@thecodeorigin/auth 0.0.9 → 0.0.11

package/dist/runtime/server/utils/local-auth.js

@@ -0,0 +1,43 @@
+import { betterAuth } from "better-auth";
+import { createAuthEndpoint } from "better-auth/api";
+import { setSessionCookie } from "better-auth/cookies";
+export function createLocalAuth(options, input) {
+  return betterAuth({
+    ...options,
+    account: { storeAccountCookie: false },
+    session: {
+      ...options.session,
+      disableSessionRefresh: true,
+      storeSessionInDatabase: false,
+      cookieCache: { enabled: false },
+      additionalFields: { snapshot: { type: "string", required: true, input: false } }
+    },
+    plugins: [{
+      id: "application-session",
+      endpoints: {
+        // Called only via auth.api after verification; auth.handler is never exposed.
+        establishLocalSession: createAuthEndpoint("/internal-establish-local-session", { method: "POST" }, async (ctx) => {
+          if (!input || input.expiresAt <= Date.now())
+            throw new Error("A verified, unexpired identity is required");
+          const user = await ctx.context.internalAdapter.createUser({
+            id: input.user.sub,
+            email: input.user.email,
+            emailVerified: true,
+            name: input.user.name ?? input.user.email,
+            image: input.user.picture
+          });
+          const session = await ctx.context.internalAdapter.createSession(user.id, false, {
+            snapshot: input.snapshot,
+            expiresAt: new Date(input.expiresAt)
+          }, true);
+          if (!session)
+            throw new Error("Unable to create application session");
+          await setSessionCookie(ctx, { session, user }, false, {
+            maxAge: Math.max(1, Math.floor((input.expiresAt - Date.now()) / 1e3))
+          });
+          return ctx.json({ token: session.token });
+        })
+      }
+    }]
+  });
+}

package/dist/runtime/server/utils/oidc.d.ts

@@ -3,6 +3,8 @@ declare module 'nitropack' {
     interface NitroRuntimeConfig {
         auth: {
             clientSecret: string;
+            sessionSecret: string;
+            sessionMaxAge: number;
             sessionStorageBase: string;
             sessionCookieName: string;
             logoutIntentCookieName: string;
@@ -37,5 +39,24 @@ export declare function exchangeCode(code: string, verifier: string, redirectUri
     id_token?: string;
 }>;
 export declare function fetchUserinfo(accessToken: string): Promise<any>;
-/** Same-origin, path-only redirect target (prevents open redirect). */
-export declare function safePath(target: string | undefined, fallback: string): string;
+/** Same-origin, path-only redirect target, including encoded backslash/control defenses. */
+export declare function safePath(target: unknown, fallback: string): string;
+export declare function requireSameOrigin(event: H3Event): void;
+export declare function transactionCookieName(state: string): string;
+export declare function encodeTransaction(input: {
+    state: string;
+    verifier: string;
+    nonce: string;
+    redirect: string;
+    flowId: string;
+}): Promise<string>;
+export declare function decodeTransaction(value: string, state: string): Promise<{
+    verifier: string;
+    nonce: string;
+    redirect: string;
+    flowId: string;
+}>;
+export declare function verifyIdToken(idToken: string, nonce: string, subject: string): Promise<void>;
+export declare function beginAuthentication(event: H3Event, state: string): Promise<string>;
+export declare function assertPendingAuthentication(event: H3Event, state: string, flowId: string): Promise<void>;
+export declare function clearPendingAuthentication(event: H3Event, expectedState?: string): Promise<void>;

package/dist/runtime/server/utils/oidc.js

@@ -1,6 +1,8 @@
-import { getRequestHost, getRequestProtocol } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
+import { createError, deleteCookie, getCookie, getHeader, getRequestHost, getRequestProtocol, getRequestURL, setCookie, setResponseHeader } from "h3";
+import { createRemoteJWKSet, jwtVerify, SignJWT } from "jose";
+import { useRuntimeConfig, useStorage } from "nitropack/runtime";
 import { $fetch } from "ofetch";
+import { sessionSecret } from "./session.js";
 function b64url(buf) {
   return btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -19,7 +21,7 @@ export function callbackRedirectUri(event) {
 export function idpBaseUrl() {
   const { public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
   const domain = publicRuntimeConfig.domain;
-  return /^https?:\/\//.test(domain) ? domain : `https://${domain}`;
+  return (/^https?:\/\//.test(domain) ? domain : `https://${domain}`).replace(/\/$/, "");
 }
 export async function exchangeCode(code, verifier, redirectUri) {
   const { auth: runtimeConfig, public: { auth: publicRuntimeConfig } } = useRuntimeConfig();
@@ -27,6 +29,8 @@ export async function exchangeCode(code, verifier, redirectUri) {
     `${idpBaseUrl()}/api/auth/oauth2/token`,
     {
       method: "POST",
+      timeout: 1e4,
+      retry: 0,
       headers: {
         "Content-Type": "application/x-www-form-urlencoded",
         "Authorization": `Basic ${btoa(`${publicRuntimeConfig.clientId}:${runtimeConfig.clientSecret}`)}`
@@ -42,11 +46,84 @@ export async function exchangeCode(code, verifier, redirectUri) {
 }
 export async function fetchUserinfo(accessToken) {
   return $fetch(`${idpBaseUrl()}/api/auth/oauth2/userinfo`, {
+    timeout: 1e4,
+    retry: 0,
     headers: { Authorization: `Bearer ${accessToken}` }
   });
 }
 export function safePath(target, fallback) {
-  if (!target || !target.startsWith("/") || target.startsWith("//"))
+  if (typeof target !== "string" || !target.startsWith("/") || target.startsWith("//"))
     return fallback;
-  return target;
+  try {
+    const decoded = decodeURIComponent(target);
+    if (decoded.includes("\\") || Array.from(decoded).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) || decoded.startsWith("//"))
+      return fallback;
+    const url = new URL(target, "https://local.invalid");
+    return url.origin === "https://local.invalid" ? `${url.pathname}${url.search}${url.hash}` : fallback;
+  } catch {
+    return fallback;
+  }
+}
+export function requireSameOrigin(event) {
+  setResponseHeader(event, "cache-control", "no-store");
+  const origin = getHeader(event, "origin");
+  if (!origin || origin !== getRequestURL(event).origin || getHeader(event, "sec-fetch-site") === "cross-site")
+    throw createError({ statusCode: 403, statusMessage: "Same-origin request required" });
+}
+export function transactionCookieName(state) {
+  return `${useRuntimeConfig().auth.sessionCookieName}_oidc_${state}`;
+}
+export async function encodeTransaction(input) {
+  return new SignJWT(input).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("10m").sign(new TextEncoder().encode(await sessionSecret()));
+}
+export async function decodeTransaction(value, state) {
+  const { payload } = await jwtVerify(value, new TextEncoder().encode(await sessionSecret()), {
+    algorithms: ["HS256"],
+    requiredClaims: ["exp", "iat"]
+  });
+  if (payload.state !== state || typeof payload.verifier !== "string" || typeof payload.nonce !== "string" || typeof payload.redirect !== "string" || typeof payload.flowId !== "string")
+    throw new Error("Invalid OAuth transaction");
+  return { verifier: payload.verifier, nonce: payload.nonce, redirect: payload.redirect, flowId: payload.flowId };
+}
+export async function verifyIdToken(idToken, nonce, subject) {
+  const { public: { auth } } = useRuntimeConfig();
+  const issuer = `${idpBaseUrl()}/api/auth`;
+  const keys = createRemoteJWKSet(new URL(`${issuer}/jwks`), { timeoutDuration: 1e4 });
+  const { payload } = await jwtVerify(idToken, keys, {
+    issuer,
+    audience: auth.clientId,
+    algorithms: ["RS256"],
+    requiredClaims: ["sub", "exp", "iat", "nonce"]
+  });
+  if (payload.nonce !== nonce || payload.sub !== subject || payload.azp !== void 0 && payload.azp !== auth.clientId || Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== auth.clientId) {
+    throw new Error("ID token identity binding failed");
+  }
+}
+function flowCookieName() {
+  return `${useRuntimeConfig().auth.sessionCookieName}_oidc_latest`;
+}
+function flowKey(flowId) {
+  const config = useRuntimeConfig();
+  return `auth:${encodeURIComponent(config.public.auth.clientId)}:${config.auth.sessionCookieName}:oauth-flow:${flowId}`;
+}
+export async function beginAuthentication(event, state) {
+  const existing = getCookie(event, flowCookieName());
+  const flowId = existing && /^[\w-]{32}$/.test(existing) ? existing : randomString(32);
+  await useStorage(useRuntimeConfig().auth.sessionStorageBase).setItem(flowKey(flowId), state, { ttl: 600 });
+  setCookie(event, flowCookieName(), flowId, { httpOnly: true, secure: getRequestURL(event).protocol === "https:", sameSite: "lax", path: "/", maxAge: 600 });
+  return flowId;
+}
+export async function assertPendingAuthentication(event, state, flowId) {
+  if (getCookie(event, flowCookieName()) !== flowId || await useStorage(useRuntimeConfig().auth.sessionStorageBase).getItem(flowKey(flowId)) !== state) {
+    throw createError({ statusCode: 409, statusMessage: "Authentication request was canceled or replaced" });
+  }
+}
+export async function clearPendingAuthentication(event, expectedState) {
+  const flowId = getCookie(event, flowCookieName());
+  const storage = useStorage(useRuntimeConfig().auth.sessionStorageBase);
+  if (expectedState && (!flowId || await storage.getItem(flowKey(flowId)) !== expectedState))
+    return;
+  if (flowId)
+    await storage.removeItem(flowKey(flowId));
+  deleteCookie(event, flowCookieName(), { path: "/" });
 }

package/dist/runtime/server/utils/session.d.ts

@@ -1,6 +1,5 @@
 import type { H3Event } from 'h3';
 import type { AbilityRule, PublicSession, ServerAuthSession as ServerAuthSessionContract } from '../../../contract/index.js';
-export declare const AUTHORIZATION_TTL_MS = 120000;
 export interface SessionRecord {
     sub: string;
     user: {
@@ -10,15 +9,15 @@ export interface SessionRecord {
         picture: string | null;
     };
     abilities: AbilityRule[];
+    organizationAuthorizations: Record<string, AbilityRule[]>;
     systemRole: string | null;
     organizations: PublicSession['organizations'];
     activeOrg: string | null;
     entitlement: PublicSession['entitlement'];
+    /** Access credential is used only for explicit directory/support operations. */
     accessToken: string;
-    refreshToken: string | null;
-    idToken: string | null;
     accessExpiresAt: number;
-    authorizationRefreshedAt: number;
+    expiresAt: number;
     isImpersonation: boolean;
     impersonator: {
         sub: string;
@@ -28,21 +27,43 @@ export interface SessionRecord {
     } | null;
     backupId: string | null;
 }
+export type SessionInput = Omit<SessionRecord, 'expiresAt'> & {
+    expiresAt?: number;
+};
 export declare function newSessionId(): string;
-export declare function writeSessionRecord(id: string, rec: SessionRecord): Promise<void>;
+export declare function sessionSecret(): Promise<string>;
+export declare function requestHeaders(event: H3Event): Headers;
+/** Establish a new opaque session and revoke the previous browser session. */
+export declare function issueSession(event: H3Event, input: SessionInput, options?: {
+    expectedPreviousId?: string | null;
+    validate?: () => Promise<void>;
+}): Promise<{
+    id: string;
+    rec: SessionRecord;
+}>;
 export declare function readSessionRecord(event: H3Event): Promise<{
     id: string;
     rec: SessionRecord;
 } | null>;
-export declare function setSessionCookie(event: H3Event, id: string): Promise<void>;
-export declare function destroySession(event: H3Event): Promise<SessionRecord | null>;
+/** Private backup records never act as browser sessions and retain original expiry. */
+export declare function writeSessionRecord(id: string, rec: SessionRecord): Promise<void>;
 export declare function readSessionRecordById(id: string): Promise<SessionRecord | null>;
+export declare function deleteSessionBackup(id: string): Promise<void>;
+/** A separate original-session capability remains usable after the support session expires. */
+export declare function setSessionRestoreCookie(event: H3Event, backupId: string, original: SessionRecord): Promise<void>;
+export declare function clearSessionRestoreCookie(event: H3Event): void;
+export declare function readSessionRestore(event: H3Event): Promise<{
+    id: string;
+    rec: SessionRecord;
+} | null>;
+export declare function destroySession(event: H3Event): Promise<SessionRecord | null>;
 export type ServerAuthSession = ServerAuthSessionContract;
 /** Server-safe session projection — no tokens or private refresh metadata. */
 export declare function toServerAuthSession(rec: SessionRecord): ServerAuthSession;
-/** Server-safe session for callers that explicitly do not need a live refresh. */
+/** Every application authorization read uses its own fixed-expiry snapshot. */
 export declare function getServerAuthSession(event: H3Event): Promise<ServerAuthSession | null>;
-export declare function getFreshServerAuthSession(event: H3Event, options?: {
+/** Kept for API compatibility; freshness means local expiry, never an ID refresh. */
+export declare function getFreshServerAuthSession(event: H3Event, _options?: {
     force?: boolean;
 }): Promise<ServerAuthSession | null>;
 /** Browser-safe projection — tokens are excluded. */

package/dist/runtime/server/utils/session.js

@@ -1,53 +1,207 @@
-import { createError, deleteCookie, getCookie, setCookie } from "h3";
+import { appendResponseHeader, createError, deleteCookie, getCookie, getRequestHeaders, getRequestURL, setCookie, setResponseHeader } from "h3";
+import { jwtVerify, SignJWT } from "jose";
 import { useRuntimeConfig, useStorage } from "nitropack/runtime";
-import { refreshAuthorizationContext } from "./idp.js";
-export const AUTHORIZATION_TTL_MS = 12e4;
-function key(id) {
-  return `session:${id}`;
+import { z } from "zod";
+import { AbilityRuleSchema, PublicUserSchema, RpOrganizationSchema, UserinfoClaimsSchema } from "../../../contract";
+import { createLocalAuth } from "./local-auth.js";
+const SessionRecordSchema = z.object({
+  sub: z.string().min(1),
+  user: PublicUserSchema,
+  abilities: z.array(AbilityRuleSchema),
+  organizationAuthorizations: z.record(z.string(), z.array(AbilityRuleSchema)),
+  systemRole: z.string().nullable(),
+  organizations: z.array(RpOrganizationSchema),
+  activeOrg: z.string().nullable(),
+  entitlement: UserinfoClaimsSchema.shape.entitlement,
+  accessToken: z.string(),
+  accessExpiresAt: z.number().finite(),
+  expiresAt: z.number().finite(),
+  isImpersonation: z.boolean(),
+  impersonator: PublicUserSchema.nullable(),
+  backupId: z.string().nullable()
+});
+function parseSessionRecord(value) {
+  const parsed = SessionRecordSchema.safeParse(value);
+  return parsed.success && parsed.data.expiresAt > Date.now() && parsed.data.sub === parsed.data.user.sub ? parsed.data : null;
 }
 export function newSessionId() {
-  const a = new Uint8Array(32);
-  crypto.getRandomValues(a);
-  return [...a].map((b) => b.toString(16).padStart(2, "0")).join("");
+  return crypto.randomUUID();
 }
-export async function writeSessionRecord(id, rec) {
-  const { auth: runtimeConfig } = useRuntimeConfig();
-  await useStorage(runtimeConfig.sessionStorageBase).setItem(key(id), rec);
+function namespace() {
+  const config = useRuntimeConfig();
+  return `auth:${encodeURIComponent(config.public.auth.clientId)}:${config.auth.sessionCookieName}:`;
+}
+function storage() {
+  return useStorage(useRuntimeConfig().auth.sessionStorageBase);
+}
+export async function sessionSecret() {
+  const { auth, public: { auth: publicAuth } } = useRuntimeConfig();
+  if (auth.sessionSecret)
+    return auth.sessionSecret;
+  if (!auth.clientSecret)
+    throw createError({ statusCode: 503, statusMessage: "Application session secret is not configured" });
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(auth.clientSecret), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: encoder.encode("thecodeorigin.application-session.v1"),
+    info: encoder.encode(`${publicAuth.clientId}:${auth.sessionCookieName}`)
+  }, key, 256);
+  return Array.from(new Uint8Array(bits), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+export function requestHeaders(event) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(getRequestHeaders(event))) {
+    if (value !== void 0)
+      headers.set(name, value);
+  }
+  return headers;
+}
+async function localAuth(event, rec) {
+  const { auth } = useRuntimeConfig();
+  const origin = getRequestURL(event).origin;
+  const prefix = namespace();
+  return createLocalAuth({
+    baseURL: origin,
+    secret: await sessionSecret(),
+    advanced: {
+      cookiePrefix: auth.sessionCookieName,
+      useSecureCookies: origin.startsWith("https:"),
+      cookies: { session_token: { name: auth.sessionCookieName } },
+      crossSubDomainCookies: { enabled: false }
+    },
+    session: { expiresIn: auth.sessionMaxAge },
+    secondaryStorage: {
+      get: async (key) => await storage().getItem(`${prefix}${key}`),
+      set: async (key, value, ttl) => {
+        await storage().setItem(`${prefix}${key}`, value, ttl ? { ttl } : void 0);
+      },
+      delete: async (key) => {
+        await storage().removeItem(`${prefix}${key}`);
+      }
+    }
+  }, rec ? { user: rec.user, expiresAt: rec.expiresAt, snapshot: JSON.stringify(rec) } : void 0);
+}
+export async function issueSession(event, input, options = {}) {
+  const maxExpiry = Date.now() + useRuntimeConfig().auth.sessionMaxAge * 1e3;
+  const rec = { ...input, expiresAt: Math.min(input.expiresAt ?? maxExpiry, maxExpiry) };
+  if (!Number.isFinite(rec.expiresAt) || rec.expiresAt <= Date.now())
+    throw createError({ statusCode: 401, statusMessage: "Session expired; sign in again" });
+  const previous = await readSessionRecord(event);
+  if (options.expectedPreviousId !== void 0 && (previous?.id ?? null) !== options.expectedPreviousId)
+    throw createError({ statusCode: 409, statusMessage: "Session changed; reload before continuing" });
+  await options.validate?.();
+  const restore = await readSessionRestore(event);
+  const auth = await localAuth(event, rec);
+  const { headers, response } = await auth.api.establishLocalSession({
+    headers: requestHeaders(event),
+    returnHeaders: true
+  });
+  try {
+    if (options.expectedPreviousId !== void 0 && ((await readSessionRecord(event))?.id ?? null) !== options.expectedPreviousId)
+      throw createError({ statusCode: 409, statusMessage: "Session changed; reload before continuing" });
+    await options.validate?.();
+    const context = await auth.$context;
+    if (previous)
+      await context.internalAdapter.deleteSession(previous.id);
+    if (restore && restore.id !== rec.backupId) {
+      await deleteSessionBackup(restore.id);
+      clearSessionRestoreCookie(event);
+    }
+  } catch (error) {
+    const context = await auth.$context;
+    await context.internalAdapter.deleteSession(response.token);
+    throw error;
+  }
+  for (const cookie of headers.getSetCookie())
+    appendResponseHeader(event, "set-cookie", cookie);
+  return { id: response.token, rec };
 }
 export async function readSessionRecord(event) {
-  const { auth: runtimeConfig } = useRuntimeConfig();
-  const id = getCookie(event, runtimeConfig.sessionCookieName);
-  if (!id)
+  setResponseHeader(event, "cache-control", "no-store");
+  const auth = await localAuth(event);
+  const result = await auth.api.getSession({ headers: requestHeaders(event) });
+  if (!result)
     return null;
-  const rec = await useStorage(runtimeConfig.sessionStorageBase).getItem(key(id));
-  return rec ? { id, rec } : null;
+  const snapshot = result.session.snapshot;
+  if (typeof snapshot !== "string")
+    return null;
+  try {
+    const rec = parseSessionRecord(JSON.parse(snapshot));
+    return rec && rec.sub === result.user.id ? { id: result.session.token, rec } : null;
+  } catch {
+    return null;
+  }
+}
+export async function writeSessionRecord(id, rec) {
+  const ttl = Math.floor((rec.expiresAt - Date.now()) / 1e3);
+  if (ttl <= 0)
+    throw createError({ statusCode: 401, statusMessage: "Original session expired" });
+  await storage().setItem(`${namespace()}backup:${id}`, rec, { ttl });
 }
-export async function setSessionCookie(event, id) {
-  const { auth: runtimeConfig } = useRuntimeConfig();
-  setCookie(event, runtimeConfig.sessionCookieName, id, {
+export async function readSessionRecordById(id) {
+  const rec = await storage().getItem(`${namespace()}backup:${id}`);
+  return parseSessionRecord(rec);
+}
+export async function deleteSessionBackup(id) {
+  await storage().removeItem(`${namespace()}backup:${id}`);
+}
+function restoreCookieName() {
+  return `${useRuntimeConfig().auth.sessionCookieName}_restore`;
+}
+export async function setSessionRestoreCookie(event, backupId, original) {
+  const token = await new SignJWT({ backupId, sub: original.sub, purpose: "restore-application-session" }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(original.expiresAt / 1e3)).sign(new TextEncoder().encode(await sessionSecret()));
+  setCookie(event, restoreCookieName(), token, {
     httpOnly: true,
-    secure: !import.meta.dev,
+    secure: getRequestURL(event).protocol === "https:",
     sameSite: "lax",
     path: "/",
-    maxAge: 60 * 60 * 24 * 7
+    maxAge: Math.max(1, Math.floor((original.expiresAt - Date.now()) / 1e3))
   });
 }
-export async function destroySession(event) {
-  const { auth: runtimeConfig } = useRuntimeConfig();
-  const id = getCookie(event, runtimeConfig.sessionCookieName);
-  if (!id)
+export function clearSessionRestoreCookie(event) {
+  deleteCookie(event, restoreCookieName(), { path: "/" });
+}
+export async function readSessionRestore(event) {
+  const value = getCookie(event, restoreCookieName());
+  if (!value)
+    return null;
+  let backupId;
+  let subject;
+  try {
+    const { payload } = await jwtVerify(value, new TextEncoder().encode(await sessionSecret()), { algorithms: ["HS256"], requiredClaims: ["exp", "iat", "sub"] });
+    if (payload.purpose !== "restore-application-session" || typeof payload.backupId !== "string" || typeof payload.sub !== "string")
+      return null;
+    backupId = payload.backupId;
+    subject = payload.sub;
+  } catch {
     return null;
-  const rec = await useStorage(runtimeConfig.sessionStorageBase).getItem(key(id));
-  await useStorage(runtimeConfig.sessionStorageBase).removeItem(key(id));
-  deleteCookie(event, runtimeConfig.sessionCookieName, { path: "/" });
-  return rec;
+  }
+  const rec = await readSessionRecordById(backupId);
+  return rec && rec.sub === subject && !rec.isImpersonation ? { id: backupId, rec } : null;
 }
-export async function readSessionRecordById(id) {
-  const { auth: runtimeConfig } = useRuntimeConfig();
-  return useStorage(runtimeConfig.sessionStorageBase).getItem(key(id));
+export async function destroySession(event) {
+  const session = await readSessionRecord(event);
+  const restore = await readSessionRestore(event);
+  if (restore)
+    await deleteSessionBackup(restore.id);
+  clearSessionRestoreCookie(event);
+  const auth = await localAuth(event);
+  if (session) {
+    const context = await auth.$context;
+    await context.internalAdapter.deleteSession(session.id);
+    if (session.rec.backupId)
+      await deleteSessionBackup(session.rec.backupId);
+  }
+  const response = await auth.api.signOut({ headers: requestHeaders(event), asResponse: true });
+  for (const cookie of response.headers.getSetCookie())
+    appendResponseHeader(event, "set-cookie", cookie);
+  return session?.rec ?? null;
 }
 export function toServerAuthSession(rec) {
   return {
+    expiresAt: rec.expiresAt,
     sub: rec.sub,
     email: rec.user.email,
     name: rec.user.name,
@@ -65,38 +219,12 @@ export async function getServerAuthSession(event) {
   const session = await readSessionRecord(event);
   return session ? toServerAuthSession(session.rec) : null;
 }
-export async function getFreshServerAuthSession(event, options = {}) {
-  const session = await readSessionRecord(event);
-  if (!session)
-    return null;
-  if (!options.force && Date.now() - session.rec.authorizationRefreshedAt <= AUTHORIZATION_TTL_MS)
-    return toServerAuthSession(session.rec);
-  try {
-    const context = await refreshAuthorizationContext(event, session.id, session.rec);
-    session.rec.activeOrg = context.organization.id;
-    session.rec.organizations = context.organizations;
-    session.rec.abilities = context.abilities;
-    session.rec.systemRole = context.systemRole;
-    session.rec.entitlement = context.entitlement;
-    session.rec.authorizationRefreshedAt = Date.now();
-    await writeSessionRecord(session.id, session.rec);
-    return toServerAuthSession(session.rec);
-  } catch (error) {
-    const status = error.statusCode ?? error.response?.status;
-    if (status === 401 || status === 403) {
-      session.rec.abilities = [];
-      session.rec.organizations = [];
-      session.rec.activeOrg = null;
-      session.rec.systemRole = null;
-      session.rec.authorizationRefreshedAt = Date.now();
-      await writeSessionRecord(session.id, session.rec);
-      throw createError({ statusCode: 403, statusMessage: "Authorization changed; sign in again" });
-    }
-    throw createError({ statusCode: 503, statusMessage: "Authorization service unavailable" });
-  }
+export async function getFreshServerAuthSession(event, _options = {}) {
+  return getServerAuthSession(event);
 }
 export function toPublicSession(rec) {
   return {
+    expiresAt: rec.expiresAt,
     user: rec.user,
     abilities: rec.abilities,
     systemRole: rec.systemRole,

package/dist/runtime/types.d.ts

@@ -1,4 +1,10 @@
+import type { MongoAbility } from '@casl/ability'
+
 declare module '#app' {
+  interface NuxtApp {
+    $ability: MongoAbility
+  }
+
   interface PageMeta {
     public?: boolean
     unauthenticatedOnly?: boolean
@@ -6,6 +12,12 @@ declare module '#app' {
   }
 }
 
+declare module 'vue' {
+  interface ComponentCustomProperties {
+    $ability: MongoAbility
+  }
+}
+
 declare module 'vue-router' {
   interface RouteMeta {
     public?: boolean

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@thecodeorigin/auth",
   "type": "module",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "private": false,
   "description": "THECODEORIGIN Authentication Portal client module",
   "repository": "https://github.com/thecodeorigin/auth",
@@ -47,17 +47,20 @@
     "lint": "eslint .",
     "test": "vitest run",
     "test:watch": "vitest watch",
+    "pretest:types": "pnpm dev:prepare",
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit"
   },
   "dependencies": {
-    "@casl/ability": "catalog:",
-    "@casl/vue": "catalog:",
-    "@nuxt/kit": "catalog:",
-    "defu": "catalog:",
-    "h3": "catalog:",
-    "ofetch": "catalog:",
-    "ufo": "catalog:",
-    "zod": "catalog:"
+    "@casl/ability": "^6.8.1",
+    "@casl/vue": "^2.2.6",
+    "@nuxt/kit": "^4.4.8",
+    "better-auth": "catalog:",
+    "defu": "^6.1.4",
+    "h3": "^1.14.0",
+    "jose": "catalog:",
+    "ofetch": "^1.4.1",
+    "ufo": "^1.5.4",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@antfu/eslint-config": "catalog:",
@@ -69,10 +72,12 @@
     "@types/node": "catalog:",
     "changelogen": "catalog:",
     "eslint": "catalog:",
+    "nitropack": "catalog:",
     "nuxt": "catalog:",
     "typescript": "catalog:",
     "unbuild": "catalog:",
     "vitest": "catalog:",
+    "vue": "catalog:",
     "vue-tsc": "catalog:"
   }
 }