@revojs/auth 0.2.65 → 0.3.0

package/dist/index.d.ts

@@ -185,6 +185,19 @@ export declare function useClientAuth(scope: Scope): {
     signOut(): Promise<unknown>;
 };
 export declare function requireAccount(scope: Scope, redirectUrl?: string): Promise<RequiredAccount>;
+export declare function useSessionCookie(scope: Scope): {
+    name: string;
+    options: {
+        domain?: string;
+        expires?: Date;
+        httpOnly?: boolean;
+        maxAge?: number;
+        path?: string;
+        priority?: import("@revojs/server").CookiePriority;
+        sameSite?: import("@revojs/server").CookieSameSite;
+        secure: boolean;
+    };
+};
 export declare function readSessionCookie(scope: Scope): Promise<Session | undefined>;
 export declare function getSession(scope: Scope): Promise<Session | undefined>;
 export declare function setSession(scope: Scope, session: Session): Promise<void>;
@@ -235,10 +248,13 @@ export declare function useRoles(): Promise<Map<string, Role>>;
 export declare function checkPassword(scope: Scope, account: Account, password: string): Promise<boolean>;
 export declare function hashToken(value: string): Promise<string>;
 export declare function requireOrganization(scope: Scope, organizationId: string, redirectUrl?: string): Promise<Authorization>;
+export declare function requireToken(scope: Scope): Promise<Authorization>;
+export declare function useAuthorization(scope: Scope): Authorization;
 export declare function getPrincipal(scope: Scope, method: Method): Promise<Principal | false | undefined>;
 export declare function createPrincipal(scope: Scope, method: Method): Promise<Principal | undefined>;
 export declare function createSession(scope: Scope, principal: Principal): Promise<Session | undefined>;
 export declare const ACCOUNT_STATE = "auth:account";
+export declare const AUTHORIZATION_CONTEXT: import("revojs").Descriptor<Authorization>;
 export declare const authIdSchema: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 128, undefined>]>;
 export declare const organizationNameSchema: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MaxLengthAction<string, 200, undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, undefined>]>;
 export declare const organizationParametersSchema: import("valibot").ObjectSchema<{

package/dist/index.js

@@ -2,9 +2,9 @@ import config from "#config/auth";
 import permissionSources from "#permissions";
 import roleSources from "#roles";
 import { isClient, isServer } from "#variables";
-import { deleteCookie, fetch, getState, sendForbidden, sendRedirect, sendUnauthorized, setCookie, setState, useCookies, useHeaders, useQuery, useUrl, withQuery } from "@revojs/server";
+import { FetchError, deleteCookie, fetch, getState, sendForbidden, sendRedirect, sendUnauthorized, setCookie, setState, useCookies, useHeaders, useQuery, useUrl, withQuery } from "@revojs/server";
 import { useStorageProvider } from "@revojs/storage";
-import { BASE64_DECODE, BASE64_ENCODE, decoder, defineHook, digest, dispatchHook, encoder, equalsConstantTime, hashPassword, isPasswordHash, needsPasswordRehash, sign, verify, verifyPassword } from "revojs";
+import { BASE64_DECODE, BASE64_ENCODE, decoder, defineContext, defineHook, digest, dispatchHook, encoder, equalsConstantTime, hashPassword, isPasswordHash, needsPasswordRehash, requireContext, setContext, sign, verify, verifyPassword } from "revojs";
 import { mergeObjects } from "revojs/shared";
 import { boolean, literal, maxLength, minLength, nullable, nullish, number, object, optional, parse, pipe, string, transform, trim, union } from "valibot";
 //#region src/index.ts
@@ -38,7 +38,7 @@ async function requireAccount(scope, redirectUrl) {
 				headers: useHeaders(scope)
 			});
 		} catch (error) {
-			if (redirectUrl && error instanceof Response && error.status === 401) {
+			if (redirectUrl && error instanceof FetchError && error.status === 401) {
 				const { pathname } = useUrl(scope);
 				if (redirectUrl !== pathname) globalThis.location.href = redirectUrl;
 			}
@@ -51,9 +51,14 @@ async function requireAccount(scope, redirectUrl) {
 			const cookie = await readSessionCookie(scope);
 			if (cookie?.id === resolved.session.id && cookie.accountId === resolved.account.id) return resolved;
 		}
-		const session = await getSession(scope);
+		const cookie = await readSessionCookie(scope);
+		let session;
 		let account;
-		if (session) account = await (await useAccountStorage(scope)).getAccountById(session.accountId);
+		if (cookie) {
+			const storage = await useAccountStorage(scope);
+			[session, account] = await Promise.all([getSession(scope), storage.getAccountById(cookie.accountId)]);
+		}
+		if (session?.accountId !== account?.id) account = void 0;
 		if (session && account) {
 			const result = {
 				session,
@@ -71,8 +76,29 @@ async function requireAccount(scope, redirectUrl) {
 	}
 	throw new Error("Session is unavailable");
 }
+function useSessionCookie(scope) {
+	const { name, cookie } = config.session;
+	const { hostname } = useUrl(scope);
+	const secure = cookie.secure ?? ![
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(hostname);
+	const options = {
+		...cookie,
+		secure
+	};
+	if (secure && cookie.path === "/" && cookie.domain === void 0 && !name.startsWith("__")) return {
+		name: `__Host-${name}`,
+		options
+	};
+	return {
+		name,
+		options
+	};
+}
 async function readSessionCookie(scope) {
-	const session = useCookies(scope)[config.session.name];
+	const session = useCookies(scope)[useSessionCookie(scope).name];
 	if (!session) return;
 	const index = session.lastIndexOf(".");
 	if (index <= 0) return;
@@ -98,10 +124,12 @@ async function getSession(scope) {
 async function setSession(scope, session) {
 	const payload = encoder.encode(JSON.stringify(session)).toBase64(BASE64_ENCODE);
 	const cookie = payload + "." + await sign(scope, SESSION_PURPOSE, payload);
-	setCookie(scope, config.session.name, cookie, config.session.cookie);
+	const { name, options } = useSessionCookie(scope);
+	setCookie(scope, name, cookie, options);
 }
 function clearSession(scope) {
-	deleteCookie(scope, config.session.name, config.session.cookie);
+	const { name, options } = useSessionCookie(scope);
+	deleteCookie(scope, name, options);
 }
 function defineAuthProvider(provider) {
 	return { async fetch(scope) {
@@ -265,50 +293,68 @@ async function requireOrganization(scope, organizationId, redirectUrl) {
 			permissions: new Set(permissions)
 		};
 	} catch (error) {
-		if (redirectUrl && error instanceof Response && error.status === 401) {
+		if (redirectUrl && error instanceof FetchError && error.status === 401) {
 			const { pathname } = useUrl(scope);
 			if (redirectUrl !== pathname) globalThis.location.href = redirectUrl;
 		}
 		throw error;
 	}
+	return await authorize(scope, organizationId, redirectUrl);
+}
+async function requireToken(scope) {
+	if (useHeaders(scope).authorization === void 0) throw sendUnauthorized(scope, void 0, { headers: new Headers({ "WWW-Authenticate": "Bearer" }) });
+	return await authorize(scope);
+}
+function useAuthorization(scope) {
+	return requireContext(scope, AUTHORIZATION_CONTEXT);
+}
+async function authorize(scope, organizationId, redirectUrl) {
 	const storage = await useAuthStorage(scope);
 	const header = useHeaders(scope).authorization;
 	let account;
 	let sessionId;
 	let token;
+	let organization;
+	let membership;
 	if (header === void 0) {
+		if (organizationId === void 0) throw sendUnauthorized(scope);
 		const authenticated = await requireAccount(scope, redirectUrl);
 		account = authenticated.account;
 		sessionId = authenticated.session.id;
+		[organization, membership] = await Promise.all([storage.getOrganization(organizationId), storage.getMembership(organizationId, account.id)]);
 	} else {
 		const value = /^Bearer ([\w-]{1,256})$/.exec(header)?.[1];
 		token = value ? await storage.getTokenByHash(await hashToken(value)) : void 0;
 		if (!token || token.expiresAt && token.expiresAt.getTime() <= Date.now()) throw sendUnauthorized(scope);
-		if (token.organizationId !== organizationId) throw sendForbidden(scope);
-		const stored = await storage.getAccountById(token.accountId);
+		if (organizationId !== void 0 && token.organizationId !== organizationId) throw sendForbidden(scope);
+		const [stored, found, joined] = await Promise.all([
+			storage.getAccountById(token.accountId),
+			storage.getOrganization(token.organizationId),
+			storage.getMembership(token.organizationId, token.accountId)
+		]);
 		if (!stored) throw sendUnauthorized(scope);
 		account = {
 			id: stored.id,
 			email: stored.email,
 			createdAt: stored.createdAt
 		};
+		organization = found;
+		membership = joined;
 		if (!token.lastUsedAt || Date.now() - token.lastUsedAt.getTime() > TOKEN_TOUCH_INTERVAL) await storage.touchToken(token.id, /* @__PURE__ */ new Date());
 	}
-	const organization = await storage.getOrganization(organizationId);
-	const membership = await storage.getMembership(organizationId, account.id);
 	if (!organization || membership?.status !== "active") throw sendForbidden(scope);
 	let granted = new Array();
 	if (organization.accountId === account.id) granted = [...(await usePermissions()).keys()];
 	else if (membership.role) granted = (await useRoles()).get(membership.role)?.permissions ?? [];
 	const permissions = new Set(granted.filter((permission) => !token || token.permissions.includes(permission)));
-	return {
+	return setContext(scope, AUTHORIZATION_CONTEXT, {
 		account,
 		organization,
 		membership,
 		sessionId,
 		tokenId: token?.id,
 		permissions
-	};
+	});
 }
 async function getPrincipal(scope, method) {
 	if (method.type === "PASSWORD") {
@@ -486,6 +532,7 @@ async function createSession(scope, principal) {
 	return created;
 }
 var ACCOUNT_STATE = "auth:account";
+var AUTHORIZATION_CONTEXT = defineContext("AUTHORIZATION_CONTEXT");
 var authIdSchema = pipe(string(), minLength(1), maxLength(128));
 var organizationNameSchema = pipe(string(), maxLength(200), trim(), minLength(1));
 var organizationParametersSchema = object({ organizationId: authIdSchema });
@@ -572,4 +619,4 @@ var userInfoSchema = pipe(object({
 var SESSION_PURPOSE = "revojs:auth:session";
 var TOKEN_TOUCH_INTERVAL = 6e4;
 //#endregion
-export { ACCOUNT_STATE, AFTER_ACCOUNT_CREATE_HOOK, AFTER_ACCOUNT_GET_HOOK, AFTER_IDENTITY_CREATE_HOOK, AFTER_IDENTITY_GET_HOOK, AFTER_PRINCIPAL_CREATE_HOOK, AFTER_PRINCIPAL_GET_HOOK, AFTER_SESSION_CREATE_HOOK, AFTER_SESSION_GET_HOOK, BEFORE_ACCOUNT_CREATE_HOOK, BEFORE_ACCOUNT_GET_HOOK, BEFORE_IDENTITY_CREATE_HOOK, BEFORE_IDENTITY_GET_HOOK, BEFORE_PRINCIPAL_CREATE_HOOK, BEFORE_PRINCIPAL_GET_HOOK, BEFORE_SESSION_CREATE_HOOK, BEFORE_SESSION_GET_HOOK, authIdSchema, checkPassword, clearSession, createPrincipal, createSession, defineAuthProvider, definePermission, defineRole, getPrincipal, getSession, hashToken, membershipParametersSchema, methodSchema, organizationNameSchema, organizationParametersSchema, passkeyMethodSchema, passwordMethodSchema, principalSchema, providerMethodSchema, readSessionCookie, requireAccount, requireOrganization, roleSchema, setSession, useAccountStorage, useAuthStorage, useClientAuth, useOrganizationStorage, usePermissions, useRoles };
+export { ACCOUNT_STATE, AFTER_ACCOUNT_CREATE_HOOK, AFTER_ACCOUNT_GET_HOOK, AFTER_IDENTITY_CREATE_HOOK, AFTER_IDENTITY_GET_HOOK, AFTER_PRINCIPAL_CREATE_HOOK, AFTER_PRINCIPAL_GET_HOOK, AFTER_SESSION_CREATE_HOOK, AFTER_SESSION_GET_HOOK, AUTHORIZATION_CONTEXT, BEFORE_ACCOUNT_CREATE_HOOK, BEFORE_ACCOUNT_GET_HOOK, BEFORE_IDENTITY_CREATE_HOOK, BEFORE_IDENTITY_GET_HOOK, BEFORE_PRINCIPAL_CREATE_HOOK, BEFORE_PRINCIPAL_GET_HOOK, BEFORE_SESSION_CREATE_HOOK, BEFORE_SESSION_GET_HOOK, authIdSchema, checkPassword, clearSession, createPrincipal, createSession, defineAuthProvider, definePermission, defineRole, getPrincipal, getSession, hashToken, membershipParametersSchema, methodSchema, organizationNameSchema, organizationParametersSchema, passkeyMethodSchema, passwordMethodSchema, principalSchema, providerMethodSchema, readSessionCookie, requireAccount, requireOrganization, requireToken, roleSchema, setSession, useAccountStorage, useAuthStorage, useAuthorization, useClientAuth, useOrganizationStorage, usePermissions, useRoles, useSessionCookie };

package/dist/module/index.js

@@ -9,7 +9,6 @@ var module_default = defineModule({
 			name: "session",
 			cookie: {
 				path: "/",
-				secure: true,
 				httpOnly: true,
 				sameSite: "Lax",
 				maxAge: 604800

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@revojs/auth",
-    "version": "0.2.65",
+    "version": "0.3.0",
     "license": "MIT",
     "repository": {
         "type": "git",
@@ -41,12 +41,12 @@
         "watch": "vite build --watch"
     },
     "dependencies": {
-        "@revojs/server": "*",
-        "@revojs/storage": "*",
-        "revojs": "*",
+        "@revojs/server": "0.3.0",
+        "@revojs/storage": "0.3.0",
+        "revojs": "0.3.0",
         "valibot": "^1.5.0"
     },
     "devDependencies": {
-        "@revojs/tsconfig": "*"
+        "@revojs/tsconfig": "0.3.0"
     }
 }