auth-vir 2.4.2 → 2.5.0

package/dist/auth-client/backend-auth.client.d.ts

@@ -58,6 +58,13 @@ export type BackendAuthClientConfig<DatabaseUser extends AnyObject, UserId exten
      */
     isDev: boolean;
 } & PartialWithUndefined<{
+    /**
+     * Optionally generate a service origin from request headers. The generated origin is used
+     * for set-cookie headers.
+     */
+    generateServiceOrigin(params: {
+        requestHeaders: Readonly<IncomingHttpHeaders>;
+    }): MaybePromise<undefined | string>;
     /**
      * Set this to allow specific users (determined by `canAssumeUser`) to assume the identity
      * of other users. This should only be used for admins so that they can troubleshoot user
@@ -119,7 +126,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
     protected cachedParsedJwtKeys: Record<string, Readonly<JwtKeys>>;
     constructor(config: BackendAuthClientConfig<DatabaseUser, UserId, AssumedUserParams, CsrfHeaderName>);
     /** Get all the parameters used for cookie generation. */
-    protected getCookieParams({ isSignUpCookie, serviceOrigin, }: {
+    protected getCookieParams({ isSignUpCookie, requestHeaders, }: {
         /**
          * Set this to `true` when we are setting the initial cookie right after a user signs up.
          * This allows them to auto-authorize when they verify their email address.
@@ -127,8 +134,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * This should only be set to `true` when a new user is signing up.
          */
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
+        requestHeaders: Readonly<IncomingHttpHeaders> | undefined;
     }): Promise<Readonly<CookieParams>>;
     /** Calls the provided `getUserFromDatabase` config. */
     protected getDatabaseUser({ isSignUpCookie, userId, assumingUser, }: {
@@ -137,10 +143,9 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
         isSignUpCookie: boolean;
     }): Promise<undefined | DatabaseUser>;
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
-    protected createCookieRefreshHeaders({ userIdResult, serviceOrigin, }: {
+    protected createCookieRefreshHeaders({ userIdResult, requestHeaders, }: {
         userIdResult: Readonly<UserIdResult<UserId>>;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
+        requestHeaders: IncomingHttpHeaders;
     }): Promise<OutgoingHttpHeaders | undefined>;
     /** Reads the user's assumed user headers and, if configured, gets the assumed user. */
     protected getAssumedUser({ headers, user, }: {
@@ -148,7 +153,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
         headers: IncomingHttpHeaders;
     }): Promise<DatabaseUser | undefined>;
     /** Securely extract a user from their request headers. */
-    getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, serviceOrigin, }: {
+    getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, }: {
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
         /**
@@ -157,8 +162,6 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined>;
     /**
      * Get all the JWT params used when creating the auth cookie, in case you need them for
@@ -176,12 +179,10 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
         'set-cookie': string[];
     }>;
     /** Use these headers to log a user in. */
-    createLoginHeaders({ userId, requestHeaders, isSignUpCookie, serviceOrigin, }: {
+    createLoginHeaders({ userId, requestHeaders, isSignUpCookie, }: {
         userId: UserId;
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<OutgoingHttpHeaders>;
     /** Combines `.getInsecureUser()` and `.getSecureUser()` into one method. */
     getInsecureOrSecureUser(params: {
@@ -210,7 +211,7 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
      *   where JavaScript cannot be used to attach the CSRF token header to the request (like when
      *   opening a PDF file). Use `.getSecureUser()` instead, whenever possible.
      */
-    getInsecureUser({ requestHeaders, allowUserAuthRefresh, serviceOrigin, }: {
+    getInsecureUser({ requestHeaders, allowUserAuthRefresh, }: {
         requestHeaders: IncomingHttpHeaders;
         /**
          * If true, this method will generate headers to refresh the user's auth session. This
@@ -218,7 +219,5 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined>;
 }

package/dist/auth-client/backend-auth.client.js

@@ -24,7 +24,10 @@ export class BackendAuthClient {
         this.config = config;
     }
     /** Get all the parameters used for cookie generation. */
-    async getCookieParams({ isSignUpCookie, serviceOrigin, }) {
+    async getCookieParams({ isSignUpCookie, requestHeaders, }) {
+        const serviceOrigin = requestHeaders
+            ? await this.config.generateServiceOrigin?.({ requestHeaders })
+            : undefined;
         return {
             cookieDuration: this.config.userSessionIdleTimeout || defaultSessionIdleTimeout,
             hostOrigin: serviceOrigin || this.config.serviceOrigin,
@@ -49,7 +52,7 @@ export class BackendAuthClient {
         return authenticatedUser;
     }
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
-    async createCookieRefreshHeaders({ userIdResult, serviceOrigin, }) {
+    async createCookieRefreshHeaders({ userIdResult, requestHeaders, }) {
         const now = getNowInUtcTimezone();
         /** Double check that the JWT hasn't already expired. */
         const isExpiredAlready = isDateAfter({
@@ -80,10 +83,9 @@ export class BackendAuthClient {
         });
         if (isRefreshReady) {
             return this.createLoginHeaders({
-                requestHeaders: {},
+                requestHeaders,
                 userId: userIdResult.userId,
                 isSignUpCookie: userIdResult.cookieName === AuthCookieName.SignUp,
-                serviceOrigin,
             });
         }
         else {
@@ -111,7 +113,7 @@ export class BackendAuthClient {
         return assumedUser;
     }
     /** Securely extract a user from their request headers. */
-    async getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, serviceOrigin, }) {
+    async getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, }) {
         const userIdResult = await extractUserIdFromRequestHeaders(requestHeaders, await this.getJwtParams(), isSignUpCookie ? AuthCookieName.SignUp : AuthCookieName.Auth, this.config.overrides);
         if (!userIdResult) {
             return undefined;
@@ -130,7 +132,7 @@ export class BackendAuthClient {
         });
         const cookieRefreshHeaders = (await this.createCookieRefreshHeaders({
             userIdResult,
-            serviceOrigin,
+            requestHeaders,
         })) || {};
         return {
             user: assumedUser || user,
@@ -162,13 +164,13 @@ export class BackendAuthClient {
         const signUpCookieHeaders = params.allCookies || params.isSignUpCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: true,
-                serviceOrigin: params.serviceOrigin,
+                requestHeaders: undefined,
             }), this.config.overrides)
             : undefined;
         const authCookieHeaders = params.allCookies || !params.isSignUpCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: false,
-                serviceOrigin: params.serviceOrigin,
+                requestHeaders: undefined,
             }), this.config.overrides)
             : undefined;
         const setCookieHeader = {
@@ -184,18 +186,18 @@ export class BackendAuthClient {
         };
     }
     /** Use these headers to log a user in. */
-    async createLoginHeaders({ userId, requestHeaders, isSignUpCookie, serviceOrigin, }) {
+    async createLoginHeaders({ userId, requestHeaders, isSignUpCookie, }) {
         const oppositeCookieName = isSignUpCookie ? AuthCookieName.Auth : AuthCookieName.SignUp;
         const hasExistingOppositeCookie = requestHeaders.cookie?.includes(`${oppositeCookieName}=`);
         const discardOppositeCookieHeaders = hasExistingOppositeCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: !isSignUpCookie,
-                serviceOrigin,
+                requestHeaders,
             }), this.config.overrides)
             : undefined;
         const newCookieHeaders = await generateSuccessfulLoginHeaders(userId, await this.getCookieParams({
             isSignUpCookie,
-            serviceOrigin,
+            requestHeaders,
         }), this.config.overrides);
         return {
             ...newCookieHeaders,
@@ -222,7 +224,7 @@ export class BackendAuthClient {
      *   where JavaScript cannot be used to attach the CSRF token header to the request (like when
      *   opening a PDF file). Use `.getSecureUser()` instead, whenever possible.
      */
-    async getInsecureUser({ requestHeaders, allowUserAuthRefresh, serviceOrigin, }) {
+    async getInsecureUser({ requestHeaders, allowUserAuthRefresh, }) {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
         const userIdResult = await insecureExtractUserIdFromCookieAlone(requestHeaders, await this.getJwtParams(), AuthCookieName.Auth);
         if (!userIdResult) {
@@ -239,7 +241,7 @@ export class BackendAuthClient {
         const refreshHeaders = allowUserAuthRefresh &&
             (await this.createCookieRefreshHeaders({
                 userIdResult,
-                serviceOrigin,
+                requestHeaders,
             }));
         return {
             user,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth-vir",
-    "version": "2.4.2",
+    "version": "2.5.0",
     "description": "Auth made easy and secure via JWT cookies, CSRF tokens, and password hashing helpers.",
     "keywords": [
         "auth",

package/src/auth-client/backend-auth.client.ts

@@ -78,6 +78,13 @@ export type BackendAuthClientConfig<
          */
         isDev: boolean;
     } & PartialWithUndefined<{
+        /**
+         * Optionally generate a service origin from request headers. The generated origin is used
+         * for set-cookie headers.
+         */
+        generateServiceOrigin(params: {
+            requestHeaders: Readonly<IncomingHttpHeaders>;
+        }): MaybePromise<undefined | string>;
         /**
          * Set this to allow specific users (determined by `canAssumeUser`) to assume the identity
          * of other users. This should only be used for admins so that they can troubleshoot user
@@ -168,7 +175,7 @@ export class BackendAuthClient<
     /** Get all the parameters used for cookie generation. */
     protected async getCookieParams({
         isSignUpCookie,
-        serviceOrigin,
+        requestHeaders,
     }: {
         /**
          * Set this to `true` when we are setting the initial cookie right after a user signs up.
@@ -177,9 +184,12 @@ export class BackendAuthClient<
          * This should only be set to `true` when a new user is signing up.
          */
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
+        requestHeaders: Readonly<IncomingHttpHeaders> | undefined;
     }): Promise<Readonly<CookieParams>> {
+        const serviceOrigin = requestHeaders
+            ? await this.config.generateServiceOrigin?.({requestHeaders})
+            : undefined;
+
         return {
             cookieDuration: this.config.userSessionIdleTimeout || defaultSessionIdleTimeout,
             hostOrigin: serviceOrigin || this.config.serviceOrigin,
@@ -219,11 +229,10 @@ export class BackendAuthClient<
     /** Creates a `'cookie-set'` header to refresh the user's session cookie. */
     protected async createCookieRefreshHeaders({
         userIdResult,
-        serviceOrigin,
+        requestHeaders,
     }: {
         userIdResult: Readonly<UserIdResult<UserId>>;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
+        requestHeaders: IncomingHttpHeaders;
     }): Promise<OutgoingHttpHeaders | undefined> {
         const now = getNowInUtcTimezone();
 
@@ -262,10 +271,9 @@ export class BackendAuthClient<
 
         if (isRefreshReady) {
             return this.createLoginHeaders({
-                requestHeaders: {},
+                requestHeaders,
                 userId: userIdResult.userId,
                 isSignUpCookie: userIdResult.cookieName === AuthCookieName.SignUp,
-                serviceOrigin,
             });
         } else {
             return undefined;
@@ -313,7 +321,6 @@ export class BackendAuthClient<
         requestHeaders,
         isSignUpCookie,
         allowUserAuthRefresh,
-        serviceOrigin,
     }: {
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
@@ -323,8 +330,6 @@ export class BackendAuthClient<
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined> {
         const userIdResult = await extractUserIdFromRequestHeaders<UserId>(
             requestHeaders,
@@ -354,7 +359,7 @@ export class BackendAuthClient<
         const cookieRefreshHeaders =
             (await this.createCookieRefreshHeaders({
                 userIdResult,
-                serviceOrigin,
+                requestHeaders,
             })) || {};
 
         return {
@@ -408,7 +413,7 @@ export class BackendAuthClient<
                 ? (generateLogoutHeaders(
                       await this.getCookieParams({
                           isSignUpCookie: true,
-                          serviceOrigin: params.serviceOrigin,
+                          requestHeaders: undefined,
                       }),
                       this.config.overrides,
                   ) satisfies Record<CsrfHeaderName, string>)
@@ -418,7 +423,7 @@ export class BackendAuthClient<
                 ? (generateLogoutHeaders(
                       await this.getCookieParams({
                           isSignUpCookie: false,
-                          serviceOrigin: params.serviceOrigin,
+                          requestHeaders: undefined,
                       }),
                       this.config.overrides,
                   ) satisfies Record<CsrfHeaderName, string>)
@@ -448,13 +453,10 @@ export class BackendAuthClient<
         userId,
         requestHeaders,
         isSignUpCookie,
-        serviceOrigin,
     }: {
         userId: UserId;
         requestHeaders: IncomingHttpHeaders;
         isSignUpCookie: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<OutgoingHttpHeaders> {
         const oppositeCookieName = isSignUpCookie ? AuthCookieName.Auth : AuthCookieName.SignUp;
         const hasExistingOppositeCookie = requestHeaders.cookie?.includes(`${oppositeCookieName}=`);
@@ -463,7 +465,7 @@ export class BackendAuthClient<
             ? generateLogoutHeaders(
                   await this.getCookieParams({
                       isSignUpCookie: !isSignUpCookie,
-                      serviceOrigin,
+                      requestHeaders,
                   }),
                   this.config.overrides,
               )
@@ -473,7 +475,7 @@ export class BackendAuthClient<
             userId,
             await this.getCookieParams({
                 isSignUpCookie,
-                serviceOrigin,
+                requestHeaders,
             }),
             this.config.overrides,
         );
@@ -536,7 +538,6 @@ export class BackendAuthClient<
     public async getInsecureUser({
         requestHeaders,
         allowUserAuthRefresh,
-        serviceOrigin,
     }: {
         requestHeaders: IncomingHttpHeaders;
         /**
@@ -545,8 +546,6 @@ export class BackendAuthClient<
          * with the frontend auth client's `checkUser.performCheck` callback.
          */
         allowUserAuthRefresh: boolean;
-        /** Overrides the client's already established `serviceOrigin`. */
-        serviceOrigin?: string | undefined;
     }): Promise<GetUserResult<DatabaseUser> | undefined> {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
         const userIdResult = await insecureExtractUserIdFromCookieAlone<UserId>(
@@ -573,7 +572,7 @@ export class BackendAuthClient<
             allowUserAuthRefresh &&
             (await this.createCookieRefreshHeaders({
                 userIdResult,
-                serviceOrigin,
+                requestHeaders,
             }));
 
         return {