auth-vir 2.4.0 → 2.4.2

package/dist/auth-client/backend-auth.client.d.ts

@@ -128,7 +128,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          */
         isSignUpCookie: boolean;
         /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin: string | undefined;
+        serviceOrigin?: string | undefined;
     }): Promise<Readonly<CookieParams>>;
     /** Calls the provided `getUserFromDatabase` config. */
     protected getDatabaseUser({ isSignUpCookie, userId, assumingUser, }: {
@@ -137,8 +137,10 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
         isSignUpCookie: boolean;
     }): Promise<undefined | DatabaseUser>;
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
-    protected createCookieRefreshHeaders({ userIdResult, }: {
+    protected createCookieRefreshHeaders({ userIdResult, serviceOrigin, }: {
         userIdResult: Readonly<UserIdResult<UserId>>;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<OutgoingHttpHeaders | undefined>;
     /** Reads the user's assumed user headers and, if configured, gets the assumed user. */
     protected getAssumedUser({ headers, user, }: {
@@ -146,7 +148,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
         headers: IncomingHttpHeaders;
     }): Promise<DatabaseUser | undefined>;
     /** Securely extract a user from their request headers. */
-    getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, }: {
+    getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, serviceOrigin, }: {
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
         /**
@@ -155,6 +157,8 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined>;
     /**
      * Get all the JWT params used when creating the auth cookie, in case you need them for
@@ -162,9 +166,10 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
      */
     getJwtParams(): Promise<Readonly<CreateJwtParams>>;
     /** Use these headers to log out the user. */
-    createLogoutHeaders(params: RequireExactlyOne<{
+    createLogoutHeaders(params: Readonly<RequireExactlyOne<{
         allCookies: true;
         isSignUpCookie: boolean;
+    }> & {
         /** Overrides the client's already established `serviceOrigin`. */
         serviceOrigin?: string | undefined;
     }>): Promise<Partial<Record<CsrfHeaderName, string>> & {
@@ -188,6 +193,8 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<RequireOneOrNone<{
         secureUser: GetUserResult<DatabaseUser>;
         /**
@@ -203,7 +210,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
      *   where JavaScript cannot be used to attach the CSRF token header to the request (like when
      *   opening a PDF file). Use `.getSecureUser()` instead, whenever possible.
      */
-    getInsecureUser({ requestHeaders, allowUserAuthRefresh, }: {
+    getInsecureUser({ requestHeaders, allowUserAuthRefresh, serviceOrigin, }: {
         requestHeaders: IncomingHttpHeaders;
         /**
          * If true, this method will generate headers to refresh the user's auth session. This
@@ -211,5 +218,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined>;
 }

package/dist/auth-client/backend-auth.client.js

@@ -49,7 +49,7 @@ export class BackendAuthClient {
         return authenticatedUser;
     }
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
-    async createCookieRefreshHeaders({ userIdResult, }) {
+    async createCookieRefreshHeaders({ userIdResult, serviceOrigin, }) {
         const now = getNowInUtcTimezone();
         /** Double check that the JWT hasn't already expired. */
         const isExpiredAlready = isDateAfter({
@@ -83,6 +83,7 @@ export class BackendAuthClient {
                 requestHeaders: {},
                 userId: userIdResult.userId,
                 isSignUpCookie: userIdResult.cookieName === AuthCookieName.SignUp,
+                serviceOrigin,
             });
         }
         else {
@@ -110,7 +111,7 @@ export class BackendAuthClient {
         return assumedUser;
     }
     /** Securely extract a user from their request headers. */
-    async getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, }) {
+    async getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, serviceOrigin, }) {
         const userIdResult = await extractUserIdFromRequestHeaders(requestHeaders, await this.getJwtParams(), isSignUpCookie ? AuthCookieName.SignUp : AuthCookieName.Auth, this.config.overrides);
         if (!userIdResult) {
             return undefined;
@@ -129,6 +130,7 @@ export class BackendAuthClient {
         });
         const cookieRefreshHeaders = (await this.createCookieRefreshHeaders({
             userIdResult,
+            serviceOrigin,
         })) || {};
         return {
             user: assumedUser || user,
@@ -220,7 +222,7 @@ export class BackendAuthClient {
      *   where JavaScript cannot be used to attach the CSRF token header to the request (like when
      *   opening a PDF file). Use `.getSecureUser()` instead, whenever possible.
      */
-    async getInsecureUser({ requestHeaders, allowUserAuthRefresh, }) {
+    async getInsecureUser({ requestHeaders, allowUserAuthRefresh, serviceOrigin, }) {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
         const userIdResult = await insecureExtractUserIdFromCookieAlone(requestHeaders, await this.getJwtParams(), AuthCookieName.Auth);
         if (!userIdResult) {
@@ -237,6 +239,7 @@ export class BackendAuthClient {
         const refreshHeaders = allowUserAuthRefresh &&
             (await this.createCookieRefreshHeaders({
                 userIdResult,
+                serviceOrigin,
             }));
         return {
             user,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth-vir",
-    "version": "2.4.0",
+    "version": "2.4.2",
     "description": "Auth made easy and secure via JWT cookies, CSRF tokens, and password hashing helpers.",
     "keywords": [
         "auth",

package/src/auth-client/backend-auth.client.ts

@@ -178,7 +178,7 @@ export class BackendAuthClient<
          */
         isSignUpCookie: boolean;
         /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin: string | undefined;
+        serviceOrigin?: string | undefined;
     }): Promise<Readonly<CookieParams>> {
         return {
             cookieDuration: this.config.userSessionIdleTimeout || defaultSessionIdleTimeout,
@@ -219,8 +219,11 @@ export class BackendAuthClient<
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
     protected async createCookieRefreshHeaders({
         userIdResult,
+        serviceOrigin,
     }: {
         userIdResult: Readonly<UserIdResult<UserId>>;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<OutgoingHttpHeaders | undefined> {
         const now = getNowInUtcTimezone();
 
@@ -262,6 +265,7 @@ export class BackendAuthClient<
                 requestHeaders: {},
                 userId: userIdResult.userId,
                 isSignUpCookie: userIdResult.cookieName === AuthCookieName.SignUp,
+                serviceOrigin,
             });
         } else {
             return undefined;
@@ -309,6 +313,7 @@ export class BackendAuthClient<
         requestHeaders,
         isSignUpCookie,
         allowUserAuthRefresh,
+        serviceOrigin,
     }: {
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
@@ -318,6 +323,8 @@ export class BackendAuthClient<
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined> {
         const userIdResult = await extractUserIdFromRequestHeaders<UserId>(
             requestHeaders,
@@ -347,6 +354,7 @@ export class BackendAuthClient<
         const cookieRefreshHeaders =
             (await this.createCookieRefreshHeaders({
                 userIdResult,
+                serviceOrigin,
             })) || {};
 
         return {
@@ -381,12 +389,15 @@ export class BackendAuthClient<
 
     /** Use these headers to log out the user. */
     public async createLogoutHeaders(
-        params: RequireExactlyOne<{
-            allCookies: true;
-            isSignUpCookie: boolean;
-            /** Overrides the client's already established `serviceOrigin`. */
-            serviceOrigin?: string | undefined;
-        }>,
+        params: Readonly<
+            RequireExactlyOne<{
+                allCookies: true;
+                isSignUpCookie: boolean;
+            }> & {
+                /** Overrides the client's already established `serviceOrigin`. */
+                serviceOrigin?: string | undefined;
+            }
+        >,
     ): Promise<
         Partial<Record<CsrfHeaderName, string>> & {
             'set-cookie': string[];
@@ -491,6 +502,8 @@ export class BackendAuthClient<
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<
         RequireOneOrNone<{
             secureUser: GetUserResult<DatabaseUser>;
@@ -523,6 +536,7 @@ export class BackendAuthClient<
     public async getInsecureUser({
         requestHeaders,
         allowUserAuthRefresh,
+        serviceOrigin,
     }: {
         requestHeaders: IncomingHttpHeaders;
         /**
@@ -531,6 +545,8 @@ export class BackendAuthClient<
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined> {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
         const userIdResult = await insecureExtractUserIdFromCookieAlone<UserId>(
@@ -557,6 +573,7 @@ export class BackendAuthClient<
             allowUserAuthRefresh &&
             (await this.createCookieRefreshHeaders({
                 userIdResult,
+                serviceOrigin,
             }));
 
         return {