najm-auth 3.1.4 → 3.1.5

package/README.md

@@ -272,9 +272,13 @@ login, `AuthSessionService.establish()`, Google OAuth (which redirects with
 recovery — so verified-email OAuth linking cannot skip it. Marking a new
 requirement also revokes the user's current sessions.
 
-`withAuthCookiePersistence` recognizes the setup response on its own: it drops
-any session cookies the response carried, clears the remembered preference, and
-leaves the opaque setup cookie alone.
+`withAuthCookiePersistence` recognizes logout and setup boundaries on its own.
+After a successful logout it drops stale auth-cookie issuances and guarantees
+exactly one deletion for each configured auth cookie. It preserves a valid
+upstream deletion (including a custom cookie path), or synthesizes a canonical
+deletion when one is missing. A setup response gets the same auth-cookie
+deletions, clears the remembered preference, and leaves the opaque setup cookie
+alone.
 
 ### Google Sign-In
 
@@ -721,7 +725,7 @@ limits are active when `auth()` is registered.
 | Route | Limit | Window | Key Strategy |
 |-------|-------|--------|--------------|
 | `POST /auth/register` | 5 | 15 minutes | IP |
-| `POST /auth/login` | 8 | 10 minutes | IP + hashed normalized identity |
+| `POST /auth/login` | 8 | 10 minutes | IP + hashed normalized identity |
 | `POST /auth/refresh` | 15 | 15 minutes | Cookie fingerprint |
 | `POST /auth/session/recover` | 120 | 1 minute | Cookie fingerprint |
 | `POST /auth/logout` | 10 | 15 minutes | User ID |
@@ -729,27 +733,27 @@ limits are active when `auth()` is registered.
 | `POST /auth/forgot-password` | 3 | 15 minutes | IP |
 | `POST /auth/reset-password` | 5 | 15 minutes | IP |
 
-### Customizing Rate Limits
-
-The login route has strict environment overrides. Values are read when the
-server imports `najm-auth`, so restart the process after changing them. Invalid
-values fail startup rather than silently weakening the limiter.
-
-```bash
-NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=true
-NAJM_AUTH_LOGIN_RATE_LIMIT=8
-NAJM_AUTH_LOGIN_RATE_WINDOW=10m
-```
-
-`NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=false` disables only the login-route
-limiter. Keep it enabled on public production deployments; a shorter window is
-the safer setting for a disposable production-built demo.
-
-The generic plugin configuration remains available for global limits and skip
-rules:
-
-```typescript
-auth({
+### Customizing Rate Limits
+
+The login route has strict environment overrides. Values are read when the
+server imports `najm-auth`, so restart the process after changing them. Invalid
+values fail startup rather than silently weakening the limiter.
+
+```bash
+NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=true
+NAJM_AUTH_LOGIN_RATE_LIMIT=8
+NAJM_AUTH_LOGIN_RATE_WINDOW=10m
+```
+
+`NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=false` disables only the login-route
+limiter. Keep it enabled on public production deployments; a shorter window is
+the safer setting for a disposable production-built demo.
+
+The generic plugin configuration remains available for global limits and skip
+rules:
+
+```typescript
+auth({
   rateLimit: {
     keyGenerator: 'ip',        // or 'user', 'api-key', 'user+ip'
     defaultWindow: '10m',

package/dist/client/server/index.d.ts

@@ -248,8 +248,8 @@ interface AuthCookiePersistenceOptions {
      * Najm's own setup response is recognized without this — supply it only to
      * cover an application-specific shape. Such a response may carry auth
      * cookies anyway, and persisting them would leave a half-authenticated
-     * browser that skips the setup step on reload. Returning `true` strips them
-     * and clears the stored choice.
+     * browser that skips the setup step on reload. Returning `true` replaces
+     * them with deletions and clears the stored choice.
      */
     isSetupResponse?: (payload: unknown) => boolean;
 }

package/dist/client/server/index.js

@@ -1661,6 +1661,18 @@ function clearedRememberCookie(name, secure) {
   ].join("; ");
 }
 __name(clearedRememberCookie, "clearedRememberCookie");
+function clearedAuthCookie(name, secure) {
+  return [
+    `${name}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    ...secure ? ["Secure"] : [],
+    "Expires=Thu, 01 Jan 1970 00:00:00 GMT",
+    "Max-Age=0"
+  ].join("; ");
+}
+__name(clearedAuthCookie, "clearedAuthCookie");
 function withAuthCookiePersistence(handler, options = {}) {
   const {
     authCookieNames = DEFAULTS.authCookieNames,
@@ -1697,8 +1709,15 @@ function withAuthCookiePersistence(handler, options = {}) {
     const headers = new Headers(response.headers);
     const setCookies = headers.getSetCookie();
     headers.delete("set-cookie");
+    const clearedAuthCookies = /* @__PURE__ */ new Set();
     for (const setCookie of setCookies) {
-      if (action.type === "setup" && authCookieNames.includes(cookieName(setCookie)) && !isDeletionCookie(setCookie)) {
+      const name = cookieName(setCookie);
+      const isAuthCookie = authCookieNames.includes(name);
+      if ((action.type === "clear" || action.type === "setup") && isAuthCookie) {
+        if (isDeletionCookie(setCookie) && !clearedAuthCookies.has(name)) {
+          headers.append("set-cookie", setCookie);
+          clearedAuthCookies.add(name);
+        }
         continue;
       }
       headers.append(
@@ -1706,6 +1725,13 @@ function withAuthCookiePersistence(handler, options = {}) {
         action.type === "apply" && action.mode === "session" ? makeSessionCookie(setCookie, authCookieNames) : setCookie
       );
     }
+    if (action.type === "clear" || action.type === "setup") {
+      for (const name of authCookieNames) {
+        if (!clearedAuthCookies.has(name)) {
+          headers.append("set-cookie", clearedAuthCookie(name, secure));
+        }
+      }
+    }
     headers.append(
       "set-cookie",
       action.type === "clear" || action.type === "setup" ? clearedRememberCookie(rememberCookieName, secure) : rememberCookie(rememberCookieName, action.mode, secure, maxAgeSeconds)

package/dist/index.d.ts

@@ -705,7 +705,6 @@ declare class UserValidator {
      * Check if user exists by email
      */
     checkUserExistsByEmail(email: string): Promise<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -714,8 +713,9 @@ declare class UserValidator {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -727,7 +727,6 @@ declare class UserValidator {
      * Check if email exists in database
      */
     checkEmailExists(email: string): Promise<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -736,8 +735,9 @@ declare class UserValidator {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1260,8 +1260,8 @@ declare const createUserDto: z.ZodObject<{
     emailVerified: z.ZodDefault<z.ZodBoolean>;
     status: z.ZodOptional<z.ZodEnum<{
         active: "active";
-        pending: "pending";
         inactive: "inactive";
+        pending: "pending";
     }>>;
 }, z.core.$strip>;
 declare const updateUserDto: z.ZodObject<{
@@ -1273,8 +1273,8 @@ declare const updateUserDto: z.ZodObject<{
     emailVerified: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
     status: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
         active: "active";
-        pending: "pending";
         inactive: "inactive";
+        pending: "pending";
     }>>>;
 }, z.core.$strip>;
 declare const registerDto: z.ZodObject<{
@@ -1655,7 +1655,6 @@ declare class AuthController {
     registerUser(body: RegisterDto): Promise<SanitizedUser>;
     loginUser(body: LoginDto): Promise<LoginResult>;
     inviteUser(body: InviteUserDto): Promise<Omit<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -1664,8 +1663,9 @@ declare class AuthController {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;
@@ -1688,7 +1688,6 @@ declare class AuthController {
         message: string;
     }>;
     userProfile(authorization?: string): Promise<Omit<{
-        password: string;
         id: string;
         name: string;
         createdAt: string;
@@ -1697,8 +1696,9 @@ declare class AuthController {
         emailVerified: boolean;
         phone: string;
         phoneVerified: boolean;
+        password: string;
         image: string;
-        status: "active" | "pending" | "inactive";
+        status: "active" | "inactive" | "pending";
         roleId: string;
         lastLogin: string;
         failedLoginAttempts: number;

package/dist/schema/pg.d.ts

@@ -235,7 +235,7 @@ declare const usersTable: drizzle_orm_pg_core.PgTableWithColumns<{
             tableName: "users";
             dataType: "string";
             columnType: "PgEnumColumn";
-            data: "active" | "pending" | "inactive";
+            data: "active" | "inactive" | "pending";
             driverParam: string;
             notNull: false;
             hasDefault: true;
@@ -1308,7 +1308,7 @@ declare const authSchema: {
                 tableName: "users";
                 dataType: "string";
                 columnType: "PgEnumColumn";
-                data: "active" | "pending" | "inactive";
+                data: "active" | "inactive" | "pending";
                 driverParam: string;
                 notNull: false;
                 hasDefault: true;

package/dist/schema/sqlite.d.ts

@@ -252,7 +252,7 @@ declare const usersTable: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             tableName: "users";
             dataType: "string";
             columnType: "SQLiteText";
-            data: "active" | "pending" | "inactive";
+            data: "active" | "inactive" | "pending";
             driverParam: string;
             notNull: false;
             hasDefault: true;
@@ -265,7 +265,7 @@ declare const usersTable: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             generated: undefined;
         }, {}, {
             length: number;
-            $type: "active" | "pending" | "inactive";
+            $type: "active" | "inactive" | "pending";
         }>;
         roleId: drizzle_orm_sqlite_core.SQLiteColumn<{
             name: "role_id";
@@ -1476,7 +1476,7 @@ declare const authSchema: {
                 tableName: "users";
                 dataType: "string";
                 columnType: "SQLiteText";
-                data: "active" | "pending" | "inactive";
+                data: "active" | "inactive" | "pending";
                 driverParam: string;
                 notNull: false;
                 hasDefault: true;
@@ -1489,7 +1489,7 @@ declare const authSchema: {
                 generated: undefined;
             }, {}, {
                 length: number;
-                $type: "active" | "pending" | "inactive";
+                $type: "active" | "inactive" | "pending";
             }>;
             roleId: drizzle_orm_sqlite_core.SQLiteColumn<{
                 name: "role_id";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.1.4",
+  "version": "3.1.5",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [