@rebasepro/server 0.10.0 → 0.10.1-canary.18115ba

package/dist/{jwt-B3zjddCa.js → jwt-Dj7r7QX7.js}

@@ -4165,6 +4165,7 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region src/auth/jwt.ts
 var jwt_exports = /* @__PURE__ */ __exportAll({
+	MAX_COOKIE_AGE_MS: () => MAX_COOKIE_AGE_MS,
 	configureJwt: () => configureJwt,
 	generateAccessToken: () => generateAccessToken,
 	generateDownloadToken: () => generateDownloadToken,
@@ -4172,6 +4173,7 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	getAccessTokenExpiry: () => getAccessTokenExpiry,
 	getAccessTokenExpiryMs: () => getAccessTokenExpiryMs,
 	getRefreshTokenExpiry: () => getRefreshTokenExpiry,
+	getRefreshTokenTtlMs: () => getRefreshTokenTtlMs,
 	hashRefreshToken: () => hashRefreshToken,
 	verifyAccessToken: () => verifyAccessToken,
 	verifyDownloadToken: () => verifyDownloadToken
@@ -4180,7 +4182,7 @@ var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 var jwtConfig = {
 	secret: "",
 	accessExpiresIn: "1h",
-	refreshExpiresIn: "30d"
+	refreshExpiresIn: "400d"
 };
 /**
 * Configure JWT settings - call this during initialization.
@@ -4306,30 +4308,40 @@ function hashRefreshToken(token) {
 	return createHash("sha256").update(token).digest("hex");
 }
 /**
-* Calculate refresh token expiration date
+* The longest a cookie can live. Chrome (since 104) and RFC 6265bis silently
+* rewrite any `Max-Age` beyond 400 days down to 400 days, so promising a
+* browser more is not a stricter policy — it is a policy that differs from
+* what is actually enforced, which is worse than knowing the ceiling.
 */
-function getRefreshTokenExpiry() {
-	const match = (jwtConfig.refreshExpiresIn || "30d").match(/^(\d+)([dhms])$/);
-	if (!match) return new Date(Date.now() + 720 * 60 * 60 * 1e3);
+var MAX_COOKIE_AGE_MS = 400 * 24 * 60 * 60 * 1e3;
+/** Fallback when `refreshExpiresIn` is unset or unparseable. */
+var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
+/**
+* How long a refresh token is valid for, in milliseconds.
+*
+* Every rotation issues a token with a fresh TTL, so this is a sliding window:
+* a user who visits at all keeps their session indefinitely, and one who
+* disappears loses it this long after their last visit. That is what both
+* Firebase and Supabase do by default, and it is the behaviour people mean
+* when they say they expect to still be signed in.
+*/
+function getRefreshTokenTtlMs() {
+	const match = jwtConfig.refreshExpiresIn?.match(/^(\d+)([dhms])$/);
+	if (!match) return DEFAULT_REFRESH_TTL_MS;
 	const value = parseInt(match[1], 10);
-	const unit = match[2];
-	let ms;
-	switch (unit) {
-		case "d":
-			ms = value * 24 * 60 * 60 * 1e3;
-			break;
-		case "h":
-			ms = value * 60 * 60 * 1e3;
-			break;
-		case "m":
-			ms = value * 60 * 1e3;
-			break;
-		case "s":
-			ms = value * 1e3;
-			break;
-		default: ms = 720 * 60 * 60 * 1e3;
+	switch (match[2]) {
+		case "d": return value * 24 * 60 * 60 * 1e3;
+		case "h": return value * 60 * 60 * 1e3;
+		case "m": return value * 60 * 1e3;
+		case "s": return value * 1e3;
+		default: return DEFAULT_REFRESH_TTL_MS;
 	}
-	return new Date(Date.now() + ms);
+}
+/**
+* Calculate refresh token expiration date
+*/
+function getRefreshTokenExpiry() {
+	return new Date(Date.now() + getRefreshTokenTtlMs());
 }
 /**
 * Generate a short-lived download token scoped to a specific file path or prefix
@@ -4363,6 +4375,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { getAccessTokenExpiry as a, jwt_exports as c, require_jsonwebtoken as d, __commonJSMin as f, __toESM as h, generateRefreshToken as i, verifyAccessToken as l, __require as m, generateAccessToken as n, getRefreshTokenExpiry as o, __exportAll as p, generateDownloadToken as r, hashRefreshToken as s, configureJwt as t, verifyDownloadToken as u };
+export { __toESM as _, generateRefreshToken as a, getRefreshTokenTtlMs as c, verifyAccessToken as d, verifyDownloadToken as f, __require as g, __exportAll as h, generateDownloadToken as i, hashRefreshToken as l, __commonJSMin as m, configureJwt as n, getAccessTokenExpiry as o, require_jsonwebtoken as p, generateAccessToken as r, getRefreshTokenExpiry as s, MAX_COOKIE_AGE_MS as t, jwt_exports as u };
 
-//# sourceMappingURL=jwt-B3zjddCa.js.map
+//# sourceMappingURL=jwt-Dj7r7QX7.js.map