@stacksjs/defaults 0.74.62 → 0.74.63

package/app/Actions/Auth/RefreshTokenAction.ts

@@ -1,5 +1,5 @@
 import { Action } from '@stacksjs/actions'
-import { authCookie, refreshToken } from '@stacksjs/auth'
+import { authCookieForBrowserSession, refreshToken } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
 
@@ -34,7 +34,7 @@ export default new Action({
         refresh_token: result.refreshToken,
         token_type: 'Bearer',
         expires_in: result.expiresIn,
-      }, { headers: { 'Set-Cookie': authCookie(result.plainTextToken) } })
+      }, { headers: { 'Set-Cookie': authCookieForBrowserSession(result.plainTextToken, result.expiresIn) } })
     }
     catch (error: any) {
       return response.unauthorized(error.message || 'Invalid or expired refresh token')

package/app/Actions/Auth/VerifyAuthenticationAction.ts

@@ -1,8 +1,11 @@
 import type { AuthenticationCredential } from '@stacksjs/auth'
 import { Action } from '@stacksjs/actions'
 import {
+  Auth,
+  authCookieForBrowserSession,
   consumeWebAuthnChallenge,
   getUserPasskey,
+  resolveBrowserSessionPolicy,
   updatePasskeyCounter,
   verifyAuthenticationResponse,
 } from '@stacksjs/auth'
@@ -86,7 +89,27 @@ export default new Action({
         }
       }
 
-      return response.json(verification)
+      const policy = resolveBrowserSessionPolicy(false)
+      const session = await Auth.loginUsingId(user.id as number, {
+        expiresInMinutes: policy.expiresInMinutes,
+        withRefreshToken: policy.withRefreshToken,
+      })
+      if (!session)
+        return response.serverError('Authentication session could not be created')
+
+      return response.json({
+        ...verification,
+        access_token: session.token,
+        refresh_token: session.refreshToken,
+        token_type: 'Bearer',
+        expires_in: session.expiresIn,
+        token: session.token,
+        user: {
+          id: session.user?.id,
+          email: session.user?.email,
+          name: session.user?.name,
+        },
+      }, { headers: { 'Set-Cookie': authCookieForBrowserSession(session.token, session.expiresIn) } })
     }
     catch (error) {
       console.error('Authentication verification failed:', error)

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.62",
+  "version": "0.74.63",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.62",
+  "version": "0.74.63",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.62",
+    "@stacksjs/mobile": "^0.74.63",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/routes/auth.ts

@@ -53,7 +53,7 @@ route.post('/verify-registration', 'Actions/Auth/VerifyRegistrationAction').midd
 // Passkey AUTHENTICATION (logging in) is correctly unauthenticated —
 // the caller doesn't have a session yet, that's the point.
 route.get('/generate-authentication-options', 'Actions/Auth/GenerateAuthenticationAction').rateLimit(10, 'minute')
-route.get('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
+route.post('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
 
 // TOTP 2FA. Setup/enable/disable act on the caller's own authenticated
 // account (auth-gated, same identity rule as passkey enrollment above).