auth-vir 2.4.1 → 2.5.0

package/dist/auth-client/backend-auth.client.d.ts

@@ -58,6 +58,13 @@ export type BackendAuthClientConfig<DatabaseUser extends AnyObject, UserId exten
      */
     isDev: boolean;
 } & PartialWithUndefined<{
+    /**
+     * Optionally generate a service origin from request headers. The generated origin is used
+     * for set-cookie headers.
+     */
+    generateServiceOrigin(params: {
+        requestHeaders: Readonly<IncomingHttpHeaders>;
+    }): MaybePromise<undefined | string>;
     /**
      * Set this to allow specific users (determined by `canAssumeUser`) to assume the identity
      * of other users. This should only be used for admins so that they can troubleshoot user
@@ -119,7 +126,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
     protected cachedParsedJwtKeys: Record<string, Readonly<JwtKeys>>;
     constructor(config: BackendAuthClientConfig<DatabaseUser, UserId, AssumedUserParams, CsrfHeaderName>);
     /** Get all the parameters used for cookie generation. */
-    protected getCookieParams({ isSignUpCookie, serviceOrigin, }: {
+    protected getCookieParams({ isSignUpCookie, requestHeaders, }: {
         /**
          * Set this to `true` when we are setting the initial cookie right after a user signs up.
          * This allows them to auto-authorize when they verify their email address.
@@ -127,8 +134,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * This should only be set to `true` when a new user is signing up.
          */
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin: string | undefined;
+        requestHeaders: Readonly<IncomingHttpHeaders> | undefined;
     }): Promise<Readonly<CookieParams>>;
     /** Calls the provided `getUserFromDatabase` config. */
     protected getDatabaseUser({ isSignUpCookie, userId, assumingUser, }: {
@@ -137,8 +143,9 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
         isSignUpCookie: boolean;
     }): Promise<undefined | DatabaseUser>;
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
-    protected createCookieRefreshHeaders({ userIdResult, }: {
+    protected createCookieRefreshHeaders({ userIdResult, requestHeaders, }: {
         userIdResult: Readonly<UserIdResult<UserId>>;
+        requestHeaders: IncomingHttpHeaders;
     }): Promise<OutgoingHttpHeaders | undefined>;
     /** Reads the user's assumed user headers and, if configured, gets the assumed user. */
     protected getAssumedUser({ headers, user, }: {
@@ -172,12 +179,10 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
         'set-cookie': string[];
     }>;
     /** Use these headers to log a user in. */
-    createLoginHeaders({ userId, requestHeaders, isSignUpCookie, serviceOrigin, }: {
+    createLoginHeaders({ userId, requestHeaders, isSignUpCookie, }: {
         userId: UserId;
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<OutgoingHttpHeaders>;
     /** Combines `.getInsecureUser()` and `.getSecureUser()` into one method. */
     getInsecureOrSecureUser(params: {
@@ -189,6 +194,8 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<RequireOneOrNone<{
         secureUser: GetUserResult<DatabaseUser>;
         /**

package/dist/auth-client/backend-auth.client.js

@@ -24,7 +24,10 @@ export class BackendAuthClient {
         this.config = config;
     }
     /** Get all the parameters used for cookie generation. */
-    async getCookieParams({ isSignUpCookie, serviceOrigin, }) {
+    async getCookieParams({ isSignUpCookie, requestHeaders, }) {
+        const serviceOrigin = requestHeaders
+            ? await this.config.generateServiceOrigin?.({ requestHeaders })
+            : undefined;
         return {
             cookieDuration: this.config.userSessionIdleTimeout || defaultSessionIdleTimeout,
             hostOrigin: serviceOrigin || this.config.serviceOrigin,
@@ -49,7 +52,7 @@ export class BackendAuthClient {
         return authenticatedUser;
     }
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
-    async createCookieRefreshHeaders({ userIdResult, }) {
+    async createCookieRefreshHeaders({ userIdResult, requestHeaders, }) {
         const now = getNowInUtcTimezone();
         /** Double check that the JWT hasn't already expired. */
         const isExpiredAlready = isDateAfter({
@@ -80,7 +83,7 @@ export class BackendAuthClient {
         });
         if (isRefreshReady) {
             return this.createLoginHeaders({
-                requestHeaders: {},
+                requestHeaders,
                 userId: userIdResult.userId,
                 isSignUpCookie: userIdResult.cookieName === AuthCookieName.SignUp,
             });
@@ -129,6 +132,7 @@ export class BackendAuthClient {
         });
         const cookieRefreshHeaders = (await this.createCookieRefreshHeaders({
             userIdResult,
+            requestHeaders,
         })) || {};
         return {
             user: assumedUser || user,
@@ -160,13 +164,13 @@ export class BackendAuthClient {
         const signUpCookieHeaders = params.allCookies || params.isSignUpCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: true,
-                serviceOrigin: params.serviceOrigin,
+                requestHeaders: undefined,
             }), this.config.overrides)
             : undefined;
         const authCookieHeaders = params.allCookies || !params.isSignUpCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: false,
-                serviceOrigin: params.serviceOrigin,
+                requestHeaders: undefined,
             }), this.config.overrides)
             : undefined;
         const setCookieHeader = {
@@ -182,18 +186,18 @@ export class BackendAuthClient {
         };
     }
     /** Use these headers to log a user in. */
-    async createLoginHeaders({ userId, requestHeaders, isSignUpCookie, serviceOrigin, }) {
+    async createLoginHeaders({ userId, requestHeaders, isSignUpCookie, }) {
         const oppositeCookieName = isSignUpCookie ? AuthCookieName.Auth : AuthCookieName.SignUp;
         const hasExistingOppositeCookie = requestHeaders.cookie?.includes(`${oppositeCookieName}=`);
         const discardOppositeCookieHeaders = hasExistingOppositeCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: !isSignUpCookie,
-                serviceOrigin,
+                requestHeaders,
             }), this.config.overrides)
             : undefined;
         const newCookieHeaders = await generateSuccessfulLoginHeaders(userId, await this.getCookieParams({
             isSignUpCookie,
-            serviceOrigin,
+            requestHeaders,
         }), this.config.overrides);
         return {
             ...newCookieHeaders,
@@ -237,6 +241,7 @@ export class BackendAuthClient {
         const refreshHeaders = allowUserAuthRefresh &&
             (await this.createCookieRefreshHeaders({
                 userIdResult,
+                requestHeaders,
             }));
         return {
             user,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth-vir",
-    "version": "2.4.1",
+    "version": "2.5.0",
     "description": "Auth made easy and secure via JWT cookies, CSRF tokens, and password hashing helpers.",
     "keywords": [
         "auth",

package/src/auth-client/backend-auth.client.ts

@@ -78,6 +78,13 @@ export type BackendAuthClientConfig<
          */
         isDev: boolean;
     } & PartialWithUndefined<{
+        /**
+         * Optionally generate a service origin from request headers. The generated origin is used
+         * for set-cookie headers.
+         */
+        generateServiceOrigin(params: {
+            requestHeaders: Readonly<IncomingHttpHeaders>;
+        }): MaybePromise<undefined | string>;
         /**
          * Set this to allow specific users (determined by `canAssumeUser`) to assume the identity
          * of other users. This should only be used for admins so that they can troubleshoot user
@@ -168,7 +175,7 @@ export class BackendAuthClient<
     /** Get all the parameters used for cookie generation. */
     protected async getCookieParams({
         isSignUpCookie,
-        serviceOrigin,
+        requestHeaders,
     }: {
         /**
          * Set this to `true` when we are setting the initial cookie right after a user signs up.
@@ -177,9 +184,12 @@ export class BackendAuthClient<
          * This should only be set to `true` when a new user is signing up.
          */
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin: string | undefined;
+        requestHeaders: Readonly<IncomingHttpHeaders> | undefined;
     }): Promise<Readonly<CookieParams>> {
+        const serviceOrigin = requestHeaders
+            ? await this.config.generateServiceOrigin?.({requestHeaders})
+            : undefined;
+
         return {
             cookieDuration: this.config.userSessionIdleTimeout || defaultSessionIdleTimeout,
             hostOrigin: serviceOrigin || this.config.serviceOrigin,
@@ -219,8 +229,10 @@ export class BackendAuthClient<
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
     protected async createCookieRefreshHeaders({
         userIdResult,
+        requestHeaders,
     }: {
         userIdResult: Readonly<UserIdResult<UserId>>;
+        requestHeaders: IncomingHttpHeaders;
     }): Promise<OutgoingHttpHeaders | undefined> {
         const now = getNowInUtcTimezone();
 
@@ -259,7 +271,7 @@ export class BackendAuthClient<
 
         if (isRefreshReady) {
             return this.createLoginHeaders({
-                requestHeaders: {},
+                requestHeaders,
                 userId: userIdResult.userId,
                 isSignUpCookie: userIdResult.cookieName === AuthCookieName.SignUp,
             });
@@ -347,6 +359,7 @@ export class BackendAuthClient<
         const cookieRefreshHeaders =
             (await this.createCookieRefreshHeaders({
                 userIdResult,
+                requestHeaders,
             })) || {};
 
         return {
@@ -400,7 +413,7 @@ export class BackendAuthClient<
                 ? (generateLogoutHeaders(
                       await this.getCookieParams({
                           isSignUpCookie: true,
-                          serviceOrigin: params.serviceOrigin,
+                          requestHeaders: undefined,
                       }),
                       this.config.overrides,
                   ) satisfies Record<CsrfHeaderName, string>)
@@ -410,7 +423,7 @@ export class BackendAuthClient<
                 ? (generateLogoutHeaders(
                       await this.getCookieParams({
                           isSignUpCookie: false,
-                          serviceOrigin: params.serviceOrigin,
+                          requestHeaders: undefined,
                       }),
                       this.config.overrides,
                   ) satisfies Record<CsrfHeaderName, string>)
@@ -440,13 +453,10 @@ export class BackendAuthClient<
         userId,
         requestHeaders,
         isSignUpCookie,
-        serviceOrigin,
     }: {
         userId: UserId;
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<OutgoingHttpHeaders> {
         const oppositeCookieName = isSignUpCookie ? AuthCookieName.Auth : AuthCookieName.SignUp;
         const hasExistingOppositeCookie = requestHeaders.cookie?.includes(`${oppositeCookieName}=`);
@@ -455,7 +465,7 @@ export class BackendAuthClient<
             ? generateLogoutHeaders(
                   await this.getCookieParams({
                       isSignUpCookie: !isSignUpCookie,
-                      serviceOrigin,
+                      requestHeaders,
                   }),
                   this.config.overrides,
               )
@@ -465,7 +475,7 @@ export class BackendAuthClient<
             userId,
             await this.getCookieParams({
                 isSignUpCookie,
-                serviceOrigin,
+                requestHeaders,
             }),
             this.config.overrides,
         );
@@ -494,6 +504,8 @@ export class BackendAuthClient<
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
+        /** Overrides the client's already established `serviceOrigin`. */
+        serviceOrigin?: string | undefined;
     }): Promise<
         RequireOneOrNone<{
             secureUser: GetUserResult<DatabaseUser>;
@@ -560,6 +572,7 @@ export class BackendAuthClient<
             allowUserAuthRefresh &&
             (await this.createCookieRefreshHeaders({
                 userIdResult,
+                requestHeaders,
             }));
 
         return {