npm - @plank-cms/plank - Versions diffs - 0.15.1 → 0.15.2 - Mend

@plank-cms/plank 0.15.1 → 0.15.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/admin/assets/{index-BvcFQsXq.js → index-NxBzeHGf.js} +51 -51
package/dist/admin/index.html +1 -1
package/dist/index.js +2 -2
package/dist/{server-D4FUWQTZ.js → server-YYJGX3SJ.js} +86 -8
package/package.json +4 -4

package/dist/admin/index.html CHANGED Viewed

@@ -12,7 +12,7 @@
       href="https://fonts.googleapis.com/css2?family=Google+Sans:ital,opsz,wght@0,17..18,400..700;1,17..18,400..700&display=swap"
       rel="stylesheet"
     />
-    <script type="module" crossorigin src="/admin/assets/index-BvcFQsXq.js"></script>
+    <script type="module" crossorigin src="/admin/assets/index-NxBzeHGf.js"></script>
     <link rel="stylesheet" crossorigin href="/admin/assets/index-DU5dGjXR.css">
   </head>
   <body>

package/dist/index.js CHANGED Viewed

@@ -7,7 +7,7 @@ import { randomBytes } from "crypto";
 import { resolve, join } from "path";
 import fs from "fs-extra";
 import { execa } from "execa";
-var PACKAGE_VERSION = "0.15.1";
+var PACKAGE_VERSION = "0.15.2";
 function generateSecret() {
   return randomBytes(32).toString("hex");
 }
@@ -101,7 +101,7 @@ import { dirname, join as join2, resolve as resolve2 } from "path";
 async function start() {
   config({ path: resolve2(process.cwd(), ".env") });
   process.env.PLANK_ADMIN_DIST = join2(dirname(fileURLToPath(import.meta.url)), "admin");
-  const { start: startServer } = await import("./server-D4FUWQTZ.js");
+  const { start: startServer } = await import("./server-YYJGX3SJ.js");
   await startServer();
 }

package/dist/{server-D4FUWQTZ.js → server-YYJGX3SJ.js} RENAMED Viewed

@@ -2315,7 +2315,9 @@ var RATE_LIMIT_WINDOW_MS = 15 * 60 * 1e3;
 var LOGIN_RATE_LIMIT_MAX = 10;
 var LOGIN_2FA_RATE_LIMIT_MAX = 5;
 var ACCESS_TOKEN_COOKIE = "plank_session";
-var ACCESS_TOKEN_EXPIRES_SECONDS = 60 * 15;
+var ACCESS_TOKEN_EXPIRES_SECONDS = 60 * 60 * 24 * 30;
+var REFRESH_TOKEN_COOKIE = "plank_refresh";
+var REFRESH_TOKEN_EXPIRES_SECONDS = 60 * 60 * 24 * 30;
 function isProduction() {
   return process.env.NODE_ENV === "production";
 }
@@ -2328,6 +2330,15 @@ function setSessionCookie(res, token) {
     maxAge: ACCESS_TOKEN_EXPIRES_SECONDS * 1e3
   });
 }
+function setRefreshCookie(res, token) {
+  res.cookie(REFRESH_TOKEN_COOKIE, token, {
+    httpOnly: true,
+    secure: isProduction(),
+    sameSite: "lax",
+    path: "/",
+    maxAge: REFRESH_TOKEN_EXPIRES_SECONDS * 1e3
+  });
+}
 function clearSessionCookie(res) {
   res.clearCookie(ACCESS_TOKEN_COOKIE, {
     httpOnly: true,
@@ -2336,6 +2347,14 @@ function clearSessionCookie(res) {
     path: "/"
   });
 }
+function clearRefreshCookie(res) {
+  res.clearCookie(REFRESH_TOKEN_COOKIE, {
+    httpOnly: true,
+    secure: isProduction(),
+    sameSite: "lax",
+    path: "/"
+  });
+}
 async function consumeRateLimit(scope, rateKey, max) {
   const resetAt = new Date(Date.now() + RATE_LIMIT_WINDOW_MS);
   const { rows } = await pool_default.query(`INSERT INTO plank_auth_rate_limits (id, scope, rate_key, count, reset_at)
@@ -2361,7 +2380,11 @@ async function clearRateLimit(scope, rateKey) {
   ]);
 }
 function buildAccessToken(payload) {
-  return jwt.sign(payload, process.env.PLANK_JWT_SECRET, { expiresIn: "15m" });
+  return jwt.sign(payload, process.env.PLANK_JWT_SECRET, { expiresIn: "30d" });
+}
+function buildRefreshToken(payload) {
+  const refreshPayload = { ...payload, type: "refresh" };
+  return jwt.sign(refreshPayload, process.env.PLANK_JWT_SECRET, { expiresIn: "30d" });
 }
 function buildChallengeToken(payload) {
   return jwt.sign(payload, process.env.PLANK_JWT_SECRET, { expiresIn: "5m" });
@@ -2426,6 +2449,7 @@ async function login(req, res) {
   }
   const auth = await buildAuthPayload(user);
   setSessionCookie(res, auth.token);
+  setRefreshCookie(res, buildRefreshToken({ sub: user.id, roleId: user.role_id, sv: user.session_version }));
   res.json({
     requiresTwoFactor: false,
     user: auth.user
@@ -2494,6 +2518,7 @@ async function loginWithTwoFactor(req, res) {
   await clearRateLimit("login-2fa", rateKey);
   const auth = await buildAuthPayload(user);
   setSessionCookie(res, auth.token);
+  setRefreshCookie(res, buildRefreshToken({ sub: user.id, roleId: user.role_id, sv: user.session_version }));
   res.json({
     requiresTwoFactor: false,
     user: auth.user
@@ -2512,6 +2537,7 @@ async function logout(req, res) {
     }
   }
   clearSessionCookie(res);
+  clearRefreshCookie(res);
   const ip = req.ip ?? "unknown";
   await pool_default.query("DELETE FROM plank_auth_rate_limits WHERE rate_key LIKE $1", [`${ip}:%`]);
   res.status(204).end();
@@ -2553,6 +2579,24 @@ import { Router as Router2 } from "express";
 // ../core/dist/middlewares/authenticate.js
 import jwt2 from "jsonwebtoken";
+var ACCESS_TOKEN_COOKIE2 = "plank_session";
+var REFRESH_TOKEN_COOKIE2 = "plank_refresh";
+var ACCESS_TOKEN_EXPIRES_SECONDS2 = 60 * 60 * 24 * 30;
+function isProduction2() {
+  return process.env.NODE_ENV === "production";
+}
+function setSessionCookie2(res, token) {
+  res.cookie(ACCESS_TOKEN_COOKIE2, token, {
+    httpOnly: true,
+    secure: isProduction2(),
+    sameSite: "lax",
+    path: "/",
+    maxAge: ACCESS_TOKEN_EXPIRES_SECONDS2 * 1e3
+  });
+}
+function buildAccessToken2(payload) {
+  return jwt2.sign(payload, process.env.PLANK_JWT_SECRET, { expiresIn: "30d" });
+}
 function cookieValue(raw, key) {
   if (!raw)
     return null;
@@ -2567,27 +2611,61 @@ function cookieValue(raw, key) {
 async function authenticate(req, res, next) {
   const header = req.headers.authorization;
   const bearer = header?.startsWith("Bearer ") ? header.slice(7) : null;
-  const cookieToken = cookieValue(req.headers.cookie, "plank_session");
+  const cookieToken = cookieValue(req.headers.cookie, ACCESS_TOKEN_COOKIE2);
+  const refreshToken = cookieValue(req.headers.cookie, REFRESH_TOKEN_COOKIE2);
   const token = bearer ?? cookieToken;
   if (!token) {
     res.status(401).json({ error: "Unauthorized" });
     return;
   }
-  try {
-    const payload = jwt2.verify(token, process.env.PLANK_JWT_SECRET);
+  async function validateSession(payload) {
     if (typeof payload.sv !== "number") {
-      res.status(401).json({ error: "Invalid session token" });
-      return;
+      return { ok: false };
     }
     const { rows } = await pool_default.query("SELECT session_version FROM plank_users WHERE id = $1", [payload.sub]);
     if (!rows[0] || rows[0].session_version !== payload.sv) {
+      return { ok: false };
+    }
+    return { ok: true, sessionVersion: rows[0].session_version };
+  }
+  try {
+    const payload = jwt2.verify(token, process.env.PLANK_JWT_SECRET);
+    const session = await validateSession(payload);
+    if (!session.ok) {
       res.status(401).json({ error: "Session has been revoked" });
       return;
     }
     req.user = { id: payload.sub, roleId: payload.roleId };
     next();
   } catch {
-    res.status(401).json({ error: "Invalid or expired token" });
+    if (bearer || !refreshToken) {
+      res.status(401).json({ error: "Invalid or expired token" });
+      return;
+    }
+    try {
+      const refreshPayload = jwt2.verify(refreshToken, process.env.PLANK_JWT_SECRET);
+      if (refreshPayload.type !== "refresh") {
+        res.status(401).json({ error: "Invalid or expired token" });
+        return;
+      }
+      const session = await validateSession(refreshPayload);
+      if (!session.ok || typeof session.sessionVersion !== "number") {
+        res.status(401).json({ error: "Session has been revoked" });
+        return;
+      }
+      const renewed = buildAccessToken2({
+        sub: refreshPayload.sub,
+        roleId: refreshPayload.roleId,
+        sv: session.sessionVersion
+      });
+      setSessionCookie2(res, renewed);
+      req.user = { id: refreshPayload.sub, roleId: refreshPayload.roleId };
+      next();
+      return;
+    } catch {
+      res.status(401).json({ error: "Invalid or expired token" });
+      return;
+    }
   }
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@plank-cms/plank",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "Self-hosted headless CMS. Deploy in minutes on your own infrastructure.",
   "type": "module",
   "files": [
@@ -55,9 +55,9 @@
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",
     "tsup": "^8.5.0",
-    "@plank-cms/core": "0.15.1",
-    "@plank-cms/db": "0.15.1",
-    "@plank-cms/schema": "0.15.1"
+    "@plank-cms/core": "0.15.2",
+    "@plank-cms/db": "0.15.2",
+    "@plank-cms/schema": "0.15.2"
   },
   "scripts": {
     "build": "tsup",