@wtfalch/auth 0.13.0 → 0.14.0

package/dist/namespace-session.js

@@ -248,11 +248,30 @@ export function namespaceSessions(deps) {
                 .catch(() => { });
             return stillValid ? leased : null;
         }
-        const committed = await store().advance(key, generation, {
-            payload: await seal(key, fresh),
-            expiresAt: now() + options().sessionMaxAge,
-            leaseUntil: null,
-        });
+        let committed;
+        try {
+            committed = await store().advance(key, generation, {
+                payload: await seal(key, fresh),
+                expiresAt: now() + options().sessionMaxAge,
+                leaseUntil: null,
+            });
+        }
+        catch (error) {
+            // The commit itself threw (a store outage): the lease is still held.
+            // Best-effort release it, as the still-valid path above already does,
+            // so the session does not stay locked out for up to LEASE_SECONDS, and
+            // revoke a rotated refresh token that was never stored.
+            await store()
+                .advance(key, generation, {
+                payload: record.payload,
+                expiresAt: record.expiresAt,
+                leaseUntil: null,
+            })
+                .catch(() => { });
+            if (fresh.refreshToken !== tokens.rt)
+                revokeToken(fresh.refreshToken);
+            throw error;
+        }
         if (!committed) {
             // Revoked while we asked, or our lease ran out and another request took
             // over. These tokens are kept nowhere, so they are not left live.
@@ -351,11 +370,31 @@ export function namespaceSessions(deps) {
             // does for the same case.
             throw error;
         }
-        const committed = await store().advance(key, generation, {
-            payload: await seal(key, fresh),
-            expiresAt: now() + options().sessionMaxAge,
-            leaseUntil: null,
-        });
+        let committed;
+        try {
+            committed = await store().advance(key, generation, {
+                payload: await seal(key, fresh),
+                expiresAt: now() + options().sessionMaxAge,
+                leaseUntil: null,
+            });
+        }
+        catch (error) {
+            // The commit itself threw (a store outage): the lease is still held.
+            // Best-effort release it, as the still-valid path in `refreshLeased`
+            // does, so the session does not stay locked out for up to
+            // LEASE_SECONDS, and revoke a rotated refresh token that was never
+            // stored.
+            await store()
+                .advance(key, generation, {
+                payload: record.payload,
+                expiresAt: record.expiresAt,
+                leaseUntil: null,
+            })
+                .catch(() => { });
+            if (fresh.refreshToken !== tokens.rt)
+                revokeToken(fresh.refreshToken);
+            throw error;
+        }
         if (!committed) {
             // Revoked while the grant was in flight, or the lease ran out and
             // another request took over. The fresh tokens are kept nowhere, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",