@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/dist/lib/auth/session-config.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Session Config Resolution
+ *
+ * Turns the (optional, partially specified) `auth.session` block of the merged
+ * app config into the concrete values handed to Better Auth. Pure function —
+ * no side effects besides a `console.warn` on invalid input — so themes and
+ * tests can reason about the exact numbers Better Auth will receive.
+ *
+ * Resolution rules:
+ * - Every field falls back to the core default when missing.
+ * - Non-positive / non-finite values are rejected (warning) → default.
+ * - `updateAge` defaults to 1 day, capped at `expiresIn / 2` for short
+ *   sessions so a rolling renewal still happens before expiry.
+ * - `updateAge` and `cookieCache.maxAge` are clamped to `expiresIn`.
+ */
+import type { AuthConfig } from '../config/types';
+export interface ResolvedSessionConfig {
+    /** Total session lifetime in seconds. */
+    expiresIn: number;
+    /** Rolling-renewal interval in seconds (<= expiresIn). */
+    updateAge: number;
+    cookieCache: {
+        enabled: boolean;
+        /** Cookie-cache lifetime in seconds (<= expiresIn). */
+        maxAge: number;
+    };
+}
+export declare const DEFAULT_SESSION_CONFIG: ResolvedSessionConfig;
+/**
+ * Resolve the session configuration Better Auth should run with.
+ *
+ * @param authConfig - The merged `auth` config (core defaults + theme overrides).
+ *                     Only its `session` block is read; `undefined`/`null` is
+ *                     allowed and yields the defaults.
+ */
+export declare function resolveSessionConfig(authConfig?: Pick<AuthConfig, 'session'> | null): ResolvedSessionConfig;
+//# sourceMappingURL=session-config.d.ts.map

package/dist/lib/auth/session-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-config.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/session-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,iBAAiB,CAAA;AAEpE,MAAM,WAAW,qBAAqB;IACpC,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE;QACX,OAAO,EAAE,OAAO,CAAA;QAChB,uDAAuD;QACvD,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,eAAO,MAAM,sBAAsB,EAAE,qBAOpC,CAAA;AAqBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,IAAI,GAC9C,qBAAqB,CAmCvB"}

package/dist/lib/auth/session-config.js

@@ -0,0 +1,59 @@
+const DEFAULT_SESSION_CONFIG = {
+  expiresIn: 60 * 60 * 24 * 7,
+  // 7 days
+  updateAge: 60 * 60 * 24,
+  // 1 day
+  cookieCache: {
+    enabled: true,
+    maxAge: 60 * 5
+    // 5 minutes
+  }
+};
+function isPositiveSeconds(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function resolveSeconds(value, fallback, field) {
+  if (value === void 0) return fallback;
+  if (!isPositiveSeconds(value)) {
+    console.warn(
+      `[Auth] Ignoring invalid auth.session.${field} (${String(value)}); using default ${fallback}s`
+    );
+    return fallback;
+  }
+  return Math.floor(value);
+}
+function resolveSessionConfig(authConfig) {
+  var _a, _b;
+  const cfg = (authConfig == null ? void 0 : authConfig.session) ?? {};
+  const expiresIn = resolveSeconds(cfg.expiresIn, DEFAULT_SESSION_CONFIG.expiresIn, "expiresIn");
+  const defaultUpdateAge = Math.max(
+    1,
+    Math.min(DEFAULT_SESSION_CONFIG.updateAge, Math.floor(expiresIn / 2))
+  );
+  let updateAge = resolveSeconds(cfg.updateAge, defaultUpdateAge, "updateAge");
+  if (updateAge > expiresIn) {
+    console.warn(
+      `[Auth] auth.session.updateAge (${updateAge}s) exceeds expiresIn (${expiresIn}s); clamping to expiresIn`
+    );
+    updateAge = expiresIn;
+  }
+  const cacheEnabled = ((_a = cfg.cookieCache) == null ? void 0 : _a.enabled) ?? DEFAULT_SESSION_CONFIG.cookieCache.enabled;
+  let cacheMaxAge = resolveSeconds(
+    (_b = cfg.cookieCache) == null ? void 0 : _b.maxAge,
+    DEFAULT_SESSION_CONFIG.cookieCache.maxAge,
+    "cookieCache.maxAge"
+  );
+  if (cacheMaxAge > expiresIn) cacheMaxAge = expiresIn;
+  return {
+    expiresIn,
+    updateAge,
+    cookieCache: {
+      enabled: cacheEnabled,
+      maxAge: cacheMaxAge
+    }
+  };
+}
+export {
+  DEFAULT_SESSION_CONFIG,
+  resolveSessionConfig
+};

package/dist/lib/auth/session-refresh.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Server-side session cookie refresh
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Better Auth sessions are "rolling": every `updateAge` seconds of activity,
+ * `getSession` extends `expiresAt` in the database AND re-issues the session
+ * cookie with a fresh `Max-Age`. The cookie half of that only works where
+ * cookies can be written — Route Handlers and Server Actions. When the session
+ * is read while RENDERING a Server Component (root layout, i18n request
+ * config, theme mode…), Next.js forbids `cookies().set()`; the `nextCookies`
+ * plugin swallows the error, the DB row is renewed, but the browser keeps the
+ * old cookie and drops it N days after login — even for daily users. That is
+ * exactly what an installed PWA hits, because it is only ever opened through
+ * server-rendered pages.
+ *
+ * THE OFFICIAL PATH
+ * -----------------
+ * 1. Render-time reads pass `query: { disableRefresh: true }` so they never
+ *    consume the renewal window (see `lib/locale.ts`,
+ *    `lib/theme/get-default-theme-mode.ts`).
+ * 2. The renewal is triggered from the browser against Better Auth's own
+ *    `GET /api/auth/get-session` endpoint, served by the `app/api/auth/[...all]`
+ *    Route Handler where `Set-Cookie` works. `refreshSessionCookie()` in
+ *    `lib/auth-client.ts` does that call; `useSessionCookieRefresh()` /
+ *    `<SessionCookieRefresher />` fire it on app open, tab focus and reconnect.
+ * 3. Apps that want their own endpoint (custom path, service worker, native
+ *    shell) can expose `refreshSessionResponse` from any Route Handler.
+ */
+/**
+ * Run Better Auth's session lookup with the cookie cache bypassed and return
+ * the raw `Response`, `Set-Cookie` headers included. Call it from a Route
+ * Handler and return the result as-is:
+ *
+ * ```ts
+ * // app/api/session/refresh/route.ts
+ * import { refreshSessionResponse } from '@nextsparkjs/core/lib/auth/session-refresh'
+ * export const GET = (req: Request) => refreshSessionResponse(req.headers)
+ * ```
+ *
+ * When the rolling renewal is due, the response carries the renewed session
+ * cookie; otherwise it just returns the current session (or `null` when the
+ * request is anonymous). Never call this during Server Component render.
+ */
+export declare function refreshSessionResponse(headers: Headers): Promise<Response>;
+//# sourceMappingURL=session-refresh.d.ts.map

package/dist/lib/auth/session-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-refresh.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/session-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAMhF"}

package/dist/lib/auth/session-refresh.js

@@ -0,0 +1,11 @@
+import { auth } from "../auth.js";
+async function refreshSessionResponse(headers) {
+  return auth.api.getSession({
+    headers,
+    query: { disableCookieCache: true },
+    asResponse: true
+  });
+}
+export {
+  refreshSessionResponse
+};