@webtypen/webframez-core 0.3.74 → 0.3.76

package/auth-client.js

@@ -8,6 +8,7 @@ function csrfCookie(name) {
 exports.createAuthFetch = function createAuthFetch(options = {}, originalFetch = window.fetch.bind(window)) {
     const base = (options.basePath || "/api/auth").replace(/\/+$/, "");
     const loginPaths = options.loginPaths || [`${base}/login`];
+    let refreshing;
     return async (input, init) => {
         const url = new URL(input instanceof Request ? input.url : String(input), window.location.href);
         const method = String(init?.method || (input instanceof Request ? input.method : "GET")).toUpperCase();
@@ -21,7 +22,36 @@ exports.createAuthFetch = function createAuthFetch(options = {}, originalFetch =
         } else token = csrfCookie(options.cookieName);
         const headers = new Headers(init?.headers || (input instanceof Request ? input.headers : undefined));
         if (typeof token === "string" && token) headers.set("X-CSRF-Token", token);
-        return originalFetch(input, { ...init, headers });
+        const retryInput = input instanceof Request ? input.clone() : input;
+        const response = await originalFetch(input, { ...init, headers });
+        if (loginPaths.includes(url.pathname) || url.pathname.startsWith(`${base}/`)
+            || ![401, 403].includes(response.status)) return response;
+        const failure = await response.clone().json().catch(() => null);
+        if (!["unauthorized", "invalid_csrf"].includes(failure?.code)) return response;
+        const performRefresh = () => {
+            const refreshHeaders = new Headers();
+            const csrf = csrfCookie(options.cookieName);
+            if (csrf) refreshHeaders.set("X-CSRF-Token", csrf);
+            return originalFetch(`${base}/refresh`, { method: "POST", credentials: "same-origin", headers: refreshHeaders });
+        };
+        const retry = () => {
+            const nextCsrf = csrfCookie(options.cookieName);
+            if (nextCsrf) headers.set("X-CSRF-Token", nextCsrf);
+            return originalFetch(retryInput, { ...init, headers });
+        };
+        if (typeof navigator !== "undefined" && navigator.locks) {
+            // Hold the shared tab lock through the retry so another refresh cannot invalidate it.
+            return navigator.locks.request(`webframez-auth:${base}`, async () => {
+                const renewed = await performRefresh().then(result => result.ok, () => false);
+                return renewed ? retry() : response;
+            });
+        }
+        if (!refreshing) {
+            refreshing = performRefresh().then(result => result.ok, () => false)
+                .finally(() => { refreshing = undefined; });
+        }
+        if (!await refreshing) return response;
+        return retry();
     };
 };
 

package/dist/Auth/Auth.d.ts

@@ -1,3 +1,4 @@
+import { Model } from "../Database/Model";
 import type { Request } from "../Router/Request";
 import type { Response } from "../Router/Response";
 import { AuthScope, AuthScopeOptions, AuthOperation, AuthRouteOptions } from "./ModelAuth";
@@ -13,6 +14,7 @@ export declare class AuthFacade {
     private initialized;
     init(): void;
     scope(key?: string): AuthScope;
+    revokeUserSessions(model: typeof Model, subject: string): Promise<void>;
     registerScope(key: string, config: Partial<AuthScopeOptions>): AuthScope;
 }
 export declare const Auth: AuthFacade;

package/dist/Auth/Auth.js

@@ -1,11 +1,21 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authRoute = exports.Auth = exports.AuthFacade = void 0;
 const Config_1 = require("../Config");
 const Model_1 = require("../Database/Model");
 const ModelAuth_1 = require("./ModelAuth");
 function mergeOptions(base, config) {
-    return Object.assign(Object.assign(Object.assign({ model: Model_1.Model }, base), config), { fields: Object.assign(Object.assign({}, base.fields), config.fields), session: Object.assign(Object.assign({}, base.session), config.session), messages: Object.assign(Object.assign({}, base.messages), config.messages) });
+    return Object.assign(Object.assign(Object.assign({ model: Model_1.Model }, base), config), { fields: Object.assign(Object.assign({}, base.fields), config.fields), session: Object.assign(Object.assign({}, base.session), config.session), passwordReset: config.passwordReset === false ? false : config.passwordReset === undefined && base.passwordReset === false ? false
+            : Object.assign(Object.assign({}, (base.passwordReset || {})), (config.passwordReset || {})), messages: Object.assign(Object.assign({}, base.messages), config.messages) });
 }
 /** Application-wide registry of named browser-authentication scopes. */
 class AuthFacade {
@@ -35,6 +45,15 @@ class AuthFacade {
             throw new Error(`Auth scope "${key}" is not registered.`);
         return scope;
     }
+    revokeUserSessions(model, subject) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.init();
+            for (const scope of this.scopes.values()) {
+                if (scope.configuration.model === model)
+                    yield scope.sessions.revokeAll(subject);
+            }
+        });
+    }
     registerScope(key, config) {
         var _a;
         this.init();

package/dist/Auth/ModelAuth.d.ts

@@ -1,6 +1,7 @@
 import { Model } from "../Database/Model";
 import { Request } from "../Router/Request";
 import type { Response } from "../Router/Response";
+import { PasswordReset, PasswordResetOptions } from "./PasswordReset";
 import { AuthSession, SessionAuthOptions } from "./SessionAuth";
 import { WebAuth, WebAuthError, WebAuthOptions } from "./WebAuth";
 export type AuthContext<TUser extends Model = Model> = {
@@ -24,6 +25,7 @@ export type ModelAuthOptions = Partial<WebAuthOptions> & {
     locale?: "en" | "de";
     /** Record browser metadata and update activity at most once per minute. */
     trackActivity?: boolean;
+    passwordReset?: PasswordResetOptions | false;
     fields?: {
         identifier?: string;
         password?: string;
@@ -56,10 +58,18 @@ export type AuthRouteOptions = Partial<ModelAuthOptions> & {
 export declare class AuthScope extends WebAuth {
     private readonly modelOptions;
     readonly key: string;
+    readonly passwordReset: PasswordReset | null;
     private readonly model;
+    private authPaths;
     private readonly sessionUsers;
     private readonly fields;
     constructor(modelOptions: ModelAuthOptions);
+    configureRoutes(basePath: string, loginPath?: string): void;
+    get browserConfiguration(): {
+        basePath: string;
+        loginPaths: string[];
+        cookieName: string;
+    };
     get configuration(): ModelAuthOptions;
     private message;
     /** Use this when creating users; existing bcrypt hashes are supported without migration. */
@@ -68,7 +78,7 @@ export declare class AuthScope extends WebAuth {
     login(req: Request, res: Response, verifyCredentials?: () => Promise<string | null>): Promise<AuthSession>;
     logout(req: Request, res: Response): Promise<void>;
     /** Resolve a fresh validated session and its model; never trusts a client-supplied req.auth. */
-    resolve<TUser extends Model = Model>(req: Request): Promise<AuthContext<TUser> | null>;
+    resolve<TUser extends Model = Model>(req: Request, res?: Response): Promise<AuthContext<TUser> | null>;
     resolveCookies<TUser extends Model = Model>(cookies: Record<string, string | undefined>): Promise<AuthContext<TUser> | null>;
     /** Only explicit public fields are sent to browsers; Model instances remain on the server. */
     snapshot(auth: AuthContext | null | undefined): AuthSnapshot | null;

package/dist/Auth/ModelAuth.js

@@ -11,8 +11,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ModelAuth = exports.AuthScope = exports.AuthLoginError = void 0;
 const bcryptjs_1 = require("bcryptjs");
+const routing_1 = require("../routing");
 const Config_1 = require("../Config");
 const Request_1 = require("../Router/Request");
+const Auth_1 = require("./Auth");
+const PasswordReset_1 = require("./PasswordReset");
 const AuthSecurity_1 = require("./AuthSecurity");
 const SessionAuth_1 = require("./SessionAuth");
 const WebAuth_1 = require("./WebAuth");
@@ -57,7 +60,7 @@ let dummyHash;
 /** Model-backed browser authentication with secure default routes and revocable sessions. */
 class AuthScope extends WebAuth_1.WebAuth {
     constructor(modelOptions) {
-        var _a, _b, _c, _d, _e, _f, _g;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         if (modelOptions.csrfDisabled)
             throw new Error("Browser auth routes require CSRF protection.");
         if (!modelOptions.model)
@@ -73,7 +76,7 @@ class AuthScope extends WebAuth_1.WebAuth {
                 && (!modelOptions.isUserAllowed || (yield modelOptions.isUserAllowed(user))));
         });
         const sessionUsers = new WeakMap();
-        const sessions = new SessionAuth_1.SessionAuth(Object.assign(Object.assign({ accessTokenSeconds: 30 * 86400, sessionSeconds: 30 * 86400 }, modelOptions.session), { issuer: origin, scope: key, audience: (_d = (_b = modelOptions.audience) !== null && _b !== void 0 ? _b : (_c = modelOptions.session) === null || _c === void 0 ? void 0 : _c.audience) !== null && _d !== void 0 ? _d : origin, connection: ((_e = modelOptions.session) === null || _e === void 0 ? void 0 : _e.connection) || new model().__connection, isSessionAllowed: (session) => __awaiter(this, void 0, void 0, function* () {
+        const sessions = new SessionAuth_1.SessionAuth(Object.assign(Object.assign({ accessTokenSeconds: 15 * 60, sessionSeconds: 30 * 86400, idleTimeoutSeconds: 7 * 86400 }, modelOptions.session), { issuer: origin, scope: key, audience: (_d = (_b = modelOptions.audience) !== null && _b !== void 0 ? _b : (_c = modelOptions.session) === null || _c === void 0 ? void 0 : _c.audience) !== null && _d !== void 0 ? _d : origin, connection: ((_e = modelOptions.session) === null || _e === void 0 ? void 0 : _e.connection) || new model().__connection, isSessionAllowed: (session) => __awaiter(this, void 0, void 0, function* () {
                 const id = fields.primaryKey === "_id" ? yield model.objectId(session.subject, { noExceptions: true }) : session.subject;
                 const user = id !== null && id !== undefined ? yield model.where(fields.primaryKey, "=", id).first() : null;
                 if (!(yield allowed(user)))
@@ -83,10 +86,23 @@ class AuthScope extends WebAuth_1.WebAuth {
             }) }));
         super(sessions, Object.assign(Object.assign({}, modelOptions), { origin, cookiePrefix: (_f = modelOptions.cookiePrefix) !== null && _f !== void 0 ? _f : (key === "main" ? undefined : `${origin.startsWith("https:") ? "__Host-wf_" : "wf_dev_"}${key}_`), allowInsecureLocalhost: (_g = modelOptions.allowInsecureLocalhost) !== null && _g !== void 0 ? _g : true }));
         this.modelOptions = modelOptions;
+        this.authPaths = { basePath: "/api/auth", loginPath: "/api/auth/login" };
         this.key = key;
         this.sessionUsers = sessionUsers;
         this.model = model;
         this.fields = fields;
+        this.passwordReset = modelOptions.passwordReset === false ? null : new PasswordReset_1.PasswordReset(model, key, fields, modelOptions.passwordReset || {}, (user) => __awaiter(this, void 0, void 0, function* () { return allowed(user); }), (user, mode) => __awaiter(this, void 0, void 0, function* () {
+            const subject = String(user[fields.primaryKey]);
+            yield this.sessions.revokeAll(subject);
+            if (mode === "all")
+                yield Auth_1.Auth.revokeUserSessions(model, subject);
+        }), (_h = modelOptions.session) === null || _h === void 0 ? void 0 : _h.database);
+    }
+    configureRoutes(basePath, loginPath) {
+        this.authPaths = { basePath, loginPath: loginPath || `${basePath}/login` };
+    }
+    get browserConfiguration() {
+        return { basePath: (0, routing_1.appPath)(this.authPaths.basePath), loginPaths: [(0, routing_1.appPath)(this.authPaths.loginPath)], cookieName: this.cookies.prefix + "csrf" };
     }
     get configuration() {
         return this.modelOptions;
@@ -176,13 +192,15 @@ class AuthScope extends WebAuth_1.WebAuth {
         });
     }
     /** Resolve a fresh validated session and its model; never trusts a client-supplied req.auth. */
-    resolve(req) {
+    resolve(req, res) {
         const _super = Object.create(null, {
-            authenticate: { get: () => super.authenticate }
+            authenticate: { get: () => super.authenticate },
+            resume: { get: () => super.resume }
         });
         return __awaiter(this, void 0, void 0, function* () {
+            res === null || res === void 0 ? void 0 : res.header("Cache-Control", "no-store");
             Object.defineProperty(req, "auth", { value: null, writable: true, configurable: true, enumerable: false });
-            const session = yield _super.authenticate.call(this, req);
+            const session = (yield _super.authenticate.call(this, req)) || (res ? yield _super.resume.call(this, req, res) : null);
             if (!session)
                 return null;
             const user = this.sessionUsers.get(session);
@@ -212,7 +230,7 @@ class AuthScope extends WebAuth_1.WebAuth {
         const user = {};
         for (const field of fields) {
             if (field.startsWith("__") || field === this.fields.password || ((_a = auth.user.__hidden) === null || _a === void 0 ? void 0 : _a.includes(field))
-                || ["constructor", "prototype"].includes(field))
+                || field.startsWith("auth_reset_") || ["constructor", "prototype"].includes(field))
                 continue;
             const value = auth.user[field];
             if (value !== undefined)
@@ -224,7 +242,7 @@ class AuthScope extends WebAuth_1.WebAuth {
     middleware(options = {}) {
         return (next, reject, req, res) => __awaiter(this, void 0, void 0, function* () {
             try {
-                const auth = yield this.resolve(req);
+                const auth = yield this.resolve(req, res);
                 res.header("Cache-Control", "no-store");
                 if (!auth && options.required) {
                     res.status(401).send({ status: "error", code: "unauthorized" });

package/dist/Auth/PasswordReset.d.ts

@@ -0,0 +1,40 @@
+import type { DocumentDatabase } from "../Database/DatabaseAdapter";
+import { Model } from "../Database/Model";
+export type PasswordResetOptions = {
+    tokenSeconds?: number;
+    cooldownSeconds?: number;
+    /** Revoke registered scopes using the same model, only this scope, or leave sessions intact. */
+    revokeSessions?: "all" | "scope" | false;
+};
+export type PasswordResetDelivery = (user: Model, token: string, expiresAt: number) => void | Promise<void>;
+/** Framework adapter: the password change and token consumption are one conditional database update. */
+export declare class PasswordReset {
+    private readonly model;
+    private readonly key;
+    private readonly fields;
+    private readonly options;
+    private readonly allowed;
+    private readonly invalidate;
+    private readonly database?;
+    readonly tokenSeconds: number;
+    readonly cooldownSeconds: number;
+    readonly revokeSessions: "all" | "scope" | false;
+    readonly hiddenFields: string[];
+    private readonly hashField;
+    private readonly expiresField;
+    private readonly requestedField;
+    constructor(model: typeof Model, key: string, fields: {
+        identifier: string;
+        password: string;
+        primaryKey: string;
+        active: string | false;
+    }, options: PasswordResetOptions, allowed: (user: Model) => boolean | Promise<boolean>, invalidate: (user: Model, mode: "all" | "scope") => Promise<void>, database?: (() => Promise<DocumentDatabase>) | undefined);
+    private rows;
+    private digest;
+    private userForToken;
+    /** No account-existence result is returned. Deliver the raw token only through a trusted server callback. */
+    request(identifier: string, deliver: PasswordResetDelivery): Promise<void>;
+    /** A non-consuming check for the reset form; reset() always checks again atomically. */
+    validate(token: string): Promise<Model | null>;
+    reset(token: string, password: string): Promise<Model | null>;
+}

package/dist/Auth/PasswordReset.js

@@ -0,0 +1,111 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordReset = void 0;
+const bcryptjs_1 = require("bcryptjs");
+const DBConnection_1 = require("../Database/DBConnection");
+const AuthSecurity_1 = require("./AuthSecurity");
+/** Framework adapter: the password change and token consumption are one conditional database update. */
+class PasswordReset {
+    constructor(model, key, fields, options, allowed, invalidate, database) {
+        var _a;
+        this.model = model;
+        this.key = key;
+        this.fields = fields;
+        this.options = options;
+        this.allowed = allowed;
+        this.invalidate = invalidate;
+        this.database = database;
+        this.tokenSeconds = (0, AuthSecurity_1.authLifetime)(options.tokenSeconds, 15 * 60);
+        this.cooldownSeconds = (0, AuthSecurity_1.authLifetime)(options.cooldownSeconds, 3 * 60);
+        this.revokeSessions = (_a = options.revokeSessions) !== null && _a !== void 0 ? _a : "all";
+        if (!["all", "scope", false].includes(this.revokeSessions))
+            throw new Error("Invalid password reset session policy.");
+        const prefix = `auth_reset_${key}_`;
+        this.hashField = prefix + "hash";
+        this.expiresField = prefix + "expires_at";
+        this.requestedField = prefix + "requested_at";
+        this.hiddenFields = [this.hashField, this.expiresField, this.requestedField];
+    }
+    rows() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const instance = new this.model();
+            const db = yield (this.database ? this.database() : DBConnection_1.DBConnection.getDocumentStore(instance.__connection));
+            return db.collection(instance.__table);
+        });
+    }
+    digest(token, user) {
+        // Bind reset tokens to the scope and current password: a later password change invalidates them.
+        return (0, AuthSecurity_1.hashAuthToken)(`${this.key}\0${token}\0${user[this.fields.password]}`);
+    }
+    userForToken(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof token !== "string" || !/^[A-Za-z0-9_-]{1,128}\.[A-Za-z0-9_-]{43}$/.test(token))
+                return null;
+            const subject = token.split(".")[0];
+            const id = this.fields.primaryKey === "_id" ? yield this.model.objectId(subject, { noExceptions: true }) : subject;
+            if (id == null)
+                return null;
+            const user = yield this.model.where(this.fields.primaryKey, "=", id).first();
+            if (!user || typeof user[this.fields.password] !== "string" || !(yield this.allowed(user)))
+                return null;
+            return user;
+        });
+    }
+    /** No account-existence result is returned. Deliver the raw token only through a trusted server callback. */
+    request(identifier, deliver) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof identifier !== "string" || !identifier.trim() || identifier.length > 320)
+                return;
+            const user = yield this.model.where(this.fields.identifier, "=", identifier.trim().toLowerCase()).first();
+            if (!user || typeof user[this.fields.password] !== "string" || !(yield this.allowed(user)))
+                return;
+            const now = Date.now(), expiresAt = now + this.tokenSeconds * 1000;
+            const token = `${user[this.fields.primaryKey]}.${(0, AuthSecurity_1.randomAuthToken)()}`;
+            const filter = { [this.fields.primaryKey]: user[this.fields.primaryKey],
+                [this.fields.password]: user[this.fields.password],
+                $or: [{ [this.requestedField]: { $exists: false } }, { [this.requestedField]: { $lte: now - this.cooldownSeconds * 1000 } }] };
+            const updated = yield (yield this.rows()).findOneAndUpdate(filter, { $set: { [this.hashField]: this.digest(token, user), [this.expiresField]: expiresAt, [this.requestedField]: now } }, { returnDocument: "after" });
+            if (updated)
+                yield deliver(user, token, expiresAt);
+        });
+    }
+    /** A non-consuming check for the reset form; reset() always checks again atomically. */
+    validate(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.userForToken(token);
+            if (!user)
+                return null;
+            const row = yield (yield this.rows()).findOne({ [this.fields.primaryKey]: user[this.fields.primaryKey],
+                [this.fields.password]: user[this.fields.password], [this.hashField]: this.digest(token, user), [this.expiresField]: { $gt: Date.now() } });
+            return row ? user : null;
+        });
+    }
+    reset(token, password) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof password !== "string" || !password || password.length > 1024)
+                throw new Error("Invalid password.");
+            const user = yield this.validate(token);
+            if (!user)
+                return null;
+            const stored = user[this.fields.password];
+            const nextPassword = yield (0, bcryptjs_1.hash)(password, 12);
+            const row = yield (yield this.rows()).findOneAndUpdate(Object.assign({ [this.fields.primaryKey]: user[this.fields.primaryKey], [this.fields.password]: stored, [this.hashField]: this.digest(token, user), [this.expiresField]: { $gt: Date.now() } }, (this.fields.active === false ? {} : { [this.fields.active]: { $ne: false } })), { $set: { [this.fields.password]: nextPassword }, $unset: { [this.hashField]: "", [this.expiresField]: "" } }, { returnDocument: "after" });
+            if (!row)
+                return null;
+            user[this.fields.password] = nextPassword;
+            if (this.revokeSessions !== false)
+                yield this.invalidate(user, this.revokeSessions);
+            return user;
+        });
+    }
+}
+exports.PasswordReset = PasswordReset;

package/dist/Auth/SessionAuth.d.ts

@@ -34,6 +34,8 @@ export type SessionAuthOptions = {
     collection?: string;
     accessTokenSeconds?: number;
     sessionSeconds?: number;
+    /** Maximum inactivity; false disables the idle limit. */
+    idleTimeoutSeconds?: number | false;
     /** Called on creation, authentication and refresh. Check account status and tenant membership here.
      * For federated sessions this can also introspect the parent authority session. Failures fail closed. */
     isSessionAllowed: (session: AuthSession) => boolean | Promise<boolean>;
@@ -48,10 +50,12 @@ export declare class SessionAuth {
     private readonly scope;
     private readonly accessSeconds;
     private readonly sessionSeconds;
+    private readonly idleSeconds;
     constructor(options: SessionAuthOptions);
     private ids;
     private sessionId;
     private rows;
+    private liveFilter;
     private allowed;
     private pair;
     create(subject: string, parent?: AuthSession["parent"]): Promise<CreatedAuthSession>;
@@ -61,6 +65,10 @@ export declare class SessionAuth {
     verifyCsrf(token: string, csrf: string, kind?: "access" | "refresh"): Promise<boolean>;
     /** One winner under concurrency. A previously consumed refresh token revokes its device session. */
     refresh(token: string): Promise<SessionTokenPair | null>;
+    /** Trusted server refresh-secret lookup; never expose as a public endpoint. */
+    inspectRefresh(token: string): Promise<AuthSession | null>;
+    /** Trusted browser GET resumption: renew access without consuming or replaying refresh rotation. */
+    renewAccess(token: string): Promise<SessionTokenPair | null>;
     /** Browser login metadata; arbitrary request data and token hashes are never exposed. */
     recordLogin(session: AuthSession, userAgent: string): Promise<void>;
     /** Persist activity with a one-minute throttle; authorization does not depend on this timestamp. */

package/dist/Auth/SessionAuth.js

@@ -27,6 +27,7 @@ class SessionAuth {
             environment: options.environment === undefined ? null : (0, AuthSecurity_1.authText)(options.environment, "environment") };
         this.accessSeconds = (0, AuthSecurity_1.authLifetime)(options.accessTokenSeconds, 15 * 60);
         this.sessionSeconds = (0, AuthSecurity_1.authLifetime)(options.sessionSeconds, 30 * 86400);
+        this.idleSeconds = options.idleTimeoutSeconds === undefined || options.idleTimeoutSeconds === false ? false : (0, AuthSecurity_1.authLifetime)(options.idleTimeoutSeconds, 7 * 86400);
         if (typeof options.isSessionAllowed !== "function")
             throw new Error("SessionAuth requires isSessionAllowed.");
     }
@@ -45,9 +46,17 @@ class SessionAuth {
             return db.collection(this.options.collection || "auth_sessions");
         });
     }
+    liveFilter(now = Date.now()) {
+        return Object.assign({ revokedAt: null, expiresAt: { $gt: now }, createdAt: { $gt: now - this.sessionSeconds * 1000 } }, (this.idleSeconds === false ? {} : { $and: [{ $or: [
+                        { lastActiveAt: { $gt: now - this.idleSeconds * 1000 } },
+                        { lastActiveAt: { $exists: false }, createdAt: { $gt: now - this.idleSeconds * 1000 } },
+                    ] }] }));
+    }
     allowed(record) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            if (!record || record.revokedAt !== null || !Number.isFinite(record.expiresAt) || record.expiresAt <= Date.now())
+            if (!record || record.revokedAt !== null || !Number.isFinite(record.expiresAt) || Math.min(record.expiresAt, record.createdAt + this.sessionSeconds * 1000) <= Date.now()
+                || (this.idleSeconds !== false && ((_a = record.lastActiveAt) !== null && _a !== void 0 ? _a : record.createdAt) + this.idleSeconds * 1000 <= Date.now()))
                 return null;
             const session = publicSession(record);
             return (yield this.options.isSessionAllowed(session)) ? session : null;
@@ -55,7 +64,7 @@ class SessionAuth {
     }
     pair(record, access, refresh) {
         return { auth_token: access, refresh_token: refresh, auth_expires_at: record.accessExpiresAt,
-            refresh_expires_at: record.expiresAt, session: publicSession(record) };
+            refresh_expires_at: Math.min(record.expiresAt, record.createdAt + this.sessionSeconds * 1000), session: publicSession(record) };
     }
     create(subject, parent = null) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -66,7 +75,7 @@ class SessionAuth {
             }
             const now = Date.now(), id = this.ids().create();
             const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, refresh = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, csrf = (0, AuthSecurity_1.randomAuthToken)();
-            const record = Object.assign(Object.assign({ _id: id, _subject: this.ids().create(subject) }, this.scope), { parent: parent ? Object.assign({}, parent) : null, createdAt: now, expiresAt: now + this.sessionSeconds * 1000, accessExpiresAt: now + Math.min(this.accessSeconds, this.sessionSeconds) * 1000, accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh), csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf), usedRefreshHashes: [], revokedAt: null });
+            const record = Object.assign(Object.assign({ _id: id, _subject: this.ids().create(subject) }, this.scope), { parent: parent ? Object.assign({}, parent) : null, createdAt: now, lastActiveAt: now, expiresAt: now + this.sessionSeconds * 1000, accessExpiresAt: now + Math.min(this.accessSeconds, this.sessionSeconds) * 1000, accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh), csrfHash: (0, AuthSecurity_1.hashAuthToken)(csrf), usedRefreshHashes: [], revokedAt: null });
             if (!(yield this.allowed(record)))
                 throw new Error("Session is not allowed.");
             yield (yield this.rows()).insertOne(record);
@@ -78,8 +87,11 @@ class SessionAuth {
             const id = tokenSessionId(token);
             if (!id)
                 return null;
-            const row = yield (yield this.rows()).findOne(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { accessHash: (0, AuthSecurity_1.hashAuthToken)(token), accessExpiresAt: { $gt: Date.now() } }));
-            return this.allowed(row);
+            const row = yield (yield this.rows()).findOne(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), this.liveFilter()), { accessHash: (0, AuthSecurity_1.hashAuthToken)(token), accessExpiresAt: { $gt: Date.now() } }));
+            const session = yield this.allowed(row);
+            if (session && this.idleSeconds !== false)
+                yield this.touch(session);
+            return session;
         });
     }
     /** Trusted-server introspection; never expose this method as an unauthenticated endpoint. */
@@ -120,8 +132,9 @@ class SessionAuth {
                 return null;
             }
             const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, refresh = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`;
-            const next = yield rows.findOneAndUpdate(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: hash, revokedAt: null, expiresAt: { $gt: Date.now() } }), { $set: { accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh),
-                    accessExpiresAt: Math.min(Date.now() + this.accessSeconds * 1000, row.expiresAt),
+            const next = yield rows.findOneAndUpdate(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: hash }), this.liveFilter()), { $set: { accessHash: (0, AuthSecurity_1.hashAuthToken)(access), refreshHash: (0, AuthSecurity_1.hashAuthToken)(refresh),
+                    accessExpiresAt: Math.min(Date.now() + this.accessSeconds * 1000, row.expiresAt, row.createdAt + this.sessionSeconds * 1000),
+                    lastActiveAt: Date.now(),
                     usedRefreshHashes: [...row.usedRefreshHashes, hash] } }, { returnDocument: "after" });
             if (!next) {
                 // Also detect simultaneous replay that lost the compare-and-swap.
@@ -131,6 +144,34 @@ class SessionAuth {
             return this.pair(next, access, refresh);
         });
     }
+    /** Trusted server refresh-secret lookup; never expose as a public endpoint. */
+    inspectRefresh(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const id = tokenSessionId(token);
+            if (!id)
+                return null;
+            return this.allowed(yield (yield this.rows()).findOne(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter())));
+        });
+    }
+    /** Trusted browser GET resumption: renew access without consuming or replaying refresh rotation. */
+    renewAccess(token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const id = tokenSessionId(token);
+            if (!id)
+                return null;
+            const rows = yield this.rows();
+            const filter = Object.assign(Object.assign(Object.assign(Object.assign({ _id: this.sessionId(id) }, this.scope), { refreshHash: (0, AuthSecurity_1.hashAuthToken)(token) }), this.liveFilter()), { accessExpiresAt: { $lte: Date.now() } });
+            const row = yield rows.findOne(filter);
+            if (!row || !(yield this.allowed(row)))
+                return null;
+            const access = `${id}.${(0, AuthSecurity_1.randomAuthToken)()}`, now = Date.now();
+            const next = yield rows.findOneAndUpdate(filter, { $set: { accessHash: (0, AuthSecurity_1.hashAuthToken)(access),
+                    accessExpiresAt: Math.min(now + this.accessSeconds * 1000, row.expiresAt, row.createdAt + this.sessionSeconds * 1000),
+                    lastActiveAt: now } }, { returnDocument: "after" });
+            const session = next ? yield this.allowed(next) : null;
+            return next && session ? Object.assign(Object.assign({}, this.pair(next, access, token)), { session }) : null;
+        });
+    }
     /** Browser login metadata; arbitrary request data and token hashes are never exposed. */
     recordLogin(session, userAgent) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -144,9 +185,9 @@ class SessionAuth {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
             const now = Date.now();
-            if (((_a = session.lastActiveAt) !== null && _a !== void 0 ? _a : session.createdAt) >= now - 60000)
+            if (((_a = session.lastActiveAt) !== null && _a !== void 0 ? _a : session.createdAt) >= now - (this.idleSeconds === false ? 60000 : Math.min(60000, this.idleSeconds * 250)))
                 return;
-            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: this.sessionId(session.id) }, this.scope), { revokedAt: null, expiresAt: { $gt: now } }), { $set: { lastActiveAt: now } });
+            yield (yield this.rows()).updateOne(Object.assign(Object.assign({ _id: this.sessionId(session.id) }, this.scope), this.liveFilter(now)), { $max: { lastActiveAt: now } });
             session.lastActiveAt = now;
         });
     }
@@ -165,14 +206,21 @@ class SessionAuth {
     list(subject) {
         return __awaiter(this, void 0, void 0, function* () {
             (0, AuthSecurity_1.authText)(subject, "subject");
-            const rows = yield (yield this.rows()).find(Object.assign(Object.assign({ _subject: this.ids().create(subject) }, this.scope), { revokedAt: null, expiresAt: { $gt: Date.now() } })).toArray();
+            const rows = yield (yield this.rows()).find(Object.assign(Object.assign({ _subject: this.ids().create(subject) }, this.scope), this.liveFilter())).toArray();
             return rows.map(publicSession);
         });
     }
     /** Run periodically; authorization checks never depend on cleanup scheduling. */
     cleanup() {
         return __awaiter(this, void 0, void 0, function* () {
-            yield (yield this.rows()).deleteMany(Object.assign(Object.assign({}, this.scope), { expiresAt: { $lte: Date.now() } }));
+            const now = Date.now();
+            yield (yield this.rows()).deleteMany(Object.assign(Object.assign({}, this.scope), { $or: [
+                    { expiresAt: { $lte: now } }, { createdAt: { $lte: now - this.sessionSeconds * 1000 } },
+                    ...(this.idleSeconds === false ? [] : [
+                        { lastActiveAt: { $lte: now - this.idleSeconds * 1000 } },
+                        { lastActiveAt: { $exists: false }, createdAt: { $lte: now - this.idleSeconds * 1000 } },
+                    ]),
+                ] }));
         });
     }
 }

package/dist/Auth/WebAuth.d.ts

@@ -32,6 +32,8 @@ export declare class WebAuth {
     /** GET /auth/csrf, fetched from this origin. Also protects login before a user session exists. */
     bootstrap(req: Request, res: Response): string;
     private writePair;
+    /** GET/HEAD only. A current refresh secret and matching session-bound CSRF cookie are required. */
+    resume(req: Request, res: Response): Promise<AuthSession | null>;
     /** Credential verification is supplied by the app, after CSRF checks. Never accepts a user ID from the browser. */
     login(req: Request, res: Response, verifyCredentials: () => Promise<string | null>): Promise<AuthSession>;
     /** Trusted-server entry point after a validated SSO callback (not a public login endpoint). */

package/dist/Auth/WebAuth.js

@@ -86,6 +86,24 @@ class WebAuth {
         this.cookies.write(res, "access", pair.auth_token, (pair.auth_expires_at - Date.now()) / 1000);
         this.cookies.write(res, "refresh", pair.refresh_token, (pair.refresh_expires_at - Date.now()) / 1000);
     }
+    /** GET/HEAD only. A current refresh secret and matching session-bound CSRF cookie are required. */
+    resume(req, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!["GET", "HEAD"].includes(req.method))
+                return null;
+            const token = this.cookies.read(req, "refresh"), csrf = this.cookies.read(req, "csrf");
+            if (!(yield this.sessions.verifyCsrf(token, csrf, "refresh")))
+                return null;
+            const pair = yield this.sessions.renewAccess(token);
+            if (!pair)
+                return this.sessions.inspectRefresh(token);
+            this.writePair(res, pair);
+            const name = this.cookies.prefix + "access";
+            const cookies = (0, AuthSecurity_1.authHeader)(req, "cookie").split(";").map(value => value.trim()).filter(value => value && !value.startsWith(`${name}=`));
+            req.headers = Object.assign(Object.assign({}, req.headers), { cookie: [...cookies, `${name}=${encodeURIComponent(pair.auth_token)}`].join("; ") });
+            return pair.session;
+        });
+    }
     /** Credential verification is supplied by the app, after CSRF checks. Never accepts a user ID from the browser. */
     login(req, res, verifyCredentials) {
         return __awaiter(this, void 0, void 0, function* () {

package/dist/Auth/index.d.ts

@@ -6,3 +6,4 @@ export * from "./WebAuth";
 export * from "./SingleSignOn";
 export * from "./ModelAuth";
 export * from "./Auth";
+export * from "./PasswordReset";

package/dist/Auth/index.js

@@ -22,3 +22,4 @@ __exportStar(require("./WebAuth"), exports);
 __exportStar(require("./SingleSignOn"), exports);
 __exportStar(require("./ModelAuth"), exports);
 __exportStar(require("./Auth"), exports);
+__exportStar(require("./PasswordReset"), exports);

package/dist/Router/Route.js

@@ -90,6 +90,7 @@ class RouteFacade {
             Auth_1.Auth.registerScope(auth, overrides);
         }
         const base = prefix.replace(/\/+$/, "");
+        Auth_1.Auth.scope(auth).configureRoutes(base, loginPath);
         const registration = { middleware: options.middleware, domains: options.domains };
         this.get(`${base}/csrf`, (0, Auth_1.authRoute)("csrf", options), registration);
         this.post(options.loginPath || `${base}/login`, (0, Auth_1.authRoute)("login", options), registration);

package/docs/authentication.md

@@ -312,7 +312,7 @@ not trimmed. Store a bcrypt hash; existing bcrypt hashes work without migration.
 and `isUserAllowed` adds account/tenant checks on login and every session access.
 An explicit `false` in `is_active` rejects the account; `fields.active: false`
 disables this field check. Optional `session` options configure storage, scope
-and lifetimes. For `AuthScope`, access and absolute session lifetimes default to
+and lifetimes. For `AuthScope`, access lifetime defaults to 15 minutes and absolute session lifetime to
 30 days; both remain configurable through `session.accessTokenSeconds` and
 `session.sessionSeconds`. The lower-level `SessionAuth` retains its 15-minute
 access-token default.
@@ -428,3 +428,70 @@ hashes and expiry unchanged. SessionAuth recognizes the former token prefixes,
 so converted sessions retain their existing cookies. Applications should run
 an explicit migration while stopping auth writes, rather than changing schemas
 implicitly during a request.
+
+
+## Scope-configured lifetimes and password recovery
+
+```ts
+Config.register("auth", {
+    scopes: {
+        main: {
+            model: User,
+            session: {
+                accessTokenSeconds: 15 * 60,
+                sessionSeconds: 30 * 86400,
+                idleTimeoutSeconds: 7 * 86400, // false explicitly disables inactivity expiry.
+            },
+            passwordReset: {
+                tokenSeconds: 15 * 60,
+                cooldownSeconds: 3 * 60,
+                revokeSessions: "all", // "scope" or false are explicit alternatives.
+            },
+        },
+    },
+});
+
+await Auth.scope().passwordReset?.request(email, async (user, token, expiresAt) => {
+    // Build a link from your configured website URL, never from request Host headers.
+    await sendResetEmail(user, token, expiresAt);
+});
+const user = await Auth.scope().passwordReset?.validate(token); // Does not consume it.
+const changedUser = await Auth.scope().passwordReset?.reset(token, newPassword);
+// null means invalid, expired, consumed, wrong scope, inactive account, or changed password.
+```
+
+Scope defaults are a 15-minute access lifetime, a 30-day absolute lifetime and a
+seven-day inactivity limit. `session.idleTimeoutSeconds: false` disables only the
+inactivity limit. All deadlines are enforced on access, refresh, CSRF, introspection
+and listing. Existing records also respect newly shortened configured limits.
+Successful authentication updates activity with throttled writes; introspection
+and CSRF verification alone do not extend inactivity. Absolute expiry never slides.
+
+`scope.resolve(req, res)` resumes an expired access token for GET/HEAD if the current
+refresh secret and matching session-bound CSRF cookie are valid. It issues a new
+access token and retains the refresh secret, so parallel page requests do not
+trigger refresh replay revocation. This trusted read resumption does not authorize
+unsafe requests, revive expired sessions, or extend absolute expiry. Explicit
+POST refresh rotates both secrets and retains replay protection. Middleware uses
+this resumption automatically when a response is available. Browser `createAuthFetch`
+refreshes rejected authentication/CSRF requests once, then repeats the rejected
+request once; login failures and permission errors are never retried. Web Locks
+serialize refresh calls across tabs in browsers supporting that API; a per-window
+single-flight promise remains the fallback.
+
+Reset tokens have 256-bit random secrets; only a SHA-256 digest bound to the scope
+and current password is stored. Per-account request cooldown is an atomic conditional
+update. Successful reset consumes the token and writes the new password in the same
+atomic database operation. Other password changes invalidate outstanding links.
+The callback is a trusted server delivery integration; raw reset tokens must not be
+returned to browsers by the request endpoint. Password validation remains the app's
+responsibility. Disable recovery explicitly with `passwordReset: false`.
+
+The fields `auth_reset_<scope>_hash`, `_expires_at` and `_requested_at` are stored
+on the model's document collection and must be included in the model's `__hidden`
+when serializing entire models. Auth snapshots always exclude these fields.
+`revokeSessions: "all"` revokes registered scopes using the same model class;
+`"scope"` limits revocation to the initiating scope. Recovery does not log in the
+user automatically. Existing application plaintext reset links are intentionally
+not accepted; users must request a new link after migration. Reset pages should
+use `Referrer-Policy: no-referrer` and avoid response caching.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@webtypen/webframez-core",
-    "version": "0.3.74",
+    "version": "0.3.76",
     "description": "The core package of the typescript based webframez (web-framework) by webtypen.de",
     "homepage": "https://webtypen.de/",
     "license": "MIT",