akanjs 3.0.0-alpha.84 → 3.0.0-alpha.86

package/client/cookie.ts

@@ -1,5 +1,12 @@
 import { getEnv } from "akanjs/base";
-import { decodeJwtPayload, Logger } from "akanjs/common";
+import {
+  authTokenKey,
+  decodeJwtPayload,
+  isOwnAuthToken,
+  Logger,
+  legacyAuthTokenKey,
+  readAuthToken,
+} from "akanjs/common";
 import type { Account } from "akanjs/fetch";
 import { parseCookieHeader, cookies as serverCookies, headers as serverHeaders } from "akanjs/fetch";
 import { loadCapacitorCore } from "./capacitor";
@@ -57,15 +64,29 @@ export const headers = (): Map<string, string> => {
 export const getHeader = (key: string): string | undefined => {
   return headers().get(key);
 };
+
+export { authTokenKey };
+
+/** The auth token this app holds in the cookie jar, under the app-scoped key or a legacy global one. */
+export const getAuthToken = (): string | undefined => readAuthToken(getCookie);
+
+/** The auth token this app holds in client storage — localStorage under SSR, Capacitor Preferences on CSR. */
+export const getStoredAuthToken = async (): Promise<string | undefined> => {
+  const scoped = await storage.getItem(authTokenKey());
+  if (scoped) return scoped;
+  const legacy = await storage.getItem(legacyAuthTokenKey);
+  return legacy && isOwnAuthToken(legacy) ? legacy : undefined;
+};
+
 /**
  * Decodes the current JWT into account data when it belongs to this app/environment.
  *
- * The two credentials read here are exactly the two the server honours — the `jwt` cookie and
+ * The two credentials read here are exactly the two the server honours — the app-scoped auth cookie and
  * `Authorization: Bearer` (`AccountMiddleware`). It used to fall back to a bare `jwt` *header*, which nothing
  * sends and no guard accepts, so a request carrying one read as signed in here and anonymous at the endpoint.
  */
 export const getAccount = <AddData = unknown>(): Account<AddData> => {
-  const jwt = getCookie("jwt") ?? getHeader("authorization")?.replace(/^Bearer\s+/i, "");
+  const jwt = getAuthToken() ?? getHeader("authorization")?.replace(/^Bearer\s+/i, "");
   const defaultAccount = { appName: getEnv().appName, environment: getEnv().environment } as Account<AddData>;
   if (!jwt) return defaultAccount;
   const account = decodeJwtPayload<Account<AddData>>(jwt);
@@ -81,15 +102,25 @@ interface SetAuthOption {
 /** Sets the active auth token on fetch, cookie storage, and client storage. */
 export const setAuth = ({ jwt }: SetAuthOption) => {
   fetch.setJwt(jwt);
-  setCookie("jwt", jwt);
-  void storage.setItem("jwt", jwt);
+  setCookie(authTokenKey(), jwt);
+  void storage.setItem(authTokenKey(), jwt);
+
+  removeCookie(legacyAuthTokenKey);
+  void storage.removeItem(legacyAuthTokenKey);
 };
 
 interface InitAuthOption {
   jwt?: string;
 }
 export const initAuth = ({ jwt }: InitAuthOption = {}) => {
-  const token = jwt ?? cookies().get("jwt")?.value;
+  const stored = getAuthToken();
+  const token = jwt ?? stored;
+  if (token && !isOwnAuthToken(token)) {
+
+    Logger.warn("JWT ignored: it was minted for another app or environment");
+    if (token === stored) resetAuth();
+    return;
+  }
   if (token) setAuth({ jwt: token });
   
   Logger.verbose(`JWT ${token ? "restored from cookie" : "not found in cookie"}`);
@@ -97,6 +128,8 @@ export const initAuth = ({ jwt }: InitAuthOption = {}) => {
 
 export const resetAuth = () => {
   fetch.setJwt(null);
-  removeCookie("jwt");
-  void storage.removeItem("jwt");
+  removeCookie(authTokenKey());
+  removeCookie(legacyAuthTokenKey);
+  void storage.removeItem(authTokenKey());
+  void storage.removeItem(legacyAuthTokenKey);
 };

package/common/authToken.ts

@@ -0,0 +1,44 @@
+import { getEnv } from "akanjs/base";
+import { decodeJwtPayload } from "./jwtDecode";
+
+/** The pre-scoping key. Read as a fallback, never written; drop it once deployments have rotated past it. */
+export const legacyAuthTokenKey = "jwt";
+
+/**
+ * Cookies carry no port (RFC 6265), so every app served from one host shares a jar — which on localhost is
+ * every app in the workspace at once. Under a global `jwt` key each signin overwrites the neighbour's
+ * session, and the JWT's own `appName` check only turns the stolen cookie into a failing credential.
+ */
+export const authTokenKey = (): string => `${legacyAuthTokenKey}:${getEnv().appName}`;
+
+/** Matches both spellings so a signout can sweep a jar written before and after the key was scoped. */
+export const isAuthTokenKey = (key: string): boolean =>
+  key === legacyAuthTokenKey || key.startsWith(`${legacyAuthTokenKey}:`);
+
+const authCookiePattern = new RegExp(`(?:^|;\\s*)${legacyAuthTokenKey}(?::[^=\\s;]+)?=`);
+
+/** Whether a raw `cookie` header carries an auth token under either spelling. */
+export const cookieHeaderHasAuthToken = (cookieHeader: string | null | undefined): boolean =>
+  !!cookieHeader && authCookiePattern.test(cookieHeader);
+
+/** Whether a token was minted for this app and environment — the same pair the server's account check makes. */
+export const isOwnAuthToken = (jwt: string): boolean => {
+  const { appName, environment } = getEnv();
+  try {
+    const account = decodeJwtPayload<{ appName?: string; environment?: string }>(jwt);
+    return account.appName === appName && account.environment === environment;
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Reads the app-scoped token, falling back to a leftover global one only when its payload names this app —
+ * a neighbour's token would decode fine here and fail every guard, so adopting it is worse than none.
+ */
+export const readAuthToken = (read: (key: string) => string | null | undefined): string | undefined => {
+  const scoped = read(authTokenKey());
+  if (scoped) return scoped;
+  const legacy = read(legacyAuthTokenKey);
+  return legacy && isOwnAuthToken(legacy) ? legacy : undefined;
+};

package/common/index.ts

@@ -1,4 +1,12 @@
 export { applyMixins } from "./applyMixins";
+export {
+  authTokenKey,
+  cookieHeaderHasAuthToken,
+  isAuthTokenKey,
+  isOwnAuthToken,
+  legacyAuthTokenKey,
+  readAuthToken,
+} from "./authToken";
 export { capitalize } from "./capitalize";
 export { clamp } from "./clamp";
 export {

package/fetch/client/fetchClient.ts

@@ -1,5 +1,12 @@
 import { getEnv, PrimitiveRegistry, type PromiseOrObject } from "akanjs/base";
-import { capitalize, type FetchPolicy, fileUploadContract, Logger, resolveFileUploadCapability } from "akanjs/common";
+import {
+  capitalize,
+  type FetchPolicy,
+  fileUploadContract,
+  Logger,
+  readAuthToken,
+  resolveFileUploadCapability,
+} from "akanjs/common";
 import { type BaseInsight, type BaseObject, ConstantRegistry, deserialize, serialize } from "akanjs/constant";
 import type {
   DatabaseSignal,
@@ -272,7 +279,7 @@ export class FetchClient {
       if (getEnv().side === "server") {
         const authorization = requestHeaders().get("authorization");
         if (authorization) return { Authorization: authorization };
-        const token = requestCookies().get("jwt")?.value;
+        const token = readAuthToken((key) => requestCookies().get(key)?.value);
         if (token) return { Authorization: `Bearer ${token}` };
       }
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.0.0-alpha.84",
+  "version": "3.0.0-alpha.86",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -367,7 +367,7 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.8",
+    "@biomejs/biome": "2.5.12",
     "@types/bun": "^1.4.0"
   },
   "bun": {

package/server/resolver/signal.resolver.ts

@@ -12,7 +12,7 @@ import {
   type PromiseOrObject,
   SLICE_META,
 } from "akanjs/base";
-import { capitalize, Logger } from "akanjs/common";
+import { capitalize, cookieHeaderHasAuthToken, Logger } from "akanjs/common";
 import { deserialize, resolvePageLimit, resolvePageSkip, serialize } from "akanjs/constant";
 import { documentQueryHelper } from "akanjs/document";
 import {
@@ -581,7 +581,7 @@ export class SignalResolver {
   }
 
   static #hasAuthCredential(req: Request) {
-    return Boolean(req.headers.get("authorization") || req.headers.get("cookie")?.includes("jwt="));
+    return Boolean(req.headers.get("authorization") || cookieHeaderHasAuthToken(req.headers.get("cookie")));
   }
 
   /**

package/server/routing/appWsData.ts

@@ -1,4 +1,10 @@
-import { clientAddressFromHeaders, clientPortFromHeaders, forwardedHeaders, TrustedProxy } from "akanjs/common";
+import {
+  clientAddressFromHeaders,
+  clientPortFromHeaders,
+  forwardedHeaders,
+  isAuthTokenKey,
+  TrustedProxy,
+} from "akanjs/common";
 
 const CREDENTIAL_HEADERS = ["authorization", "cookie", "user-agent"] as const;
 
@@ -30,7 +36,10 @@ export class AppWsData {
     if (jwt) data.headers.set("authorization", `Bearer ${jwt}`);
     else {
       data.headers.delete("authorization");
-      data.cookies.delete("jwt");
+
+      for (const name of [...data.cookies].map(([name]) => name)) {
+        if (isAuthTokenKey(name)) data.cookies.delete(name);
+      }
       const cookie = [...data.cookies].map(([name, value]) => `${name}=${value}`).join("; ");
       if (cookie) data.headers.set("cookie", cookie);
       else data.headers.delete("cookie");

package/types/client/cookie.d.ts

@@ -1,3 +1,4 @@
+import { authTokenKey } from "akanjs/common";
 import type { Account } from "akanjs/fetch";
 interface CookieOptions {
     path?: string;
@@ -20,10 +21,15 @@ export declare const removeCookie: (key: string, options?: {
 }) => void;
 export declare const headers: () => Map<string, string>;
 export declare const getHeader: (key: string) => string | undefined;
+export { authTokenKey };
+/** The auth token this app holds in the cookie jar, under the app-scoped key or a legacy global one. */
+export declare const getAuthToken: () => string | undefined;
+/** The auth token this app holds in client storage — localStorage under SSR, Capacitor Preferences on CSR. */
+export declare const getStoredAuthToken: () => Promise<string | undefined>;
 /**
  * Decodes the current JWT into account data when it belongs to this app/environment.
  *
- * The two credentials read here are exactly the two the server honours — the `jwt` cookie and
+ * The two credentials read here are exactly the two the server honours — the app-scoped auth cookie and
  * `Authorization: Bearer` (`AccountMiddleware`). It used to fall back to a bare `jwt` *header*, which nothing
  * sends and no guard accepts, so a request carrying one read as signed in here and anonymous at the endpoint.
  */
@@ -41,4 +47,3 @@ interface InitAuthOption {
 }
 export declare const initAuth: ({ jwt }?: InitAuthOption) => void;
 export declare const resetAuth: () => void;
-export {};

package/types/common/authToken.d.ts

@@ -0,0 +1,19 @@
+/** The pre-scoping key. Read as a fallback, never written; drop it once deployments have rotated past it. */
+export declare const legacyAuthTokenKey = "jwt";
+/**
+ * Cookies carry no port (RFC 6265), so every app served from one host shares a jar — which on localhost is
+ * every app in the workspace at once. Under a global `jwt` key each signin overwrites the neighbour's
+ * session, and the JWT's own `appName` check only turns the stolen cookie into a failing credential.
+ */
+export declare const authTokenKey: () => string;
+/** Matches both spellings so a signout can sweep a jar written before and after the key was scoped. */
+export declare const isAuthTokenKey: (key: string) => boolean;
+/** Whether a raw `cookie` header carries an auth token under either spelling. */
+export declare const cookieHeaderHasAuthToken: (cookieHeader: string | null | undefined) => boolean;
+/** Whether a token was minted for this app and environment — the same pair the server's account check makes. */
+export declare const isOwnAuthToken: (jwt: string) => boolean;
+/**
+ * Reads the app-scoped token, falling back to a leftover global one only when its payload names this app —
+ * a neighbour's token would decode fine here and fail every guard, so adopting it is worse than none.
+ */
+export declare const readAuthToken: (read: (key: string) => string | null | undefined) => string | undefined;

package/types/common/index.d.ts

@@ -1,4 +1,5 @@
 export { applyMixins } from "./applyMixins.d.ts";
+export { authTokenKey, cookieHeaderHasAuthToken, isAuthTokenKey, isOwnAuthToken, legacyAuthTokenKey, readAuthToken, } from "./authToken.d.ts";
 export { capitalize } from "./capitalize.d.ts";
 export { clamp } from "./clamp.d.ts";
 export { clientAddressFromHeaders, clientPortFromHeaders, forwardedHeaders, normalizeIpAddress, } from "./clientAddress.d.ts";

package/types/ui/recipe/buttonRecipe.d.ts

@@ -2,7 +2,7 @@
 export declare const buttonRecipe: (variants?: Omit<({
     size?: "lg" | "md" | "sm" | "xs" | "icon" | undefined;
     outline?: boolean | undefined;
-    variant?: "default" | "info" | "link" | "success" | "warning" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
+    variant?: "link" | "default" | "info" | "success" | "warning" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
     shape?: "default" | "circle" | "square" | undefined;
 } & {
     class?: import("tailwind-variants").ClassValue;
@@ -10,7 +10,7 @@ export declare const buttonRecipe: (variants?: Omit<({
 }) | ({
     size?: "lg" | "md" | "sm" | "xs" | "icon" | undefined;
     outline?: boolean | undefined;
-    variant?: "default" | "info" | "link" | "success" | "warning" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
+    variant?: "link" | "default" | "info" | "success" | "warning" | "primary" | "secondary" | "accent" | "destructive" | "neutral" | "outline" | "ghost" | undefined;
     shape?: "default" | "circle" | "square" | undefined;
 } & {
     class?: never;

package/webkit/bootCsr.tsx

@@ -3,6 +3,7 @@ import {
   csrContext,
   Device,
   getExplicitPageConfigKeys,
+  getStoredAuthToken,
   initAuth,
   type LayoutModule,
   type PageConfig,
@@ -13,7 +14,6 @@ import {
   type RouteRender,
   readCssSafeAreaInsets,
   resolvePageState,
-  storage,
   validatePageConfig,
 } from "akanjs/client";
 import {
@@ -86,7 +86,7 @@ export const bootCsr = async (context: Record<string, CsrRouteModuleEntry>) => {
   const pathname = mobileBasePath && window.location.pathname === "/" ? `/${mobileBasePath}` : window.location.pathname;
   if (pathname === "/404") return;
 
-  const [device, jwt] = await Promise.all([Device.load({ supportLanguages: i18n.locales }), storage.getItem("jwt")]);
+  const [device, jwt] = await Promise.all([Device.load({ supportLanguages: i18n.locales }), getStoredAuthToken()]);
   if (!window.__AKAN_MOBILE_TARGET__ && !pathname.startsWith(`/${device.lang}`))
     window.location.replace(`/${device.lang}${pathname}${window.location.search}${window.location.hash}`);