@starci/auth 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.4.0 - 2026-11-04
+
+- Added: `RefreshCookieOptions.domains`: the refresh cookie's `Domain` follows the request host (its `Host` header without the port). A host equal to a listed domain, or ending in `.` and one, takes the longest that fits; any other host takes `domain`, else stays host-only, so one api signs in on localhost (host-only) and on a tunnel origin (its parent domain).
+- Changed: `RefreshCookie.issue(response, tokens, request)` and `clear(response, request)` take the request; `AuthDoors` passes it at every write and clear. Specs: `src/server/cookie.spec.ts` (localhost host-only, a tunnel host under a listed domain, the longest fit, an unlisted host and no host fall back).
+
 ## 0.3.0 - 2026-11-03
 
 - Added: a session carries the person's full name when the account directory knows it: `AccountStanding.name` and `AuthSubject.name` in; `SessionUser.name`, the `name` access-token claim (`AUTH_CLAIMS.name`), `AccessClaims.name` and `AuthPrincipal.name` out. The client keeps it (from the grant, or from the token when the grant carries no user) and announces a change of it. An account without a name answers as before.

package/dist/server/cookie.d.ts

@@ -2,8 +2,9 @@ import type { HttpRequest, HttpResponse } from "./http.js";
 import type { RefreshCookieOptions } from "./options.js";
 import type { DeviceMeta, SessionTokens } from "./ports.js";
 /**
- * The refresh cookie: httpOnly and Secure on every write and clear, SameSite lax (or strict), on the configured domain so the web
- * app and the API both see it. The token only ever leaves the back end through this cookie, never in a body or a URL.
+ * The refresh cookie: httpOnly and Secure on every write and clear, SameSite lax (or strict), on the domain the request host falls
+ * under (one of `domains`, else `domain`, else host-only) so the web app and the API both see it. The token only ever leaves the back
+ * end through this cookie, never in a body or a URL.
  */
 export declare class RefreshCookie {
     #private;
@@ -13,7 +14,7 @@ export declare class RefreshCookie {
     /** The device a request comes from: its user agent (bounded) and caller address. */
     deviceOf(request: HttpRequest): DeviceMeta;
     /** Sets the cookie to the refresh token of a session, clearing the copies older sessions kept under their paths. */
-    issue(response: HttpResponse, tokens: SessionTokens): void;
+    issue(response: HttpResponse, tokens: SessionTokens, request: HttpRequest): void;
     /** Clears the cookie on its path and on the paths older sessions used. */
-    clear(response: HttpResponse): void;
+    clear(response: HttpResponse, request: HttpRequest): void;
 }

package/dist/server/cookie.js

@@ -2,8 +2,9 @@ import { cookieValue } from "./primitives.js";
 const MAX_AGENT_LENGTH = 512;
 const MILLISECONDS = 1000;
 /**
- * The refresh cookie: httpOnly and Secure on every write and clear, SameSite lax (or strict), on the configured domain so the web
- * app and the API both see it. The token only ever leaves the back end through this cookie, never in a body or a URL.
+ * The refresh cookie: httpOnly and Secure on every write and clear, SameSite lax (or strict), on the domain the request host falls
+ * under (one of `domains`, else `domain`, else host-only) so the web app and the API both see it. The token only ever leaves the back
+ * end through this cookie, never in a body or a URL.
  */
 export class RefreshCookie {
     #options;
@@ -22,18 +23,27 @@ export class RefreshCookie {
         return { userAgent: text?.slice(0, MAX_AGENT_LENGTH) ?? null, ip: request.ip ?? null };
     }
     /** Sets the cookie to the refresh token of a session, clearing the copies older sessions kept under their paths. */
-    issue(response, tokens) {
+    issue(response, tokens, request) {
+        const domain = this.#domainOf(request);
         for (const path of this.#legacyPaths())
-            response.clearCookie(this.#options.name, this.#flags(path));
+            response.clearCookie(this.#options.name, this.#flags(path, domain));
         response.cookie(this.#options.name, tokens.cookieToken, {
-            ...this.#flags(this.#path()),
+            ...this.#flags(this.#path(), domain),
             maxAge: tokens.refreshMaxAgeSeconds * MILLISECONDS,
         });
     }
     /** Clears the cookie on its path and on the paths older sessions used. */
-    clear(response) {
+    clear(response, request) {
+        const domain = this.#domainOf(request);
         for (const path of [this.#path(), ...this.#legacyPaths()])
-            response.clearCookie(this.#options.name, this.#flags(path));
+            response.clearCookie(this.#options.name, this.#flags(path, domain));
+    }
+    /** The `Domain` for a request: the longest listed domain its host (without the port) equals or ends under, else the configured one. */
+    #domainOf(request) {
+        const header = request.headers.host;
+        const host = (Array.isArray(header) ? header[0] : header)?.replace(/:\d+$/u, "").toLowerCase() ?? "";
+        const fits = (this.#options.domains ?? []).filter((domain) => host === domain || host.endsWith(`.${domain}`));
+        return fits.sort((a, b) => b.length - a.length)[0] ?? this.#options.domain;
     }
     #path() {
         return this.#options.path ?? "/";
@@ -41,8 +51,7 @@ export class RefreshCookie {
     #legacyPaths() {
         return (this.#options.legacyPaths ?? ["/auth"]).filter((path) => path !== this.#path());
     }
-    #flags(path) {
-        const domain = this.#options.domain;
+    #flags(path, domain) {
         return {
             httpOnly: true,
             secure: true,

package/dist/server/doors.js

@@ -22,18 +22,18 @@ export class AuthDoors {
     async login(exchange) {
         const subject = await this.#deps.flows.authenticateLocal(exchange);
         const tokens = await this.#deps.sessions.start(subject, this.#deps.cookie.deviceOf(exchange.req));
-        this.#deps.cookie.issue(exchange.res, tokens);
+        this.#deps.cookie.issue(exchange.res, tokens, exchange.req);
         return accessOf(tokens);
     }
     /** Rotates the cookie token and sets the successor (every refresh rotates, a racing one included); a cookie that cannot be used is cleared and the refusal rethrown. */
     async refresh(exchange) {
         try {
             const tokens = await this.#deps.sessions.refresh(this.#deps.cookie.read(exchange.req));
-            this.#deps.cookie.issue(exchange.res, tokens);
+            this.#deps.cookie.issue(exchange.res, tokens, exchange.req);
             return accessOf(tokens);
         }
         catch (cause) {
-            this.#deps.cookie.clear(exchange.res);
+            this.#deps.cookie.clear(exchange.res, exchange.req);
             throw cause;
         }
     }
@@ -44,7 +44,7 @@ export class AuthDoors {
     /** Ends the session of the cookie and clears it. */
     async logout(exchange) {
         await this.#deps.sessions.end(this.#deps.cookie.read(exchange.req));
-        this.#deps.cookie.clear(exchange.res);
+        this.#deps.cookie.clear(exchange.res, exchange.req);
     }
     /** Sends the browser to the Google consent screen. */
     beginGoogle(exchange) {
@@ -59,11 +59,11 @@ export class AuthDoors {
         try {
             const completion = await this.#deps.flows.completeGoogle(exchange);
             const tokens = await this.#deps.sessions.start(completion.subject, this.#deps.cookie.deviceOf(exchange.req));
-            this.#deps.cookie.issue(exchange.res, tokens);
+            this.#deps.cookie.issue(exchange.res, tokens, exchange.req);
             return { url: `${this.#deps.returnOrigin}${completion.next}`, statusCode: SEE_OTHER };
         }
         catch (cause) {
-            this.#deps.cookie.clear(exchange.res);
+            this.#deps.cookie.clear(exchange.res, exchange.req);
             this.#deps.logger?.warn(GOOGLE_SIGN_IN_FAILED_EVENT, { cause: String(cause) });
             return { url: `${this.#deps.returnOrigin}/sign-in?auth=error`, statusCode: SEE_OTHER };
         }

package/dist/server/options.d.ts

@@ -24,8 +24,13 @@ export interface GoogleOptions {
 export interface RefreshCookieOptions {
     /** The cookie name. */
     readonly name: string;
-    /** The `Domain` of the cookie; undefined keeps it host-only. */
+    /** The `Domain` of the cookie when the request host is under none of `domains`; undefined keeps it host-only. */
     readonly domain?: string | undefined;
+    /**
+     * The domains a request host may set the cookie on: a host equal to one, or ending in "." and one, gets that one as the `Domain`
+     * (the longest that fits), so one api serves sign-in on localhost (host-only) and on a tunnel origin (its parent domain).
+     */
+    readonly domains?: readonly string[] | undefined;
     /** The path the cookie is sent on (the web app's server reads it on its own pages and forwards it to the api). */
     readonly path?: string | undefined;
     /** The paths older sessions wrote the cookie under; each is cleared so a stale copy never shadows the live one. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/auth",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The sign-in of a StarCi lite app in one package: a NestJS module (EdDSA access tokens with a multi-key JWKS, bcrypt passwords, Google OAuth with state and PKCE, rotating refresh tokens with a reuse grace window and reuse detection, a failures-only sign-in limit, the refresh cookie), the door contracts, a front-end auth client (access token in memory, one shared refresh, signed out only on 401 or 403) with React bindings, and test doubles.",
   "keywords": [
     "auth",