@voltro/plugin-auth 0.5.0 → 0.6.0

package/dist/plugin.d.ts

@@ -7,9 +7,21 @@ import { VoltroPlugin } from '@voltro/protocol';
 import { YieldableError } from 'effect/Cause';
 
 declare interface AuthConfig {
-    readonly secret: string;
+    /**
+     * The session-signing key. OMIT IT and the value is read from
+     * `VOLTRO_SESSION_SECRET` when a request is actually handled.
+     *
+     * Omitting is the better default: `app.config.ts` is evaluated before the
+     * environment gate runs (and before `voltro dev` mints a project-local
+     * secret), so reading `process.env` here to pass a value is precisely what
+     * pushes apps into shipping a hardcoded fallback. Deferring the read means
+     * there is nothing to fall back TO.
+     *
+     * Pass one explicitly only when the key does not come from the environment.
+     */
+    readonly secret?: string;
     /** Explicit keyed secret set for zero-downtime rotation. When absent,
-     *  the set is derived from `secret` (current) + the
+     *  the set is derived from `secret` (or `VOLTRO_SESSION_SECRET`) plus the
      *  `VOLTRO_SESSION_SECRET_PREVIOUS` / `VOLTRO_SESSION_KID*` env vars —
      *  so env-var rotation works without setting this. Cookies are always
      *  SIGNED with the current key; verification also accepts `previous`. */

package/dist/plugin.js

@@ -1,4 +1,4 @@
 import "./session.js";
-import { n as e, t } from "./plugin-CRt-kdEA.js";
+import { n as e, t } from "./plugin-DOBoUVJ-.js";
 import "./csrf.js";
 export { t as authRoutesPlugin, e as getAuthSessionStrategy };

package/dist/session.d.ts

@@ -81,6 +81,4 @@ export declare const sessionSecretsOf: (secret: SessionSecretInput) => SessionSe
 
 export { VerifyResult }
 
-export declare const VOLTRO_DEV_SESSION_SECRET: "voltro-dev-session-secret-32b-DO-NOT-USE-IN-PROD";
-
 export { }

package/dist/session.js

@@ -1,20 +1,20 @@
-import { DEFAULT_SESSION_KID as e, VOLTRO_DEV_SESSION_SECRET as t, buildSetCookie as n, readCookie as r, resolveSessionSecret as i, resolveSessionSecrets as a, signSession as o, timingSafeStringEqual as s, verifySessionKeyed as c } from "@voltro/protocol/session";
+import { DEFAULT_SESSION_KID as e, buildSetCookie as t, readCookie as n, resolveOptionalSessionSecrets as r, resolveSessionSecret as i, resolveSessionSecrets as a, signSession as o, timingSafeStringEqual as s, verifySessionKeyed as c } from "@voltro/protocol/session";
 //#region src/session.ts
-var l = "voltro:session", u = 3600 * 24 * 7, d = t, f = i, p = a, m = (e) => typeof e == "string" ? e : e.current, h = (t) => {
+var l = "voltro:session", u = 3600 * 24 * 7, d = i, f = a, p = (e) => typeof e == "string" ? e : e.current, m = (t) => {
 	if (typeof t != "string") return t;
-	let n = a(), r = {
-		kid: s(n.current.secret, t) ? n.current.kid : e,
+	let n = r(), i = {
+		kid: n && s(n.current.secret, t) ? n.current.kid : e,
 		secret: t
 	};
-	return n.previous ? {
-		current: r,
+	return n?.previous ? {
+		current: i,
 		previous: n.previous
-	} : { current: r };
-}, g = (e, t, r = {}) => {
-	let i = r.ttlSeconds ?? u, a = o(e, m(t), { ttlSeconds: i });
+	} : { current: i };
+}, h = (e, n, r = {}) => {
+	let i = r.ttlSeconds ?? u, a = o(e, p(n), { ttlSeconds: i });
 	return {
 		value: a,
-		setCookie: n(l, a, {
+		setCookie: t(l, a, {
 			maxAgeSeconds: i,
 			httpOnly: !0,
 			sameSite: "lax",
@@ -23,10 +23,10 @@ var l = "voltro:session", u = 3600 * 24 * 7, d = t, f = i, p = a, m = (e) => typ
 			path: "/"
 		})
 	};
-}, _ = (e, t) => v(e, t)?.subject ?? null, v = (e, t, n = {}) => {
-	let i = r(e, l);
-	return i ? c(i, h(t), n) : null;
-}, y = (e = {}) => n(l, "", {
+}, g = (e, t) => _(e, t)?.subject ?? null, _ = (e, t, r = {}) => {
+	let i = n(e, l);
+	return i ? c(i, m(t), r) : null;
+}, v = (e = {}) => t(l, "", {
 	maxAgeSeconds: 0,
 	httpOnly: !0,
 	sameSite: "lax",
@@ -35,4 +35,4 @@ var l = "voltro:session", u = 3600 * 24 * 7, d = t, f = i, p = a, m = (e) => typ
 	path: "/"
 });
 //#endregion
-export { l as SESSION_COOKIE_NAME, d as VOLTRO_DEV_SESSION_SECRET, y as clearSessionCookie, g as issueSession, _ as readSession, v as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, h as sessionSecretsOf };
+export { l as SESSION_COOKIE_NAME, v as clearSessionCookie, h as issueSession, g as readSession, _ as readSessionKeyed, d as resolveSessionSecret, f as resolveSessionSecrets, m as sessionSecretsOf };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -78,8 +78,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.51.1",
-    "@voltro/database": "0.5.0",
-    "@voltro/protocol": "0.5.0"
+    "@voltro/database": "0.6.0",
+    "@voltro/protocol": "0.6.0"
   },
   "peerDependencies": {
     "effect": "^3.21.4",