@stacksjs/auth 0.70.178 → 0.70.179

package/dist/authentication.js

@@ -141,8 +141,10 @@ export class Auth {
     return await verifyHash(authPass, hashToVerify) && !!user;
   }
   static async login(credentials, options) {
-    const isValid = await this.attempt(credentials), authedUser = authStateOrNull()?.authUser;
-    if (!isValid || !authedUser)
+    if (!await this.attempt(credentials))
+      return null;
+    const username = config.auth.username || "email", authedUser = authStateOrNull()?.authUser ?? await User.where(username, "=", credentials[username]).first();
+    if (!authedUser)
       return null;
     const { plainTextToken, refreshToken, expiresIn } = await this.createTokenForUser(authedUser, options);
     return { user: authedUser, token: plainTextToken, refreshToken, expiresIn };

package/dist/cookie-auth.d.ts

@@ -0,0 +1,70 @@
+import { Auth } from './authentication';
+/**
+ * The `Set-Cookie` value that signs a browser in.
+ *
+ * Pair it with the token from `Auth.login()`:
+ *
+ * ```ts
+ * const result = await Auth.login({ email, password })
+ * return new Response(null, {
+ *   status: 303,
+ *   headers: { 'Location': '/account', 'Set-Cookie': authCookie(result.token) },
+ * })
+ * ```
+ */
+export declare function authCookie(token: string, options?: AuthCookieOptions): string;
+/**
+ * The `Set-Cookie` value that signs a browser out.
+ *
+ * Every attribute except the value has to match the cookie being replaced, or
+ * the browser keeps the original alongside the expired one.
+ */
+export declare function clearAuthCookie(options?: AuthCookieOptions): string;
+/** The raw token in a request's auth cookie, if it carries one. */
+export declare function authCookieToken(request: Request | { headers: Headers }, options?: AuthCookieOptions): string | undefined;
+/**
+ * The signed-in user for a server-rendered request, or undefined.
+ *
+ * Reads the cookie, then validates the token exactly as a bearer token would
+ * be — a revoked or expired token yields undefined, so signing out on one
+ * device takes effect on every page load elsewhere.
+ */
+export declare function userFromCookie(request: Request | { headers: Headers }, options?: AuthCookieOptions): Promise<AuthenticatedUser>;
+/** Whether a server-rendered request carries a valid session. */
+export declare function cookieCheck(request: Request | { headers: Headers }, options?: AuthCookieOptions): Promise<boolean>;
+/**
+ * Sign out the browser: revoke the token the cookie carries, then clear it.
+ *
+ * Revoking matters — without it a copied cookie stays valid for the token's
+ * whole lifetime, and "log out on a shared computer" would only mean "hide
+ * the key".
+ */
+export declare function logoutCookie(request: Request | { headers: Headers }, options?: AuthCookieOptions): Promise<string>;
+/**
+ * Cookie-carried access tokens, for server-rendered pages.
+ *
+ * The token system assumes an API client that can hold a bearer token and put
+ * it in a header. A server-rendered page has no such client: the browser posts
+ * a form, follows a redirect, and comes back with nothing but cookies. So
+ * those apps ended up either inventing their own cookie format or reaching for
+ * `SessionAuth`, whose in-memory map drops every session when the process
+ * restarts and cannot be shared across workers.
+ *
+ * This carries the same personal access token the API uses in an httpOnly
+ * cookie: one source of truth for who is signed in, revocable through the
+ * usual token calls, and durable because the token lives in the database.
+ *
+ * The cookie is httpOnly (a page script never needs it), SameSite=Lax (so a
+ * link from an email still arrives signed in, while a cross-site POST does
+ * not), and Secure everywhere except local HTTP development.
+ */
+export declare interface AuthCookieOptions {
+  name?: string
+  maxAge?: number
+  path?: string
+  domain?: string
+  secure?: boolean
+  sameSite?: 'Strict' | 'Lax' | 'None'
+}
+/** Whatever the token layer resolves a user to, so the two cannot drift. */
+declare type AuthenticatedUser = Awaited<ReturnType<typeof Auth.getUserFromToken>>;

package/dist/cookie-auth.js

@@ -0,0 +1,63 @@
+import { config } from "@stacksjs/config";
+import { Auth } from "./authentication";
+function cookieName(options) {
+  return options?.name ?? config.auth?.cookie?.name ?? "stacks_auth";
+}
+function defaultMaxAge() {
+  const days = Number(config.auth?.tokenExpiry ?? 30);
+  return Math.max(60, Math.round(days * 24 * 60 * 60));
+}
+function isLocal() {
+  const environment = String(config.app?.env ?? process.env.APP_ENV ?? "");
+  return environment === "local" || environment === "development" || environment === "dev";
+}
+export function authCookie(token, options = {}) {
+  const parts = [
+    `${cookieName(options)}=${encodeURIComponent(token)}`,
+    `Path=${options.path ?? "/"}`,
+    `Max-Age=${options.maxAge ?? defaultMaxAge()}`,
+    "HttpOnly",
+    `SameSite=${options.sameSite ?? "Lax"}`
+  ];
+  if (options.domain)
+    parts.push(`Domain=${options.domain}`);
+  if (options.secure ?? !isLocal())
+    parts.push("Secure");
+  return parts.join("; ");
+}
+export function clearAuthCookie(options = {}) {
+  return authCookie("", { ...options, maxAge: 0 });
+}
+export function authCookieToken(request, options = {}) {
+  const header = request.headers.get("cookie");
+  if (!header)
+    return;
+  const wanted = cookieName(options);
+  for (const pair of header.split(";")) {
+    const index = pair.indexOf("=");
+    if (index === -1)
+      continue;
+    if (pair.slice(0, index).trim() !== wanted)
+      continue;
+    const value = decodeURIComponent(pair.slice(index + 1).trim());
+    return value.length > 0 ? value : void 0;
+  }
+  return;
+}
+export async function userFromCookie(request, options = {}) {
+  const token = authCookieToken(request, options);
+  if (!token)
+    return;
+  return Auth.getUserFromToken(token);
+}
+export async function cookieCheck(request, options = {}) {
+  return Boolean(await userFromCookie(request, options));
+}
+export async function logoutCookie(request, options = {}) {
+  const token = authCookieToken(request, options);
+  if (token)
+    try {
+      await Auth.revokeToken(token);
+    } catch {}
+  return clearAuthCookie(options);
+}

package/dist/index.d.ts

@@ -24,6 +24,8 @@ export { DEFAULT_ROLE_PACKS, seedDefaultRoles } from './rbac-seed';
 export * from './email-verification';
 // Session-based Authentication (SPA Cookie Auth)
 export * from './session-auth';
+// Cookie-carried access tokens, for server-rendered pages.
+export * from './cookie-auth';
 // TOTP (Two-Factor Authentication) - re-export from ts-auth
 export {
   generateTOTP,

package/dist/index.js

@@ -17,6 +17,7 @@ export { createBqbRbacStore } from "./rbac-store-bqb";
 export { DEFAULT_ROLE_PACKS, seedDefaultRoles } from "./rbac-seed";
 export * from "./email-verification";
 export * from "./session-auth";
+export * from "./cookie-auth";
 export {
   generateTOTP,
   verifyTOTP,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.178",
+  "version": "0.70.179",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -56,7 +56,7 @@
   },
   "devDependencies": {
     "better-dx": "^0.2.17",
-    "@stacksjs/error-handling": "0.70.178",
-    "@stacksjs/router": "0.70.178"
+    "@stacksjs/error-handling": "0.70.179",
+    "@stacksjs/router": "0.70.179"
   }
 }