najm-auth 1.1.29 → 1.1.30

package/dist/client/server/index.d.ts

@@ -74,8 +74,16 @@ interface AuthMiddlewareConfig {
     roleRoutes?: Record<string, string[]>;
     /** Refresh token cookie name (default: 'refreshToken') */
     cookieName?: string;
+    /** Session cookie name to clear on redirect (default: 'najm.session') */
+    sessionCookieName?: string;
     /** URL of the verify endpoint (default: derived from request) */
     verifyURL?: string;
+    /**
+     * When true, call the verify endpoint on EVERY protected route (not just
+     * roleRoutes). Redirects to loginRoute if the session is invalid. Adds one
+     * fetch per navigation — trade latency for stronger guarantees.
+     */
+    verifyAlways?: boolean;
 }
 /**
  * Create a Next.js middleware function that protects routes based on auth state.
@@ -230,6 +238,12 @@ interface DefineAuthConfig {
     sessionSecret?: string;
     /** Next.js middleware matcher (default: exclude _next, favicon, api) */
     matcher?: string[];
+    /**
+     * When true, call the verify endpoint on every protected route (not just
+     * roleRoutes). Redirects to loginRoute if the session is invalid. One extra
+     * fetch per navigation in exchange for guaranteed fresh auth state.
+     */
+    verifyAlways?: boolean;
 }
 interface AuthKit {
     /**

package/dist/client/server/index.js

@@ -361,10 +361,22 @@ function withAuthMiddleware(config) {
     publicRoutes = [],
     loginRoute = "/login",
     roleRoutes = {},
-    cookieName = "refreshToken"
+    cookieName = "refreshToken",
+    sessionCookieName = "najm.session",
+    verifyAlways = false
   } = config;
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
+    const redirectToLogin = /* @__PURE__ */ __name((pathname2, clearCookies) => {
+      const loginUrl = new URL(loginRoute, request.url);
+      loginUrl.searchParams.set("from", pathname2);
+      const res = NextResponse.redirect(loginUrl);
+      if (clearCookies) {
+        res.cookies.delete(cookieName);
+        res.cookies.delete(sessionCookieName);
+      }
+      return res;
+    }, "redirectToLogin");
     const url = new URL(request.url);
     const pathname = url.pathname;
     if (matchesAny(pathname, publicRoutes)) {
@@ -375,30 +387,28 @@ function withAuthMiddleware(config) {
     const cookie = request.headers.get("cookie") ?? "";
     const hasToken = cookieRegex(cookieName).test(cookie);
     if (!hasToken) {
-      const loginUrl = new URL(loginRoute, request.url);
-      loginUrl.searchParams.set("from", pathname);
-      return NextResponse.redirect(loginUrl);
+      return redirectToLogin(pathname, true);
     }
     const requiredRoles = findMatchingRoles(pathname, roleRoutes);
-    if (requiredRoles) {
+    const needsVerify = verifyAlways || !!requiredRoles;
+    if (needsVerify) {
       const verifyURL = config.verifyURL ?? `${url.origin}/api/auth/me`;
       try {
         const res = await fetch(verifyURL, {
           headers: { "Cookie": cookie, "Accept": "application/json" }
         });
         if (!res.ok) {
-          const loginUrl = new URL(loginRoute, request.url);
-          loginUrl.searchParams.set("from", pathname);
-          return NextResponse.redirect(loginUrl);
+          return redirectToLogin(pathname, true);
         }
-        const body = await res.json();
-        const userRole = body?.data?.role;
-        if (!userRole || !requiredRoles.includes(userRole)) {
-          return new NextResponse(null, { status: 403 });
+        if (requiredRoles) {
+          const body = await res.json();
+          const userRole = body?.data?.role;
+          if (!userRole || !requiredRoles.includes(userRole)) {
+            return new NextResponse(null, { status: 403 });
+          }
         }
       } catch {
-        const loginUrl = new URL(loginRoute, request.url);
-        return NextResponse.redirect(loginUrl);
+        return redirectToLogin(pathname, true);
       }
     }
     return NextResponse.next();
@@ -909,6 +919,7 @@ function defineAuth(authConfig = {}) {
     sessionCookieName = "najm.session",
     sessionSecret,
     matcher = ["/((?!_next/static|_next/image|favicon.ico|api).*)"],
+    verifyAlways = false,
     refreshThreshold,
     tabSync,
     channelName,
@@ -967,6 +978,16 @@ function defineAuth(authConfig = {}) {
     const { NextResponse } = await import("next/server");
     const url = new URL(request.url);
     const pathname = url.pathname;
+    const redirectToLogin = /* @__PURE__ */ __name((clearCookies) => {
+      const loginUrl = new URL(loginRoute, request.url);
+      loginUrl.searchParams.set("from", pathname);
+      const res = NextResponse.redirect(loginUrl);
+      if (clearCookies) {
+        res.cookies.delete(cookieName);
+        res.cookies.delete(sessionCookieName);
+      }
+      return res;
+    }, "redirectToLogin");
     if (matchesAny2(pathname, publicRoutes)) {
       return NextResponse.next();
     }
@@ -975,31 +996,28 @@ function defineAuth(authConfig = {}) {
     const cookie = request.headers.get("cookie") ?? "";
     const hasToken = cookieRegex2(cookieName).test(cookie);
     if (!hasToken) {
-      const loginUrl = new URL(loginRoute, request.url);
-      loginUrl.searchParams.set("from", pathname);
-      return NextResponse.redirect(loginUrl);
+      return redirectToLogin(true);
     }
     const requiredRoles = findMatchingRoles2(pathname, roleRoutes);
-    if (requiredRoles) {
+    const needsVerify = verifyAlways || !!requiredRoles;
+    if (needsVerify) {
       const verifyURL = `${url.origin}${apiBaseURL}${authPrefix}/me`;
       try {
         const res = await fetch(verifyURL, {
           headers: { Cookie: cookie, Accept: "application/json" }
         });
         if (!res.ok) {
-          const loginUrl = new URL(loginRoute, request.url);
-          loginUrl.searchParams.set("from", pathname);
-          return NextResponse.redirect(loginUrl);
+          return redirectToLogin(true);
         }
-        const body = await res.json();
-        const userRole = body?.data?.role;
-        if (!userRole || !requiredRoles.includes(userRole)) {
-          return new NextResponse(null, { status: 403 });
+        if (requiredRoles) {
+          const body = await res.json();
+          const userRole = body?.data?.role;
+          if (!userRole || !requiredRoles.includes(userRole)) {
+            return new NextResponse(null, { status: 403 });
+          }
         }
       } catch {
-        const loginUrl = new URL(loginRoute, request.url);
-        loginUrl.searchParams.set("from", pathname);
-        return NextResponse.redirect(loginUrl);
+        return redirectToLogin(true);
       }
     }
     return NextResponse.next();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "1.1.29",
+  "version": "1.1.30",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [