@startsimpli/auth 0.4.3 → 0.4.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/client/functions.ts

@@ -20,6 +20,7 @@ export interface AuthUser {
   groups?: string[];
   permissions?: string[];
   isActive?: boolean;
+  isStaff?: boolean;
   isEmailVerified?: boolean;
 }
 
@@ -136,6 +137,9 @@ export function setAccessToken(token: string | null): void {
       // Also clear from the other storage in case rememberMe was toggled
       if (_storageAvailable('sessionStorage')) sessionStorage.removeItem(TOKEN_STORAGE_KEY);
       if (_storageAvailable('localStorage')) localStorage.removeItem(TOKEN_STORAGE_KEY);
+      // Clear ALL auth cookies so middleware doesn't redirect back
+      // (prevents infinite loop when auth state is corrupted)
+      _clearAllAuthCookies();
     } else {
       storage.setItem(TOKEN_STORAGE_KEY, token);
     }
@@ -145,6 +149,14 @@ export function setAccessToken(token: string | null): void {
   _memToken = token;
 }
 
+/** Clear every cookie the middleware checks so it won't redirect back to the app. */
+function _clearAllAuthCookies(): void {
+  if (typeof document === 'undefined') return;
+  for (const name of ['auth_session', 'access_token', 'refresh_token']) {
+    document.cookie = `${name}=; path=/; max-age=0`;
+  }
+}
+
 const AUTH_COOKIE_NAME = 'auth_session';
 
 /** Derive cookie max-age from JWT exp claim instead of hardcoding. */
@@ -213,6 +225,7 @@ function normalizeUser(raw: unknown): AuthUser | null {
     groups: Array.isArray(payload.groups) ? (payload.groups as string[]) : [],
     permissions: Array.isArray(payload.permissions) ? (payload.permissions as string[]) : [],
     isActive: (payload.isActive ?? payload.is_active) as boolean | undefined,
+    isStaff: (payload.isStaff ?? payload.is_staff) as boolean | undefined,
     isEmailVerified: (payload.isEmailVerified ?? payload.is_email_verified) as boolean | undefined,
   };
 }