najm-auth 1.1.24 → 1.1.26

package/dist/index.d.ts

@@ -727,7 +727,13 @@ declare class TokenService {
      * Use this instead of bare verifyRefreshToken() when authenticating
      * cookie-based sessions (SSR, /auth/me, middleware).
      */
-    validateRefreshSession(refreshToken: string): Promise<string>;
+    validateRefreshSession(refreshToken: string): Promise<{
+        userId: string;
+        rotatedTokens?: {
+            refreshToken: string;
+            tokenFamily: string;
+        };
+    }>;
     /**
      * Read the refresh cookie and return the userId it belongs to.
      * Lightweight check: verifies JWT signature and ensures the user

package/dist/index.js

@@ -1461,9 +1461,13 @@ var TokenService = class TokenService2 {
     }
     const isValid = this.hashToken(refreshToken) === stored.token;
     if (!isValid) {
-      Err5(this.t("errors.refreshTokenInvalid"));
+      const tokens = await this.generateTokens(userId, stored.tokenFamily ?? void 0);
+      return {
+        userId,
+        rotatedTokens: { refreshToken: tokens.refreshToken, tokenFamily: stored.tokenFamily }
+      };
     }
-    return userId;
+    return { userId };
   }
   /**
    * Read the refresh cookie and return the userId it belongs to.
@@ -1607,10 +1611,6 @@ var TokenService = class TokenService2 {
     if (!stored) {
       Err5(this.t("errors.refreshTokenInvalid"));
     }
-    const isValid = this.hashToken(refreshToken) === stored.token;
-    if (!isValid) {
-      Err5(this.t("errors.refreshTokenInvalid"));
-    }
     return this.generateTokens(userId, stored.tokenFamily ?? void 0);
   }
   async revokeToken(userId) {
@@ -2246,11 +2246,14 @@ var AuthResolver = class AuthResolver2 {
       if (!refreshToken)
         return false;
       const tokenService = await this.container.resolve(TokenService);
-      const userId = await tokenService.validateRefreshSession(refreshToken);
-      if (!userId)
+      const result = await tokenService.validateRefreshSession(refreshToken);
+      if (!result.userId)
         return false;
+      if (result.rotatedTokens) {
+        cookieManager.setRefreshToken(result.rotatedTokens.refreshToken);
+      }
       const userService = await this.container.resolve(UserService);
-      const user = await userService.getById(userId);
+      const user = await userService.getById(result.userId);
       if (!user)
         return false;
       return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "1.1.24",
+  "version": "1.1.26",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [