auth-vir 3.0.1 → 3.1.1

package/README.md

@@ -252,8 +252,7 @@ Use this on your client / frontend for storing and sending session authorization
 
 1. Send a login fetch request to your host / server / backend with `{credentials: 'include'}` set on the request.
 2. Pass the `Response` from step 1 into [`handleAuthResponse`](https://electrovir.github.io/auth-vir/functions/handleAuthResponse.html).
-3. In all subsequent fetch requests to the host / server / backend, set `{credentials: 'include'}` and include `{headers: {[AuthHeaderName.CsrfToken]: getCurrentCsrfToken()}}`.
-4. Upon user logout, call [`wipeCurrentCsrfToken()`](https://electrovir.github.io/auth-vir/functions/wipeCurrentCsrfToken.html)
+3. In all subsequent fetch requests to the host / server / backend, set `{credentials: 'include'}` and include `{headers: {[AuthHeaderName.CsrfToken]: (await getCurrentCsrfToken()).csrfToken}}`.
 
 Here's a full example of how to use all the client / frontend side auth functionality:
 
@@ -282,7 +281,7 @@ export async function sendLoginRequest(
     userLoginData: {username: string; password: string},
     loginUrl: string,
 ) {
-    if (getCurrentCsrfToken(csrfOption).csrfToken) {
+    if ((await getCurrentCsrfToken(csrfOption)).csrfToken) {
         throw new Error('Already logged in.');
     }
 
@@ -292,7 +291,7 @@ export async function sendLoginRequest(
         credentials: 'include',
     });
 
-    handleAuthResponse(response, csrfOption);
+    await handleAuthResponse(response, csrfOption);
 
     return response;
 }
@@ -303,7 +302,7 @@ export async function sendAuthenticatedRequest(
     requestInit: Omit<RequestInit, 'headers'> = {},
     headers: Record<string, string> = {},
 ) {
-    const {csrfToken} = getCurrentCsrfToken(csrfOption);
+    const {csrfToken} = await getCurrentCsrfToken(csrfOption);
 
     if (!csrfToken) {
         throw new Error('Not authenticated.');
@@ -324,7 +323,7 @@ export async function sendAuthenticatedRequest(
      * another tab.)
      */
     if (response.status === HttpStatus.Unauthorized) {
-        wipeCurrentCsrfToken(csrfOption);
+        await wipeCurrentCsrfToken(csrfOption);
         throw new Error(`User no longer logged in.`);
     } else {
         return response;
@@ -332,8 +331,8 @@ export async function sendAuthenticatedRequest(
 }
 
 /** Call this when the user explicitly clicks a "log out" button. */
-export function logout() {
-    wipeCurrentCsrfToken(csrfOption);
+export async function logout() {
+    await wipeCurrentCsrfToken(csrfOption);
 }
 ```
 

package/dist/auth-client/backend-auth.client.d.ts

@@ -60,6 +60,12 @@ export type BackendAuthClientConfig<DatabaseUser extends AnyObject, UserId exten
      */
     isDev: boolean;
 } & PartialWithUndefined<{
+    /** If this returns true, logging will be enabled while handling the relevant session. */
+    enableLogging(params: {
+        user: DatabaseUser | undefined;
+        userId: UserId | undefined;
+        assumedUserParams: AssumedUserParams | undefined;
+    }): boolean;
     /**
      * Overwrite the header name used for tracking is an admin is assuming the identity of
      * another user.
@@ -72,6 +78,8 @@ export type BackendAuthClientConfig<DatabaseUser extends AnyObject, UserId exten
     generateServiceOrigin(params: {
         requestHeaders: Readonly<IncomingHttpHeaders>;
     }): MaybePromise<undefined | string>;
+    /** If provided, logs will be sent to this method. */
+    log?: (message: string, extraData: AnyObject) => void;
     /**
      * Set this to allow specific users (determined by `canAssumeUser`) to assume the identity
      * of other users. This should only be used for admins so that they can troubleshoot user
@@ -141,6 +149,12 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
     protected readonly config: BackendAuthClientConfig<DatabaseUser, UserId, AssumedUserParams>;
     protected cachedParsedJwtKeys: Record<string, Readonly<JwtKeys>>;
     constructor(config: BackendAuthClientConfig<DatabaseUser, UserId, AssumedUserParams>);
+    /** Conditionally logs a message if logging is enabled for the given user context. */
+    protected logForUser(params: {
+        user: DatabaseUser | undefined;
+        userId: UserId | undefined;
+        assumedUserParams: AssumedUserParams | undefined;
+    }, message: string, extra?: Record<string, unknown>): void;
     /** Get all the parameters used for cookie generation. */
     protected getCookieParams({ isSignUpCookie, requestHeaders, }: {
         /**
@@ -195,6 +209,15 @@ export declare class BackendAuthClient<DatabaseUser extends AnyObject, UserId ex
     }>): Promise<Record<string, string | string[]> & {
         'set-cookie': string[];
     }>;
+    /**
+     * Refreshes a login session by reissuing the auth cookie with the same CSRF token instead of
+     * generating a new one.
+     */
+    protected refreshLoginHeaders({ userId, cookieParams, existingUserIdResult, }: {
+        userId: UserId;
+        cookieParams: Readonly<CookieParams>;
+        existingUserIdResult: Readonly<UserIdResult<UserId>>;
+    }): Promise<Record<string, string>>;
     /** Use these headers to log a user in. */
     createLoginHeaders({ userId, requestHeaders, isSignUpCookie, }: {
         userId: UserId;

package/dist/auth-client/backend-auth.client.js

@@ -28,10 +28,27 @@ export class BackendAuthClient {
     constructor(config) {
         this.config = config;
     }
+    /** Conditionally logs a message if logging is enabled for the given user context. */
+    logForUser(params, message, extra) {
+        if (this.config.enableLogging?.(params)) {
+            const extraData = {
+                userId: params.userId,
+                ...extra,
+            };
+            if (this.config.log) {
+                this.config.log(message, extraData);
+            }
+            else {
+                console.info(`[auth-vir] ${message}`, extraData);
+            }
+        }
+    }
     /** Get all the parameters used for cookie generation. */
     async getCookieParams({ isSignUpCookie, requestHeaders, }) {
         const serviceOrigin = requestHeaders
-            ? await this.config.generateServiceOrigin?.({ requestHeaders })
+            ? await this.config.generateServiceOrigin?.({
+                requestHeaders,
+            })
             : undefined;
         return {
             cookieDuration: this.config.userSessionIdleTimeout || defaultSessionIdleTimeout,
@@ -53,6 +70,13 @@ export class BackendAuthClient {
             requestHeaders,
         });
         if (!authenticatedUser) {
+            this.logForUser({
+                user: undefined,
+                userId,
+                assumedUserParams: assumingUser,
+            }, 'getUserFromDatabase returned no user', {
+                isSignUpCookie,
+            });
             return undefined;
         }
         return authenticatedUser;
@@ -67,6 +91,14 @@ export class BackendAuthClient {
             relativeTo: calculateRelativeDate(userIdResult.jwtExpiration, clockSkew),
         });
         if (isExpiredAlready) {
+            this.logForUser({
+                user: undefined,
+                userId: userIdResult.userId,
+                assumedUserParams: undefined,
+            }, 'Session refresh denied: JWT already expired (even with clock skew tolerance)', {
+                jwtExpiration: userIdResult.jwtExpiration,
+                now: JSON.stringify(now),
+            });
             return undefined;
         }
         /**
@@ -82,6 +114,15 @@ export class BackendAuthClient {
                 relativeTo: maxSessionEndDate,
             });
             if (isSessionExpired) {
+                this.logForUser({
+                    user: undefined,
+                    userId: userIdResult.userId,
+                    assumedUserParams: undefined,
+                }, 'Session refresh denied: max session duration exceeded', {
+                    sessionStartedAt: userIdResult.sessionStartedAt,
+                    maxSessionEndDate: JSON.stringify(maxSessionEndDate),
+                    now: JSON.stringify(now),
+                });
                 return undefined;
             }
         }
@@ -112,6 +153,14 @@ export class BackendAuthClient {
             };
         }
         else {
+            this.logForUser({
+                user: undefined,
+                userId: userIdResult.userId,
+                assumedUserParams: undefined,
+            }, 'Session refresh skipped: not yet ready for refresh', {
+                jwtIssuedAt: userIdResult.jwtIssuedAt,
+                sessionRefreshStartTime,
+            });
             return undefined;
         }
     }
@@ -140,6 +189,13 @@ export class BackendAuthClient {
     async getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, }) {
         const userIdResult = await extractUserIdFromRequestHeaders(requestHeaders, await this.getJwtParams(), this.config.csrf, isSignUpCookie ? AuthCookieName.SignUp : AuthCookieName.Auth);
         if (!userIdResult) {
+            this.logForUser({
+                user: undefined,
+                userId: undefined,
+                assumedUserParams: undefined,
+            }, 'getSecureUser: failed to extract user ID from request headers (invalid JWT, missing cookie, or CSRF mismatch)', {
+                isSignUpCookie,
+            });
             return undefined;
         }
         const user = await this.getDatabaseUser({
@@ -149,6 +205,13 @@ export class BackendAuthClient {
             requestHeaders,
         });
         if (!user) {
+            this.logForUser({
+                user: undefined,
+                userId: userIdResult.userId,
+                assumedUserParams: undefined,
+            }, 'getSecureUser: user not found in database', {
+                isSignUpCookie,
+            });
             return undefined;
         }
         const assumedUser = await this.getAssumedUser({
@@ -175,7 +238,9 @@ export class BackendAuthClient {
         const cachedParsedKeys = this.cachedParsedJwtKeys[cacheKey];
         const parsedKeys = cachedParsedKeys || (await parseJwtKeys(rawJwtKeys));
         if (!cachedParsedKeys) {
-            this.cachedParsedJwtKeys = { [cacheKey]: parsedKeys };
+            this.cachedParsedJwtKeys = {
+                [cacheKey]: parsedKeys,
+            };
         }
         return {
             jwtKeys: parsedKeys,
@@ -191,24 +256,30 @@ export class BackendAuthClient {
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: true,
                 requestHeaders: undefined,
-            }), this.config.csrf)
+            }))
             : undefined;
         const authCookieHeaders = params.allCookies || !params.isSignUpCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: false,
                 requestHeaders: undefined,
-            }), this.config.csrf)
+            }))
             : undefined;
-        const setCookieHeader = {
+        return {
             'set-cookie': mergeHeaderValues(signUpCookieHeaders?.['set-cookie'], authCookieHeaders?.['set-cookie']),
         };
-        const csrfTokenHeader = {
-            ...authCookieHeaders,
-            ...signUpCookieHeaders,
-        };
+    }
+    /**
+     * Refreshes a login session by reissuing the auth cookie with the same CSRF token instead of
+     * generating a new one.
+     */
+    async refreshLoginHeaders({ userId, cookieParams, existingUserIdResult, }) {
+        const { cookie } = await generateAuthCookie({
+            csrfToken: existingUserIdResult.csrfToken,
+            userId,
+            sessionStartedAt: existingUserIdResult.sessionStartedAt,
+        }, cookieParams);
         return {
-            ...csrfTokenHeader,
-            ...setCookieHeader,
+            'set-cookie': cookie,
         };
     }
     /** Use these headers to log a user in. */
@@ -219,14 +290,20 @@ export class BackendAuthClient {
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: !isSignUpCookie,
                 requestHeaders,
-            }), this.config.csrf)
+            }))
             : undefined;
         const existingUserIdResult = await extractUserIdFromRequestHeaders(requestHeaders, await this.getJwtParams(), this.config.csrf, isSignUpCookie ? AuthCookieName.SignUp : AuthCookieName.Auth);
-        const sessionStartedAt = existingUserIdResult?.sessionStartedAt;
-        const newCookieHeaders = await generateSuccessfulLoginHeaders(userId, await this.getCookieParams({
+        const cookieParams = await this.getCookieParams({
             isSignUpCookie,
             requestHeaders,
-        }), this.config.csrf, sessionStartedAt);
+        });
+        const newCookieHeaders = existingUserIdResult
+            ? await this.refreshLoginHeaders({
+                userId,
+                cookieParams,
+                existingUserIdResult,
+            })
+            : await generateSuccessfulLoginHeaders(userId, cookieParams, this.config.csrf);
         return {
             ...newCookieHeaders,
             'set-cookie': mergeHeaderValues(newCookieHeaders['set-cookie'], discardOppositeCookieHeaders?.['set-cookie']),
@@ -241,11 +318,17 @@ export class BackendAuthClient {
     async getInsecureOrSecureUser(params) {
         const secureUser = await this.getSecureUser(params);
         if (secureUser) {
-            return { secureUser };
+            return {
+                secureUser,
+            };
         }
         // eslint-disable-next-line @typescript-eslint/no-deprecated
         const insecureUser = await this.getInsecureUser(params);
-        return insecureUser ? { insecureUser } : {};
+        return insecureUser
+            ? {
+                insecureUser,
+            }
+            : {};
     }
     /**
      * @deprecated This only half authenticates the user. It should only be used in circumstances
@@ -256,6 +339,11 @@ export class BackendAuthClient {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
         const userIdResult = await insecureExtractUserIdFromCookieAlone(requestHeaders, await this.getJwtParams(), AuthCookieName.Auth);
         if (!userIdResult) {
+            this.logForUser({
+                user: undefined,
+                userId: undefined,
+                assumedUserParams: undefined,
+            }, 'getInsecureUser: failed to extract user ID from cookie (invalid JWT or missing cookie)');
             return undefined;
         }
         const user = await this.getDatabaseUser({
@@ -265,6 +353,11 @@ export class BackendAuthClient {
             requestHeaders,
         });
         if (!user) {
+            this.logForUser({
+                user: undefined,
+                userId: userIdResult.userId,
+                assumedUserParams: undefined,
+            }, 'getInsecureUser: user not found in database');
             return undefined;
         }
         const refreshHeaders = allowUserAuthRefresh &&

package/dist/auth-client/frontend-auth.client.d.ts

@@ -1,6 +1,7 @@
 import { type createBlockingInterval, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type SelectFrom } from '@augment-vir/common';
 import { type AnyDuration } from 'date-vir';
 import { type EmptyObject } from 'type-fest';
+import { type CsrfTokenStore } from '../csrf-token-store.js';
 import { type CsrfHeaderNameOption } from '../csrf-token.js';
 /**
  * Config for {@link FrontendAuthClient}.
@@ -57,6 +58,7 @@ export type FrontendAuthClientConfig = Readonly<{
     allowedClockSkew: Readonly<AnyDuration>;
     overrides: PartialWithUndefined<{
         localStorage: Pick<Storage, 'setItem' | 'removeItem' | 'getItem'>;
+        csrfTokenStore: CsrfTokenStore;
     }>;
 }>;
 /**
@@ -78,7 +80,7 @@ export declare class FrontendAuthClient<AssumedUserParams extends JsonCompatible
      */
     destroy(): void;
     /** Wraps {@link getCurrentCsrfToken} to automatically handle wiping an invalid CSRF token. */
-    getCurrentCsrfToken(): string | undefined;
+    getCurrentCsrfToken(): Promise<string | undefined>;
     /**
      * Assume the given user. Pass `undefined` to wipe the currently assumed user.
      *
@@ -93,7 +95,7 @@ export declare class FrontendAuthClient<AssumedUserParams extends JsonCompatible
      * `@augment-vir/common`](https://electrovir.github.io/augment-vir/functions/mergeDeep.html) to
      * combine them with these.
      */
-    createAuthenticatedRequestInit(): RequestInit;
+    createAuthenticatedRequestInit(): Promise<RequestInit>;
     /** Wipes the current user auth. */
     logout(): Promise<void>;
     /**

package/dist/auth-client/frontend-auth.client.js

@@ -1,6 +1,6 @@
 import { HttpStatus, } from '@augment-vir/common';
 import { listenToActivity } from 'detect-activity';
-import { CsrfTokenFailureReason, defaultAllowedClockSkew, extractCsrfTokenHeader, getCurrentCsrfToken, resolveCsrfHeaderName, storeCsrfToken, wipeCurrentCsrfToken, } from '../csrf-token.js';
+import { defaultAllowedClockSkew, extractCsrfTokenHeader, getCurrentCsrfToken, resolveCsrfHeaderName, storeCsrfToken, } from '../csrf-token.js';
 import { AuthHeaderName } from '../headers.js';
 /**
  * An auth client for sending and validating client requests to a backend. This should only be used
@@ -26,7 +26,9 @@ export class FrontendAuthClient {
                         });
                     }
                 },
-                debounce: config.checkUser.debounce || { minutes: 1 },
+                debounce: config.checkUser.debounce || {
+                    minutes: 1,
+                },
                 fireImmediately: false,
             });
         }
@@ -40,19 +42,13 @@ export class FrontendAuthClient {
         this.removeActivityListener?.();
     }
     /** Wraps {@link getCurrentCsrfToken} to automatically handle wiping an invalid CSRF token. */
-    getCurrentCsrfToken() {
-        const csrfTokenResult = getCurrentCsrfToken({
+    async getCurrentCsrfToken() {
+        const csrfTokenResult = await getCurrentCsrfToken({
             ...this.config.csrf,
-            localStorage: this.config.overrides?.localStorage,
+            csrfTokenStore: this.config.overrides?.csrfTokenStore,
             allowedClockSkew: this.config.allowedClockSkew || defaultAllowedClockSkew,
         });
         if (csrfTokenResult.failure) {
-            if (csrfTokenResult.failure !== CsrfTokenFailureReason.DoesNotExist) {
-                wipeCurrentCsrfToken({
-                    ...this.config.csrf,
-                    localStorage: this.config.overrides?.localStorage,
-                });
-            }
             return undefined;
         }
         return csrfTokenResult.csrfToken.token;
@@ -69,7 +65,7 @@ export class FrontendAuthClient {
             localStorage.removeItem(storageKey);
             return true;
         }
-        if (!(await this.config.canAssumeUser?.())) {
+        else if (!(await this.config.canAssumeUser?.())) {
             return false;
         }
         localStorage.setItem(storageKey, JSON.stringify(assumedUserParams));
@@ -94,8 +90,8 @@ export class FrontendAuthClient {
      * `@augment-vir/common`](https://electrovir.github.io/augment-vir/functions/mergeDeep.html) to
      * combine them with these.
      */
-    createAuthenticatedRequestInit() {
-        const csrfToken = this.getCurrentCsrfToken();
+    async createAuthenticatedRequestInit() {
+        const csrfToken = await this.getCurrentCsrfToken();
         const assumedUser = this.getAssumedUser();
         const headers = {
             ...(csrfToken
@@ -117,10 +113,6 @@ export class FrontendAuthClient {
     /** Wipes the current user auth. */
     async logout() {
         await this.config.authClearedCallback?.();
-        wipeCurrentCsrfToken({
-            ...this.config.csrf,
-            localStorage: this.config.overrides?.localStorage,
-        });
     }
     /**
      * Use to handle a login response. Automatically stores the CSRF token.
@@ -140,9 +132,9 @@ export class FrontendAuthClient {
             await this.logout();
             throw new Error('Did not receive any CSRF token.');
         }
-        storeCsrfToken(csrfToken, {
+        await storeCsrfToken(csrfToken, {
             ...this.config.csrf,
-            localStorage: this.config.overrides?.localStorage,
+            csrfTokenStore: this.config.overrides?.csrfTokenStore,
         });
     }
     /**
@@ -162,9 +154,9 @@ export class FrontendAuthClient {
             allowedClockSkew: this.config.allowedClockSkew || defaultAllowedClockSkew,
         });
         if (csrfToken) {
-            storeCsrfToken(csrfToken, {
+            await storeCsrfToken(csrfToken, {
                 ...this.config.csrf,
-                localStorage: this.config.overrides?.localStorage,
+                csrfTokenStore: this.config.overrides?.csrfTokenStore,
             });
         }
         return true;

package/dist/auth.d.ts

@@ -1,6 +1,7 @@
 import { type PartialWithUndefined } from '@augment-vir/common';
 import { type FullDate, type UtcTimezone } from 'date-vir';
 import { type CookieParams } from './cookie.js';
+import { type CsrfTokenStore } from './csrf-token-store.js';
 import { type CsrfHeaderNameOption } from './csrf-token.js';
 import { type ParseJwtParams } from './jwt/jwt.js';
 import { type JwtUserData } from './jwt/user-jwt.js';
@@ -66,11 +67,11 @@ sessionStartedAt?: number | undefined): Promise<Record<string, string>>;
  *
  * @category Auth : Host
  */
-export declare function generateLogoutHeaders(cookieConfig: Readonly<Pick<CookieParams, 'cookieName' | 'hostOrigin' | 'isDev'>>, csrfHeaderNameOption: Readonly<CsrfHeaderNameOption>): Record<string, string>;
+export declare function generateLogoutHeaders(cookieConfig: Readonly<Pick<CookieParams, 'cookieName' | 'hostOrigin' | 'isDev'>>): Record<string, string>;
 /**
  * Store auth data on a client (frontend) after receiving an auth response from the host (backend).
- * Specifically, this stores the CSRF token into local storage (which doesn't need to be a secret).
- * Alternatively, if the given response failed, this will wipe the existing (if anyone) stored CSRF
+ * Specifically, this stores the CSRF token into IndexedDB (which doesn't need to be a secret).
+ * Alternatively, if the given response failed, this will wipe the existing (if any) stored CSRF
  * token.
  *
  * @category Auth : Client
@@ -78,9 +79,9 @@ export declare function generateLogoutHeaders(cookieConfig: Readonly<Pick<Cookie
  */
 export declare function handleAuthResponse(response: Readonly<Pick<Response, 'ok' | 'headers'>>, options: Readonly<CsrfHeaderNameOption> & PartialWithUndefined<{
     /**
-     * Allows mocking or overriding the global `localStorage`.
+     * Allows mocking or overriding the default CSRF token store.
      *
-     * @default globalThis.localStorage
+     * @default getDefaultCsrfTokenStore()
      */
-    localStorage: Pick<Storage, 'setItem' | 'removeItem'>;
-}>): void;
+    csrfTokenStore: CsrfTokenStore;
+}>): Promise<void>;

package/dist/auth.js

@@ -1,5 +1,5 @@
 import { AuthCookieName, clearAuthCookie, extractCookieJwt, generateAuthCookie, } from './cookie.js';
-import { extractCsrfTokenHeader, generateCsrfToken, parseCsrfToken, resolveCsrfHeaderName, storeCsrfToken, wipeCurrentCsrfToken, } from './csrf-token.js';
+import { extractCsrfTokenHeader, generateCsrfToken, parseCsrfToken, resolveCsrfHeaderName, storeCsrfToken, } from './csrf-token.js';
 function readHeader(headers, headerName) {
     if (headers instanceof Headers) {
         return headers.get(headerName) || undefined;
@@ -122,31 +122,27 @@ sessionStartedAt) {
  *
  * @category Auth : Host
  */
-export function generateLogoutHeaders(cookieConfig, csrfHeaderNameOption) {
-    const csrfHeaderName = resolveCsrfHeaderName(csrfHeaderNameOption);
+export function generateLogoutHeaders(cookieConfig) {
     return {
         'set-cookie': clearAuthCookie(cookieConfig),
-        [csrfHeaderName]: 'redacted',
     };
 }
 /**
  * Store auth data on a client (frontend) after receiving an auth response from the host (backend).
- * Specifically, this stores the CSRF token into local storage (which doesn't need to be a secret).
- * Alternatively, if the given response failed, this will wipe the existing (if anyone) stored CSRF
+ * Specifically, this stores the CSRF token into IndexedDB (which doesn't need to be a secret).
+ * Alternatively, if the given response failed, this will wipe the existing (if any) stored CSRF
  * token.
  *
  * @category Auth : Client
  * @throws Error if no CSRF token header is found.
  */
-export function handleAuthResponse(response, options) {
+export async function handleAuthResponse(response, options) {
     if (!response.ok) {
-        wipeCurrentCsrfToken(options);
         return;
     }
     const { csrfToken } = extractCsrfTokenHeader(response, options);
     if (!csrfToken) {
-        wipeCurrentCsrfToken(options);
         throw new Error('Did not receive any CSRF token.');
     }
-    storeCsrfToken(csrfToken, options);
+    await storeCsrfToken(csrfToken, options);
 }

package/dist/cookie.js

@@ -29,7 +29,9 @@ export async function generateAuthCookie(userJwtData, cookieConfig) {
             HttpOnly: true,
             Path: '/',
             SameSite: 'Strict',
-            'MAX-AGE': convertDuration(cookieConfig.cookieDuration, { seconds: true }).seconds,
+            'MAX-AGE': convertDuration(cookieConfig.cookieDuration, {
+                seconds: true,
+            }).seconds,
             Secure: !cookieConfig.isDev,
         }),
         expiration,

package/dist/csrf-token-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The interface used for overriding the default CSRF token store in storage functions.
+ *
+ * @category Internal
+ */
+export type CsrfTokenStore = {
+    /** Retrieves the stored CSRF token, if any. */
+    getCsrfToken(): Promise<string | undefined>;
+    /** Stores a CSRF token. */
+    setCsrfToken(value: string): Promise<void>;
+    /** Deletes the stored CSRF token. */
+    deleteCsrfToken(): Promise<void>;
+};
+/**
+ * The default {@link LocalDbClient} instance used for storing CSRF tokens. This uses a dedicated
+ * store name to avoid collisions with other storage. Lazily initialized to avoid crashes in Node.js
+ * environments where IndexedDB is not available.
+ *
+ * @category Internal
+ */
+export declare function getDefaultCsrfTokenStore(): Promise<CsrfTokenStore>;

package/dist/csrf-token-store.js

@@ -0,0 +1,35 @@
+import { LocalDbClient } from 'local-db-client';
+import { defineShape } from 'object-shape-tester';
+const csrfTokenDbShapes = {
+    csrfToken: defineShape(''),
+};
+async function createDefaultCsrfTokenStore() {
+    const client = await LocalDbClient.createClient(csrfTokenDbShapes, {
+        storeName: 'auth-vir-csrf',
+    });
+    return {
+        async getCsrfToken() {
+            return (await client.load.csrfToken()) || undefined;
+        },
+        async setCsrfToken(value) {
+            await client.set.csrfToken(value);
+        },
+        async deleteCsrfToken() {
+            await client.delete.csrfToken();
+        },
+    };
+}
+/**
+ * The default {@link LocalDbClient} instance used for storing CSRF tokens. This uses a dedicated
+ * store name to avoid collisions with other storage. Lazily initialized to avoid crashes in Node.js
+ * environments where IndexedDB is not available.
+ *
+ * @category Internal
+ */
+export async function getDefaultCsrfTokenStore() {
+    if (!cachedStorePromise) {
+        cachedStorePromise = createDefaultCsrfTokenStore();
+    }
+    return cachedStorePromise;
+}
+let cachedStorePromise;