@orangecheck/me-client 0.36.1 → 0.38.0

package/README.md

@@ -90,7 +90,7 @@ export default withOcAuth(handler, {
 });
 ```
 
-Or set it in code with `requireBond: { minSats: 100_000, minDays: 30, maxAgeSecs: 3600 }`. ochk.io re-checks the coin when its last check is over ten minutes old; `maxAgeSecs` refuses a claim checked longer ago than you accept. From 0.28.0, an account below the floor gets `403 { ok: false, reason: 'bond_required', need: { min_sats, min_days }, have: { sats_floor, days_floor } | null, back_url }`: link the person to `back_url` to back their account. If the project's setting can't be read and never has been, the request gets `503 { reason: 'bond_policy_unavailable' }` rather than being let through unchecked. `readBondClaim(session)` and `bondMeets(session, { minSats, minDays, maxAgeSecs })` are exported for your own checks.
+Or set it in code with `requireBond: { minSats: 100_000, minDays: 30, maxAgeSecs: 3600 }`. ochk.io re-checks the coin when its last check is over ten minutes old; `maxAgeSecs` refuses a claim checked longer ago than you accept. From 0.28.0, an account below the floor gets `403 { ok: false, reason: 'bond_required', need: { min_sats, min_days }, have: { sats_floor, days_floor } | null, back_url }`: link the person to `back_url` to back their account. If the project's setting can't be read, the last one read stands for ten minutes; with none read in that time, a signed-in request gets `503 { reason: 'bond_policy_unavailable' }` rather than being let through unchecked. A request with no session is not held to the project's setting and never waits on it (0.37.0); pass `required: true` to answer it 401. `readBondClaim(session)` and `bondMeets(session, { minSats, minDays, maxAgeSecs })` are exported for your own checks.
 
 ## Pay your users, when you choose to
 
@@ -249,7 +249,7 @@ app.get('/api/me', (c) => {
 
 ### Sessions ended everywhere
 
-Set `OC_PROJECT_KEY` and `OC_SIGNING_SECRET` (from ochk.app/me/projects) and `getOcSession`, `withOcAuth`, `ocAuthExpress` and `ocAuthHono` refuse a session the person ended everywhere: sign out everywhere, a passkey removed, the account deleted. A sign-in token carries `rh`, its revocation handle for your origin; they look it up in me.ochk.io's list of ended handles for that origin, read once a minute per origin with a request signed by your secret, so a refusal lands within about two minutes. The handles name nobody, and another site's handles for the same person never match yours. If the list can't be read, or is more than ten minutes old by its own clock, reads go on and writes are refused until it can. A token without `rh`, and every token while the two variables are unset, is checked by its signature alone and stays valid until it expires. Needs 0.35.0 or later.
+Set `OC_PROJECT_KEY` and `OC_SIGNING_SECRET` (from ochk.app/me/projects) and `getOcSession`, `withOcAuth`, `ocAuthExpress` and `ocAuthHono` refuse a session the person ended everywhere: sign out everywhere, a passkey removed, the account deleted. A sign-in token carries `rh`, its revocation handle for your origin; they look it up in me.ochk.io's list of ended handles for that origin, read once a minute per origin with a request signed by your secret, so a refusal lands within about two minutes. The handles name nobody, and another site's handles for the same person never match yours. If the list can't be read, or is more than ten minutes old by its own clock, reads go on and writes are refused until it can: the adapters answer such a write `503 { reason: 'revocations_unavailable' }` (0.38.0), not 401, so a client retries instead of signing the person out, and `checkOcSession(headers, options)` tells the same apart for your own code (`signed_in`, `signed_out` or `unavailable`). A token without `rh`, and every token while the two variables are unset, is checked by its signature alone and stays valid until it expires. Needs 0.35.0 or later.
 
 ## Browser popup signin
 

package/dist/server.d.mts

@@ -10,6 +10,15 @@ interface OcSessionOptions extends VerifyOcOptions {
 }
 declare function _resetSessionChecksForTests(): void;
 declare function getOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<SessionPayload | null>;
+type OcSessionCheck = {
+    status: 'signed_in';
+    session: SessionPayload;
+} | {
+    status: 'signed_out';
+} | {
+    status: 'unavailable';
+};
+declare function checkOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<OcSessionCheck>;
 interface NextApiRequestLike {
     method?: string;
     headers: {
@@ -80,4 +89,4 @@ interface HonoContextLike {
 type HonoNextLike = () => Promise<void>;
 declare function ocAuthHono(options?: WithOcAuthOptions): (c: HonoContextLike, next: HonoNextLike) => Promise<unknown>;
 
-export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };
+export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionCheck, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, checkOcSession, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };

package/dist/server.d.ts

@@ -10,6 +10,15 @@ interface OcSessionOptions extends VerifyOcOptions {
 }
 declare function _resetSessionChecksForTests(): void;
 declare function getOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<SessionPayload | null>;
+type OcSessionCheck = {
+    status: 'signed_in';
+    session: SessionPayload;
+} | {
+    status: 'signed_out';
+} | {
+    status: 'unavailable';
+};
+declare function checkOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<OcSessionCheck>;
 interface NextApiRequestLike {
     method?: string;
     headers: {
@@ -80,4 +89,4 @@ interface HonoContextLike {
 type HonoNextLike = () => Promise<void>;
 declare function ocAuthHono(options?: WithOcAuthOptions): (c: HonoContextLike, next: HonoNextLike) => Promise<unknown>;
 
-export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };
+export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionCheck, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, checkOcSession, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };

package/dist/server.js

@@ -600,15 +600,22 @@ function _resetSessionChecksForTests() {
   warnedUnchecked = false;
 }
 async function getOcSession(headers, options = {}) {
+  const checked = await checkOcSession(headers, options);
+  return checked.status === "signed_in" ? checked.session : null;
+}
+async function checkOcSession(headers, options = {}) {
   const session = await authCore.getOcSession(headers, options);
   if (!session) {
     if (options.audience === void 0) warnIfAudienceMissing(headers);
-    return null;
+    return { status: "signed_out" };
   }
   const check = revocationFor(options);
-  if (check && await check.refuses(session, options.method)) return null;
-  return session;
+  if (check && await check.refuses(session, options.method)) {
+    return await check.status(session) === "revoked" ? { status: "signed_out" } : { status: "unavailable" };
+  }
+  return { status: "signed_in", session };
 }
+var UNAVAILABLE = { status: 503, body: { ok: false, reason: "revocations_unavailable" } };
 var warnedAudience = false;
 function warnIfAudienceMissing(headers) {
   if (warnedAudience) return;
@@ -690,10 +697,11 @@ async function bondNeed(options) {
   return null;
 }
 async function refusal(session, options) {
-  const need = await bondNeed(options);
   if (!session && options.required) {
     return { status: 401, body: { ok: false, reason: "unauthenticated" } };
   }
+  if (!session && !options.requireBond) return null;
+  const need = await bondNeed(options);
   if (need === UNKNOWN_PROJECT) {
     return { status: 500, body: { ok: false, reason: "unknown_project_key" } };
   }
@@ -726,16 +734,17 @@ function withOcAuth(handler, options = {}) {
   return async (req, res) => {
     res.setHeader("Cache-Control", "no-store, private");
     res.setHeader("Vary", "Cookie, Authorization");
-    const session = await getOcSession(
+    const checked = await checkOcSession(
       {
         cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
         authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
       },
       { ...options, method: req.method }
     );
+    const session = checked.status === "signed_in" ? checked.session : null;
     const withSession = req;
     withSession.ocSession = session;
-    const refused = await refusal(session, options);
+    const refused = checked.status === "unavailable" ? UNAVAILABLE : await refusal(session, options);
     if (refused) return res.status(refused.status).json(refused.body);
     return handler(withSession, res);
   };
@@ -745,15 +754,16 @@ function ocAuthExpress(options = {}) {
     try {
       res.setHeader("Cache-Control", "no-store, private");
       res.setHeader("Vary", "Cookie, Authorization");
-      const session = await getOcSession(
+      const checked = await checkOcSession(
         {
           cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
           authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
         },
         { ...options, method: req.method }
       );
+      const session = checked.status === "signed_in" ? checked.session : null;
       req.ocSession = session;
-      const refused = await refusal(session, options);
+      const refused = checked.status === "unavailable" ? UNAVAILABLE : await refusal(session, options);
       if (refused) {
         res.status(refused.status).json(refused.body);
         return;
@@ -768,12 +778,13 @@ function ocAuthHono(options = {}) {
   return async (c, next) => {
     c.header("Cache-Control", "no-store, private");
     c.header("Vary", "Cookie, Authorization");
-    const session = await getOcSession(c.req.raw.headers, {
+    const checked = await checkOcSession(c.req.raw.headers, {
       ...options,
       method: c.req.raw.method
     });
+    const session = checked.status === "signed_in" ? checked.session : null;
     c.set("ocSession", session);
-    const refused = await refusal(session, options);
+    const refused = checked.status === "unavailable" ? UNAVAILABLE : await refusal(session, options);
     if (refused) return c.json(refused.body, refused.status);
     await next();
   };
@@ -793,6 +804,7 @@ Object.defineProperty(exports, "verifyOcToken", {
 });
 exports.BACK_ACCOUNT_URL = BACK_ACCOUNT_URL;
 exports._resetSessionChecksForTests = _resetSessionChecksForTests;
+exports.checkOcSession = checkOcSession;
 exports.getOcSession = getOcSession;
 exports.identity = identity;
 exports.ocAuthExpress = ocAuthExpress;