auth-vir 2.3.4 → 2.3.6

package/dist/auth-client/backend-auth.client.d.ts

@@ -99,7 +99,7 @@ export type BackendAuthClientConfig<DatabaseUser extends AnyObject, UserId exten
      * How long before a user's session times out when we should start trying to refresh their
      * session.
      *
-     * @default {minutes: 5}
+     * @default {minutes: 10}
      */
     sessionRefreshThreshold: Readonly<AnyDuration>;
     overrides: PartialWithUndefined<{

package/dist/auth-client/backend-auth.client.js

@@ -7,6 +7,9 @@ import { parseJwtKeys } from '../jwt/jwt-keys.js';
 const defaultSessionIdleTimeout = {
     minutes: 20,
 };
+const defaultSessionRefreshThreshold = {
+    minutes: 10,
+};
 /**
  * An auth client for creating and validating JWTs embedded in cookies. This should only be used in
  * a backend environment as it accesses native Node packages.
@@ -72,9 +75,7 @@ export class BackendAuthClient {
          * - Z = JWT expiration outside the refresh threshold: {@link isRefreshReady} = false.
          */
         const isRefreshReady = isDateAfter({
-            fullDate: calculateRelativeDate(now, this.config.sessionRefreshThreshold || {
-                minutes: 5,
-            }),
+            fullDate: calculateRelativeDate(now, this.config.sessionRefreshThreshold || defaultSessionRefreshThreshold),
             relativeTo: userIdResult.jwtExpiration,
         });
         if (isRefreshReady) {

package/dist/auth-client/frontend-auth.client.d.ts

@@ -1,4 +1,4 @@
-import { createBlockingInterval, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type SelectFrom, type SetOptionalWithUndefined } from '@augment-vir/common';
+import { createBlockingInterval, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type SelectFrom } from '@augment-vir/common';
 import { type AnyDuration } from 'date-vir';
 import { type EmptyObject } from 'type-fest';
 /**
@@ -23,10 +23,13 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
          * Get a response from the backend to see if the user is still authenticated. If the
          * response returns a non-authorized status, the user is wiped. Any other status is
          * ignored.
+         *
+         * If the user is not currently authorized, this should return `undefined` to prevent
+         * unnecessary network traffic.
          */
         performCheck: () => MaybePromise<SelectFrom<Response, {
             status: true;
-        }>>;
+        }> | undefined>;
         /** @default {minutes: 1} */
         interval?: AnyDuration | undefined;
     };
@@ -46,11 +49,6 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
 export declare class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject = EmptyObject> {
     protected readonly config: FrontendAuthClientConfig;
     protected userCheckInterval: undefined | ReturnType<typeof createBlockingInterval>;
-    /**
-     * Keeps track of whether the latest state of auth is logged in (`true`) or not (`false`). This
-     * is used for determining if the check user interval should keep running.
-     */
-    protected isLatestAuthorized: boolean;
     constructor(config?: FrontendAuthClientConfig);
     /**
      * Destroys the client and performs all necessary cleanup (like clearing the user check
@@ -92,8 +90,8 @@ export declare class FrontendAuthClient<AssumedUserParams extends JsonCompatible
      *
      * @returns `true` if the auth is okay, `false` otherwise.
      */
-    verifyResponseAuth(response: Readonly<SetOptionalWithUndefined<SelectFrom<Response, {
+    verifyResponseAuth(response: Readonly<PartialWithUndefined<SelectFrom<Response, {
         status: true;
         headers: true;
-    }>, 'headers'>>): Promise<boolean>;
+    }>>>): Promise<boolean>;
 }

package/dist/auth-client/frontend-auth.client.js

@@ -1,4 +1,5 @@
 import { createBlockingInterval, HttpStatus, } from '@augment-vir/common';
+import { isPageActive } from 'page-active';
 import { CsrfTokenFailureReason, extractCsrfTokenHeader, getCurrentCsrfToken, storeCsrfToken, wipeCurrentCsrfToken, } from '../csrf-token.js';
 import { AuthHeaderName } from '../headers.js';
 /**
@@ -11,22 +12,17 @@ import { AuthHeaderName } from '../headers.js';
 export class FrontendAuthClient {
     config;
     userCheckInterval;
-    /**
-     * Keeps track of whether the latest state of auth is logged in (`true`) or not (`false`). This
-     * is used for determining if the check user interval should keep running.
-     */
-    isLatestAuthorized = false;
     constructor(config = {}) {
         this.config = config;
         if (config.checkUser) {
             this.userCheckInterval = createBlockingInterval(async () => {
-                /** No need to check current user status when there is no user. */
-                if (!this.isLatestAuthorized) {
+                if (!isPageActive()) {
+                    /** Do not refresh the user when the page is inactive. */
                     return;
                 }
                 const response = await config.checkUser?.performCheck();
                 if (response) {
-                    this.isLatestAuthorized = await this.verifyResponseAuth({
+                    await this.verifyResponseAuth({
                         status: response.status,
                     });
                 }
@@ -111,7 +107,6 @@ export class FrontendAuthClient {
     }
     /** Wipes the current user auth. */
     async logout() {
-        this.isLatestAuthorized = false;
         await this.config.authClearedCallback?.();
         wipeCurrentCsrfToken(this.config.overrides);
     }
@@ -132,7 +127,6 @@ export class FrontendAuthClient {
             throw new Error('Did not receive any CSRF token.');
         }
         storeCsrfToken(csrfToken, this.config.overrides);
-        this.isLatestAuthorized = true;
     }
     /**
      * Use to verify _all_ responses received from the backend. Immediately logs the user out once
@@ -146,6 +140,11 @@ export class FrontendAuthClient {
             await this.logout();
             return false;
         }
+        /** If the response has a new CSRF token, store it. */
+        const { csrfToken } = extractCsrfTokenHeader(response, this.config.overrides);
+        if (csrfToken) {
+            storeCsrfToken(csrfToken, this.config.overrides);
+        }
         return true;
     }
 }

package/dist/csrf-token.d.ts

@@ -62,9 +62,9 @@ export type GetCsrfTokenResult = RequireExactlyOne<{
  *
  * @category Auth : Client
  */
-export declare function extractCsrfTokenHeader(response: Readonly<SelectFrom<Response, {
+export declare function extractCsrfTokenHeader(response: Readonly<PartialWithUndefined<SelectFrom<Response, {
     headers: true;
-}>>, overrides?: PartialWithUndefined<{
+}>>>, overrides?: PartialWithUndefined<{
     csrfHeaderName: string;
 }>): Readonly<GetCsrfTokenResult>;
 /**

package/dist/csrf-token.js

@@ -45,7 +45,7 @@ export var CsrfTokenFailureReason;
  */
 export function extractCsrfTokenHeader(response, overrides = {}) {
     const csrfTokenHeaderName = overrides.csrfHeaderName || AuthHeaderName.CsrfToken;
-    const rawCsrfToken = response.headers.get(csrfTokenHeaderName);
+    const rawCsrfToken = response.headers?.get(csrfTokenHeaderName);
     return parseCsrfToken(rawCsrfToken);
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth-vir",
-    "version": "2.3.4",
+    "version": "2.3.6",
     "description": "Auth made easy and secure via JWT cookies, CSRF tokens, and password hashing helpers.",
     "keywords": [
         "auth",
@@ -42,17 +42,18 @@
         "test:web": "virmator test web"
     },
     "dependencies": {
-        "@augment-vir/assert": "^31.45.0",
-        "@augment-vir/common": "^31.45.0",
+        "@augment-vir/assert": "^31.47.0",
+        "@augment-vir/common": "^31.47.0",
         "date-vir": "^8.0.0",
         "hash-wasm": "^4.12.0",
         "jose": "^6.1.0",
         "object-shape-tester": "^6.9.3",
+        "page-active": "^1.0.3",
         "type-fest": "^5.1.0",
         "url-vir": "^2.1.6"
     },
     "devDependencies": {
-        "@augment-vir/test": "^31.45.0",
+        "@augment-vir/test": "^31.47.0",
         "@prisma/client": "^6.18.0",
         "@types/node": "^24.9.1",
         "@web/dev-server-esbuild": "^1.0.4",
@@ -62,7 +63,7 @@
         "@web/test-runner-visual-regression": "^0.10.0",
         "istanbul-smart-text-reporter": "^1.1.5",
         "markdown-code-example-inserter": "^3.0.3",
-        "prisma-vir": "^2.0.0",
+        "prisma-vir": "^2.1.0",
         "typedoc": "^0.28.14"
     },
     "engines": {

package/src/auth-client/backend-auth.client.ts

@@ -123,7 +123,7 @@ export type BackendAuthClientConfig<
          * How long before a user's session times out when we should start trying to refresh their
          * session.
          *
-         * @default {minutes: 5}
+         * @default {minutes: 10}
          */
         sessionRefreshThreshold: Readonly<AnyDuration>;
         overrides: PartialWithUndefined<{
@@ -137,6 +137,10 @@ const defaultSessionIdleTimeout: Readonly<AnyDuration> = {
     minutes: 20,
 };
 
+const defaultSessionRefreshThreshold: Readonly<AnyDuration> = {
+    minutes: 10,
+};
+
 /**
  * An auth client for creating and validating JWTs embedded in cookies. This should only be used in
  * a backend environment as it accesses native Node packages.
@@ -245,9 +249,7 @@ export class BackendAuthClient<
         const isRefreshReady = isDateAfter({
             fullDate: calculateRelativeDate(
                 now,
-                this.config.sessionRefreshThreshold || {
-                    minutes: 5,
-                },
+                this.config.sessionRefreshThreshold || defaultSessionRefreshThreshold,
             ),
             relativeTo: userIdResult.jwtExpiration,
         });

package/src/auth-client/frontend-auth.client.ts

@@ -5,9 +5,9 @@ import {
     type MaybePromise,
     type PartialWithUndefined,
     type SelectFrom,
-    type SetOptionalWithUndefined,
 } from '@augment-vir/common';
 import {type AnyDuration} from 'date-vir';
+import {isPageActive} from 'page-active';
 import {type EmptyObject} from 'type-fest';
 import {
     CsrfTokenFailureReason,
@@ -41,14 +41,18 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
          * Get a response from the backend to see if the user is still authenticated. If the
          * response returns a non-authorized status, the user is wiped. Any other status is
          * ignored.
+         *
+         * If the user is not currently authorized, this should return `undefined` to prevent
+         * unnecessary network traffic.
          */
         performCheck: () => MaybePromise<
-            SelectFrom<
-                Response,
-                {
-                    status: true;
-                }
-            >
+            | SelectFrom<
+                  Response,
+                  {
+                      status: true;
+                  }
+              >
+            | undefined
         >;
         /** @default {minutes: 1} */
         interval?: AnyDuration | undefined;
@@ -70,24 +74,19 @@ export type FrontendAuthClientConfig = PartialWithUndefined<{
  */
 export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject = EmptyObject> {
     protected userCheckInterval: undefined | ReturnType<typeof createBlockingInterval>;
-    /**
-     * Keeps track of whether the latest state of auth is logged in (`true`) or not (`false`). This
-     * is used for determining if the check user interval should keep running.
-     */
-    protected isLatestAuthorized = false;
 
     constructor(protected readonly config: FrontendAuthClientConfig = {}) {
         if (config.checkUser) {
             this.userCheckInterval = createBlockingInterval(
                 async () => {
-                    /** No need to check current user status when there is no user. */
-                    if (!this.isLatestAuthorized) {
+                    if (!isPageActive()) {
+                        /** Do not refresh the user when the page is inactive. */
                         return;
                     }
-
                     const response = await config.checkUser?.performCheck();
+
                     if (response) {
-                        this.isLatestAuthorized = await this.verifyResponseAuth({
+                        await this.verifyResponseAuth({
                             status: response.status,
                         });
                     }
@@ -194,7 +193,6 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
 
     /** Wipes the current user auth. */
     public async logout() {
-        this.isLatestAuthorized = false;
         await this.config.authClearedCallback?.();
         wipeCurrentCsrfToken(this.config.overrides);
     }
@@ -229,7 +227,6 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
         }
 
         storeCsrfToken(csrfToken, this.config.overrides);
-        this.isLatestAuthorized = true;
     }
 
     /**
@@ -240,15 +237,14 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
      */
     public async verifyResponseAuth(
         response: Readonly<
-            SetOptionalWithUndefined<
+            PartialWithUndefined<
                 SelectFrom<
                     Response,
                     {
                         status: true;
                         headers: true;
                     }
-                >,
-                'headers'
+                >
             >
         >,
     ): Promise<boolean> {
@@ -260,6 +256,12 @@ export class FrontendAuthClient<AssumedUserParams extends JsonCompatibleObject =
             return false;
         }
 
+        /** If the response has a new CSRF token, store it. */
+        const {csrfToken} = extractCsrfTokenHeader(response, this.config.overrides);
+        if (csrfToken) {
+            storeCsrfToken(csrfToken, this.config.overrides);
+        }
+
         return true;
     }
 }

package/src/csrf-token.ts

@@ -77,14 +77,14 @@ export type GetCsrfTokenResult = RequireExactlyOne<{
  * @category Auth : Client
  */
 export function extractCsrfTokenHeader(
-    response: Readonly<SelectFrom<Response, {headers: true}>>,
+    response: Readonly<PartialWithUndefined<SelectFrom<Response, {headers: true}>>>,
     overrides: PartialWithUndefined<{
         csrfHeaderName: string;
     }> = {},
 ): Readonly<GetCsrfTokenResult> {
     const csrfTokenHeaderName = overrides.csrfHeaderName || AuthHeaderName.CsrfToken;
 
-    const rawCsrfToken = response.headers.get(csrfTokenHeaderName);
+    const rawCsrfToken = response.headers?.get(csrfTokenHeaderName);
 
     return parseCsrfToken(rawCsrfToken);
 }