@rebasepro/server 0.21.2-canary.g1ea48be → 0.23.0

package/dist/{jwt-C4OW-DNq.js → jwt-DnQHNFCl.js}

@@ -4,7 +4,7 @@ globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
 import { r as logger } from "./logger-DO2PZc4i.js";
-import { i as canonicalStorageId } from "./keys-Qfc4XieN.js";
+import { a as canonicalStorageId } from "./keys-CogCQpxG.js";
 import { createPrivateKey, createPublicKey } from "crypto";
 //#region src/utils/portable-crypto.ts
 /**
@@ -4436,6 +4436,7 @@ var jwt_exports = /* @__PURE__ */ __exportAll({
 	hasAsymmetricSigningKey: () => hasAsymmetricSigningKey,
 	hashRefreshToken: () => hashRefreshToken,
 	isJwtConfigured: () => isJwtConfigured,
+	parseDurationMs: () => parseDurationMs,
 	signPurposeToken: () => signPurposeToken,
 	verifyAccessToken: () => verifyAccessToken,
 	verifyDownloadToken: () => verifyDownloadToken,
@@ -4523,9 +4524,18 @@ function configureJwt(config) {
 		active = resolved.find((key) => key.kid === config.activeKid) ?? null;
 		if (!active) throw new Error(`auth.activeKid is "${config.activeKid}", which is not among the configured signing keys (${resolved.map((k) => `"${k.kid}"`).join(", ")}). Signing with a key nobody published produces tokens no verifier can check.`);
 	} else active = resolved[0];
+	const lifetimes = {};
+	for (const key of ["accessExpiresIn", "refreshExpiresIn"]) {
+		const value = config[key];
+		if (value === void 0) continue;
+		if (parseDurationMs(value) === null) throw new Error(`auth.${key} is "${value}", which is not a lifetime. Give a positive number and a unit — "15m", "1h", "30d", "1w", "2 weeks" — in the grammar the token signer reads (vercel/ms). A bare number is refused: the signer reads it as milliseconds.`);
+		lifetimes[key] = value;
+	}
 	jwtConfig = {
 		...jwtConfig,
-		...config
+		...config,
+		accessExpiresIn: lifetimes.accessExpiresIn ?? jwtConfig.accessExpiresIn,
+		refreshExpiresIn: lifetimes.refreshExpiresIn ?? jwtConfig.refreshExpiresIn
 	};
 	signingKeys = resolved;
 	activeSigningKey = active;
@@ -4585,16 +4595,59 @@ async function generateAccessToken(uid, roles, aal = "aal1", customClaims, isAno
 * Get the expiration time of an access token in milliseconds from now
 */
 function getAccessTokenExpiryMs() {
-	const match = (jwtConfig.accessExpiresIn || "1h").match(/^(\d+)([dhms])$/);
-	if (!match) return 3600 * 1e3;
-	const value = parseInt(match[1], 10);
-	switch (match[2]) {
-		case "d": return value * 24 * 60 * 60 * 1e3;
-		case "h": return value * 60 * 60 * 1e3;
-		case "m": return value * 60 * 1e3;
-		case "s": return value * 1e3;
-		default: return 3600 * 1e3;
-	}
+	return parseDurationMs(jwtConfig.accessExpiresIn || "1h") ?? 3600 * 1e3;
+}
+var DURATION_UNIT_MS = {
+	ms: 1,
+	msec: 1,
+	msecs: 1,
+	millisecond: 1,
+	milliseconds: 1,
+	s: 1e3,
+	sec: 1e3,
+	secs: 1e3,
+	second: 1e3,
+	seconds: 1e3,
+	m: 6e4,
+	min: 6e4,
+	mins: 6e4,
+	minute: 6e4,
+	minutes: 6e4,
+	h: 36e5,
+	hr: 36e5,
+	hrs: 36e5,
+	hour: 36e5,
+	hours: 36e5,
+	d: 864e5,
+	day: 864e5,
+	days: 864e5,
+	w: 6048e5,
+	week: 6048e5,
+	weeks: 6048e5,
+	y: 315576e5,
+	yr: 315576e5,
+	yrs: 315576e5,
+	year: 315576e5,
+	years: 315576e5
+};
+/**
+* A lifetime setting in milliseconds, or null when it is not one.
+*
+* The grammar is vercel/ms, because that is what `jsonwebtoken` reads
+* `expiresIn` with: the token's `exp` and the expiry this module reports
+* have to come from one reading of the same string, and they used to come
+* from two — ours understood `<integer><d|h|m|s>` and nothing else.
+*
+* Stricter than ms in two ways, both about values nobody means: a bare number
+* (ms reads "3600" as 3.6 seconds) and a lifetime of zero or less.
+*/
+function parseDurationMs(value) {
+	const match = /^(\d+(?:\.\d+)?|\.\d+) *([a-z]+)$/i.exec(value);
+	if (!match) return null;
+	const unit = DURATION_UNIT_MS[match[2].toLowerCase()];
+	if (unit === void 0) return null;
+	const ms = parseFloat(match[1]) * unit;
+	return ms > 0 && Number.isFinite(ms) ? ms : null;
 }
 /**
 * Get the expiration timestamp for an access token
@@ -4670,7 +4723,7 @@ function hashRefreshToken(token) {
 * what is actually enforced, which is worse than knowing the ceiling.
 */
 var MAX_COOKIE_AGE_MS = 400 * 24 * 60 * 60 * 1e3;
-/** Fallback when `refreshExpiresIn` is unset or unparseable. */
+/** Fallback when `refreshExpiresIn` is unset. {@link configureJwt} refuses an unparseable one. */
 var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
 /**
 * How long a refresh token is valid for, in milliseconds.
@@ -4682,16 +4735,8 @@ var DEFAULT_REFRESH_TTL_MS = MAX_COOKIE_AGE_MS;
 * when they say they expect to still be signed in.
 */
 function getRefreshTokenTtlMs() {
-	const match = jwtConfig.refreshExpiresIn?.match(/^(\d+)([dhms])$/);
-	if (!match) return DEFAULT_REFRESH_TTL_MS;
-	const value = parseInt(match[1], 10);
-	switch (match[2]) {
-		case "d": return value * 24 * 60 * 60 * 1e3;
-		case "h": return value * 60 * 60 * 1e3;
-		case "m": return value * 60 * 1e3;
-		case "s": return value * 1e3;
-		default: return DEFAULT_REFRESH_TTL_MS;
-	}
+	const duration = jwtConfig.refreshExpiresIn;
+	return (duration ? parseDurationMs(duration) : null) ?? DEFAULT_REFRESH_TTL_MS;
 }
 /**
 * Calculate refresh token expiration date
@@ -4732,13 +4777,20 @@ async function generateMfaPendingToken(uid, expiresInSeconds = 300) {
 *
 * Returns `null` for anything else — including a perfectly valid *access*
 * token, which must not be interchangeable with this one in either direction.
+*
+* `iat` comes back with the uid because this token is a first factor that was
+* accepted at that instant, and a sign-out everywhere after it has to void it
+* the way it voids an access token — see `isAccessTokenRevoked`.
 */
 async function verifyMfaPendingToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	try {
 		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
 		if (decoded.purpose !== "mfa-pending" || !decoded.uid) return null;
-		return { uid: decoded.uid };
+		return {
+			uid: decoded.uid,
+			iat: typeof decoded.iat === "number" ? decoded.iat : void 0
+		};
 	} catch {
 		return null;
 	}
@@ -4916,4 +4968,4 @@ async function verifyMcpAccessToken(token, expectedAudience) {
 //#endregion
 export { require_jsonwebtoken as C, sha256Bytes as D, randomInt as E, sha256Hex as O, normalizePemFromEnv as S, randomHex as T, verifyAccessToken as _, generateMcpAccessToken as a, verifyMfaPendingToken as b, getAccessTokenExpiry as c, getRefreshTokenTtlMs as d, hasAsymmetricSigningKey as f, signPurposeToken as g, jwt_exports as h, generateDownloadToken as i, getJwks as l, isJwtConfigured as m, configureJwt as n, generateMfaPendingToken as o, hashRefreshToken as p, generateAccessToken as r, generateRefreshToken as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenExpiry as u, verifyDownloadToken as v, constantTimeEqual as w, verifyPurposeToken as x, verifyMcpAccessToken as y };
 
-//# sourceMappingURL=jwt-C4OW-DNq.js.map
+//# sourceMappingURL=jwt-DnQHNFCl.js.map