auth-vir 1.2.0 → 1.3.0

package/dist/auth.d.ts

@@ -15,6 +15,14 @@ export type HeaderContainer = Record<string, string[] | undefined | string | num
  * @returns The extracted user id or `undefined` if no valid auth headers exist.
  */
 export declare function extractUserIdFromRequestHeaders(headers: HeaderContainer, jwtParams: Readonly<ParseJwtParams>, cookieName?: string | undefined): Promise<string | undefined>;
+/**
+ * Extract a user id from just the cookie, without CSRF token validation. This is _less secure_ than
+ * {@link extractUserIdFromRequestHeaders} as a result. This should only be used in rare
+ * circumstances where you cannot rely on client-side JavaScript to insert the CSRF token.
+ *
+ * @deprecated Prefer {@link extractUserIdFromRequestHeaders} instead: it is more secure.
+ */
+export declare function extractUserIdFromCookieAlone(headers: HeaderContainer, jwtParams: Readonly<ParseJwtParams>, cookieName?: string | undefined): Promise<string | undefined>;
 /**
  * Used by host (backend) code to set headers on a response object.
  *

package/dist/auth.js

@@ -42,6 +42,29 @@ export async function extractUserIdFromRequestHeaders(headers, jwtParams, cookie
         return undefined;
     }
 }
+/**
+ * Extract a user id from just the cookie, without CSRF token validation. This is _less secure_ than
+ * {@link extractUserIdFromRequestHeaders} as a result. This should only be used in rare
+ * circumstances where you cannot rely on client-side JavaScript to insert the CSRF token.
+ *
+ * @deprecated Prefer {@link extractUserIdFromRequestHeaders} instead: it is more secure.
+ */
+export async function extractUserIdFromCookieAlone(headers, jwtParams, cookieName) {
+    try {
+        const cookie = readHeader(headers, 'cookie');
+        if (!cookie) {
+            return undefined;
+        }
+        const jwt = await extractCookieJwt(cookie, jwtParams, cookieName);
+        if (!jwt) {
+            return undefined;
+        }
+        return jwt.userId;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Used by host (backend) code to set headers on a response object.
  *

package/dist/cookie.js

@@ -71,7 +71,7 @@ export async function extractCookieJwt(rawCookie, jwtParams, cookieName = 'auth'
     if (!auth) {
         return undefined;
     }
-    const rawJwt = auth.replace('auth=', '').replace(';', '');
+    const rawJwt = auth.replace(`${cookieName}=`, '').replace(';', '');
     const jwt = await parseUserJwt(rawJwt, jwtParams);
     return jwt;
 }

package/dist/jwt.js

@@ -11,7 +11,7 @@ const signingProtectedHeader = { alg: 'HS512' };
 export async function createJwt(
 /** The data to be included in the JWT. */
 data, params) {
-    const rawJwt = new SignJWT({ data: data })
+    const rawJwt = new SignJWT({ data })
         .setProtectedHeader(signingProtectedHeader)
         .setIssuedAt(params.issuedAt
         ? toTimestamp(createFullDateInUserTimezone(params.issuedAt))

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth-vir",
-    "version": "1.2.0",
+    "version": "1.3.0",
     "description": "Auth made easy and secure via JWT cookies, CSRF tokens, and password hashing helpers.",
     "keywords": [
         "auth",
@@ -40,25 +40,25 @@
         "test:update": "npm test update"
     },
     "dependencies": {
-        "@augment-vir/assert": "^31.17.1",
-        "@augment-vir/common": "^31.17.1",
-        "date-vir": "^7.3.1",
+        "@augment-vir/assert": "^31.32.2",
+        "@augment-vir/common": "^31.32.2",
+        "date-vir": "^7.4.0",
         "hash-wasm": "^4.12.0",
-        "jose": "^6.0.11",
-        "object-shape-tester": "^5.1.5",
+        "jose": "^6.0.12",
+        "object-shape-tester": "^5.3.0",
         "type-fest": "^4.41.0",
         "url-vir": "^2.1.3"
     },
     "devDependencies": {
-        "@augment-vir/test": "^31.17.1",
+        "@augment-vir/test": "^31.32.2",
         "@web/dev-server-esbuild": "^1.0.4",
-        "@web/test-runner": "^0.20.1",
+        "@web/test-runner": "^0.20.2",
         "@web/test-runner-commands": "^0.9.0",
-        "@web/test-runner-playwright": "^0.11.0",
+        "@web/test-runner-playwright": "^0.11.1",
         "@web/test-runner-visual-regression": "^0.10.0",
         "istanbul-smart-text-reporter": "^1.1.5",
         "markdown-code-example-inserter": "^3.0.3",
-        "typedoc": "^0.28.4"
+        "typedoc": "^0.28.10"
     },
     "engines": {
         "node": ">=22"

package/src/auth.ts

@@ -63,6 +63,37 @@ export async function extractUserIdFromRequestHeaders(
     }
 }
 
+/**
+ * Extract a user id from just the cookie, without CSRF token validation. This is _less secure_ than
+ * {@link extractUserIdFromRequestHeaders} as a result. This should only be used in rare
+ * circumstances where you cannot rely on client-side JavaScript to insert the CSRF token.
+ *
+ * @deprecated Prefer {@link extractUserIdFromRequestHeaders} instead: it is more secure.
+ */
+export async function extractUserIdFromCookieAlone(
+    headers: HeaderContainer,
+    jwtParams: Readonly<ParseJwtParams>,
+    cookieName?: string | undefined,
+): Promise<string | undefined> {
+    try {
+        const cookie = readHeader(headers, 'cookie');
+
+        if (!cookie) {
+            return undefined;
+        }
+
+        const jwt = await extractCookieJwt(cookie, jwtParams, cookieName);
+
+        if (!jwt) {
+            return undefined;
+        }
+
+        return jwt.userId;
+    } catch {
+        return undefined;
+    }
+}
+
 /**
  * Used by host (backend) code to set headers on a response object.
  *

package/src/cookie.ts

@@ -132,7 +132,7 @@ export async function extractCookieJwt(
         return undefined;
     }
 
-    const rawJwt = auth.replace('auth=', '').replace(';', '');
+    const rawJwt = auth.replace(`${cookieName}=`, '').replace(';', '');
 
     const jwt = await parseUserJwt(rawJwt, jwtParams);
 

package/src/jwt.ts

@@ -87,7 +87,7 @@ export async function createJwt<JwtData extends AnyObject = AnyObject>(
     data: JwtData,
     params: Readonly<CreateJwtParams>,
 ): Promise<string> {
-    const rawJwt = new SignJWT({data: data})
+    const rawJwt = new SignJWT({data})
         .setProtectedHeader(signingProtectedHeader)
         .setIssuedAt(
             params.issuedAt