najm-auth 2.0.3 → 2.0.5

package/dist/index.d.ts

@@ -9,6 +9,7 @@ import { User, NewUser, RoleEntity, NewRoleEntity, Permission, NewPermission, Ro
 export { NewOAuthAccount, NewRolePermission, NewToken, OAuthAccount, Token, authSchema, baseFields, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable } from './schema/pg.js';
 import { CacheService } from 'najm-cache';
 import { z } from 'zod';
+import { Context } from 'hono';
 import { GuardResult } from 'najm-guard';
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
@@ -42,7 +43,7 @@ interface SessionCookieConfig {
     name: string;
     /** Max age in seconds (default: 300 = 5 min) */
     maxAge: number;
-    /** Secret used to HMAC-sign the cookie. Defaults to jwt.accessSecret. */
+    /** HMAC secret. Falls back to NAJM_SESSION_SECRET, then jwt.accessSecret. */
     secret?: string;
 }
 type OAuthProvider = 'google';
@@ -279,6 +280,7 @@ var auth = {
 		passwordReset: "Password has been reset successfully",
 		accountInviteSent: "Invitation sent successfully",
 		tokenRefreshed: "Token refreshed successfully",
+		sessionRecovered: "Session recovered successfully",
 		oauthLogin: "Google sign-in successful",
 		oauthLinked: "Google account linked successfully"
 	},
@@ -396,6 +398,7 @@ declare const AUTH_LOCALES: {
                 passwordReset: string;
                 accountInviteSent: string;
                 tokenRefreshed: string;
+                sessionRecovered: string;
                 oauthLogin: string;
                 oauthLinked: string;
             };
@@ -518,7 +521,7 @@ declare class CookieManager {
     getCookieName(): string;
     /**
      * Write a signed session cookie containing user data, roles, and permissions.
-     * The cookie is HMAC-signed with the access secret so it is tamper-proof
+     * The cookie is HMAC-signed with the configured session secret so it is tamper-proof
      * but readable without a database query. Short TTL (5 min) ensures freshness.
      */
     setSessionCookie(data: Omit<SessionCookieData, 'iat'>): void;
@@ -932,7 +935,21 @@ declare class TokenService {
      * the active session. Reuse detection and revocation belong to the
      * rotation path only.
      */
+    private resolveRefreshSessionFromCookie;
     resolveUserFromCookie(): Promise<string>;
+    /**
+     * Resolve authoritative claims for signed-session recovery.
+     *
+     * This deliberately bypasses the 30-second user cache so status, role, and
+     * permission changes are reflected when the short session snapshot expires.
+     * It validates but never rotates or consumes the refresh token.
+     */
+    recoverSessionFromCookie(): Promise<{
+        user: any;
+        roles: any[];
+        permissions: any;
+        sessionVersion: number;
+    }>;
     getUser(auth: string): Promise<any>;
     getUserById(userId: string): Promise<any>;
     private hashToken;
@@ -1009,6 +1026,7 @@ declare class TokenService {
         accessTokenExpiresAt: number;
         refreshTokenExpiresAt: number;
     }>;
+    private requireActiveRefreshUser;
     /** Revoke every refresh session for a user (password change/reset, logout-all). */
     revokeAllForUser(userId: string): Promise<any>;
     /** Revoke a single refresh session (one family). */
@@ -1242,6 +1260,14 @@ declare class AuthService {
         user: SanitizedUser;
     }>;
     refreshTokens(): Promise<TokenPair>;
+    /**
+     * Reissue the short-lived signed session snapshot from a fully validated
+     * refresh session. This path never creates or returns access/refresh tokens
+     * and never rotates the refresh family.
+     */
+    recoverSession(): Promise<{
+        recovered: true;
+    }>;
     logoutUser(userId: string, authorization?: string): Promise<{
         data: any;
         message: string;
@@ -1310,6 +1336,9 @@ declare class AuthController {
         emailSent: boolean;
     }>;
     refreshTokens(): Promise<TokenPair>;
+    recoverSession(recoveryRequest: string | undefined, ctx: Context): Promise<{
+        recovered: true;
+    }>;
     logoutUser(userId: string, authorization?: string): Promise<{
         data: any;
         message: string;

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // src/AuthPlugin.ts
-import { Err as Err10, plugin } from "najm-core";
+import { Err as Err11, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
@@ -293,6 +293,47 @@ EncryptionService = __decorate([
 import { Service, Inject as Inject2 } from "najm-core";
 import { CookieService } from "najm-cookies";
 import timestring from "timestring";
+
+// src/client/sessionCookie.ts
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 300;
+var MAX_CLOCK_SKEW_MS = 3e4;
+function parseSessionCookiePayload(payload, maxAgeSeconds = DEFAULT_SESSION_MAX_AGE_SECONDS, now = Date.now()) {
+  if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds <= 0) return null;
+  try {
+    const data = JSON.parse(payload);
+    if (!isRecord(data) || !isValidUser(data.user)) return null;
+    if (!isStringArray(data.roles) || !isStringArray(data.permissions)) return null;
+    if (!Number.isInteger(data.sessionVersion) || data.sessionVersion < 0) return null;
+    if (!Number.isFinite(data.iat) || !Number.isInteger(data.iat) || data.iat <= 0) return null;
+    const issuedAt = data.iat;
+    if (issuedAt > now + MAX_CLOCK_SKEW_MS) return null;
+    if (now - issuedAt >= maxAgeSeconds * 1e3) return null;
+    return {
+      user: data.user,
+      roles: [...data.roles],
+      permissions: [...data.permissions],
+      sessionVersion: data.sessionVersion,
+      iat: issuedAt
+    };
+  } catch {
+    return null;
+  }
+}
+__name(parseSessionCookiePayload, "parseSessionCookiePayload");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function isValidUser(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+}
+__name(isValidUser, "isValidUser");
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+__name(isStringArray, "isStringArray");
+
+// src/auth/CookieManager.ts
 var __decorate2 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -348,7 +389,7 @@ var CookieManager = class CookieManager2 {
   // =========================================================================
   /**
    * Write a signed session cookie containing user data, roles, and permissions.
-   * The cookie is HMAC-signed with the access secret so it is tamper-proof
+   * The cookie is HMAC-signed with the configured session secret so it is tamper-proof
    * but readable without a database query. Short TTL (5 min) ensures freshness.
    */
   setSessionCookie(data) {
@@ -368,15 +409,7 @@ var CookieManager = class CookieManager2 {
     const raw = this.cookieService.getSigned(this.sessionCookieName, this.sessionSecret);
     if (!raw)
       return null;
-    try {
-      const data = JSON.parse(raw);
-      const age = Date.now() - data.iat;
-      if (age > this.sessionMaxAge * 1e3)
-        return null;
-      return data;
-    } catch {
-      return null;
-    }
+    return parseSessionCookiePayload(raw, this.sessionMaxAge);
   }
   /**
    * Clear the session cookie (on logout, password change, etc.)
@@ -398,9 +431,9 @@ CookieManager = __decorate2([
 ], CookieManager);
 
 // src/auth/AuthController.ts
-import { Controller } from "najm-core";
+import { Controller, Err as Err9 } from "najm-core";
 import { Get, Post, ResMsg } from "najm-core";
-import { Body, User as User2, Headers } from "najm-core";
+import { Body, User as User2, Headers, Ctx } from "najm-core";
 
 // src/auth/AuthService.ts
 import { Injectable as Injectable8, Inject as Inject8 } from "najm-core";
@@ -1605,7 +1638,7 @@ var TokenService = class TokenService2 {
    * the active session. Reuse detection and revocation belong to the
    * rotation path only.
    */
-  async resolveUserFromCookie() {
+  async resolveRefreshSessionFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
     if (!refreshToken) {
       Err6(this.t("errors.refreshTokenMissing"));
@@ -1617,14 +1650,35 @@ var TokenService = class TokenService2 {
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
-      return userId;
+      return { userId, tokenFamily };
     }
     const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
-      return userId;
+      return { userId, tokenFamily };
     }
     Err6(this.t("errors.refreshTokenInvalid"));
   }
+  async resolveUserFromCookie() {
+    return (await this.resolveRefreshSessionFromCookie()).userId;
+  }
+  /**
+   * Resolve authoritative claims for signed-session recovery.
+   *
+   * This deliberately bypasses the 30-second user cache so status, role, and
+   * permission changes are reflected when the short session snapshot expires.
+   * It validates but never rotates or consumes the refresh token.
+   */
+  async recoverSessionFromCookie() {
+    const { userId, tokenFamily } = await this.resolveRefreshSessionFromCookie();
+    const user = await this.requireActiveRefreshUser(userId, tokenFamily);
+    const sessionVersion = await this.getUserSessionVersion(userId);
+    return {
+      user,
+      roles: user.role ? [user.role] : [],
+      permissions: Array.isArray(user.permissions) ? user.permissions : [],
+      sessionVersion
+    };
+  }
   // ============ USER RETRIEVAL (MAIN METHOD) ============
   async getUser(auth2) {
     if (!auth2)
@@ -1787,6 +1841,7 @@ var TokenService = class TokenService2 {
       Err6(this.t("errors.refreshTokenInvalid"));
     }
     const presentedHash = this.hashToken(refreshToken);
+    await this.requireActiveRefreshUser(userId, tokenFamily);
     if (presentedHash === stored.token) {
       return this.generateTokens(userId, tokenFamily);
     }
@@ -1801,6 +1856,14 @@ var TokenService = class TokenService2 {
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
     Err6(this.t("errors.refreshTokenInvalid"));
   }
+  async requireActiveRefreshUser(userId, tokenFamily) {
+    const user = await this.tokenRepository.getUser(userId);
+    if (!user || user.status !== "active") {
+      await this.revokeFamily(tokenFamily);
+      Err6(this.t("errors.refreshTokenInvalid"));
+    }
+    return user;
+  }
   /** Revoke every refresh session for a user (password change/reset, logout-all). */
   async revokeAllForUser(userId) {
     return this.tokenRepository.revokeAllForUser(userId);
@@ -2243,6 +2306,27 @@ var AuthService = class AuthService2 {
     const { userId: _userId, tokenFamily: _tokenFamily, roles: _roles, permissions: _permissions, sessionVersion: _sv, ...tokens } = generated;
     return tokens;
   }
+  /**
+   * Reissue the short-lived signed session snapshot from a fully validated
+   * refresh session. This path never creates or returns access/refresh tokens
+   * and never rotates the refresh family.
+   */
+  async recoverSession() {
+    const recovered = await this.tokenService.recoverSessionFromCookie();
+    this.cookieManager.setSessionCookie({
+      user: {
+        id: recovered.user.id,
+        email: recovered.user.email,
+        name: recovered.user.name,
+        role: recovered.user.role ?? void 0,
+        status: recovered.user.status ?? void 0
+      },
+      roles: recovered.roles,
+      permissions: recovered.permissions,
+      sessionVersion: recovered.sessionVersion
+    });
+    return { recovered: true };
+  }
   async logoutUser(userId, authorization) {
     await this.tokenService.logout(userId, authorization);
     this.cookieManager.clearRefreshToken();
@@ -2571,6 +2655,14 @@ var AuthController = class AuthController2 {
   async refreshTokens() {
     return this.authService.refreshTokens();
   }
+  async recoverSession(recoveryRequest, ctx) {
+    if (recoveryRequest !== "1") {
+      Err9("Invalid session recovery request", 400);
+    }
+    ctx.header("Cache-Control", "private, no-store");
+    ctx.header("Vary", "Cookie");
+    return this.authService.recoverSession();
+  }
   async logoutUser(userId, authorization) {
     return this.authService.logoutUser(userId, authorization);
   }
@@ -2626,6 +2718,16 @@ __decorate15([
   __metadata15("design:paramtypes", []),
   __metadata15("design:returntype", Promise)
 ], AuthController.prototype, "refreshTokens", null);
+__decorate15([
+  Post("/session/recover"),
+  RateLimit({ limit: 120, window: "1m", key: cookieFingerprint() }),
+  ResMsg("auth.success.sessionRecovered"),
+  __param5(0, Headers("x-najm-session-recovery")),
+  __param5(1, Ctx()),
+  __metadata15("design:type", Function),
+  __metadata15("design:paramtypes", [String, Object]),
+  __metadata15("design:returntype", Promise)
+], AuthController.prototype, "recoverSession", null);
 __decorate15([
   Post("/logout"),
   isAuth(),
@@ -3438,7 +3540,7 @@ import { Injectable as Injectable11 } from "najm-core";
 // src/permissions/PermissionValidator.ts
 import { Injectable as Injectable10 } from "najm-core";
 import { I18n as I18n7 } from "najm-i18n";
-import { Err as Err9 } from "najm-core";
+import { Err as Err10 } from "najm-core";
 var __decorate21 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -3467,7 +3569,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExists(id) {
     const permission = await this.permissionRepository.getById(id);
     if (!permission) {
-      Err9(this.t("errors.notFound"), 404);
+      Err10(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3477,7 +3579,7 @@ var PermissionValidator = class PermissionValidator2 {
   async checkPermissionExistsByName(name) {
     const permission = await this.permissionRepository.getByName(name);
     if (!permission) {
-      Err9(this.t("errors.notFound"), 404);
+      Err10(this.t("errors.notFound"), 404);
     }
     return permission;
   }
@@ -3489,7 +3591,7 @@ var PermissionValidator = class PermissionValidator2 {
       return;
     const existingPermission = await this.permissionRepository.getByName(name);
     if (existingPermission && existingPermission.id !== excludeId) {
-      Err9(this.t("errors.nameExists"), 409);
+      Err10(this.t("errors.nameExists"), 409);
     }
   }
   /**
@@ -3512,7 +3614,7 @@ var PermissionValidator = class PermissionValidator2 {
     await this.checkPermissionExists(permissionId);
     const hasPermission = await this.permissionRepository.checkRoleHasPermission(roleId, permissionId);
     if (hasPermission) {
-      Err9(this.t("errors.roleAlreadyHasPermission"), 409);
+      Err10(this.t("errors.roleAlreadyHasPermission"), 409);
     }
   }
 };
@@ -4561,6 +4663,7 @@ var en_default = {
       passwordReset: "Password has been reset successfully",
       accountInviteSent: "Invitation sent successfully",
       tokenRefreshed: "Token refreshed successfully",
+      sessionRecovered: "Session recovered successfully",
       oauthLogin: "Google sign-in successful",
       oauthLinked: "Google account linked successfully"
     },
@@ -4977,7 +5080,7 @@ OAuthAccountService = __decorate29([
 
 // src/oauth/OAuthController.ts
 import { createHash as createHash4 } from "crypto";
-import { Controller as Controller5, Ctx, Get as Get5, Post as Post5, Query as Query2, User as User5 } from "najm-core";
+import { Controller as Controller5, Ctx as Ctx2, Get as Get5, Post as Post5, Query as Query2, User as User5 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
 
 // src/oauth/OAuthService.ts
@@ -5263,7 +5366,7 @@ var OAuthController = class OAuthController2 {
 __decorate32([
   Get5("/start"),
   RateLimit2({ limit: 20, window: "15m", key: "ip" }),
-  __param11(0, Ctx()),
+  __param11(0, Ctx2()),
   __param11(1, Query2("returnTo")),
   __metadata32("design:type", Function),
   __metadata32("design:paramtypes", [Object, String]),
@@ -5272,7 +5375,7 @@ __decorate32([
 __decorate32([
   Get5("/callback"),
   RateLimit2({ limit: 20, window: "15m", key: callbackKey }),
-  __param11(0, Ctx()),
+  __param11(0, Ctx2()),
   __param11(1, Query2("code")),
   __param11(2, Query2("state")),
   __param11(3, Query2("error")),
@@ -5327,9 +5430,9 @@ var resolveGoogleConfig = /* @__PURE__ */ __name((config) => {
   const clientId = google.clientId ?? process.env.GOOGLE_CLIENT_ID ?? "";
   const clientSecret = google.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET ?? "";
   if (!clientId)
-    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
+    throw Err11.configRequired("auth.oauth.google", "GOOGLE_CLIENT_ID");
   if (!clientSecret)
-    throw Err10.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
+    throw Err11.configRequired("auth.oauth.google", "GOOGLE_CLIENT_SECRET");
   const frontendUrl = config?.frontendUrl ?? process.env.FRONTEND_URL ?? "http://localhost:3000";
   const callbackUrl = google.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL ?? `${frontendUrl.replace(/\/$/, "")}/api/auth/oauth/google/callback`;
   let callback;
@@ -5379,18 +5482,19 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     session: {
       name: config?.session?.name ?? "najm.session",
       maxAge: config?.session?.maxAge ?? 300,
-      secret: config?.session?.secret
-      // fallback to jwt.accessSecret at use site
+      // Keep Edge/server readers aligned with the documented secret order.
+      // CookieManager falls back to jwt.accessSecret when this is undefined.
+      secret: config?.session?.secret ?? process.env.NAJM_SESSION_SECRET
     },
     oauth: {
       google: resolveGoogleConfig(config)
     }
   };
   if (!finalConfig.jwt.accessSecret) {
-    throw Err10.configRequired("auth", "JWT_ACCESS_SECRET");
+    throw Err11.configRequired("auth", "JWT_ACCESS_SECRET");
   }
   if (!finalConfig.jwt.refreshSecret) {
-    throw Err10.configRequired("auth", "JWT_REFRESH_SECRET");
+    throw Err11.configRequired("auth", "JWT_REFRESH_SECRET");
   }
   return finalConfig;
 }, "resolveAuthConfig");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [