najm-auth 3.3.0 → 3.3.1

package/dist/index.d.ts

@@ -1084,16 +1084,19 @@ declare class TokenService {
         tokenFamily: string;
     };
     private static readonly PREVIOUS_GRACE_SECONDS;
+    private clearRefreshSessionCookies;
+    private rejectRefreshSession;
+    private readRefreshSessionCookie;
     /**
      * Read the refresh cookie and return the userId it belongs to.
      * Validates against current/previous token state with bounded recovery.
      * Throws if the cookie is missing, invalid, or outside the grace window.
      *
-     * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
-     * does NOT revoke the suspect family. This is a read path (e.g. GET
-     * /auth/me) — a stray stale cookie on a read must not be able to destroy
-     * the active session. Reuse detection and revocation belong to the
-     * rotation path only.
+     * Intentionally does not revoke on a mismatch: unlike refreshTokens(), this
+     * is a read path (e.g. GET /auth/me), so a stray stale cookie must not be
+     * able to destroy server-side session state. Definitively invalid browser
+     * cookies are still cleared so a signed snapshot cannot cause a redirect
+     * loop.
      */
     private resolveRefreshSessionFromCookie;
     resolveUserFromCookie(): Promise<string>;

package/dist/index.js

@@ -1914,26 +1914,42 @@ var TokenService = class TokenService2 {
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
   static PREVIOUS_GRACE_SECONDS = 120;
+  clearRefreshSessionCookies() {
+    this.cookieManager.clearRefreshToken();
+    this.cookieManager.clearSessionCookie();
+  }
+  rejectRefreshSession(messageKey = "errors.refreshTokenInvalid") {
+    this.clearRefreshSessionCookies();
+    Err7(this.t(messageKey), 401);
+  }
+  readRefreshSessionCookie() {
+    const refreshToken = this.cookieManager.getRefreshToken();
+    if (!refreshToken) {
+      this.rejectRefreshSession("errors.refreshTokenMissing");
+    }
+    try {
+      return { refreshToken, ...this.verifyRefreshToken(refreshToken) };
+    } catch (error) {
+      this.clearRefreshSessionCookies();
+      throw error;
+    }
+  }
   /**
    * Read the refresh cookie and return the userId it belongs to.
    * Validates against current/previous token state with bounded recovery.
    * Throws if the cookie is missing, invalid, or outside the grace window.
    *
-   * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
-   * does NOT revoke the suspect family. This is a read path (e.g. GET
-   * /auth/me) — a stray stale cookie on a read must not be able to destroy
-   * the active session. Reuse detection and revocation belong to the
-   * rotation path only.
+   * Intentionally does not revoke on a mismatch: unlike refreshTokens(), this
+   * is a read path (e.g. GET /auth/me), so a stray stale cookie must not be
+   * able to destroy server-side session state. Definitively invalid browser
+   * cookies are still cleared so a signed snapshot cannot cause a redirect
+   * loop.
    */
   async resolveRefreshSessionFromCookie() {
-    const refreshToken = this.cookieManager.getRefreshToken();
-    if (!refreshToken) {
-      Err7(this.t("errors.refreshTokenMissing"), 401);
-    }
-    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1943,7 +1959,7 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       return { userId, tokenFamily };
     }
-    Err7(this.t("errors.refreshTokenInvalid"), 401);
+    this.rejectRefreshSession();
   }
   async resolveUserFromCookie() {
     return (await this.resolveRefreshSessionFromCookie()).userId;
@@ -2143,14 +2159,10 @@ var TokenService = class TokenService2 {
    * Compares provided token with hashed version in database
    */
   async refreshTokens() {
-    const refreshToken = this.cookieManager.getRefreshToken();
-    if (!refreshToken) {
-      Err7(this.t("errors.refreshTokenMissing"), 401);
-    }
-    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const presentedHash = this.hashToken(refreshToken);
     await this.requireActiveRefreshUser(userId, tokenFamily);
@@ -2166,19 +2178,18 @@ var TokenService = class TokenService2 {
       return this.rotateTokens(userId, tokenFamily, stored.token);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
-    Err7(this.t("errors.refreshTokenInvalid"), 401);
+    this.rejectRefreshSession();
   }
   async requireActiveRefreshUser(userId, tokenFamily) {
     const user = await this.tokenRepository.getUser(userId);
     if (!user || user.status !== "active") {
       await this.revokeFamily(tokenFamily);
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const requirement = await this.credentialSetupRequirements?.find(userId, PASSWORD_SETUP_PURPOSE);
     if (requirement?.required) {
       await this.revokeFamily(tokenFamily);
-      this.cookieManager.clearRefreshToken();
-      this.cookieManager.clearSessionCookie();
+      this.clearRefreshSessionCookies();
       Err7(this.t("errors.credentialSetupRequired"), 403);
     }
     return user;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -91,13 +91,13 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.5",
-    "najm-database": "^2.0.3",
+    "najm-core": "^2.0.6",
+    "najm-database": "^2.0.4",
     "najm-guard": "^2.0.2",
-    "najm-i18n": "^2.0.3",
-    "najm-cache": "^2.1.0",
+    "najm-i18n": "^2.1.1",
+    "najm-cache": "^2.1.2",
     "najm-email": "^2.0.2",
-    "najm-rate": "^2.1.0",
+    "najm-rate": "^2.1.1",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",
     "jose": "^6.1.3",