auth-vir 2.3.4 → 2.3.5

package/dist/auth-client/frontend-auth.client.d.ts

@@ -1,4 +1,4 @@
-import { createBlockingInterval, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type SelectFrom, type SetOptionalWithUndefined } from '@augment-vir/common';
+import { createBlockingInterval, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type SelectFrom } from '@augment-vir/common';
 import { type AnyDuration } from 'date-vir';
 import { type EmptyObject } from 'type-fest';
 /**
@@ -23,10 +23,13 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
          * Get a response from the backend to see if the user is still authenticated. If the
          * response returns a non-authorized status, the user is wiped. Any other status is
          * ignored.
+         *
+         * If the user is not currently authorized, this should return `undefined` to prevent
+         * unnecessary network traffic.
          */
         performCheck: () => MaybePromise<SelectFrom<Response, {
             status: true;
-        }>>;
+        }> | undefined>;
         /** @default {minutes: 1} */
         interval?: AnyDuration | undefined;
     };
@@ -46,11 +49,6 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
 export declare class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject = EmptyObject> {
     protected readonly config: FrontendAuthClientConfig;
     protected userCheckInterval: undefined | ReturnType<typeof createBlockingInterval>;
-    /**
-     * Keeps track of whether the latest state of auth is logged in (`true`) or not (`false`). This
-     * is used for determining if the check user interval should keep running.
-     */
-    protected isLatestAuthorized: boolean;
     constructor(config?: FrontendAuthClientConfig);
     /**
      * Destroys the client and performs all necessary cleanup (like clearing the user check
@@ -92,8 +90,8 @@ export declare class FrontendAuthClient<AssumedUserParams extends JsonCompatible
      *
      * @returns `true` if the auth is okay, `false` otherwise.
      */
-    verifyResponseAuth(response: Readonly<SetOptionalWithUndefined<SelectFrom<Response, {
+    verifyResponseAuth(response: Readonly<PartialWithUndefined<SelectFrom<Response, {
         status: true;
         headers: true;
-    }>, 'headers'>>): Promise<boolean>;
+    }>>>): Promise<boolean>;
 }

package/dist/auth-client/frontend-auth.client.js

@@ -11,22 +11,13 @@ import { AuthHeaderName } from '../headers.js';
 export class FrontendAuthClient {
     config;
     userCheckInterval;
-    /**
-     * Keeps track of whether the latest state of auth is logged in (`true`) or not (`false`). This
-     * is used for determining if the check user interval should keep running.
-     */
-    isLatestAuthorized = false;
     constructor(config = {}) {
         this.config = config;
         if (config.checkUser) {
             this.userCheckInterval = createBlockingInterval(async () => {
-                /** No need to check current user status when there is no user. */
-                if (!this.isLatestAuthorized) {
-                    return;
-                }
                 const response = await config.checkUser?.performCheck();
                 if (response) {
-                    this.isLatestAuthorized = await this.verifyResponseAuth({
+                    await this.verifyResponseAuth({
                         status: response.status,
                     });
                 }
@@ -111,7 +102,6 @@ export class FrontendAuthClient {
     }
     /** Wipes the current user auth. */
     async logout() {
-        this.isLatestAuthorized = false;
         await this.config.authClearedCallback?.();
         wipeCurrentCsrfToken(this.config.overrides);
     }
@@ -132,7 +122,6 @@ export class FrontendAuthClient {
             throw new Error('Did not receive any CSRF token.');
         }
         storeCsrfToken(csrfToken, this.config.overrides);
-        this.isLatestAuthorized = true;
     }
     /**
      * Use to verify _all_ responses received from the backend. Immediately logs the user out once
@@ -146,6 +135,11 @@ export class FrontendAuthClient {
             await this.logout();
             return false;
         }
+        /** If the response has a new CSRF token, store it. */
+        const { csrfToken } = extractCsrfTokenHeader(response, this.config.overrides);
+        if (csrfToken) {
+            storeCsrfToken(csrfToken, this.config.overrides);
+        }
         return true;
     }
 }

package/dist/csrf-token.d.ts

@@ -62,9 +62,9 @@ export type GetCsrfTokenResult = RequireExactlyOne<{
  *
  * @category Auth : Client
  */
-export declare function extractCsrfTokenHeader(response: Readonly<SelectFrom<Response, {
+export declare function extractCsrfTokenHeader(response: Readonly<PartialWithUndefined<SelectFrom<Response, {
     headers: true;
-}>>, overrides?: PartialWithUndefined<{
+}>>>, overrides?: PartialWithUndefined<{
     csrfHeaderName: string;
 }>): Readonly<GetCsrfTokenResult>;
 /**

package/dist/csrf-token.js

@@ -45,7 +45,7 @@ export var CsrfTokenFailureReason;
  */
 export function extractCsrfTokenHeader(response, overrides = {}) {
     const csrfTokenHeaderName = overrides.csrfHeaderName || AuthHeaderName.CsrfToken;
-    const rawCsrfToken = response.headers.get(csrfTokenHeaderName);
+    const rawCsrfToken = response.headers?.get(csrfTokenHeaderName);
     return parseCsrfToken(rawCsrfToken);
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth-vir",
-    "version": "2.3.4",
+    "version": "2.3.5",
     "description": "Auth made easy and secure via JWT cookies, CSRF tokens, and password hashing helpers.",
     "keywords": [
         "auth",
@@ -42,8 +42,8 @@
         "test:web": "virmator test web"
     },
     "dependencies": {
-        "@augment-vir/assert": "^31.45.0",
-        "@augment-vir/common": "^31.45.0",
+        "@augment-vir/assert": "^31.47.0",
+        "@augment-vir/common": "^31.47.0",
         "date-vir": "^8.0.0",
         "hash-wasm": "^4.12.0",
         "jose": "^6.1.0",
@@ -52,7 +52,7 @@
         "url-vir": "^2.1.6"
     },
     "devDependencies": {
-        "@augment-vir/test": "^31.45.0",
+        "@augment-vir/test": "^31.47.0",
         "@prisma/client": "^6.18.0",
         "@types/node": "^24.9.1",
         "@web/dev-server-esbuild": "^1.0.4",
@@ -62,7 +62,7 @@
         "@web/test-runner-visual-regression": "^0.10.0",
         "istanbul-smart-text-reporter": "^1.1.5",
         "markdown-code-example-inserter": "^3.0.3",
-        "prisma-vir": "^2.0.0",
+        "prisma-vir": "^2.1.0",
         "typedoc": "^0.28.14"
     },
     "engines": {

package/src/auth-client/frontend-auth.client.ts

@@ -5,7 +5,6 @@ import {
     type MaybePromise,
     type PartialWithUndefined,
     type SelectFrom,
-    type SetOptionalWithUndefined,
 } from '@augment-vir/common';
 import {type AnyDuration} from 'date-vir';
 import {type EmptyObject} from 'type-fest';
@@ -41,14 +40,18 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
          * Get a response from the backend to see if the user is still authenticated. If the
          * response returns a non-authorized status, the user is wiped. Any other status is
          * ignored.
+         *
+         * If the user is not currently authorized, this should return `undefined` to prevent
+         * unnecessary network traffic.
          */
         performCheck: () => MaybePromise<
-            SelectFrom<
-                Response,
-                {
-                    status: true;
-                }
-            >
+            | SelectFrom<
+                  Response,
+                  {
+                      status: true;
+                  }
+              >
+            | undefined
         >;
         /** @default {minutes: 1} */
         interval?: AnyDuration | undefined;
@@ -70,24 +73,15 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
  */
 export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject = EmptyObject> {
     protected userCheckInterval: undefined | ReturnType<typeof createBlockingInterval>;
-    /**
-     * Keeps track of whether the latest state of auth is logged in (`true`) or not (`false`). This
-     * is used for determining if the check user interval should keep running.
-     */
-    protected isLatestAuthorized = false;
 
     constructor(protected readonly config: FrontendAuthClientConfig = {}) {
         if (config.checkUser) {
             this.userCheckInterval = createBlockingInterval(
                 async () => {
-                    /** No need to check current user status when there is no user. */
-                    if (!this.isLatestAuthorized) {
-                        return;
-                    }
-
                     const response = await config.checkUser?.performCheck();
+
                     if (response) {
-                        this.isLatestAuthorized = await this.verifyResponseAuth({
+                        await this.verifyResponseAuth({
                             status: response.status,
                         });
                     }
@@ -194,7 +188,6 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
 
     /** Wipes the current user auth. */
     public async logout() {
-        this.isLatestAuthorized = false;
         await this.config.authClearedCallback?.();
         wipeCurrentCsrfToken(this.config.overrides);
     }
@@ -229,7 +222,6 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
         }
 
         storeCsrfToken(csrfToken, this.config.overrides);
-        this.isLatestAuthorized = true;
     }
 
     /**
@@ -240,15 +232,14 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
      */
     public async verifyResponseAuth(
         response: Readonly<
-            SetOptionalWithUndefined<
+            PartialWithUndefined<
                 SelectFrom<
                     Response,
                     {
                         status: true;
                         headers: true;
                     }
-                >,
-                'headers'
+                >
             >
         >,
     ): Promise<boolean> {
@@ -260,6 +251,12 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
             return false;
         }
 
+        /** If the response has a new CSRF token, store it. */
+        const {csrfToken} = extractCsrfTokenHeader(response, this.config.overrides);
+        if (csrfToken) {
+            storeCsrfToken(csrfToken, this.config.overrides);
+        }
+
         return true;
     }
 }

package/src/csrf-token.ts

@@ -77,14 +77,14 @@ export type GetCsrfTokenResult = RequireExactlyOne<{
  * @category Auth : Client
  */
 export function extractCsrfTokenHeader(
-    response: Readonly<SelectFrom<Response, {headers: true}>>,
+    response: Readonly<PartialWithUndefined<SelectFrom<Response, {headers: true}>>>,
     overrides: PartialWithUndefined<{
         csrfHeaderName: string;
     }> = {},
 ): Readonly<GetCsrfTokenResult> {
     const csrfTokenHeaderName = overrides.csrfHeaderName || AuthHeaderName.CsrfToken;
 
-    const rawCsrfToken = response.headers.get(csrfTokenHeaderName);
+    const rawCsrfToken = response.headers?.get(csrfTokenHeaderName);
 
     return parseCsrfToken(rawCsrfToken);
 }