@orangecheck/me-client 0.37.0 → 0.38.0

package/README.md

@@ -249,7 +249,7 @@ app.get('/api/me', (c) => {
 
 ### Sessions ended everywhere
 
-Set `OC_PROJECT_KEY` and `OC_SIGNING_SECRET` (from ochk.app/me/projects) and `getOcSession`, `withOcAuth`, `ocAuthExpress` and `ocAuthHono` refuse a session the person ended everywhere: sign out everywhere, a passkey removed, the account deleted. A sign-in token carries `rh`, its revocation handle for your origin; they look it up in me.ochk.io's list of ended handles for that origin, read once a minute per origin with a request signed by your secret, so a refusal lands within about two minutes. The handles name nobody, and another site's handles for the same person never match yours. If the list can't be read, or is more than ten minutes old by its own clock, reads go on and writes are refused until it can. A token without `rh`, and every token while the two variables are unset, is checked by its signature alone and stays valid until it expires. Needs 0.35.0 or later.
+Set `OC_PROJECT_KEY` and `OC_SIGNING_SECRET` (from ochk.app/me/projects) and `getOcSession`, `withOcAuth`, `ocAuthExpress` and `ocAuthHono` refuse a session the person ended everywhere: sign out everywhere, a passkey removed, the account deleted. A sign-in token carries `rh`, its revocation handle for your origin; they look it up in me.ochk.io's list of ended handles for that origin, read once a minute per origin with a request signed by your secret, so a refusal lands within about two minutes. The handles name nobody, and another site's handles for the same person never match yours. If the list can't be read, or is more than ten minutes old by its own clock, reads go on and writes are refused until it can: the adapters answer such a write `503 { reason: 'revocations_unavailable' }` (0.38.0), not 401, so a client retries instead of signing the person out, and `checkOcSession(headers, options)` tells the same apart for your own code (`signed_in`, `signed_out` or `unavailable`). A token without `rh`, and every token while the two variables are unset, is checked by its signature alone and stays valid until it expires. Needs 0.35.0 or later.
 
 ## Browser popup signin
 

package/dist/server.d.mts

@@ -10,6 +10,15 @@ interface OcSessionOptions extends VerifyOcOptions {
 }
 declare function _resetSessionChecksForTests(): void;
 declare function getOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<SessionPayload | null>;
+type OcSessionCheck = {
+    status: 'signed_in';
+    session: SessionPayload;
+} | {
+    status: 'signed_out';
+} | {
+    status: 'unavailable';
+};
+declare function checkOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<OcSessionCheck>;
 interface NextApiRequestLike {
     method?: string;
     headers: {
@@ -80,4 +89,4 @@ interface HonoContextLike {
 type HonoNextLike = () => Promise<void>;
 declare function ocAuthHono(options?: WithOcAuthOptions): (c: HonoContextLike, next: HonoNextLike) => Promise<unknown>;
 
-export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };
+export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionCheck, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, checkOcSession, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };

package/dist/server.d.ts

@@ -10,6 +10,15 @@ interface OcSessionOptions extends VerifyOcOptions {
 }
 declare function _resetSessionChecksForTests(): void;
 declare function getOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<SessionPayload | null>;
+type OcSessionCheck = {
+    status: 'signed_in';
+    session: SessionPayload;
+} | {
+    status: 'signed_out';
+} | {
+    status: 'unavailable';
+};
+declare function checkOcSession(headers: SessionRequestHeaders | Headers, options?: OcSessionOptions): Promise<OcSessionCheck>;
 interface NextApiRequestLike {
     method?: string;
     headers: {
@@ -80,4 +89,4 @@ interface HonoContextLike {
 type HonoNextLike = () => Promise<void>;
 declare function ocAuthHono(options?: WithOcAuthOptions): (c: HonoContextLike, next: HonoNextLike) => Promise<unknown>;
 
-export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };
+export { BACK_ACCOUNT_URL, type OcHonoEnv, type OcSessionCheck, type OcSessionOptions, type WithOcAuthOptions, type WithOcSession, _resetSessionChecksForTests, checkOcSession, getOcSession, ocAuthExpress, ocAuthHono, withOcAuth };

package/dist/server.js

@@ -600,15 +600,22 @@ function _resetSessionChecksForTests() {
   warnedUnchecked = false;
 }
 async function getOcSession(headers, options = {}) {
+  const checked = await checkOcSession(headers, options);
+  return checked.status === "signed_in" ? checked.session : null;
+}
+async function checkOcSession(headers, options = {}) {
   const session = await authCore.getOcSession(headers, options);
   if (!session) {
     if (options.audience === void 0) warnIfAudienceMissing(headers);
-    return null;
+    return { status: "signed_out" };
   }
   const check = revocationFor(options);
-  if (check && await check.refuses(session, options.method)) return null;
-  return session;
+  if (check && await check.refuses(session, options.method)) {
+    return await check.status(session) === "revoked" ? { status: "signed_out" } : { status: "unavailable" };
+  }
+  return { status: "signed_in", session };
 }
+var UNAVAILABLE = { status: 503, body: { ok: false, reason: "revocations_unavailable" } };
 var warnedAudience = false;
 function warnIfAudienceMissing(headers) {
   if (warnedAudience) return;
@@ -727,16 +734,17 @@ function withOcAuth(handler, options = {}) {
   return async (req, res) => {
     res.setHeader("Cache-Control", "no-store, private");
     res.setHeader("Vary", "Cookie, Authorization");
-    const session = await getOcSession(
+    const checked = await checkOcSession(
       {
         cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
         authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
       },
       { ...options, method: req.method }
     );
+    const session = checked.status === "signed_in" ? checked.session : null;
     const withSession = req;
     withSession.ocSession = session;
-    const refused = await refusal(session, options);
+    const refused = checked.status === "unavailable" ? UNAVAILABLE : await refusal(session, options);
     if (refused) return res.status(refused.status).json(refused.body);
     return handler(withSession, res);
   };
@@ -746,15 +754,16 @@ function ocAuthExpress(options = {}) {
     try {
       res.setHeader("Cache-Control", "no-store, private");
       res.setHeader("Vary", "Cookie, Authorization");
-      const session = await getOcSession(
+      const checked = await checkOcSession(
         {
           cookie: typeof req.headers.cookie === "string" ? req.headers.cookie : null,
           authorization: typeof req.headers.authorization === "string" ? req.headers.authorization : null
         },
         { ...options, method: req.method }
       );
+      const session = checked.status === "signed_in" ? checked.session : null;
       req.ocSession = session;
-      const refused = await refusal(session, options);
+      const refused = checked.status === "unavailable" ? UNAVAILABLE : await refusal(session, options);
       if (refused) {
         res.status(refused.status).json(refused.body);
         return;
@@ -769,12 +778,13 @@ function ocAuthHono(options = {}) {
   return async (c, next) => {
     c.header("Cache-Control", "no-store, private");
     c.header("Vary", "Cookie, Authorization");
-    const session = await getOcSession(c.req.raw.headers, {
+    const checked = await checkOcSession(c.req.raw.headers, {
       ...options,
       method: c.req.raw.method
     });
+    const session = checked.status === "signed_in" ? checked.session : null;
     c.set("ocSession", session);
-    const refused = await refusal(session, options);
+    const refused = checked.status === "unavailable" ? UNAVAILABLE : await refusal(session, options);
     if (refused) return c.json(refused.body, refused.status);
     await next();
   };
@@ -794,6 +804,7 @@ Object.defineProperty(exports, "verifyOcToken", {
 });
 exports.BACK_ACCOUNT_URL = BACK_ACCOUNT_URL;
 exports._resetSessionChecksForTests = _resetSessionChecksForTests;
+exports.checkOcSession = checkOcSession;
 exports.getOcSession = getOcSession;
 exports.identity = identity;
 exports.ocAuthExpress = ocAuthExpress;