@startsimpli/auth 0.4.4 → 0.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/__tests__/auth-functions.test.ts

@@ -85,18 +85,15 @@ function makeJwt(payload: object): string {
 
 const VALID_TOKEN = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600, user_id: '1' });
 
-describe('CSRF token on signin/register', () => {
+describe('CSRF not required for signin/register (endpoints are @csrf_exempt)', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockSessionStorage.clear();
     mockLocalStorage.clear();
   });
 
-  it('signInWithCredentials sends X-CSRFToken header', async () => {
-    mockFetch.mockImplementation((url: string) => {
-      if (url.includes('/csrf/')) {
-        return Promise.resolve({ ok: true });
-      }
+  it('signInWithCredentials does not fetch or send CSRF token', async () => {
+    mockFetch.mockImplementation(() => {
       return Promise.resolve({
         ok: true,
         status: 200,
@@ -106,20 +103,23 @@ describe('CSRF token on signin/register', () => {
 
     await signInWithCredentials('test@test.com', 'password');
 
-    // Find the token endpoint call (not the csrf call)
+    // Should NOT call the CSRF endpoint
+    const csrfCall = mockFetch.mock.calls.find(
+      (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/csrf/')
+    );
+    expect(csrfCall).toBeUndefined();
+
+    // Token endpoint call should not include X-CSRFToken header
     const tokenCall = mockFetch.mock.calls.find(
       (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/auth/token/') && !(c[0] as string).includes('csrf') && !(c[0] as string).includes('refresh')
     );
     expect(tokenCall).toBeDefined();
     const headers = tokenCall![1]?.headers;
-    expect(headers['X-CSRFToken']).toBe('test-csrf');
+    expect(headers['X-CSRFToken']).toBeUndefined();
   });
 
-  it('registerAccount sends X-CSRFToken header', async () => {
-    mockFetch.mockImplementation((url: string) => {
-      if (url.includes('/csrf/')) {
-        return Promise.resolve({ ok: true });
-      }
+  it('registerAccount does not fetch or send CSRF token', async () => {
+    mockFetch.mockImplementation(() => {
       return Promise.resolve({
         ok: true,
         status: 200,
@@ -133,12 +133,18 @@ describe('CSRF token on signin/register', () => {
       passwordConfirm: 'securepassword',
     });
 
+    // Should NOT call the CSRF endpoint
+    const csrfCall = mockFetch.mock.calls.find(
+      (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/csrf/')
+    );
+    expect(csrfCall).toBeUndefined();
+
     const registerCall = mockFetch.mock.calls.find(
       (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/auth/register/')
     );
     expect(registerCall).toBeDefined();
     const headers = registerCall![1]?.headers;
-    expect(headers['X-CSRFToken']).toBe('test-csrf');
+    expect(headers['X-CSRFToken']).toBeUndefined();
   });
 });
 

package/src/client/functions.ts

@@ -20,6 +20,7 @@ export interface AuthUser {
   groups?: string[];
   permissions?: string[];
   isActive?: boolean;
+  isStaff?: boolean;
   isEmailVerified?: boolean;
 }
 
@@ -136,6 +137,9 @@ export function setAccessToken(token: string | null): void {
       // Also clear from the other storage in case rememberMe was toggled
       if (_storageAvailable('sessionStorage')) sessionStorage.removeItem(TOKEN_STORAGE_KEY);
       if (_storageAvailable('localStorage')) localStorage.removeItem(TOKEN_STORAGE_KEY);
+      // Clear ALL auth cookies so middleware doesn't redirect back
+      // (prevents infinite loop when auth state is corrupted)
+      _clearAllAuthCookies();
     } else {
       storage.setItem(TOKEN_STORAGE_KEY, token);
     }
@@ -145,6 +149,14 @@ export function setAccessToken(token: string | null): void {
   _memToken = token;
 }
 
+/** Clear every cookie the middleware checks so it won't redirect back to the app. */
+function _clearAllAuthCookies(): void {
+  if (typeof document === 'undefined') return;
+  for (const name of ['auth_session', 'access_token', 'refresh_token']) {
+    document.cookie = `${name}=; path=/; max-age=0`;
+  }
+}
+
 const AUTH_COOKIE_NAME = 'auth_session';
 
 /** Derive cookie max-age from JWT exp claim instead of hardcoding. */
@@ -213,6 +225,7 @@ function normalizeUser(raw: unknown): AuthUser | null {
     groups: Array.isArray(payload.groups) ? (payload.groups as string[]) : [],
     permissions: Array.isArray(payload.permissions) ? (payload.permissions as string[]) : [],
     isActive: (payload.isActive ?? payload.is_active) as boolean | undefined,
+    isStaff: (payload.isStaff ?? payload.is_staff) as boolean | undefined,
     isEmailVerified: (payload.isEmailVerified ?? payload.is_email_verified) as boolean | undefined,
   };
 }
@@ -230,13 +243,11 @@ function parseAuthResponse(data: unknown): { access?: string; user?: AuthUser }
 // --- Auth functions ---
 
 export async function signInWithCredentials(email: string, password: string) {
-  await fetchCsrfToken();
-  const csrfToken = getCsrfToken();
+  // No CSRF needed — Django's /auth/token/ is @csrf_exempt (JWT endpoint)
   const response = await fetchWithTimeout(resolveAuthUrl(AUTH_PATHS.TOKEN), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
-      ...(csrfToken ? { 'X-CSRFToken': csrfToken } : {}),
     },
     credentials: 'include',
     body: JSON.stringify({ email, password }),
@@ -273,13 +284,11 @@ export async function registerAccount(payload: {
   const [firstFromName, ...rest] = rawName ? rawName.split(/\s+/) : [];
   const lastFromName = rest.length ? rest.join(' ') : undefined;
 
-  await fetchCsrfToken();
-  const csrfToken = getCsrfToken();
+  // No CSRF needed — Django's /auth/register/ is @csrf_exempt
   const response = await fetchWithTimeout(resolveAuthUrl(AUTH_PATHS.REGISTER), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
-      ...(csrfToken ? { 'X-CSRFToken': csrfToken } : {}),
     },
     credentials: 'include',
     body: JSON.stringify({