@stacksjs/defaults 0.74.58 → 0.74.60

package/app/Actions/Auth/LoginAction.ts

@@ -35,10 +35,13 @@ export default new Action({
     // cannot be followed by this old in-flight login minting fresh access.
     const decision = await Auth.withVerifiedCredentials({ email, password }, async (authedUser) => {
       const { enabled: twoFactorEnabled } = await getTwoFactorState(authedUser.id as number)
+      const policy = resolveBrowserSessionPolicy(remember)
       if (twoFactorEnabled) {
-        return { kind: 'challenge' as const, token: await createTwoFactorChallenge(authedUser.id as number) }
+        return {
+          kind: 'challenge' as const,
+          token: await createTwoFactorChallenge(authedUser.id as number, { remembered: policy.remembered }),
+        }
       }
-      const policy = resolveBrowserSessionPolicy(remember)
       return {
         kind: 'login' as const,
         result: await Auth.loginUsingId(authedUser.id as number, {

package/app/Actions/Auth/LogoutAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, clearAuthCookie, requestToken } from '@stacksjs/auth'
+import { Auth, browserSessionLogoutRedirect, clearAuthCookie, requestToken } from '@stacksjs/auth'
 import { getCurrentRequest, response } from '@stacksjs/router'
 
 export default new Action({
@@ -9,16 +9,17 @@ export default new Action({
   async handle() {
     const request = getCurrentRequest()
     const usesDatabaseSession = !requestToken(request) && !!request?.cookie?.('session_id')
+    const redirect = browserSessionLogoutRedirect(request)
     await Auth.logout()
 
     // Clearing is separate from revoking, and both are needed. Revoking alone
     // leaves the browser sending a dead cookie on every request; clearing alone
     // leaves a copied cookie valid for the token's whole lifetime, which would
     // make "log out on a shared computer" mean only "hide the key".
-    const result = response.json(
-      { message: 'Successfully logged out' },
-      { headers: { 'Set-Cookie': clearAuthCookie() } },
-    )
+    const result = redirect
+      ? response.redirect(redirect, 303)
+      : response.json({ message: 'Successfully logged out' })
+    result.headers.append('Set-Cookie', clearAuthCookie())
     if (usesDatabaseSession)
       result.headers.append('Set-Cookie', clearAuthCookie({ name: 'session_id' }))
     return result

package/app/Actions/Auth/RegisterAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, register } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, register, resolveBrowserSessionPolicy } from '@stacksjs/auth'
 import { dispatch } from '@stacksjs/events'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
@@ -29,9 +29,13 @@ export default new Action({
     const email = request.get('email')
     const password = request.get('password')
     const name = request.get('name')
+    const policy = resolveBrowserSessionPolicy(request.get('remember'))
 
     const referralCode = request.get('referralCode')
-    const result = await register({ email, password, name, referralCode: typeof referralCode === 'string' ? referralCode : undefined })
+    const result = await register(
+      { email, password, name, referralCode: typeof referralCode === 'string' ? referralCode : undefined },
+      { expiresInMinutes: policy.expiresInMinutes, withRefreshToken: policy.withRefreshToken },
+    )
 
     if (result) {
       const user = await Auth.getUserFromToken(result.token)
@@ -72,7 +76,7 @@ export default new Action({
           email: user?.email,
           name: user?.name,
         },
-      }, { headers: { 'Set-Cookie': authCookie(result.token) } })
+      }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.token, result.expiresIn) } })
     }
 
     return response.error('Registration failed')

package/app/Actions/Auth/VerifyTwoFactorLoginAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, authCookie, verifyTwoFactorLoginCode, withTwoFactorChallenge } from '@stacksjs/auth'
+import { Auth, authCookieForBrowserSession, resolveBrowserSessionPolicy, verifyTwoFactorLoginCode, withTwoFactorChallenge } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
@@ -27,9 +27,13 @@ export default new Action({
     // (whether the code was right or wrong) must start over from
     // LoginAction, not retry — mirrors the WebAuthn challenge
     // delete-on-read semantics in passkey.ts (stacksjs/stacks#1866).
-    const result = await withTwoFactorChallenge(challengeToken, async (userId) => {
+    const result = await withTwoFactorChallenge(challengeToken, async (userId, challenge) => {
       if (!await verifyTwoFactorLoginCode(userId, code)) return null
-      return Auth.loginUsingId(userId)
+      const policy = resolveBrowserSessionPolicy(challenge.remembered)
+      return Auth.loginUsingId(userId, {
+        expiresInMinutes: policy.expiresInMinutes,
+        withRefreshToken: policy.withRefreshToken,
+      })
     })
     if (!result)
       return response.unauthorized('Invalid or expired login attempt. Please sign in again.')
@@ -51,6 +55,6 @@ export default new Action({
         email: user?.email,
         name: user?.name,
       },
-    }, { headers: { 'Set-Cookie': authCookie(result.token) } })
+    }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.token, result.expiresIn) } })
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.58",
+  "version": "0.74.60",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.58",
+  "version": "0.74.60",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.58",
+    "@stacksjs/mobile": "^0.74.60",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }