Date;
         mfa?: import("../index.js").MfaState;
         metadata?: Record<string, unknown>;
+        extra?: import("../index.js").SessionExtra;
     } | undefined>;
     createSession(record: SessionRecord): Promise<void>;
     touchSession(id: string, lastActiveAt: Date): Promise<void>;
@@ -27,6 +28,7 @@ export declare class InMemorySessionStore implements SessionStore {
         lastActiveAt: Date;
         mfa?: import("../index.js").MfaState;
         metadata?: Record<string, unknown>;
+        extra?: import("../index.js").SessionExtra;
     }[]>;
     deleteUserSessions(userId: string): Promise<void>;
     private sweep;

package/dist/session/in-memory-session.store.js

@@ -20,7 +20,9 @@ let InMemorySessionStore = class InMemorySessionStore {
         return record && { ...record };
     }
     async createSession(record) {
-        this.sessions.set(record.id, { ...record });
+        // `extra` is read with a session, never stored.
+        const { extra: _, ...stored } = record;
+        this.sessions.set(record.id, stored);
         // The new session's own clock, so tests with a fake one agree.
         if (this.sessions.size >= this.sweepAt) {
             this.sweep(record.lastActiveAt.getTime());

package/dist/session/session-cookie.provider.d.ts

@@ -18,6 +18,19 @@ import { SessionService } from './session.service.js';
  * }
  * ```
  *
+ * A store whose `getSession()` reads the user in the same query (a `JOIN`)
+ * can hand it over in `session.extra`, typed by `sessionExtra` on
+ * `AuthenticationTypes`, which saves the second read on every request:
+ *
+ * ```ts
+ * validate(session: SessionRecord) {
+ *   return session.extra?.user ?? null;
+ * }
+ * ```
+ *
+ * `extra` stays out of the result: `@CurrentSession()`, `request.session`
+ * and `AuthenticationContext.session` get the session without it.
+ *
  * A missing, stale or unknown cookie counts as "no credentials" rather than
  * a 401: browsers keep sending them, and optional routes should keep
  * working. So does the cookie on a cross-origin POST, PUT, PATCH or DELETE
@@ -28,7 +41,10 @@ import { SessionService } from './session.service.js';
  */
 export declare abstract class SessionCookieProvider<TUser> extends AuthenticationProvider<TUser, SessionRecord> {
     protected readonly sessions: SessionService;
-    /** Loads the user for a live session; `null` for deleted or banned users, which ends the session. */
+    /**
+     * Loads the user for a live session; `null` for deleted or banned users, which ends the session.
+     * `session.extra` is what the store read with the session, if anything.
+     */
     protected abstract validate(session: SessionRecord): TUser | null | undefined | Promise<TUser | null | undefined>;
     authenticate(context: ExecutionContext): Promise<AuthenticationResult<TUser, SessionRecord> | null>;
     /** @internal An instance created with `new` was not property-injected. */

package/dist/session/session-cookie.provider.js

@@ -26,6 +26,19 @@ import { SessionService } from './session.service.js';
  * }
  * ```
  *
+ * A store whose `getSession()` reads the user in the same query (a `JOIN`)
+ * can hand it over in `session.extra`, typed by `sessionExtra` on
+ * `AuthenticationTypes`, which saves the second read on every request:
+ *
+ * ```ts
+ * validate(session: SessionRecord) {
+ *   return session.extra?.user ?? null;
+ * }
+ * ```
+ *
+ * `extra` stays out of the result: `@CurrentSession()`, `request.session`
+ * and `AuthenticationContext.session` get the session without it.
+ *
  * A missing, stale or unknown cookie counts as "no credentials" rather than
  * a 401: browsers keep sending them, and optional routes should keep
  * working. So does the cookie on a cross-origin POST, PUT, PATCH or DELETE
@@ -45,7 +58,9 @@ export class SessionCookieProvider extends AuthenticationProvider {
             await this.sessions.discard(session.id);
             return null;
         }
-        return { user, session, mfa: session.mfa };
+        // What the store joined (often the user's row, password hash and all) is for `validate()` only.
+        const { extra: _, ...stored } = session;
+        return { user, session: stored, mfa: session.mfa };
     }
     /** @internal An instance created with `new` was not property-injected. */
     [PROVIDER_INIT](resolve) {

package/dist/session/session.service.d.ts

@@ -18,6 +18,7 @@ type RequestHeaders = Record<string, string | string[] | undefined>;
 export declare class SessionService {
     private readonly storage;
     private readonly events;
+    private static readonly logger;
     private readonly options;
     private readonly absoluteTtl;
     private readonly pendingTtl;
@@ -25,6 +26,8 @@ export declare class SessionService {
     private readonly touchInterval;
     private readonly cookieName;
     private readonly trustedOrigins;
+    /** Touches failed since the last successful one: a spell of failures logs one warning, not one per request. */
+    private failedTouches;
     constructor(storage: AuthenticationStorage, options?: {
         session?: SessionOptions;
         mfa?: {
@@ -43,7 +46,11 @@ export declare class SessionService {
         metadata?: Record<string, unknown>;
         replacing?: string;
     }): Promise<IssuedSession>;
-    /** The live session for a token, sliding its idle timeout. */
+    /**
+     * The live session for a token, sliding its idle timeout. Sliding is
+     * best-effort: when the store fails to record the activity, the session
+     * is still returned, as read (see `SessionStore.touchSession()`).
+     */
     validate(token: string | undefined): Promise<SessionRecord | null>;
     /**
      * Replaces the session id, keeping its user and absolute expiry. For
@@ -53,7 +60,8 @@ export declare class SessionService {
      * `absoluteTtl` from its creation, in place of its `mfa.pendingTtl`.
      * Resolves `null` when the session was gone by the time it was replaced:
      * revoked (a sign-out everywhere, a password reset) or rotated by another
-     * request, which leaves no new session behind.
+     * request, which leaves no new session behind. The session's `extra` is
+     * not carried over.
      */
     rotate(session: SessionRecord, changes?: Pick<Partial<SessionRecord>, 'mfa' | 'metadata'>): Promise<IssuedSession | null>;
     /**
@@ -90,6 +98,14 @@ export declare class SessionService {
     clearCookie(): string;
     /** @internal Deletes a session by id, for sessions whose user is gone. */
     discard(sessionId: string): Promise<void>;
+    /**
+     * Records activity, best-effort: the session was read live, so a failed write (a lock timeout,
+     * a read-only replica) does not fail the request, and the session keeps the idle deadline the
+     * store still has. Every failure is published as `session-touch-failed`; the log gets one warning
+     * per spell of failures (the first), then one line once a touch succeeds again, with how many
+     * failed in between.
+     */
+    private touch;
     private isLive;
     private issue;
     private now;

package/dist/session/session.service.js

@@ -10,7 +10,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Inject, Injectable, Optional } from '@nestjs/common';
+var SessionService_1;
+import { Inject, Injectable, Logger, Optional } from '@nestjs/common';
 import { firstHeader } from '../utils/auth-state.util.js';
 import { AUTHENTICATION_MODULE_OPTIONS } from '../authentication.constants.js';
 import { isCrossOriginWrite, normalizeOrigin } from '../utils/cross-origin.util.js';
@@ -29,10 +30,12 @@ import { assertCookieAttributes, defaultCookieName, readCookie, serializeCookie
  * - `create()`, `validate()` and `rotate()` are the low-level operations
  *   behind `SignInService`, which also reads and writes the cookie.
  */
-let SessionService = class SessionService {
+let SessionService = SessionService_1 = class SessionService {
     constructor(storage, options, events = new AuthenticationEvents()) {
         this.storage = storage;
         this.events = events;
+        /** Touches failed since the last successful one: a spell of failures logs one warning, not one per request. */
+        this.failedTouches = 0;
         this.options = options?.session ?? {};
         this.absoluteTtl = durationOr(this.options.absoluteTtl, '7d');
         // A pending session never outlives a verified one would.
@@ -70,7 +73,11 @@ let SessionService = class SessionService {
             ...(metadata && { metadata }),
         });
     }
-    /** The live session for a token, sliding its idle timeout. */
+    /**
+     * The live session for a token, sliding its idle timeout. Sliding is
+     * best-effort: when the store fails to record the activity, the session
+     * is still returned, as read (see `SessionStore.touchSession()`).
+     */
     async validate(token) {
         if (!token || !TOKEN_PATTERN.test(token)) {
             return null;
@@ -90,8 +97,7 @@ let SessionService = class SessionService {
             return null;
         }
         if (now - record.lastActiveAt.getTime() >= this.touchInterval) {
-            record.lastActiveAt = new Date(now);
-            await this.storage.sessions.touchSession(record.id, record.lastActiveAt);
+            await this.touch(record, new Date(now));
         }
         return record;
     }
@@ -103,10 +109,11 @@ let SessionService = class SessionService {
      * `absoluteTtl` from its creation, in place of its `mfa.pendingTtl`.
      * Resolves `null` when the session was gone by the time it was replaced:
      * revoked (a sign-out everywhere, a password reset) or rotated by another
-     * request, which leaves no new session behind.
+     * request, which leaves no new session behind. The session's `extra` is
+     * not carried over.
      */
     async rotate(session, changes = {}) {
-        const { id: _, ...rest } = session;
+        const { id: _, extra: _extra, ...rest } = session;
         const verifying = session.mfa === 'pending' && changes.mfa === 'verified';
         // The new session first, then the old one, which must still be there to delete: if a revocation
         // took it meanwhile (deleting the user's sessions, this new one included, or not yet), or another
@@ -182,6 +189,33 @@ let SessionService = class SessionService {
     async discard(sessionId) {
         await this.storage.sessions.deleteSession(sessionId);
     }
+    /**
+     * Records activity, best-effort: the session was read live, so a failed write (a lock timeout,
+     * a read-only replica) does not fail the request, and the session keeps the idle deadline the
+     * store still has. Every failure is published as `session-touch-failed`; the log gets one warning
+     * per spell of failures (the first), then one line once a touch succeeds again, with how many
+     * failed in between.
+     */
+    async touch(record, lastActiveAt) {
+        try {
+            await this.storage.sessions.touchSession(record.id, lastActiveAt);
+        }
+        catch (error) {
+            if (this.failedTouches++ === 0) {
+                SessionService_1.logger.warn(`Recording activity on a session of user ${record.userId} failed, so its idle timeout did not move: ` +
+                    (error instanceof Error ? error.message : String(error)) +
+                    '. Further failures are not logged until a touch succeeds again.');
+            }
+            // Published on every failure, logged or not, so metrics and alerting count them all.
+            this.events.emit({ type: 'session-touch-failed', userId: record.userId, sessionId: record.id, error });
+            return;
+        }
+        record.lastActiveAt = lastActiveAt;
+        if (this.failedTouches > 0) {
+            SessionService_1.logger.log(`Recording session activity works again; ${this.failedTouches} ${this.failedTouches === 1 ? 'touch' : 'touches'} failed meanwhile.`);
+            this.failedTouches = 0;
+        }
+    }
     isLive(record, now) {
         if (hasExpired(record.expiresAt, now)) {
             return false;
@@ -199,7 +233,8 @@ let SessionService = class SessionService {
         return this.options.now?.() ?? Date.now();
     }
 };
-SessionService = __decorate([
+SessionService.logger = new Logger('SessionService');
+SessionService = SessionService_1 = __decorate([
     Injectable(),
     __param(1, Optional()),
     __param(1, Inject(AUTHENTICATION_MODULE_OPTIONS)),

package/dist/session/sign-in.service.d.ts

@@ -19,8 +19,9 @@ import { SessionService } from './session.service.js';
  *   (login CSRF: signing the victim's browser in to the attacker's
  *   account), by the same rule as `app.enableCsrfProtection()`;
  * - the browser's previous session is deleted (session fixation defence);
- * - users with a confirmed authenticator get an `mfa: 'pending'` session,
- *   which is not signed in anywhere until `completeMfa()` verifies a code.
+ * - with `mfa` configured, users with a confirmed authenticator get an
+ *   `mfa: 'pending'` session, which is not signed in anywhere until
+ *   `completeMfa()` verifies a code.
  */
 export declare class SignInService {
     private readonly sessions;
@@ -71,9 +72,9 @@ export declare class SignInService {
      */
     signOut(): Promise<boolean>;
     /**
-     * Ends every session and refresh-token family of the user, and clears
-     * this browser's cookie if it was one of them. API keys live in your own
-     * table: revoke those yourself.
+     * Ends every session and, with refresh tokens on (`accessToken`), every
+     * refresh-token family of the user, and clears this browser's cookie if it
+     * was one of them. API keys live in your own table: revoke those yourself.
      */
     signOutEverywhere(userId: string): Promise<void>;
     /**

package/dist/session/sign-in.service.js

@@ -31,8 +31,9 @@ import { SessionService } from './session.service.js';
  *   (login CSRF: signing the victim's browser in to the attacker's
  *   account), by the same rule as `app.enableCsrfProtection()`;
  * - the browser's previous session is deleted (session fixation defence);
- * - users with a confirmed authenticator get an `mfa: 'pending'` session,
- *   which is not signed in anywhere until `completeMfa()` verifies a code.
+ * - with `mfa` configured, users with a confirmed authenticator get an
+ *   `mfa: 'pending'` session, which is not signed in anywhere until
+ *   `completeMfa()` verifies a code.
  */
 let SignInService = class SignInService {
     constructor(sessions, mfa, tokens, scope = new AuthenticationScope(), adapterHost, events = new AuthenticationEvents()) {
@@ -162,9 +163,9 @@ let SignInService = class SignInService {
         return true;
     }
     /**
-     * Ends every session and refresh-token family of the user, and clears
-     * this browser's cookie if it was one of them. API keys live in your own
-     * table: revoke those yourself.
+     * Ends every session and, with refresh tokens on (`accessToken`), every
+     * refresh-token family of the user, and clears this browser's cookie if it
+     * was one of them. API keys live in your own table: revoke those yourself.
      */
     async signOutEverywhere(userId) {
         const exchange = this.scope.exchange();

package/dist/storage/authentication.storage.d.ts

@@ -8,32 +8,41 @@ import type { AuthenticationStorageSources, AuthenticationStorageContract, Authe
 /**
  * @internal What each feature reads or writes, audited against the code
  * paths: the production guard's rule.
- * Any feature that signs someone in reads `mfa`, configured or not: a user
- * may have enrolled an authenticator through another instance, and
- * `MfaService.isEnrolled()` is how a sign-in finds out. Any feature that
- * revokes a user's sign-ins reaches both `sessions` and `refreshTokens`.
+ * MFA is off unless `mfa` is configured: without it, `MfaService.isEnrolled()`
+ * answers `false` without reading the store, and its other methods throw.
+ * Refresh tokens exist only with `accessToken`, and not with
+ * `refreshToken: false`: otherwise `TokenService.issue()` starts no family
+ * and `revokeAll()` has nothing to revoke and reads nothing. Apps
+ * that sign users in from a shared user database must therefore agree: if
+ * one configures `mfa` (or `accessToken`), every one of them must, or a user
+ * who enrolled an authenticator through one signs in to another with a
+ * password alone (and a sign-out everywhere leaves token clients signed in).
+ * Removing `mfa` turns MFA off for everyone.
  */
 export declare const CONTRACTS_BY_FEATURE: {
     /**
      * A `SessionCookieProvider` in `providers`: `SessionService` (every
-     * request), `SignInService.signIn()` (`isEnrolled()`), `completeMfa()`,
-     * and `signOutEverywhere()`, which also revokes the user's refresh-token
-     * families.
+     * request), `SignInService.signIn()` and `signOutEverywhere()`.
      */
-    readonly sessionCookie: readonly ["sessions", "refreshTokens", "mfa"];
-    /** `accessToken`: `TokenService` (refresh-token families), whose `issue()` checks for an authenticator. */
-    readonly accessToken: readonly ["refreshTokens", "mfa"];
-    /** `mfa`: enrollment, codes, recovery codes and the lockout. */
+    readonly sessionCookie: readonly ["sessions"];
+    /**
+     * `accessToken` without `refreshToken: false`: the refresh-token families
+     * `TokenService` starts, which every sign-out everywhere revokes too.
+     * Access tokens alone keep no state.
+     */
+    readonly refreshToken: readonly ["refreshTokens"];
+    /** `mfa`: enrollment, codes, recovery codes and the lockout; every sign-in checks for an authenticator. */
     readonly mfa: readonly ["mfa"];
     /** `magicLinkHandler`: pending links, then `SignInService.signIn()`. */
-    readonly magicLink: readonly ["sessions", "mfa", "magicLinks"];
+    readonly magicLink: readonly ["sessions", "magicLinks"];
     /** `oidcAccountResolver`: logins in progress, the session that links an account, then `SignInService.signIn()`. */
-    readonly oidc: readonly ["sessions", "mfa", "oidcStates"];
+    readonly oidc: readonly ["sessions", "oidcStates"];
     /**
-     * `passwordResetHandler`: the links; `reset()` revokes every session and
-     * refresh-token family of the user, and with `signIn: true` signs in.
+     * `passwordResetHandler`: the links; `reset()` revokes every session (and
+     * refresh-token family, with refresh tokens on) of the user, and with
+     * `signIn: true` signs in.
      */
-    readonly passwordReset: readonly ["sessions", "refreshTokens", "mfa", "emailTokens"];
+    readonly passwordReset: readonly ["sessions", "emailTokens"];
     /** `emailVerificationHandler`: the links. */
     readonly emailVerification: readonly ["emailTokens"];
 };

package/dist/storage/authentication.storage.js

@@ -22,32 +22,41 @@ import { AUTHENTICATION_STORAGE_REQUIREMENTS } from '../authentication.constants
 /**
  * @internal What each feature reads or writes, audited against the code
  * paths: the production guard's rule.
- * Any feature that signs someone in reads `mfa`, configured or not: a user
- * may have enrolled an authenticator through another instance, and
- * `MfaService.isEnrolled()` is how a sign-in finds out. Any feature that
- * revokes a user's sign-ins reaches both `sessions` and `refreshTokens`.
+ * MFA is off unless `mfa` is configured: without it, `MfaService.isEnrolled()`
+ * answers `false` without reading the store, and its other methods throw.
+ * Refresh tokens exist only with `accessToken`, and not with
+ * `refreshToken: false`: otherwise `TokenService.issue()` starts no family
+ * and `revokeAll()` has nothing to revoke and reads nothing. Apps
+ * that sign users in from a shared user database must therefore agree: if
+ * one configures `mfa` (or `accessToken`), every one of them must, or a user
+ * who enrolled an authenticator through one signs in to another with a
+ * password alone (and a sign-out everywhere leaves token clients signed in).
+ * Removing `mfa` turns MFA off for everyone.
  */
 export const CONTRACTS_BY_FEATURE = {
     /**
      * A `SessionCookieProvider` in `providers`: `SessionService` (every
-     * request), `SignInService.signIn()` (`isEnrolled()`), `completeMfa()`,
-     * and `signOutEverywhere()`, which also revokes the user's refresh-token
-     * families.
+     * request), `SignInService.signIn()` and `signOutEverywhere()`.
      */
-    sessionCookie: ['sessions', 'refreshTokens', 'mfa'],
-    /** `accessToken`: `TokenService` (refresh-token families), whose `issue()` checks for an authenticator. */
-    accessToken: ['refreshTokens', 'mfa'],
-    /** `mfa`: enrollment, codes, recovery codes and the lockout. */
+    sessionCookie: ['sessions'],
+    /**
+     * `accessToken` without `refreshToken: false`: the refresh-token families
+     * `TokenService` starts, which every sign-out everywhere revokes too.
+     * Access tokens alone keep no state.
+     */
+    refreshToken: ['refreshTokens'],
+    /** `mfa`: enrollment, codes, recovery codes and the lockout; every sign-in checks for an authenticator. */
     mfa: ['mfa'],
     /** `magicLinkHandler`: pending links, then `SignInService.signIn()`. */
-    magicLink: ['sessions', 'mfa', 'magicLinks'],
+    magicLink: ['sessions', 'magicLinks'],
     /** `oidcAccountResolver`: logins in progress, the session that links an account, then `SignInService.signIn()`. */
-    oidc: ['sessions', 'mfa', 'oidcStates'],
+    oidc: ['sessions', 'oidcStates'],
     /**
-     * `passwordResetHandler`: the links; `reset()` revokes every session and
-     * refresh-token family of the user, and with `signIn: true` signs in.
+     * `passwordResetHandler`: the links; `reset()` revokes every session (and
+     * refresh-token family, with refresh tokens on) of the user, and with
+     * `signIn: true` signs in.
      */
-    passwordReset: ['sessions', 'refreshTokens', 'mfa', 'emailTokens'],
+    passwordReset: ['sessions', 'emailTokens'],
     /** `emailVerificationHandler`: the links. */
     emailVerification: ['emailTokens'],
 };

package/dist/testing/index.js

@@ -70,8 +70,8 @@ export function authenticationStoreContract(create, options = {}) {
         for (const record of [full, bare, other]) {
             await store.createSession(record);
         }
-        same(await store.getSession(full.id), full, 'getSession() returns every field as saved');
-        same(await store.getSession(bare.id), bare, 'optional fields come back absent, not null');
+        same(stored(await store.getSession(full.id)), full, 'getSession() returns every field as saved');
+        same(stored(await store.getSession(bare.id)), bare, 'optional fields come back absent, not null');
         same(await store.getSession(id()), undefined, 'getSession() of an unknown id');
         same(sortIds(await store.listUserSessions(u1)), [full.id, bare.id].sort(), "listUserSessions() returns the user's sessions");
         same(await store.listUserSessions(uid()), [], 'listUserSessions() of a user without sessions');
@@ -81,13 +81,13 @@ export function authenticationStoreContract(create, options = {}) {
         same(await store.deleteSession(id()), false, 'deleteSession() of an unknown id resolves false');
         await store.deleteUserSessions(u1);
         same(await store.listUserSessions(u1), [], "deleteUserSessions() deletes the user's sessions");
-        same(await store.getSession(other.id), other, "deleteUserSessions() leaves other users' sessions alone");
+        same(stored(await store.getSession(other.id)), other, "deleteUserSessions() leaves other users' sessions alone");
     });
     add('sessions', 'touchSession() moves lastActiveAt forward only, and never recreates a deleted session', async ({ sessions: store }) => {
         const record = session(uid(), { mfa: 'verified', metadata: { device: 'phone' } });
         await store.createSession(record);
         await store.touchSession(record.id, at(5_000));
-        same(await store.getSession(record.id), { ...record, lastActiveAt: at(5_000) }, 'touchSession() changes lastActiveAt, nothing else');
+        same(stored(await store.getSession(record.id)), { ...record, lastActiveAt: at(5_000) }, 'touchSession() changes lastActiveAt, nothing else');
         await store.touchSession(record.id, at(1_000));
         same((await store.getSession(record.id))?.lastActiveAt, at(5_000), 'touchSession() never moves lastActiveAt back');
         await store.deleteSession(record.id);
@@ -102,7 +102,7 @@ export function authenticationStoreContract(create, options = {}) {
         await store.createSession(idle);
         await store.createSession(expired);
         await store.createSession(session(user, { createdAt: at(2_000), lastActiveAt: at(2_000) }));
-        same(await store.getSession(idle.id), idle, 'a session idle for a long time, but within its absolute expiry, is kept');
+        same(stored(await store.getSession(idle.id)), idle, 'a session idle for a long time, but within its absolute expiry, is kept');
         const left = await store.getSession(expired.id);
         assert.ok(left === undefined || left.expiresAt <= at(2_000), 'a pruned session is gone, or still past its expiry');
     });
@@ -514,6 +514,14 @@ function emailToken(overrides = {}) {
     return { id: id(), purpose: 'password-reset', userId: uid(), email: `${uid()}@example.com`, createdAt: at(0), expiresAt: at(60_000), ...overrides };
 }
 const sortIds = (records) => records.map((record) => record.id).sort();
+/** A session as stored: without the `extra` a store may read along with it. */
+function stored(record) {
+    if (!record) {
+        return record;
+    }
+    const { extra: _, ...rest } = record;
+    return rest;
+}
 /** Deep equality where a missing key and an `undefined` one are the same, and `null` is not `undefined`. */
 function same(actual, expected, message) {
     assert.deepStrictEqual(normalize(actual), normalize(expected), message);