@voult/core 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to `@voult/core` are documented here.
 
+## 0.2.1
+
+- New route `GET /session/renew?returnTo=/path`: renews the session from the refresh cookie, saves the new cookies and redirects back (or to `errorPath?voult_error=SESSION_EXPIRED`). For pages rendered where cookies can't be written, such as Next.js Server Components: renewing there would rotate the refresh token without saving it, and Voult's reuse detection would then end the session.
+- New entry point `@voult/core/cookies` (signing and cookie parsing only, no `@voult/sdk`), for Edge middleware.
+- `parseUserCookie` and `safeReturnTo` are exported.
+
 ## 0.2.0
 
 The router now serves every end-user feature, so apps write no auth route handlers. New routes (below the mount path):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voult/core",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "The Voult auth router on the Fetch API (Request \u2192 Response), shared by @voult/express and @voult/next",
   "type": "module",
   "main": "./src/index.js",
@@ -10,6 +10,11 @@
       "types": "./src/index.d.ts",
       "import": "./src/index.js",
       "default": "./src/index.js"
+    },
+    "./cookies": {
+      "types": "./src/index.d.ts",
+      "import": "./src/cookies.js",
+      "default": "./src/cookies.js"
     }
   },
   "sideEffects": false,

package/src/index.d.ts

@@ -88,6 +88,9 @@ export function restoreSession(
   config: VoultConfig
 ): IncomingSession;
 export function sessionCookies(client: VoultClient, incoming: IncomingSession, config: VoultConfig): CookieToSet[];
+/** `value` when it's a same-site relative path (`/x`, not `//x` or `https://…`), else `fallback`. */
+export function safeReturnTo(value: unknown, fallback: string): string;
+export function parseUserCookie(value: unknown): Record<string, unknown> | null;
 export function renewSession(client: VoultClient, read: ReadCookie, config: VoultConfig): Promise<CookieToSet[]>;
 
 export function readCookieHeader(header: string | null | undefined, secret?: string): Promise<{

package/src/index.js

@@ -3,6 +3,7 @@
 export { createVoultHandler } from './handler.js';
 export { loadConfigFromEnv, resolveConfig } from './config.js';
 export { normalizeVoultError } from './errors.js';
+export { safeReturnTo } from './oauth.js';
 export {
   COOKIE_ACCESS,
   COOKIE_MFA_PENDING,
@@ -11,6 +12,7 @@ export {
   COOKIE_USER,
   createVoultClient,
   getSessionFromRequest,
+  parseUserCookie,
   renewSession,
   restoreSession,
   sessionCookies,

package/src/oauth.js

@@ -100,6 +100,19 @@ export function oauthRoutes() {
   let providersCache = { at: 0, value: null };
 
   return [
+    // For pages rendered where cookies can't be written (Next.js Server Components): renewing
+    // there would rotate the refresh token without saving it. They send the browser here
+    // instead; this renews, saves the new cookies and goes back.
+    ['GET', '/session/renew', async (ctx) => {
+      // The caller already knows the access token is stale (its cookie outlives the token).
+      ctx.client.accessToken = null;
+      await ctx.renew();
+      const back = safeReturnTo(ctx.query('returnTo'), ctx.config.oauth.successPath);
+      return ctx.client.accessToken
+        ? redirect(appLocation(ctx.config, back))
+        : redirectWithError(ctx.config, 'SESSION_EXPIRED', 'Please sign in again.');
+    }],
+
     ['GET', '/oauth/providers', async (ctx) => {
       if (!providersCache.value || Date.now() - providersCache.at > PROVIDERS_CACHE_MS) {
         const info = await getAppInfo(ctx.client);