najm-auth 2.0.5 → 2.0.6

package/README.md

@@ -681,6 +681,9 @@ throw new HttpError(403, 'Insufficient permissions for this action');
   their session version.
 - Expired signed sessions recover through authoritative, non-rotating refresh
   validation; middleware verifies the reissued HMAC before using its claims.
+- Server-side recovery sends only the configured refresh cookie and accepts
+  relative or exact same-origin endpoints. URL credentials and any
+  scheme/hostname/port change are rejected before the network request.
 - `verifyAlways` forces that authoritative check on every protected request;
   the default bounds cached role/status staleness to `session.maxAge`.
 

package/dist/{NajmAuthClient-B9dGk9MH.d.ts → NajmAuthClient-0yzFb9CR.d.ts}

@@ -247,4 +247,4 @@ declare class NajmAuthClient {
  */
 declare function createAuthClient(config: AuthClientConfig): NajmAuthClient;
 
-export { AuthError as A, type DecodedToken as D, FetchClient as F, type HydrateSession as H, NajmAuthClient as N, type OAuthProvider as O, type RetryConfig as R, type SyncPayload as S, type TabSyncMessage as T, type AuthClientConfig as a, type AuthEventMap as b, createAuthClient as c, type AuthState as d, type AuthUser as e, type AuthEvent as f, type AuthEventHandler as g, type ServerResponse as h, type TokenPair as i, type RequestOptions as j, type OAuthLoginOptions as k };
+export { type AuthClientConfig as A, type DecodedToken as D, FetchClient as F, type HydrateSession as H, NajmAuthClient as N, type OAuthLoginOptions as O, type RequestOptions as R, type SyncPayload as S, type TabSyncMessage as T, AuthError as a, type AuthEvent as b, type AuthEventHandler as c, type AuthEventMap as d, type AuthState as e, type AuthUser as f, type OAuthProvider as g, type RetryConfig as h, type ServerResponse as i, type TokenPair as j, createAuthClient as k };

package/dist/client/edge.js

@@ -139,12 +139,16 @@ async function requestSessionRecovery(options) {
   if (!isCookieValue(options.refreshCookieValue)) {
     return { status: "invalid" };
   }
-  if (!isSafeRecoveryEndpoint(options.endpoint)) {
+  const endpoint = sameOriginRecoveryEndpoint(
+    options.endpoint,
+    options.requestOrigin
+  );
+  if (!endpoint) {
     return { status: "unavailable" };
   }
   let response;
   try {
-    response = await fetch(options.endpoint, {
+    response = await fetch(endpoint, {
       method: "POST",
       headers: {
         Accept: "application/json",
@@ -208,21 +212,24 @@ function isCookieName(value) {
 }
 __name(isCookieName, "isCookieName");
 function isCookieValue(value) {
-  return value.length > 0 && !/[\r\n;]/.test(value);
+  return value.length > 0 && /^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/.test(value);
 }
 __name(isCookieValue, "isCookieValue");
-function isSafeRecoveryEndpoint(value) {
+function sameOriginRecoveryEndpoint(endpoint, requestOrigin) {
   try {
-    const url = new URL(value);
-    if (url.username || url.password) return false;
-    if (url.protocol === "https:") return true;
-    if (url.protocol !== "http:") return false;
-    return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+    const trusted = new URL(requestOrigin);
+    if (trusted.protocol !== "https:" && trusted.protocol !== "http:" || trusted.username || trusted.password) {
+      return void 0;
+    }
+    const resolved = new URL(endpoint, trusted.origin);
+    if (resolved.username || resolved.password) return void 0;
+    if (resolved.origin !== trusted.origin) return void 0;
+    return resolved.toString();
   } catch {
-    return false;
+    return void 0;
   }
 }
-__name(isSafeRecoveryEndpoint, "isSafeRecoveryEndpoint");
+__name(sameOriginRecoveryEndpoint, "sameOriginRecoveryEndpoint");
 
 // src/client/server/withAuthMiddleware.ts
 function withAuthMiddleware(config) {
@@ -281,6 +288,7 @@ function withAuthMiddleware(config) {
       const endpoint = recoveryURL ? new URL(recoveryURL, request.url).toString() : authEndpoint(apiBaseURL, authPrefix, "/session/recover", request.url);
       recovery = await requestSessionRecovery({
         endpoint,
+        requestOrigin: url.origin,
         refreshCookieName: cookieName,
         refreshCookieValue: refreshCookie,
         sessionCookieName,

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-B9dGk9MH.js';
-export { a as AuthClientConfig, A as AuthError, f as AuthEvent, g as AuthEventHandler, b as AuthEventMap, d as AuthState, e as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, k as OAuthLoginOptions, O as OAuthProvider, j as RequestOptions, R as RetryConfig, h as ServerResponse, i as TokenPair, c as createAuthClient } from '../NajmAuthClient-B9dGk9MH.js';
+import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../NajmAuthClient-0yzFb9CR.js';
+export { A as AuthClientConfig, a as AuthError, b as AuthEvent, c as AuthEventHandler, d as AuthEventMap, e as AuthState, f as AuthUser, F as FetchClient, H as HydrateSession, N as NajmAuthClient, O as OAuthLoginOptions, g as OAuthProvider, R as RequestOptions, h as RetryConfig, i as ServerResponse, j as TokenPair, k as createAuthClient } from '../NajmAuthClient-0yzFb9CR.js';
 
 /**
  * Decode a JWT token payload without verification.

package/dist/client/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession, d as AuthState, e as AuthUser, A as AuthError, k as OAuthLoginOptions, f as AuthEvent, b as AuthEventMap } from '../../NajmAuthClient-B9dGk9MH.js';
+import { N as NajmAuthClient, H as HydrateSession, e as AuthState, f as AuthUser, a as AuthError, O as OAuthLoginOptions, b as AuthEvent, d as AuthEventMap } from '../../NajmAuthClient-0yzFb9CR.js';
 
 interface AuthProviderProps {
     client: NajmAuthClient;

package/dist/client/react/index.js

@@ -7,7 +7,7 @@ import { useEffect, useRef } from "react";
 
 // src/client/react/context.ts
 import { createContext, useContext } from "react";
-var KEY = /* @__PURE__ */ Symbol.for("najm:auth:client:context");
+var KEY = Symbol.for("najm:auth:client:context");
 var contextStore = globalThis;
 function getAuthClientContext() {
   const existing = contextStore[KEY];

package/dist/client/server/index.d.ts

@@ -1,4 +1,4 @@
-import { e as AuthUser, F as FetchClient, R as RetryConfig, N as NajmAuthClient } from '../../NajmAuthClient-B9dGk9MH.js';
+import { f as AuthUser, F as FetchClient, N as NajmAuthClient, h as RetryConfig } from '../../NajmAuthClient-0yzFb9CR.js';
 export { withAuthMiddleware } from '../edge.js';
 import 'next/server';
 
@@ -72,7 +72,7 @@ interface ServerSession {
 interface GetSessionConfig {
     /**
      * Base URL for auth endpoints.
-     * Defaults to `${NEXT_PUBLIC_API_URL || http://localhost:${PORT||3000}}/api`.
+     * Defaults to `NEXT_PUBLIC_API_URL` or the same-origin `/api` path.
      */
     baseURL?: string;
     /** Auth route prefix appended to baseURL (default: '/auth'). */

package/dist/client/server/index.js

@@ -152,12 +152,16 @@ async function requestSessionRecovery(options) {
   if (!isCookieValue(options.refreshCookieValue)) {
     return { status: "invalid" };
   }
-  if (!isSafeRecoveryEndpoint(options.endpoint)) {
+  const endpoint = sameOriginRecoveryEndpoint(
+    options.endpoint,
+    options.requestOrigin
+  );
+  if (!endpoint) {
     return { status: "unavailable" };
   }
   let response;
   try {
-    response = await fetch(options.endpoint, {
+    response = await fetch(endpoint, {
       method: "POST",
       headers: {
         Accept: "application/json",
@@ -216,17 +220,20 @@ function isCookieName(value) {
   return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value);
 }
 function isCookieValue(value) {
-  return value.length > 0 && !/[\r\n;]/.test(value);
+  return value.length > 0 && /^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/.test(value);
 }
-function isSafeRecoveryEndpoint(value) {
+function sameOriginRecoveryEndpoint(endpoint, requestOrigin) {
   try {
-    const url = new URL(value);
-    if (url.username || url.password) return false;
-    if (url.protocol === "https:") return true;
-    if (url.protocol !== "http:") return false;
-    return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+    const trusted = new URL(requestOrigin);
+    if (trusted.protocol !== "https:" && trusted.protocol !== "http:" || trusted.username || trusted.password) {
+      return void 0;
+    }
+    const resolved = new URL(endpoint, trusted.origin);
+    if (resolved.username || resolved.password) return void 0;
+    if (resolved.origin !== trusted.origin) return void 0;
+    return resolved.toString();
   } catch {
-    return false;
+    return void 0;
   }
 }
 var init_sessionRecovery = __esm({
@@ -238,7 +245,7 @@ var init_sessionRecovery = __esm({
     __name(readSetCookieValue, "readSetCookieValue");
     __name(isCookieName, "isCookieName");
     __name(isCookieValue, "isCookieValue");
-    __name(isSafeRecoveryEndpoint, "isSafeRecoveryEndpoint");
+    __name(sameOriginRecoveryEndpoint, "sameOriginRecoveryEndpoint");
   }
 });
 
@@ -253,8 +260,25 @@ __export(getSession_exports, {
 function defaultBaseURL() {
   const explicit = typeof process !== "undefined" ? process.env.NAJM_AUTH_BASE_URL : void 0;
   if (explicit) return explicit;
-  const origin = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_API_URL ?? `http://localhost:${process.env.PORT ?? 3e3}` : "http://localhost:3000";
-  return `${origin.replace(/\/$/, "")}/api`;
+  const publicUrl = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_API_URL : void 0;
+  return publicUrl || "/api";
+}
+function firstForwardedValue(value) {
+  const first = value?.split(",")[0]?.trim();
+  return first || void 0;
+}
+function requestOriginFromHeaders(headers) {
+  const host = firstForwardedValue(headers.get("x-forwarded-host")) ?? firstForwardedValue(headers.get("host"));
+  if (!host) return void 0;
+  const protocol = firstForwardedValue(headers.get("x-forwarded-proto")) ?? "https";
+  if (protocol !== "https" && protocol !== "http") return void 0;
+  try {
+    const url = new URL(`${protocol}://${host}`);
+    if (url.username || url.password) return void 0;
+    return url.origin;
+  } catch {
+    return void 0;
+  }
 }
 async function getSession(config = {}) {
   const cookieName = config.cookieName ?? "refreshToken";
@@ -264,11 +288,15 @@ async function getSession(config = {}) {
   const strict = config.mode === "strict";
   let sessionCookieValue;
   let refreshCookieValue;
+  let requestOrigin;
   try {
     const mod = await import("next/headers");
     const cookieStore = await mod.cookies();
     sessionCookieValue = cookieStore.get(sessionCookieName)?.value;
     refreshCookieValue = cookieStore.get(cookieName)?.value;
+    if (typeof mod.headers === "function") {
+      requestOrigin = requestOriginFromHeaders(await mod.headers());
+    }
   } catch {
     if (strict) throw new AuthConfigError("Failed to read cookies from Next.js headers()");
     return null;
@@ -295,9 +323,14 @@ async function getSession(config = {}) {
     if (strict) throw new NoSessionError("No recoverable refresh session");
     return null;
   }
-  const endpoint = config.recoveryURL ? new URL(config.recoveryURL, baseURL).toString() : authEndpoint(baseURL, prefix, "/session/recover");
+  if (!requestOrigin) {
+    if (strict) throw new AuthConfigError("Incoming request origin is unavailable");
+    return null;
+  }
+  const endpoint = config.recoveryURL ? new URL(config.recoveryURL, requestOrigin).toString() : authEndpoint(baseURL, prefix, "/session/recover", requestOrigin);
   const recovery = await requestSessionRecovery({
     endpoint,
+    requestOrigin,
     refreshCookieName: cookieName,
     refreshCookieValue,
     sessionCookieName,
@@ -359,6 +392,8 @@ var init_getSession = __esm({
       code = "AUTH_TRANSPORT_ERROR";
     };
     __name(defaultBaseURL, "defaultBaseURL");
+    __name(firstForwardedValue, "firstForwardedValue");
+    __name(requestOriginFromHeaders, "requestOriginFromHeaders");
     __name(getSession, "getSession");
   }
 });
@@ -611,6 +646,7 @@ function withAuthMiddleware(config) {
       const endpoint = recoveryURL ? new URL(recoveryURL, request.url).toString() : authEndpoint(apiBaseURL, authPrefix, "/session/recover", request.url);
       recovery = await requestSessionRecovery({
         endpoint,
+        requestOrigin: url.origin,
         refreshCookieName: cookieName,
         refreshCookieValue: refreshCookie,
         sessionCookieName,
@@ -1185,8 +1221,7 @@ function defineAuth(authConfig = {}) {
     retry
   } = authConfig;
   const sessionConfig = {
-    baseURL: void 0,
-    // resolved at call time from env/defaults
+    baseURL: apiBaseURL,
     authPrefix,
     cookieName,
     sessionCookieName,

package/dist/index.js

@@ -10,12 +10,12 @@ import { Err as Err11, plugin } from "najm-core";
 import { cache } from "najm-cache";
 
 // src/auth.tokens.ts
-var AUTH_CONFIG = /* @__PURE__ */ Symbol.for("najm:auth:config");
-var AUTH_SCHEMA = /* @__PURE__ */ Symbol.for("najm:auth:schema");
-var AUTH_USER = /* @__PURE__ */ Symbol.for("najm:auth:user");
-var AUTH_ROLE = /* @__PURE__ */ Symbol.for("najm:auth:role");
-var AUTH_PERMISSIONS = /* @__PURE__ */ Symbol.for("najm:auth:permissions");
-var AUTH_ENCRYPTION_KEY = /* @__PURE__ */ Symbol.for("najm:auth:encryption-key");
+var AUTH_CONFIG = Symbol.for("najm:auth:config");
+var AUTH_SCHEMA = Symbol.for("najm:auth:schema");
+var AUTH_USER = Symbol.for("najm:auth:user");
+var AUTH_ROLE = Symbol.for("najm:auth:role");
+var AUTH_PERMISSIONS = Symbol.for("najm:auth:permissions");
+var AUTH_ENCRYPTION_KEY = Symbol.for("najm:auth:encryption-key");
 
 // src/schema/pg.ts
 import { pgTable, text, boolean, timestamp, pgEnum, primaryKey, integer, index, uniqueIndex } from "drizzle-orm/pg-core";
@@ -3980,9 +3980,9 @@ var revokeTokenDto = z4.object({
 // src/ownership/scopedOwnership.ts
 import { aliasedTable, eq as eq6, getTableColumns, sql as sql4 } from "drizzle-orm";
 var DEFAULT_ADMIN_ROLES = ["admin"];
-var DRIZZLE_NAME = /* @__PURE__ */ Symbol.for("drizzle:Name");
-var DRIZZLE_BASE_NAME = /* @__PURE__ */ Symbol.for("drizzle:BaseName");
-var DRIZZLE_IS_ALIAS = /* @__PURE__ */ Symbol.for("drizzle:IsAlias");
+var DRIZZLE_NAME = Symbol.for("drizzle:Name");
+var DRIZZLE_BASE_NAME = Symbol.for("drizzle:BaseName");
+var DRIZZLE_IS_ALIAS = Symbol.for("drizzle:IsAlias");
 function join2(left, right) {
   const table = right.table;
   if (!table)
@@ -4430,9 +4430,9 @@ __name(configureOwnership, "configureOwnership");
 // src/ownership/ScopeGuard.ts
 import "reflect-metadata";
 import { composeGuards as composeGuards5 } from "najm-guard";
-var ACTION_KEY = /* @__PURE__ */ Symbol.for("najm:guard:action");
-var TOKEN_KEY = /* @__PURE__ */ Symbol.for("najm:guard:token");
-var POLICY_KEY = /* @__PURE__ */ Symbol.for("najm:policy:token");
+var ACTION_KEY = Symbol.for("najm:guard:action");
+var TOKEN_KEY = Symbol.for("najm:guard:token");
+var POLICY_KEY = Symbol.for("najm:policy:token");
 var PERM = {
   list: /* @__PURE__ */ __name((n) => `read:${n}`, "list"),
   read: /* @__PURE__ */ __name((n) => `read:${n}`, "read"),
@@ -4502,7 +4502,7 @@ var __metadata25 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var _a16;
-var OWNED_META = /* @__PURE__ */ Symbol.for("najm:owned");
+var OWNED_META = Symbol.for("najm:owned");
 var ScopeContext = class ScopeContext2 {
   static {
     __name(this, "ScopeContext");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -67,9 +67,9 @@
     "@testing-library/react": "^16.3.2",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^25.0.2",
-    "drizzle-kit": "^0.31.8",
-    "drizzle-orm": "^0.45.1",
-    "happy-dom": "^17.6.3",
+    "drizzle-kit": "^0.31.10",
+    "drizzle-orm": "^0.45.2",
+    "happy-dom": "^20.11.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
@@ -93,8 +93,8 @@
     "zod": "^4.2.1"
   },
   "peerDependencies": {
-    "drizzle-orm": "^0.45.1",
-    "hono": "^4.0.0",
+    "drizzle-orm": "^0.45.2",
+    "hono": "^4.12.18",
     "react": ">=18",
     "next": ">=14"
   },