@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.24

package/dist/nextjs/server.d.ts

@@ -1,8 +1,9 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ReactNode } from 'react';
-import { S as SessionData } from '../session-Dfwu5g2W.js';
-export { i as isSafeReturnPath } from '../session-Dfwu5g2W.js';
-import { K as KeyAlgorithmType } from '../types-DYyhze28.js';
+import { authApi } from '@spfn/auth';
+import { S as SessionData } from '../session-BbhAGZtA.js';
+export { i as isSafeReturnPath } from '../session-BbhAGZtA.js';
+import { K as KeyAlgorithmType } from '../types-CTdoTOxM.js';
 import { NextResponse, NextRequest } from 'next/server';
 
 interface RequireAuthProps {
@@ -19,6 +20,17 @@ interface RequireAuthProps {
      * Fallback UI to show instead of redirecting
      */
     fallback?: ReactNode;
+    /**
+     * Path to send a bound session whose key has run out (#97)
+     *
+     * Not the sign-in page: the person is still signed in and one WebAuthn
+     * ceremony puts a live key back in the cookie. The page this names is the
+     * app's own, and all it has to do is render a client component that calls
+     * `renewSession(api)` and returns them to where they were.
+     *
+     * @default env SPFN_AUTH_SESSION_RENEW_PATH, or '/auth/renew'
+     */
+    renewalPath?: string;
 }
 /**
  * Require Authentication Guard
@@ -38,8 +50,17 @@ interface RequireAuthProps {
  *   <PrivateContent />
  * </RequireAuth>
  * ```
+ *
+ * @example A bound session whose key ran out
+ * ```tsx
+ * // Sent to /account/renew instead of the sign-in page. That page renders a
+ * // client component calling renewSession(api).
+ * <RequireAuth renewalPath="/account/renew">
+ *   <DashboardContent />
+ * </RequireAuth>
+ * ```
  */
-declare function RequireAuth({ children, redirectTo, fallback, }: RequireAuthProps): Promise<react_jsx_runtime.JSX.Element>;
+declare function RequireAuth({ children, redirectTo, renewalPath, fallback, }: RequireAuthProps): Promise<react_jsx_runtime.JSX.Element>;
 
 interface RequireRoleProps {
     /**
@@ -140,29 +161,26 @@ declare function RequirePermission({ permissions, children, redirectTo, fallback
  *
  * Uses authApi to check permissions in real-time
  */
+
+/**
+ * A bound session whose key has run out, seen from a server component.
+ *
+ * The third state `getAuthSessionData` answers with, and the reason it is a
+ * sentinel rather than `null`: a server component's `api.` call goes through the
+ * same proxy a browser's does, so it meets the same renewal-required refusal —
+ * and `null` there would read as "not signed in" and send the person to the
+ * sign-in page, which is precisely the thing renewal exists to avoid. A server
+ * component cannot run a WebAuthn ceremony, so the guard hands the work to a page
+ * that can.
+ */
+declare const RENEWAL_REQUIRED = "renewal-required";
+type AuthSessionData = Awaited<ReturnType<typeof authApi.getAuthSession.call>>;
+/** What a guard gets back: the session, the renewal sentinel, or nothing. */
+type AuthSessionState = AuthSessionData | typeof RENEWAL_REQUIRED | null;
 /**
  * Get current auth session with roles and permissions via API
  */
-declare function getAuthSessionData(): Promise<{
-    role: {
-        id: number;
-        name: string;
-        displayName: string;
-        priority: number;
-    };
-    permissions: {
-        id: number;
-        name: string;
-        displayName: string;
-        category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
-    }[];
-    userId: number;
-    publicId: string;
-    email: string | null;
-    emailVerified: boolean;
-    phoneVerified: boolean;
-    hasPassword: boolean;
-} | null>;
+declare function getAuthSessionData(): Promise<AuthSessionState>;
 /**
  * Get user role
  */

package/dist/nextjs/server.js

@@ -215,6 +215,10 @@ function getSessionTtl(override) {
   }
   return 7 * 24 * 60 * 60;
 }
+function getSessionRenewPath() {
+  return env3.SPFN_AUTH_SESSION_RENEW_PATH?.trim() || DEFAULT_SESSION_RENEW_PATH;
+}
+var DEFAULT_SESSION_RENEW_PATH = "/auth/renew";
 
 // src/nextjs/session-helpers.ts
 import { env as env4 } from "@spfn/auth/config";
@@ -309,36 +313,48 @@ async function clearPendingSession() {
 
 // src/nextjs/guards/auth-utils.ts
 import { authApi } from "@spfn/auth";
+import { SessionRenewalRequiredError } from "@spfn/auth/errors";
+var RENEWAL_REQUIRED = "renewal-required";
 async function getAuthSessionData() {
   try {
     const session = await authApi.getAuthSession.call();
     authLogger.middleware.debug("Auth session retrieved", { name: session.role?.name });
     return session;
   } catch (error) {
+    if (isRenewalRequired(error)) {
+      authLogger.middleware.debug("Auth session needs renewing");
+      return RENEWAL_REQUIRED;
+    }
     authLogger.middleware.error("Failed to get auth session", { error });
     return null;
   }
 }
+function isRenewalRequired(error) {
+  return error instanceof SessionRenewalRequiredError || error?.name === "SessionRenewalRequiredError";
+}
+function resolvedSession(state) {
+  return state && state !== RENEWAL_REQUIRED ? state : null;
+}
 async function getUserRole() {
-  const session = await getAuthSessionData();
+  const session = resolvedSession(await getAuthSessionData());
   return session?.role?.name || null;
 }
 async function getUserPermissions() {
-  const session = await getAuthSessionData();
+  const session = resolvedSession(await getAuthSessionData());
   if (!session) {
     return [];
   }
   return session.permissions?.map((p) => p.name) || [];
 }
 async function hasAnyRole(requiredRoles) {
-  const session = await getAuthSessionData();
+  const session = resolvedSession(await getAuthSessionData());
   if (!session) {
     return false;
   }
   return requiredRoles.includes(session.role?.name);
 }
 async function hasAnyPermission(requiredPermissions) {
-  const session = await getAuthSessionData();
+  const session = resolvedSession(await getAuthSessionData());
   if (!session) {
     return false;
   }
@@ -351,6 +367,7 @@ import { Fragment, jsx } from "react/jsx-runtime";
 async function RequireAuth({
   children,
   redirectTo = "/auth/login",
+  renewalPath,
   fallback
 }) {
   const session = await getSession();
@@ -361,6 +378,9 @@ async function RequireAuth({
     redirect(redirectTo);
   }
   const serverSession = await getAuthSessionData();
+  if (serverSession === RENEWAL_REQUIRED) {
+    redirect(renewalPath ?? getSessionRenewPath());
+  }
   if (!serverSession) {
     redirect(redirectTo);
   }
@@ -458,10 +478,56 @@ function isSafeReturnPath(returnPath) {
   return !/^\/[^/?#]*:/.test(returnPath);
 }
 
+// src/nextjs/interceptors/session-binding.ts
+import { SessionResealFailedError } from "@spfn/auth/errors";
+
+// src/server/lib/ua-family.ts
+var FAMILY_MARKERS = [
+  { family: "edge", marker: /\bEdg(?:A|iOS)?\// },
+  { family: "chrome", marker: /\b(?:Chrome|CriOS)\// },
+  { family: "firefox", marker: /\b(?:Firefox|FxiOS)\// },
+  { family: "safari", marker: /\bSafari\// }
+];
+function uaFamily(userAgent) {
+  if (!userAgent) {
+    return "other";
+  }
+  return FAMILY_MARKERS.find((entry) => entry.marker.test(userAgent))?.family ?? "other";
+}
+
+// src/nextjs/interceptors/cookie-options.ts
+function resolveSecure() {
+  const override = process.env.SPFN_AUTH_COOKIE_SECURE;
+  if (override !== void 0) {
+    return override === "true";
+  }
+  return process.env.NODE_ENV === "production";
+}
+var cookieSecure = resolveSecure();
+
+// src/nextjs/interceptors/session-binding.ts
+function bindingSessionFields(body, userAgent) {
+  if (body?.sessionBinding !== "passkey" || typeof body.keyExpiresAtMillis !== "number") {
+    return {};
+  }
+  return {
+    binding: "passkey",
+    keyExpiresAt: body.keyExpiresAtMillis,
+    ...userAgent ? { uaFamily: uaFamily(userAgent) } : {}
+  };
+}
+
 // src/nextjs/oauth-handlers.ts
 function safeReturnUrl(requested, defaultRedirect) {
   return requested && isSafeReturnPath(requested) ? requested : defaultRedirect;
 }
+function bindingFromQuery(searchParams) {
+  const expiresAt = Number(searchParams.get("keyExpiresAtMillis"));
+  if (searchParams.get("sessionBinding") !== "passkey" || !Number.isFinite(expiresAt)) {
+    return {};
+  }
+  return { sessionBinding: "passkey", keyExpiresAtMillis: expiresAt };
+}
 function createOAuthCallbackHandler(options) {
   const defaultRedirect = options?.defaultRedirectUrl || "/";
   const errorRedirect = options?.errorRedirectUrl || "/auth/error";
@@ -497,7 +563,8 @@ function createOAuthCallbackHandler(options) {
         userId,
         privateKey: pendingSession.privateKey,
         keyId: pendingSession.keyId,
-        algorithm: pendingSession.algorithm
+        algorithm: pendingSession.algorithm,
+        ...bindingSessionFields(bindingFromQuery(searchParams), request.headers.get("user-agent"))
       }, ttl);
       const redirectUrl = new URL(returnUrl, request.url);
       const response = NextResponse.redirect(redirectUrl);