najm-auth 3.2.1 → 3.3.1

package/dist/client/react/index.d.ts

@@ -1,4 +1,3 @@
-import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
 import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-ZtXTIUSF.js';
@@ -20,7 +19,7 @@ interface AuthProviderProps {
      */
     autoRefresh?: boolean;
 }
-declare function AuthProvider({ client, children, initialSession, autoRefresh, }: AuthProviderProps): react_jsx_runtime.JSX.Element;
+declare function AuthProvider({ client, children, initialSession, autoRefresh, }: AuthProviderProps): react.JSX.Element;
 
 interface AuthBoundaryProps {
     children: ReactNode;
@@ -28,7 +27,7 @@ interface AuthBoundaryProps {
     /** Only gate while we truly have no identity; default false. */
     requireToken?: boolean;
 }
-declare function AuthBoundary({ children, fallback, requireToken, }: AuthBoundaryProps): react_jsx_runtime.JSX.Element;
+declare function AuthBoundary({ children, fallback, requireToken, }: AuthBoundaryProps): react.JSX.Element;
 
 declare function useAuthClient(): NajmAuthClient;
 
@@ -240,7 +239,7 @@ interface SignedInProps {
  * </SignedIn>
  * ```
  */
-declare function SignedIn({ children }: SignedInProps): react_jsx_runtime.JSX.Element;
+declare function SignedIn({ children }: SignedInProps): react.JSX.Element;
 
 interface SignedOutProps {
     children: ReactNode;
@@ -256,7 +255,7 @@ interface SignedOutProps {
  * </SignedOut>
  * ```
  */
-declare function SignedOut({ children }: SignedOutProps): react_jsx_runtime.JSX.Element;
+declare function SignedOut({ children }: SignedOutProps): react.JSX.Element;
 
 interface AuthLoadingProps {
     children: ReactNode;
@@ -274,7 +273,7 @@ interface AuthLoadingProps {
  * <SignedOut>...</SignedOut>
  * ```
  */
-declare function AuthLoading({ children }: AuthLoadingProps): react_jsx_runtime.JSX.Element;
+declare function AuthLoading({ children }: AuthLoadingProps): react.JSX.Element;
 
 interface CanProps {
     /** Required permission (e.g., 'read:posts') */
@@ -300,7 +299,7 @@ interface CanProps {
  * </Can>
  * ```
  */
-declare function Can({ permission, role, children, fallback }: CanProps): react_jsx_runtime.JSX.Element;
+declare function Can({ permission, role, children, fallback }: CanProps): react.JSX.Element;
 
 interface RoleProps {
     /** Required role name */
@@ -324,7 +323,7 @@ interface RoleProps {
  * </Role>
  * ```
  */
-declare function Role(props: RoleProps): react_jsx_runtime.JSX.Element;
+declare function Role(props: RoleProps): react.JSX.Element;
 
 interface IfAuthProps {
     /** Render when authenticated — receives user */
@@ -346,7 +345,7 @@ interface IfAuthProps {
  * />
  * ```
  */
-declare function IfAuth({ authenticated, unauthenticated, loading }: IfAuthProps): react_jsx_runtime.JSX.Element;
+declare function IfAuth({ authenticated, unauthenticated, loading }: IfAuthProps): react.JSX.Element;
 
 interface ProtectedProps {
     children: ReactNode;
@@ -377,7 +376,7 @@ interface ProtectedProps {
  * </Protected>
  * ```
  */
-declare function Protected({ children, redirectTo, onUnauthenticated, role, permission, loadingFallback, fallback, }: ProtectedProps): react_jsx_runtime.JSX.Element;
+declare function Protected({ children, redirectTo, onUnauthenticated, role, permission, loadingFallback, fallback, }: ProtectedProps): react.JSX.Element;
 
 interface AuthGateProps {
     children: ReactNode;
@@ -407,7 +406,7 @@ interface AuthGateProps {
  * **Without SSR hydration** (client-side nav, hard reload without initialSession):
  * Shows `loader` while attempting a token refresh, then either opens or redirects.
  */
-declare function AuthGate({ children, loader, redirectTo, onUnauthenticated, role, permission, denied, }: AuthGateProps): react_jsx_runtime.JSX.Element;
+declare function AuthGate({ children, loader, redirectTo, onUnauthenticated, role, permission, denied, }: AuthGateProps): react.JSX.Element;
 
 interface UserNameProps {
     /** Optional fallback shown when no user is loaded */
@@ -422,7 +421,7 @@ interface UserNameProps {
  * <span>Hi, <UserName fallback="guest" />!</span>
  * ```
  */
-declare function UserName({ fallback }: UserNameProps): react_jsx_runtime.JSX.Element;
+declare function UserName({ fallback }: UserNameProps): react.JSX.Element;
 
 interface UserEmailProps {
     fallback?: string;
@@ -435,7 +434,7 @@ interface UserEmailProps {
  * <p>Email: <UserEmail fallback="Not available" /></p>
  * ```
  */
-declare function UserEmail({ fallback }: UserEmailProps): react_jsx_runtime.JSX.Element;
+declare function UserEmail({ fallback }: UserEmailProps): react.JSX.Element;
 
 interface UserRoleProps {
     fallback?: string;
@@ -448,7 +447,7 @@ interface UserRoleProps {
  * <span>Role: <UserRole fallback="none" /></span>
  * ```
  */
-declare function UserRole({ fallback }: UserRoleProps): react_jsx_runtime.JSX.Element;
+declare function UserRole({ fallback }: UserRoleProps): react.JSX.Element;
 
 interface UserAvatarProps {
     /** Pixel size of the avatar (default: 32) */
@@ -474,7 +473,7 @@ interface UserAvatarProps {
  * <UserAvatar className="my-avatar" />
  * ```
  */
-declare function UserAvatar({ size, className, style, alt }: UserAvatarProps): react_jsx_runtime.JSX.Element;
+declare function UserAvatar({ size, className, style, alt }: UserAvatarProps): react.JSX.Element;
 
 interface PermissionListProps {
     /** Render function for each permission */
@@ -492,7 +491,7 @@ interface PermissionListProps {
  * </PermissionList>
  * ```
  */
-declare function PermissionList({ children, fallback }: PermissionListProps): react_jsx_runtime.JSX.Element;
+declare function PermissionList({ children, fallback }: PermissionListProps): react.JSX.Element;
 
 interface SignOutButtonProps {
     /** A single clickable child element. Its `onClick` will be wired to logout. */
@@ -579,6 +578,6 @@ interface OAuthCallbackProps {
     }) => ReactNode);
     defaultRedirect?: string;
 }
-declare function OAuthCallback({ fallback, errorFallback, defaultRedirect, }: OAuthCallbackProps): react_jsx_runtime.JSX.Element;
+declare function OAuthCallback({ fallback, errorFallback, defaultRedirect, }: OAuthCallbackProps): react.JSX.Element;
 
 export { AuthBoundary, type AuthEventEntry, AuthGate, AuthLoading, AuthProvider, Can, GoogleLoginButton, IfAuth, LoginButton, OAuthCallback, PermissionList, Protected, RedirectToLogin, Role, type SessionStatus, SignOutButton, SignedIn, SignedOut, UserAvatar, UserEmail, UserName, UserRole, useAuth, useAuthClient, useAuthEvent, useAuthEvents, useChangePassword, useForgotPassword, useGoogleLogin, useLogin, useLogout, useOAuthCallback, usePermissions, useRegister, useResetPassword, useSession, useUser };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import * as najm_core from 'najm-core';
 import { Container } from 'najm-core';
 import { ValidationPluginConfig } from 'najm-validation';
-import { RateLimitPluginConfig, TimeWindow } from 'najm-rate';
+import { RateLimitPluginConfig, RateLimitKeyContext, TimeWindow } from 'najm-rate';
+import { CachePluginConfig, CacheService } from 'najm-cache';
 import { EmailPluginConfig, EmailService } from 'najm-email';
 import { R as ResolvedIdentityConfig, I as IdentityConfig, T as TemporaryCredentialInput } from './ma-sNHnUGLO.js';
 export { D as DEFAULT_IDENTITY_PRESET, E as EXACT_TEMPORARY_CREDENTIAL_KIND, a as IDENTITY_PRESETS, b as IdentityNormalizer, c as IdentityPreset, d as IdentityPresetName, M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, f as TemporaryCredentialKind, g as compactPhone, i as isMoroccanCin, h as isTemporaryCredentialKind, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone, l as normalizeTunisianPhone, r as resolveTemporaryCredentialKind, t as toTemporaryCredential, o as tunisiaIdentityPreset } from './ma-sNHnUGLO.js';
@@ -10,7 +11,6 @@ import { I18nService } from 'najm-i18n';
 import { TDb, SeedEntry } from 'najm-database';
 import { User, NewUser, RoleEntity, NewRoleEntity, Permission, NewPermission, RolePermission } from './schema/pg.js';
 export { CredentialSetupRequirement, CredentialSetupSession, NewCredentialSetupRequirement, NewCredentialSetupSession, NewOAuthAccount, NewRolePermission, NewToken, OAuthAccount, Token, authSchema, baseFields, credentialSetupRequirementsTable, credentialSetupSessionsTable, oauthAccountsTable, permissionsTable, rolePermissionsTable, rolesTable, tokenStatusEnum, tokenTypeEnum, tokensTable, userStatusEnum, usersTable } from './schema/pg.js';
-import { CacheService } from 'najm-cache';
 import { CookieService } from 'najm-cookies';
 import { Context } from 'hono';
 import { GuardResult } from 'najm-guard';
@@ -269,6 +269,15 @@ type AuthPluginConfig = {
     validation?: ValidationPluginConfig;
     /** Optional config forwarded to rateLimit() dependency */
     rateLimit?: RateLimitPluginConfig;
+    /**
+     * Optional config forwarded to the package-owned cache() dependency.
+     *
+     * Auth registers cache() itself, so a consumer cannot configure the store by
+     * registering its own plugin first. Pass it here to select a shared, durable
+     * backend — required in production wherever the cache backs rate limiting,
+     * since a per-process memory bucket resets on every restart.
+     */
+    cache?: CachePluginConfig;
     /** Email transport used by password reset and verification flows. */
     email?: EmailPluginConfig;
     /** AES-256-GCM key for reversible encryption (e.g. API keys). Falls back to NAJM_ENCRYPTION_KEY env var. */
@@ -1075,16 +1084,19 @@ declare class TokenService {
         tokenFamily: string;
     };
     private static readonly PREVIOUS_GRACE_SECONDS;
+    private clearRefreshSessionCookies;
+    private rejectRefreshSession;
+    private readRefreshSessionCookie;
     /**
      * Read the refresh cookie and return the userId it belongs to.
      * Validates against current/previous token state with bounded recovery.
      * Throws if the cookie is missing, invalid, or outside the grace window.
      *
-     * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
-     * does NOT revoke the suspect family. This is a read path (e.g. GET
-     * /auth/me) — a stray stale cookie on a read must not be able to destroy
-     * the active session. Reuse detection and revocation belong to the
-     * rotation path only.
+     * Intentionally does not revoke on a mismatch: unlike refreshTokens(), this
+     * is a read path (e.g. GET /auth/me), so a stray stale cookie must not be
+     * able to destroy server-side session state. Definitively invalid browser
+     * cookies are still cleared so a signed snapshot cannot cause a redirect
+     * loop.
      */
     private resolveRefreshSessionFromCookie;
     resolveUserFromCookie(): Promise<string>;
@@ -1653,11 +1665,14 @@ declare class AuthService {
 }
 
 /**
- * Composite key: IP + hashed normalized login/registration identity.
- * Buckets rate limits per IP+credential combo so different users
- * on the same IP (e.g. localhost, NAT) don't share a single bucket.
+ * Composite key: resolved client address + hashed normalized identity.
+ * Buckets rate limits per client+credential combo so different users
+ * on the same address (e.g. localhost, NAT) don't share a single bucket.
+ *
+ * The address arrives already resolved through the configured trusted-proxy
+ * boundary; this module must never parse forwarding headers itself.
  */
-declare const authIdentityRateLimitKey: (ctx: Context) => Promise<string>;
+declare const authIdentityRateLimitKey: (ctx: Context, keyContext?: RateLimitKeyContext) => Promise<string>;
 declare class AuthController {
     private authService;
     constructor(authService: AuthService);

package/dist/index.js

@@ -1914,26 +1914,42 @@ var TokenService = class TokenService2 {
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
   static PREVIOUS_GRACE_SECONDS = 120;
+  clearRefreshSessionCookies() {
+    this.cookieManager.clearRefreshToken();
+    this.cookieManager.clearSessionCookie();
+  }
+  rejectRefreshSession(messageKey = "errors.refreshTokenInvalid") {
+    this.clearRefreshSessionCookies();
+    Err7(this.t(messageKey), 401);
+  }
+  readRefreshSessionCookie() {
+    const refreshToken = this.cookieManager.getRefreshToken();
+    if (!refreshToken) {
+      this.rejectRefreshSession("errors.refreshTokenMissing");
+    }
+    try {
+      return { refreshToken, ...this.verifyRefreshToken(refreshToken) };
+    } catch (error) {
+      this.clearRefreshSessionCookies();
+      throw error;
+    }
+  }
   /**
    * Read the refresh cookie and return the userId it belongs to.
    * Validates against current/previous token state with bounded recovery.
    * Throws if the cookie is missing, invalid, or outside the grace window.
    *
-   * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
-   * does NOT revoke the suspect family. This is a read path (e.g. GET
-   * /auth/me) — a stray stale cookie on a read must not be able to destroy
-   * the active session. Reuse detection and revocation belong to the
-   * rotation path only.
+   * Intentionally does not revoke on a mismatch: unlike refreshTokens(), this
+   * is a read path (e.g. GET /auth/me), so a stray stale cookie must not be
+   * able to destroy server-side session state. Definitively invalid browser
+   * cookies are still cleared so a signed snapshot cannot cause a redirect
+   * loop.
    */
   async resolveRefreshSessionFromCookie() {
-    const refreshToken = this.cookieManager.getRefreshToken();
-    if (!refreshToken) {
-      Err7(this.t("errors.refreshTokenMissing"), 401);
-    }
-    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1943,7 +1959,7 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       return { userId, tokenFamily };
     }
-    Err7(this.t("errors.refreshTokenInvalid"), 401);
+    this.rejectRefreshSession();
   }
   async resolveUserFromCookie() {
     return (await this.resolveRefreshSessionFromCookie()).userId;
@@ -2143,14 +2159,10 @@ var TokenService = class TokenService2 {
    * Compares provided token with hashed version in database
    */
   async refreshTokens() {
-    const refreshToken = this.cookieManager.getRefreshToken();
-    if (!refreshToken) {
-      Err7(this.t("errors.refreshTokenMissing"), 401);
-    }
-    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const presentedHash = this.hashToken(refreshToken);
     await this.requireActiveRefreshUser(userId, tokenFamily);
@@ -2166,19 +2178,18 @@ var TokenService = class TokenService2 {
       return this.rotateTokens(userId, tokenFamily, stored.token);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
-    Err7(this.t("errors.refreshTokenInvalid"), 401);
+    this.rejectRefreshSession();
   }
   async requireActiveRefreshUser(userId, tokenFamily) {
     const user = await this.tokenRepository.getUser(userId);
     if (!user || user.status !== "active") {
       await this.revokeFamily(tokenFamily);
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const requirement = await this.credentialSetupRequirements?.find(userId, PASSWORD_SETUP_PURPOSE);
     if (requirement?.required) {
       await this.revokeFamily(tokenFamily);
-      this.cookieManager.clearRefreshToken();
-      this.cookieManager.clearSessionCookie();
+      this.clearRefreshSessionCookies();
       Err7(this.t("errors.credentialSetupRequired"), 403);
     }
     return user;
@@ -3561,7 +3572,7 @@ var isAdministrator = composeGuards(isAuth(), Role(ROLE_GROUPS.ADMINISTRATORS));
 
 // src/auth/AuthController.ts
 import { Validate } from "najm-validation";
-import { RateLimit } from "najm-rate";
+import { RateLimit, UNRESOLVED_CLIENT_ADDRESS } from "najm-rate";
 import { createHash as createHash3 } from "crypto";
 
 // src/identity/requestResolver.ts
@@ -3739,14 +3750,13 @@ var __param5 = function(paramIndex, decorator) {
 };
 var _a12;
 var hashKeyPart = /* @__PURE__ */ __name((value) => createHash3("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
-var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx, { clientIp }) => {
   const cookie = ctx.req.raw.headers.get("cookie") ?? "";
   const fingerprint = cookie ? hashKeyPart(cookie) : "none";
-  return `${ip}:${fingerprint}`;
+  return `${clientIp}:${fingerprint}`;
 }, "cookieFingerprint");
-var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var authIdentityRateLimitKey = /* @__PURE__ */ __name(async (ctx, keyContext) => {
+  const ip = keyContext?.clientIp ?? UNRESOLVED_CLIENT_ADDRESS;
   try {
     const body = await ctx.req.json();
     const identity = body?.identifier ?? body?.email;
@@ -6574,8 +6584,8 @@ var __param13 = function(paramIndex, decorator) {
   };
 };
 var _a25;
-var callbackKey = /* @__PURE__ */ __name((ctx) => {
-  const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
+var callbackKey = /* @__PURE__ */ __name((ctx, { clientIp }) => {
+  const ip = clientIp;
   const state = ctx.req.query("state") ?? "none";
   const fingerprint = createHash5("sha256").update(state).digest("base64url").slice(0, 24);
   return `${ip}:${fingerprint}`;
@@ -6862,7 +6872,7 @@ var selectAuthSchema = /* @__PURE__ */ __name((config) => {
       return authSchema;
   }
 }, "selectAuthSchema");
-var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_CORE_MODULE, config?.publicRegistration === false ? [] : PUBLIC_REGISTRATION_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, CREDENTIAL_SETUP_MODULE, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
+var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(config?.cache), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email(config?.email)).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(AUTH_CORE_MODULE, config?.publicRegistration === false ? [] : PUBLIC_REGISTRATION_MODULE, OAUTH_MODULE, users_exports, roles_exports, permissions_exports, tokens_exports, CREDENTIAL_SETUP_MODULE, ScopeContext).config(AUTH_CONFIG, resolveAuthConfig(config)).set(AUTH_SCHEMA, selectAuthSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.2.1",
+  "version": "3.3.1",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -91,13 +91,13 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.5",
-    "najm-database": "^2.0.3",
+    "najm-core": "^2.0.6",
+    "najm-database": "^2.0.4",
     "najm-guard": "^2.0.2",
-    "najm-i18n": "^2.0.3",
-    "najm-cache": "^2.0.2",
+    "najm-i18n": "^2.1.1",
+    "najm-cache": "^2.1.2",
     "najm-email": "^2.0.2",
-    "najm-rate": "^2.0.3",
+    "najm-rate": "^2.1.1",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",
     "jose": "^6.1.3",