@revealui/auth 0.4.4 → 0.4.5

package/dist/react/csrf.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CSRF Double-Submit Token Helper
+ *
+ * Shared by the react auth hooks (`usePasskey`, `useMFA`, `useSignOut`) whose
+ * POSTs target the RevealUI admin proxy's CSRF-gated endpoints.
+ */
+/**
+ * Read the JS-readable `revealui-csrf` cookie. The RevealUI admin proxy
+ * (`apps/admin/src/proxy.ts`) requires it as an `X-CSRF-Token` header on any
+ * session-cookie-bearing unsafe request, and may re-issue the cookie on any
+ * response — so call this immediately before each fetch rather than once per
+ * flow. Returns undefined outside the browser or when the cookie is
+ * absent/empty. Mirrors the cookie-read in `@revealui/core`'s admin APIClient
+ * (`request()`) and `@revealui/ai`'s `useAgentStream`.
+ */
+export declare function readCsrfToken(): string | undefined;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/react/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/react/csrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAgBlD"}

package/dist/react/csrf.js

@@ -0,0 +1,36 @@
+/**
+ * CSRF Double-Submit Token Helper
+ *
+ * Shared by the react auth hooks (`usePasskey`, `useMFA`, `useSignOut`) whose
+ * POSTs target the RevealUI admin proxy's CSRF-gated endpoints.
+ */
+/**
+ * Read the JS-readable `revealui-csrf` cookie. The RevealUI admin proxy
+ * (`apps/admin/src/proxy.ts`) requires it as an `X-CSRF-Token` header on any
+ * session-cookie-bearing unsafe request, and may re-issue the cookie on any
+ * response — so call this immediately before each fetch rather than once per
+ * flow. Returns undefined outside the browser or when the cookie is
+ * absent/empty. Mirrors the cookie-read in `@revealui/core`'s admin APIClient
+ * (`request()`) and `@revealui/ai`'s `useAgentStream`.
+ */
+export function readCsrfToken() {
+    if (typeof document === 'undefined')
+        return undefined;
+    for (const part of document.cookie.split(';')) {
+        const eqIdx = part.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        if (part.slice(0, eqIdx).trim() === 'revealui-csrf') {
+            const raw = part.slice(eqIdx + 1).trim();
+            if (!raw)
+                return undefined;
+            try {
+                return decodeURIComponent(raw);
+            }
+            catch {
+                return raw;
+            }
+        }
+    }
+    return undefined;
+}

package/dist/react/useMFA.d.ts

@@ -2,6 +2,14 @@
  * MFA Hooks
  *
  * React hooks for Multi-Factor Authentication setup and verification.
+ *
+ * CSRF: every POST echoes the JS-readable `revealui-csrf` cookie (the signed
+ * double-submit token the RevealUI admin proxy issues on page load) as an
+ * `X-CSRF-Token` header when the cookie is present. The proxy requires it on
+ * session-cookie-bearing unsafe requests and `/api/auth/mfa/*` is not exempt —
+ * MFA enrollment always runs with a session, so without the header it 403s
+ * ("CSRF token missing"). Cookie-less callers send no header and are
+ * unchanged.
  */
 /**
  * MFA setup data returned when initiating TOTP setup.
@@ -73,7 +81,8 @@ export interface UseMFAVerifyResult {
  *   const handleSubmit = async (code: string) => {
  *     const success = await verify(code);
  *     if (success) {
- *       router.push('/admin');
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/admin';
  *     }
  *   };
  * }

package/dist/react/useMFA.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useMFA.d.ts","sourceRoot":"","sources":["../../src/react/useMFA.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1C,0CAA0C;IAC1C,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,IAAI,iBAAiB,CAqE/C;AAED,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,IAAI,kBAAkB,CAsEjD"}
+{"version":3,"file":"useMFA.d.ts","sourceRoot":"","sources":["../../src/react/useMFA.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1C,0CAA0C;IAC1C,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,IAAI,iBAAiB,CA6E/C;AAED,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,IAAI,kBAAkB,CA8EjD"}

package/dist/react/useMFA.js

@@ -2,9 +2,18 @@
  * MFA Hooks
  *
  * React hooks for Multi-Factor Authentication setup and verification.
+ *
+ * CSRF: every POST echoes the JS-readable `revealui-csrf` cookie (the signed
+ * double-submit token the RevealUI admin proxy issues on page load) as an
+ * `X-CSRF-Token` header when the cookie is present. The proxy requires it on
+ * session-cookie-bearing unsafe requests and `/api/auth/mfa/*` is not exempt —
+ * MFA enrollment always runs with a session, so without the header it 403s
+ * ("CSRF token missing"). Cookie-less callers send no header and are
+ * unchanged.
  */
 'use client';
 import { useState } from 'react';
+import { readCsrfToken } from './csrf.js';
 /**
  * Hook for MFA setup on the security settings page.
  *
@@ -38,9 +47,13 @@ export function useMFASetup() {
         try {
             setIsLoading(true);
             setError(null);
+            const csrfToken = readCsrfToken();
             const response = await fetch('/api/auth/mfa/setup', {
                 method: 'POST',
                 credentials: 'include',
+                // Conditional headers key keeps cookie-less setup requests
+                // byte-identical to the pre-CSRF request shape.
+                ...(csrfToken ? { headers: { 'X-CSRF-Token': csrfToken } } : {}),
             });
             const json = await response.json();
             if (!response.ok) {
@@ -64,9 +77,13 @@ export function useMFASetup() {
         try {
             setIsLoading(true);
             setError(null);
+            const csrfToken = readCsrfToken();
             const response = await fetch('/api/auth/mfa/verify-setup', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}),
+                },
                 credentials: 'include',
                 body: JSON.stringify({ code }),
             });
@@ -110,7 +127,8 @@ export function useMFASetup() {
  *   const handleSubmit = async (code: string) => {
  *     const success = await verify(code);
  *     if (success) {
- *       router.push('/admin');
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/admin';
  *     }
  *   };
  * }
@@ -123,9 +141,13 @@ export function useMFAVerify() {
         try {
             setIsLoading(true);
             setError(null);
+            const csrfToken = readCsrfToken();
             const response = await fetch('/api/auth/mfa/verify', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}),
+                },
                 credentials: 'include',
                 body: JSON.stringify({ code }),
             });
@@ -150,9 +172,13 @@ export function useMFAVerify() {
         try {
             setIsLoading(true);
             setError(null);
+            const csrfToken = readCsrfToken();
             const response = await fetch('/api/auth/mfa/backup', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(csrfToken ? { 'X-CSRF-Token': csrfToken } : {}),
+                },
                 credentials: 'include',
                 body: JSON.stringify({ code }),
             });

package/dist/react/usePasskey.d.ts

@@ -3,6 +3,13 @@
  *
  * React hooks for WebAuthn passkey registration and authentication.
  * Uses dynamic imports for @simplewebauthn/browser to avoid SSR issues.
+ *
+ * CSRF: every POST echoes the JS-readable `revealui-csrf` cookie (the signed
+ * double-submit token the RevealUI admin proxy issues on page load) as an
+ * `X-CSRF-Token` header when the cookie is present. The proxy requires it on
+ * session-cookie-bearing unsafe requests — registration always runs with a
+ * session, so without the header it 403s ("CSRF token missing"). Cookie-less
+ * callers (no admin session) send no header and are unchanged.
  */
 export interface PasskeyRegisterOptions {
     /** Email for passkey registration (sign-up flow) */
@@ -67,7 +74,8 @@ export interface UsePasskeySignInResult {
  *   const handlePasskeyLogin = async () => {
  *     const success = await signIn();
  *     if (success) {
- *       router.push('/admin');
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/admin';
  *     }
  *   };
  *

package/dist/react/usePasskey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usePasskey.d.ts","sourceRoot":"","sources":["../../src/react/usePasskey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,wCAAwC;IACxC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4CAA4C;IAC5C,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CA0F7D;AAED,MAAM,WAAW,sBAAsB;IACrC,kCAAkC;IAClC,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4CAA4C;IAC5C,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,IAAI,sBAAsB,CA8EzD"}
+{"version":3,"file":"usePasskey.d.ts","sourceRoot":"","sources":["../../src/react/usePasskey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,wCAAwC;IACxC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACtF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4CAA4C;IAC5C,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CAkG7D;AAED,MAAM,WAAW,sBAAsB;IACrC,kCAAkC;IAClC,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4CAA4C;IAC5C,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gBAAgB,IAAI,sBAAsB,CAsFzD"}

package/dist/react/usePasskey.js

@@ -3,9 +3,17 @@
  *
  * React hooks for WebAuthn passkey registration and authentication.
  * Uses dynamic imports for @simplewebauthn/browser to avoid SSR issues.
+ *
+ * CSRF: every POST echoes the JS-readable `revealui-csrf` cookie (the signed
+ * double-submit token the RevealUI admin proxy issues on page load) as an
+ * `X-CSRF-Token` header when the cookie is present. The proxy requires it on
+ * session-cookie-bearing unsafe requests — registration always runs with a
+ * session, so without the header it 403s ("CSRF token missing"). Cookie-less
+ * callers (no admin session) send no header and are unchanged.
  */
 'use client';
 import { useEffect, useState } from 'react';
+import { readCsrfToken } from './csrf.js';
 /**
  * Hook for passkey registration (sign-up and security settings).
  *
@@ -43,9 +51,13 @@ export function usePasskeyRegister() {
             setIsLoading(true);
             setError(null);
             // Step 1: Get registration options from the server
+            const optionsCsrfToken = readCsrfToken();
             const optionsResponse = await fetch('/api/auth/passkey/register-options', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(optionsCsrfToken ? { 'X-CSRF-Token': optionsCsrfToken } : {}),
+                },
                 credentials: 'include',
                 body: JSON.stringify({
                     email: options?.email,
@@ -65,9 +77,13 @@ export function usePasskeyRegister() {
             const optionsData = optionsJson;
             const attestationResponse = await startRegistration({ optionsJSON: optionsData.options });
             // Step 3: Verify with the server
+            const verifyCsrfToken = readCsrfToken();
             const verifyResponse = await fetch('/api/auth/passkey/register-verify', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(verifyCsrfToken ? { 'X-CSRF-Token': verifyCsrfToken } : {}),
+                },
                 credentials: 'include',
                 body: JSON.stringify({
                     attestationResponse,
@@ -117,7 +133,8 @@ export function usePasskeyRegister() {
  *   const handlePasskeyLogin = async () => {
  *     const success = await signIn();
  *     if (success) {
- *       router.push('/admin');
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/admin';
  *     }
  *   };
  *
@@ -150,9 +167,13 @@ export function usePasskeySignIn() {
             setIsLoading(true);
             setError(null);
             // Step 1: Get authentication options from the server
+            const optionsCsrfToken = readCsrfToken();
             const optionsResponse = await fetch('/api/auth/passkey/authenticate-options', {
                 method: 'POST',
                 credentials: 'include',
+                // Conditional headers key keeps cookie-less sign-in requests
+                // byte-identical to the pre-CSRF request shape.
+                ...(optionsCsrfToken ? { headers: { 'X-CSRF-Token': optionsCsrfToken } } : {}),
             });
             const optionsJson = await optionsResponse.json();
             if (!optionsResponse.ok) {
@@ -166,9 +187,13 @@ export function usePasskeySignIn() {
             const authOptionsData = optionsJson;
             const assertionResponse = await startAuthentication({ optionsJSON: authOptionsData.options });
             // Step 3: Verify with the server
+            const verifyCsrfToken = readCsrfToken();
             const verifyResponse = await fetch('/api/auth/passkey/authenticate-verify', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(verifyCsrfToken ? { 'X-CSRF-Token': verifyCsrfToken } : {}),
+                },
                 credentials: 'include',
                 body: JSON.stringify({ authenticationResponse: assertionResponse }),
             });

package/dist/react/useSignIn.d.ts

@@ -37,7 +37,8 @@ export interface UseSignInResult {
  *     e.preventDefault()
  *     const result = await signIn({ email, password })
  *     if (result.success) {
- *       router.push('/dashboard')
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/dashboard'
  *     }
  *   }
  * }

package/dist/react/useSignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAkCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CACN,KAAK,EAAE,WAAW,KACf,OAAO,CACR;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACjC;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAC3D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CAsE3C"}
+{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAkCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CACN,KAAK,EAAE,WAAW,KACf,OAAO,CACR;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACjC;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAC3D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CAsE3C"}

package/dist/react/useSignIn.js

@@ -48,7 +48,8 @@ const SignInSuccessResponseSchema = z.object({
  *     e.preventDefault()
  *     const result = await signIn({ email, password })
  *     if (result.success) {
- *       router.push('/dashboard')
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/dashboard'
  *     }
  *   }
  * }

package/dist/react/useSignOut.d.ts

@@ -2,6 +2,14 @@
  * useSignOut Hook
  *
  * React hook for signing out a user.
+ *
+ * CSRF: the sign-out POST echoes the JS-readable `revealui-csrf` cookie (the
+ * signed double-submit token the RevealUI admin proxy issues on page load) as
+ * an `X-CSRF-Token` header when the cookie is present. The proxy requires it
+ * on session-cookie-bearing unsafe requests and `/api/auth/sign-out` is not
+ * exempt — sign-out always carries a session, so without the header it 403s
+ * ("CSRF token missing") and the server-side session survives. Cookie-less
+ * callers send no header and are unchanged.
  */
 export interface UseSignOutResult {
     signOut: () => Promise<void>;

package/dist/react/useSignOut.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSignOut.d.ts","sourceRoot":"","sources":["../../src/react/useSignOut.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAkC7C"}
+{"version":3,"file":"useSignOut.d.ts","sourceRoot":"","sources":["../../src/react/useSignOut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAsC7C"}

package/dist/react/useSignOut.js

@@ -2,9 +2,18 @@
  * useSignOut Hook
  *
  * React hook for signing out a user.
+ *
+ * CSRF: the sign-out POST echoes the JS-readable `revealui-csrf` cookie (the
+ * signed double-submit token the RevealUI admin proxy issues on page load) as
+ * an `X-CSRF-Token` header when the cookie is present. The proxy requires it
+ * on session-cookie-bearing unsafe requests and `/api/auth/sign-out` is not
+ * exempt — sign-out always carries a session, so without the header it 403s
+ * ("CSRF token missing") and the server-side session survives. Cookie-less
+ * callers send no header and are unchanged.
  */
 'use client';
 import { useState } from 'react';
+import { readCsrfToken } from './csrf.js';
 /**
  * Hook to sign out a user
  *
@@ -30,9 +39,13 @@ export function useSignOut() {
         try {
             setIsLoading(true);
             setError(null);
+            const csrfToken = readCsrfToken();
             const response = await fetch('/api/auth/sign-out', {
                 method: 'POST',
                 credentials: 'include',
+                // Conditional headers key keeps cookie-less sign-out requests
+                // byte-identical to the pre-CSRF request shape.
+                ...(csrfToken ? { headers: { 'X-CSRF-Token': csrfToken } } : {}),
             });
             if (!response.ok) {
                 throw new Error('Failed to sign out');

package/dist/react/useSignUp.d.ts

@@ -33,7 +33,8 @@ export interface UseSignUpResult {
  *     e.preventDefault()
  *     const result = await signUp({ email, password, name })
  *     if (result.success) {
- *       router.push('/dashboard')
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/dashboard'
  *     }
  *   }
  * }

package/dist/react/useSignUp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSignUp.d.ts","sourceRoot":"","sources":["../../src/react/useSignUp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAmCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CAoD3C"}
+{"version":3,"file":"useSignUp.d.ts","sourceRoot":"","sources":["../../src/react/useSignUp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAmCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CAoD3C"}

package/dist/react/useSignUp.js

@@ -49,7 +49,8 @@ const SignUpSuccessResponseSchema = z.object({
  *     e.preventDefault()
  *     const result = await signUp({ email, password, name })
  *     if (result.success) {
- *       router.push('/dashboard')
+ *       // Full navigation: a soft router.push() would replay the pre-auth Router Cache
+ *       window.location.href = '/dashboard'
  *     }
  *   }
  * }

package/dist/server/session.d.ts

@@ -93,8 +93,14 @@ export declare function rotateSession(userId: string, options?: {
 /**
  * Delete a session (sign out)
  *
+ * Revokes EVERY session token presented in the cookie header, not just the
+ * first: a browser can hold duplicate `revealui-session` cookies (e.g. a
+ * stale host-only cookie alongside the domain-scoped one), and RFC 6265
+ * ordering lets the stale duplicate shadow the live token. Sign-out must
+ * revoke them all.
+ *
  * @param headers - Request headers containing session cookie
- * @returns True if session was deleted, false if not found
+ * @returns True if at least one session row was deleted, false otherwise
  */
 export declare function deleteSession(headers: Headers): Promise<boolean>;
 /**

package/dist/server/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAUD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAkH7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC9C;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;CACzB;AAUD,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAEtF;AAED,qCAAqC;AACrC,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CA0B3F;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAI1E;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAkH7B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmE9C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoC9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BtE;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE"}

package/dist/server/session.js

@@ -7,7 +7,7 @@
 import { logger } from '@revealui/core/observability/logger';
 import { getClient } from '@revealui/db/client';
 import { sessions, users } from '@revealui/db/schema';
-import { and, eq, gt, isNull, ne } from 'drizzle-orm';
+import { and, eq, gt, inArray, isNull, ne } from 'drizzle-orm';
 import { hashToken } from '../utils/token.js';
 import { DatabaseError, TokenError } from './errors.js';
 const DEFAULT_SESSION_BINDING = {
@@ -310,21 +310,38 @@ export async function rotateSession(userId, options) {
 /**
  * Delete a session (sign out)
  *
+ * Revokes EVERY session token presented in the cookie header, not just the
+ * first: a browser can hold duplicate `revealui-session` cookies (e.g. a
+ * stale host-only cookie alongside the domain-scoped one), and RFC 6265
+ * ordering lets the stale duplicate shadow the live token. Sign-out must
+ * revoke them all.
+ *
  * @param headers - Request headers containing session cookie
- * @returns True if session was deleted, false if not found
+ * @returns True if at least one session row was deleted, false otherwise
  */
 export async function deleteSession(headers) {
     const cookieHeader = headers.get('cookie');
     if (!cookieHeader) {
         return false;
     }
-    const sessionToken = extractSessionToken(cookieHeader);
-    if (!sessionToken) {
+    const sessionTokens = extractAllSessionTokens(cookieHeader);
+    if (sessionTokens.length === 0) {
+        return false;
+    }
+    const tokenHashes = [];
+    for (const sessionToken of sessionTokens) {
+        try {
+            tokenHashes.push(hashToken(sessionToken));
+        }
+        catch {
+            logger.error('Error hashing session token during sign-out');
+        }
+    }
+    if (tokenHashes.length === 0) {
         return false;
     }
-    const tokenHash = hashToken(sessionToken);
     const db = getClient();
-    const result = await db.delete(sessions).where(eq(sessions.tokenHash, tokenHash));
+    const result = await db.delete(sessions).where(inArray(sessions.tokenHash, tokenHashes));
     // Check if any rows were deleted - Drizzle delete returns result with rowCount or similar
     const rowCount = 'rowCount' in result && typeof result.rowCount === 'number' ? result.rowCount : 0;
     return rowCount > 0;
@@ -405,6 +422,31 @@ function extractSessionToken(cookieHeader) {
     }
     return decodeURIComponent(sessionCookie.substring('revealui-session='.length));
 }
+/**
+ * Extract every distinct session token from a cookie header.
+ *
+ * Duplicate `revealui-session` cookies are real: a host-only and a
+ * domain-scoped cookie with the same name travel together in one header.
+ * Deletion must see all of them; validation (getSession) deliberately keeps
+ * first-match semantics via extractSessionToken.
+ */
+function extractAllSessionTokens(cookieHeader) {
+    const prefix = 'revealui-session=';
+    const tokens = new Set();
+    for (const part of cookieHeader.split(';')) {
+        const cookie = part.trim();
+        if (!cookie.startsWith(prefix)) {
+            continue;
+        }
+        try {
+            tokens.add(decodeURIComponent(cookie.substring(prefix.length)));
+        }
+        catch {
+            // Malformed percent-encoding in one duplicate must not abort sign-out.
+        }
+    }
+    return [...tokens];
+}
 /**
  * Generate a secure random session token
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revealui/auth",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Database-backed session auth for Hono and Next.js — bcrypt, OAuth, brute-force protection, rate limiting, password reset. Ships with RevealUI.",
   "keywords": [
     "auth",
@@ -16,7 +16,7 @@
     "zod": "^4.4.3",
     "@revealui/config": "0.4.2",
     "@revealui/contracts": "0.6.1",
-    "@revealui/core": "0.10.0",
+    "@revealui/core": "0.10.1",
     "@revealui/db": "0.7.1",
     "@revealui/security": "0.4.1"
   },