@wtfalch/auth 0.30.0 → 0.31.0

package/dist/sessions.d.ts

@@ -60,11 +60,6 @@ export interface SessionStore {
     /** Live (not revoked, not expired) records for this subject under this binding context, newest first: the devices page. */
     listSubject(context: string, subject: string): Promise<SessionRecord[]>;
 }
-/**
- * One process only. For tests and a single-instance development server: two
- * replicas with separate memory stores do not share revocations.
- */
-export declare function createMemorySessionStore(): SessionStore;
 /** The table `createPostgresSessionStore` expects. Run it in the app's own migrations. */
 export declare const POSTGRES_SESSION_TABLE = "create table if not exists wtfalch_auth_sessions (\n  key text primary key,\n  context text not null,\n  subject text not null,\n  generation integer not null,\n  payload text not null,\n  expires_at bigint not null,\n  lease_until bigint,\n  revoked_at bigint,\n  created_at bigint,\n  last_seen_at bigint,\n  user_agent text,\n  ip text\n);\ncreate index if not exists wtfalch_auth_sessions_subject on wtfalch_auth_sessions (context, subject);\ncreate index if not exists wtfalch_auth_sessions_expiry on wtfalch_auth_sessions (expires_at);";
 /**

package/dist/sessions.js

@@ -1,63 +1,3 @@
-/**
- * One process only. For tests and a single-instance development server: two
- * replicas with separate memory stores do not share revocations.
- */
-export function createMemorySessionStore() {
-    const records = new Map();
-    const sweep = (now) => {
-        for (const [key, record] of records)
-            if (record.expiresAt <= now)
-                records.delete(key);
-    };
-    return {
-        async create(record) {
-            sweep(Math.floor(Date.now() / 1000));
-            if (records.has(record.key))
-                throw new Error('session record already exists');
-            records.set(record.key, { ...record });
-        },
-        async get(key) {
-            const record = records.get(key);
-            return record ? { ...record } : null;
-        },
-        async advance(key, generation, next) {
-            const record = records.get(key);
-            if (!record || record.revokedAt !== null || record.generation !== generation)
-                return false;
-            records.set(key, {
-                ...record,
-                ...next,
-                generation: generation + 1,
-                lastSeenAt: Math.floor(Date.now() / 1000),
-            });
-            return true;
-        },
-        async revoke(key, at) {
-            const record = records.get(key);
-            if (record && record.revokedAt === null)
-                record.revokedAt = at;
-        },
-        async revokeSubject(context, subject, at) {
-            let count = 0;
-            for (const record of records.values())
-                if (record.context === context && record.subject === subject && record.revokedAt === null) {
-                    record.revokedAt = at;
-                    count++;
-                }
-            return count;
-        },
-        async listSubject(context, subject) {
-            const nowSeconds = Math.floor(Date.now() / 1000);
-            return [...records.values()]
-                .filter((r) => r.context === context &&
-                r.subject === subject &&
-                r.revokedAt === null &&
-                r.expiresAt > nowSeconds)
-                .sort((a, b) => (b.createdAt ?? 0) - (a.createdAt ?? 0))
-                .map((r) => ({ ...r }));
-        },
-    };
-}
 /** The table `createPostgresSessionStore` expects. Run it in the app's own migrations. */
 export const POSTGRES_SESSION_TABLE = `create table if not exists wtfalch_auth_sessions (
   key text primary key,

package/dist/util.d.ts

@@ -1,6 +1,20 @@
 /** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** ZITADEL's resource-owner (organisation) claim, on a JWT and on an introspection response alike. */
+export declare const ORG_CLAIM = "urn:zitadel:iam:user:resourceowner:id";
 /** How long an SDK request to the broker or issuer may take before it is abandoned. */
 export declare const FETCH_TIMEOUT_MS = 15000;
+/**
+ * The longest a cookie or namespace session may go without the SDK asking
+ * the issuer whether the grant behind it is still good. `freshness` (an
+ * app's own option, default 5 minutes) already forces that ask on an
+ * interval -- this is a hard ceiling under it, so a deactivated person is
+ * signed out everywhere within a minute even when an app raised `freshness`
+ * past that. The ask itself is the existing refresh grant: a disabled
+ * account's refresh token answers 4xx there already, in both session modes.
+ */
+export declare const REVOCATION_RECHECK_SECONDS = 60;
+/** How long a session's id token may age before the SDK asks the issuer again: the app's `freshness`, never more than `REVOCATION_RECHECK_SECONDS`. */
+export declare function recheckSeconds(freshness: number): number;
 /** `signal` if the caller brought one, otherwise a 15 second timeout. */
 export declare function timeoutSignal(signal?: AbortSignal): AbortSignal;
 /** Bytes as unpadded base64url. */

package/dist/util.js

@@ -1,6 +1,22 @@
 /** Helpers shared by the server and browser entry points. No Node-only imports: the browser bundle uses this file too. */
+/** ZITADEL's resource-owner (organisation) claim, on a JWT and on an introspection response alike. */
+export const ORG_CLAIM = 'urn:zitadel:iam:user:resourceowner:id';
 /** How long an SDK request to the broker or issuer may take before it is abandoned. */
 export const FETCH_TIMEOUT_MS = 15_000;
+/**
+ * The longest a cookie or namespace session may go without the SDK asking
+ * the issuer whether the grant behind it is still good. `freshness` (an
+ * app's own option, default 5 minutes) already forces that ask on an
+ * interval -- this is a hard ceiling under it, so a deactivated person is
+ * signed out everywhere within a minute even when an app raised `freshness`
+ * past that. The ask itself is the existing refresh grant: a disabled
+ * account's refresh token answers 4xx there already, in both session modes.
+ */
+export const REVOCATION_RECHECK_SECONDS = 60;
+/** How long a session's id token may age before the SDK asks the issuer again: the app's `freshness`, never more than `REVOCATION_RECHECK_SECONDS`. */
+export function recheckSeconds(freshness) {
+    return Math.min(freshness, REVOCATION_RECHECK_SECONDS);
+}
 /** `signal` if the caller brought one, otherwise a 15 second timeout. */
 export function timeoutSignal(signal) {
     return signal ?? AbortSignal.timeout(FETCH_TIMEOUT_MS);

package/dist/worker-session.d.ts

@@ -29,6 +29,10 @@ export interface WorkerSignedIn {
      */
     setCookies: string[];
 }
+export interface WorkerSessionState {
+    user: WorkerSignedIn | null;
+    clearCookies: string[];
+}
 export interface WorkerSession {
     /** Redirects to the issuer. `register` opens registration, `returnTo` is a path on this app. */
     signIn(req: Request, o?: {
@@ -38,6 +42,16 @@ export interface WorkerSession {
     /** Route `redirectPath` here. Always a redirect: to `returnTo` on success, to `/?auth_error=<reason>` otherwise. */
     callback(req: Request): Promise<Response>;
     currentUser(req: Request): Promise<WorkerSignedIn | null>;
+    /**
+     * `currentUser`, plus what to do about a session that is dead. `clearCookies`
+     * are `Set-Cookie` header values that remove a session cookie the SDK found
+     * unusable (a refresh that came back for another organisation, a token it
+     * rejected). Add them to the app's response when `user` is null, or the same
+     * dead cookie is tried again on every request. Empty when the person is
+     * signed in, has no cookie, or the failure may pass (the issuer refused a
+     * refresh, or could not be reached): those keep the cookie.
+     */
+    readSession(req: Request): Promise<WorkerSessionState>;
     /** POST from the app's own origin only. */
     signOut(req: Request): Promise<Response>;
 }

package/dist/worker-session.js

@@ -1,6 +1,8 @@
 import { createAuth } from './auth.js';
 import { resolveOptions } from './config.js';
 import { FETCH_TIMEOUT_MS } from './util.js';
+/** Origins one isolate keeps an `Auth` for. */
+const MAX_ORIGINS = 64;
 const CALLBACK = /^(\/[A-Za-z0-9._~-]+)+\/callback$/;
 /** The fetch the SDK is given: every outside call (discovery, token, JWKS, revoke) is abandoned after FETCH_TIMEOUT_MS unless the caller set its own signal. */
 function withTimeout(fetchImpl) {
@@ -39,14 +41,21 @@ export function createWorkerSession(opts) {
     // A bad secret or client is a startup error, not the first visitor's.
     resolveOptions(config('https://placeholder.invalid'));
     // One Auth per origin, so the discovery document, JWKS and refresh dedupe are shared across requests in an isolate.
+    // On a wildcard route the Host header is the caller's, so the map is capped and the least recently used origin dropped:
+    // an evicted origin only loses its caches.
     const byOrigin = new Map();
     const authFor = (req) => {
         const origin = new URL(req.url).origin;
         let auth = byOrigin.get(origin);
-        if (!auth) {
+        if (auth) {
+            byOrigin.delete(origin);
+        }
+        else {
             auth = createAuth(config(origin));
-            byOrigin.set(origin, auth);
+            if (byOrigin.size >= MAX_ORIGINS)
+                byOrigin.delete(byOrigin.keys().next().value);
         }
+        byOrigin.set(origin, auth);
         return auth;
     };
     // An outside failure is logged by its class only: messages can carry URLs and token fragments.
@@ -54,6 +63,22 @@ export function createWorkerSession(opts) {
         console.error(`@wtfalch/auth: worker session ${what} failed`, error instanceof Error ? error.name : 'unknown');
         return new Response('Sign-in is unavailable', { status: 503 });
     };
+    const readSession = async (req) => {
+        try {
+            const { user, cookies } = await authFor(req).read(req);
+            const headers = cookies.map((c) => c.header);
+            if (!user)
+                return { user: null, clearCookies: headers };
+            return {
+                user: { userId: user.id, orgId: user.organizationId, setCookies: headers },
+                clearCookies: [],
+            };
+        }
+        catch (error) {
+            unavailable('session read', error);
+            return { user: null, clearCookies: [] };
+        }
+    };
     return {
         async signIn(req, o = {}) {
             const url = new URL(`${basePath}/start`, req.url);
@@ -76,21 +101,9 @@ export function createWorkerSession(opts) {
                 return unavailable('callback', error);
             }
         },
+        readSession,
         async currentUser(req) {
-            try {
-                const { user, cookies } = await authFor(req).read(req);
-                if (!user)
-                    return null;
-                return {
-                    userId: user.id,
-                    orgId: user.organizationId,
-                    setCookies: cookies.map((c) => c.header),
-                };
-            }
-            catch (error) {
-                unavailable('session read', error);
-                return null;
-            }
+            return (await readSession(req)).user;
         },
         async signOut(req) {
             if (req.method !== 'POST')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Sign in against a self-hosted ZITADEL issuer: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",
@@ -62,9 +62,9 @@
       "types": "./dist/qr-door.d.ts",
       "default": "./dist/qr-door.js"
     },
-    "./testing": {
-      "types": "./dist/testing.d.ts",
-      "default": "./dist/testing.js"
+    "./desktop": {
+      "types": "./dist/desktop.d.ts",
+      "default": "./dist/desktop.js"
     }
   },
   "sideEffects": false,

package/dist/testing.d.ts

@@ -1,57 +0,0 @@
-import type { Auth, User } from './auth.js';
-import type { NextAuth } from './next.js';
-export declare function setSessionUser(user: User | null): void;
-/** A User shaped like the SDK's, for `setSessionUser`. */
-export declare function testUser(id: string, overrides?: Partial<User>): User;
-export declare function getUser(): Promise<User | null>;
-export declare function requireUser(_next?: string): Promise<User>;
-export declare const requireFreshUser: NextAuth['requireFreshUser'];
-export declare const handlers: () => never;
-export declare const proxy: () => never;
-export declare const authRequest: () => never;
-export declare const signIn: () => never;
-export declare const signUp: () => never;
-export declare const requestPasswordReset: () => never;
-export declare const resetPassword: () => never;
-export declare const sendLink: () => never;
-export declare const resendVerification: () => never;
-export declare const setNewPassword: () => never;
-export declare const invite: () => never;
-export declare const people: () => never;
-export declare const setPersonActive: () => never;
-export declare const adminResetPassword: () => never;
-export declare const sessions: () => never;
-export declare const endSession: () => never;
-export declare const startPasskeyRegistration: () => never;
-export declare const finishPasskeyRegistration: () => never;
-export declare const startEmailChange: () => never;
-export declare const completeEmailChange: () => never;
-export declare const changePassword: () => never;
-export declare const passkeys: () => never;
-export declare const deletePasskey: () => never;
-export declare const startPasskeySignIn: () => never;
-export declare const finishPasskeySignIn: () => never;
-export declare const startQrSignIn: () => never;
-export declare const pollQrSignIn: () => never;
-/**
- * The core SDK instance, as far as a device sign-in module reaches into it.
- *
- * The real one talks to the issuer. This one records what was asked and
- * answers with whatever a test set, so a device/link sign-in flow can be
- * exercised against a real database without one. Only the members named
- * here are stubbed; anything else read off `auth` is a mistake worth a loud
- * one.
- */
-export declare const sentLinks: {
-    email: string;
-    next?: string;
-}[];
-export declare function setFollowLinkResult(result: unknown): void;
-export declare function setCookieUser(user: User | null): void;
-export declare const auth: Auth;
-/**
- * Every member of `NextAuth`, so the compiler fails here when the real
- * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
- * is the same as importing the named exports above.
- */
-export declare const nextAuthStub: NextAuth;

package/dist/testing.js

@@ -1,138 +0,0 @@
-/**
- * A stub for whatever `@/lib/auth` resolves to in an app's integration test
- * tier. The real module reads a sealed cookie through `next/headers`, which
- * does not load outside a Next.js build; this one answers with whatever
- * `setSessionUser` last set, so a test can be "signed in" as one person,
- * call the app's own authorization logic for real, then sign in as another.
- * Nothing here talks to the issuer.
- *
- * Alias the app's auth module to `@wtfalch/auth/testing` for that tier (for
- * example in a vitest config's `resolve.alias`), or re-export from it.
- */
-let current = null;
-export function setSessionUser(user) {
-    current = user;
-}
-/** A User shaped like the SDK's, for `setSessionUser`. */
-export function testUser(id, overrides = {}) {
-    return {
-        id,
-        email: `${id}@example.test`,
-        emailVerified: true,
-        name: `Person ${id}`,
-        givenName: null,
-        familyName: null,
-        preferredUsername: null,
-        organizationId: 'org-test',
-        // Never fresh, which is what a stubbed session should be: the issuer only
-        // owes `auth_time` when the request asked for it, and nothing here asks.
-        authTime: null,
-        claims: {},
-        ...overrides,
-    };
-}
-export async function getUser() {
-    return current;
-}
-export async function requireUser(_next) {
-    if (!current)
-        throw new Error('requireUser: no session set; call setSessionUser first');
-    return current;
-}
-export const requireFreshUser = async () => requireUser();
-function unavailable(name) {
-    return () => {
-        throw new Error(`${name} is not available in the integration tier`);
-    };
-}
-export const handlers = unavailable('handlers');
-export const proxy = unavailable('proxy');
-export const authRequest = unavailable('authRequest');
-export const signIn = unavailable('signIn');
-export const signUp = unavailable('signUp');
-export const requestPasswordReset = unavailable('requestPasswordReset');
-export const resetPassword = unavailable('resetPassword');
-export const sendLink = unavailable('sendLink');
-export const resendVerification = unavailable('resendVerification');
-export const setNewPassword = unavailable('setNewPassword');
-export const invite = unavailable('invite');
-export const people = unavailable('people');
-export const setPersonActive = unavailable('setPersonActive');
-export const adminResetPassword = unavailable('adminResetPassword');
-export const sessions = unavailable('sessions');
-export const endSession = unavailable('endSession');
-export const startPasskeyRegistration = unavailable('startPasskeyRegistration');
-export const finishPasskeyRegistration = unavailable('finishPasskeyRegistration');
-export const startEmailChange = unavailable('startEmailChange');
-export const completeEmailChange = unavailable('completeEmailChange');
-export const changePassword = unavailable('changePassword');
-export const passkeys = unavailable('passkeys');
-export const deletePasskey = unavailable('deletePasskey');
-export const startPasskeySignIn = unavailable('startPasskeySignIn');
-export const finishPasskeySignIn = unavailable('finishPasskeySignIn');
-export const startQrSignIn = unavailable('startQrSignIn');
-export const pollQrSignIn = unavailable('pollQrSignIn');
-/**
- * The core SDK instance, as far as a device sign-in module reaches into it.
- *
- * The real one talks to the issuer. This one records what was asked and
- * answers with whatever a test set, so a device/link sign-in flow can be
- * exercised against a real database without one. Only the members named
- * here are stubbed; anything else read off `auth` is a mistake worth a loud
- * one.
- */
-export const sentLinks = [];
-let linkResult = { ok: false, error: 'invalid_code', message: 'no result set' };
-let cookieUser = null;
-export function setFollowLinkResult(result) {
-    linkResult = result;
-}
-export function setCookieUser(user) {
-    cookieUser = user;
-}
-export const auth = {
-    sessionCookieName: '__Host-wtfalch_auth',
-    sendLink: async (email, next) => {
-        sentLinks.push({ email, next });
-    },
-    followLink: async () => linkResult,
-    readCookie: async () => ({ user: cookieUser, cookies: [] }),
-};
-/**
- * Every member of `NextAuth`, so the compiler fails here when the real
- * surface gains one this stub lacks. `export const { getUser } = nextAuthStub`
- * is the same as importing the named exports above.
- */
-export const nextAuthStub = {
-    auth,
-    handlers: handlers,
-    proxy,
-    getUser,
-    requireUser,
-    requireFreshUser,
-    authRequest,
-    signIn,
-    setNewPassword,
-    signUp,
-    resendVerification,
-    requestPasswordReset,
-    sendLink,
-    invite,
-    people,
-    setPersonActive,
-    adminResetPassword,
-    sessions,
-    endSession,
-    resetPassword,
-    startPasskeyRegistration,
-    finishPasskeyRegistration,
-    startEmailChange,
-    completeEmailChange,
-    changePassword,
-    passkeys,
-    deletePasskey,
-    startPasskeySignIn,
-    finishPasskeySignIn,
-    startQrSignIn,
-    pollQrSignIn,
-};