najm-auth 3.3.0 → 3.3.2

package/dist/{NajmAuthClient-ZtXTIUSF.d.ts → NajmAuthClient-BBl-GRis.d.ts}

@@ -110,6 +110,7 @@ declare class NajmAuthClient {
     private _refreshWithCircuit;
     private _doRefresh;
     private handleUnauthorized;
+    private requestServerLogout;
     private applyTokens;
     private scheduleRefresh;
     private clearRefreshTimer;

package/dist/client/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FetchClient, H as HydrateSession, N as NajmAuthClient, c as createAuthClient } from '../NajmAuthClient-ZtXTIUSF.js';
+export { F as FetchClient, H as HydrateSession, N as NajmAuthClient, c as createAuthClient } from '../NajmAuthClient-BBl-GRis.js';
 import { D as DecodedToken, T as TabSyncMessage, S as SyncPayload } from '../types-BaSfgxqE.js';
 export { b as AuthClientConfig, h as AuthError, f as AuthEvent, g as AuthEventHandler, i as AuthEventMap, e as AuthState, A as AuthUser, j as AuthenticatedLogin, C as CredentialSetupPending, L as LoginCredentials, c as LoginResult, d as OAuthLoginOptions, O as OAuthProvider, a as RequestOptions, R as RetryConfig, k as ServerResponse, l as TokenPair } from '../types-BaSfgxqE.js';
 

package/dist/client/index.js

@@ -364,7 +364,7 @@ var NajmAuthClient = class _NajmAuthClient {
     this.emit("logout", null);
     try {
       await pendingRefresh?.catch(() => void 0);
-      await this.api.post(`${this.prefix}/logout`, { skipAuth: true });
+      await this.requestServerLogout();
     } catch (err) {
       this.emit("logoutError", err);
     }
@@ -549,6 +549,7 @@ var NajmAuthClient = class _NajmAuthClient {
       if (generation !== this.authGeneration) return;
       const shouldOpenCircuit = this.registerRefreshFailure(err);
       if (shouldOpenCircuit) {
+        await this.requestServerLogout().catch(() => void 0);
         this.resetState();
         this.emit("sessionExpired", null);
         if (err instanceof AuthError && err.status === 401) {
@@ -578,6 +579,9 @@ var NajmAuthClient = class _NajmAuthClient {
       return null;
     }
   }
+  async requestServerLogout() {
+    await this.api.post(`${this.prefix}/logout`, { skipAuth: true });
+  }
   applyTokens(tokens) {
     this.resetRefreshFailures();
     const decoded = decodeToken(tokens.accessToken);
@@ -618,7 +622,7 @@ var NajmAuthClient = class _NajmAuthClient {
     this.clearRefreshCircuitTimer();
   }
   registerRefreshFailure(err) {
-    if (err instanceof AuthError && err.status === 401) {
+    if (err instanceof AuthError && [401, 403, 429].includes(err.status)) {
       this.refreshFailures = _NajmAuthClient.MAX_REFRESH_FAILURES;
     } else {
       this.refreshFailures += 1;

package/dist/client/react/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode, CSSProperties, ReactElement } from 'react';
-import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-ZtXTIUSF.js';
+import { N as NajmAuthClient, H as HydrateSession } from '../../NajmAuthClient-BBl-GRis.js';
 import { e as AuthState, A as AuthUser, c as LoginResult, h as AuthError, L as LoginCredentials, d as OAuthLoginOptions, f as AuthEvent, i as AuthEventMap } from '../../types-BaSfgxqE.js';
 
 interface AuthProviderProps {

package/dist/client/server/index.d.ts

@@ -1,5 +1,5 @@
 import { A as AuthUser, R as RetryConfig } from '../../types-BaSfgxqE.js';
-import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-ZtXTIUSF.js';
+import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-BBl-GRis.js';
 import { ProxySessionMode } from '../edge.js';
 export { withAuthMiddleware } from '../edge.js';
 import { G as GetSessionConfig, S as ServerSession$1 } from '../../getSession-BthP85UA.js';

package/dist/client/server/index.js

@@ -1075,7 +1075,7 @@ var NajmAuthClient = class _NajmAuthClient {
     this.emit("logout", null);
     try {
       await pendingRefresh?.catch(() => void 0);
-      await this.api.post(`${this.prefix}/logout`, { skipAuth: true });
+      await this.requestServerLogout();
     } catch (err) {
       this.emit("logoutError", err);
     }
@@ -1260,6 +1260,7 @@ var NajmAuthClient = class _NajmAuthClient {
       if (generation !== this.authGeneration) return;
       const shouldOpenCircuit = this.registerRefreshFailure(err);
       if (shouldOpenCircuit) {
+        await this.requestServerLogout().catch(() => void 0);
         this.resetState();
         this.emit("sessionExpired", null);
         if (err instanceof AuthError && err.status === 401) {
@@ -1289,6 +1290,9 @@ var NajmAuthClient = class _NajmAuthClient {
       return null;
     }
   }
+  async requestServerLogout() {
+    await this.api.post(`${this.prefix}/logout`, { skipAuth: true });
+  }
   applyTokens(tokens) {
     this.resetRefreshFailures();
     const decoded = decodeToken(tokens.accessToken);
@@ -1329,7 +1333,7 @@ var NajmAuthClient = class _NajmAuthClient {
     this.clearRefreshCircuitTimer();
   }
   registerRefreshFailure(err) {
-    if (err instanceof AuthError && err.status === 401) {
+    if (err instanceof AuthError && [401, 403, 429].includes(err.status)) {
       this.refreshFailures = _NajmAuthClient.MAX_REFRESH_FAILURES;
     } else {
       this.refreshFailures += 1;

package/dist/index.d.ts

@@ -1084,16 +1084,19 @@ declare class TokenService {
         tokenFamily: string;
     };
     private static readonly PREVIOUS_GRACE_SECONDS;
+    private clearRefreshSessionCookies;
+    private rejectRefreshSession;
+    private readRefreshSessionCookie;
     /**
      * Read the refresh cookie and return the userId it belongs to.
      * Validates against current/previous token state with bounded recovery.
      * Throws if the cookie is missing, invalid, or outside the grace window.
      *
-     * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
-     * does NOT revoke the suspect family. This is a read path (e.g. GET
-     * /auth/me) — a stray stale cookie on a read must not be able to destroy
-     * the active session. Reuse detection and revocation belong to the
-     * rotation path only.
+     * Intentionally does not revoke on a mismatch: unlike refreshTokens(), this
+     * is a read path (e.g. GET /auth/me), so a stray stale cookie must not be
+     * able to destroy server-side session state. Definitively invalid browser
+     * cookies are still cleared so a signed snapshot cannot cause a redirect
+     * loop.
      */
     private resolveRefreshSessionFromCookie;
     resolveUserFromCookie(): Promise<string>;
@@ -1623,7 +1626,7 @@ declare class AuthService {
     recoverSession(): Promise<{
         recovered: true;
     }>;
-    logoutUser(userId: string, authorization?: string): Promise<{
+    logoutUser(userId: string | undefined, authorization?: string): Promise<{
         data: any;
         message: string;
     }>;
@@ -1700,7 +1703,7 @@ declare class AuthController {
     recoverSession(recoveryRequest: string | undefined, ctx: Context): Promise<{
         recovered: true;
     }>;
-    logoutUser(userId: string, authorization?: string): Promise<{
+    logoutUser(userId: string | undefined, authorization?: string): Promise<{
         data: any;
         message: string;
     }>;

package/dist/index.js

@@ -1914,26 +1914,42 @@ var TokenService = class TokenService2 {
     return { userId: decoded.userId, tokenFamily: decoded.tokenFamily };
   }
   static PREVIOUS_GRACE_SECONDS = 120;
+  clearRefreshSessionCookies() {
+    this.cookieManager.clearRefreshToken();
+    this.cookieManager.clearSessionCookie();
+  }
+  rejectRefreshSession(messageKey = "errors.refreshTokenInvalid") {
+    this.clearRefreshSessionCookies();
+    Err7(this.t(messageKey), 401);
+  }
+  readRefreshSessionCookie() {
+    const refreshToken = this.cookieManager.getRefreshToken();
+    if (!refreshToken) {
+      this.rejectRefreshSession("errors.refreshTokenMissing");
+    }
+    try {
+      return { refreshToken, ...this.verifyRefreshToken(refreshToken) };
+    } catch (error) {
+      this.clearRefreshSessionCookies();
+      throw error;
+    }
+  }
   /**
    * Read the refresh cookie and return the userId it belongs to.
    * Validates against current/previous token state with bounded recovery.
    * Throws if the cookie is missing, invalid, or outside the grace window.
    *
-   * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
-   * does NOT revoke the suspect family. This is a read path (e.g. GET
-   * /auth/me) — a stray stale cookie on a read must not be able to destroy
-   * the active session. Reuse detection and revocation belong to the
-   * rotation path only.
+   * Intentionally does not revoke on a mismatch: unlike refreshTokens(), this
+   * is a read path (e.g. GET /auth/me), so a stray stale cookie must not be
+   * able to destroy server-side session state. Definitively invalid browser
+   * cookies are still cleared so a signed snapshot cannot cause a redirect
+   * loop.
    */
   async resolveRefreshSessionFromCookie() {
-    const refreshToken = this.cookieManager.getRefreshToken();
-    if (!refreshToken) {
-      Err7(this.t("errors.refreshTokenMissing"), 401);
-    }
-    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const presentedHash = this.hashToken(refreshToken);
     if (presentedHash === stored.token) {
@@ -1943,7 +1959,7 @@ var TokenService = class TokenService2 {
     if (canRecover) {
       return { userId, tokenFamily };
     }
-    Err7(this.t("errors.refreshTokenInvalid"), 401);
+    this.rejectRefreshSession();
   }
   async resolveUserFromCookie() {
     return (await this.resolveRefreshSessionFromCookie()).userId;
@@ -2143,14 +2159,10 @@ var TokenService = class TokenService2 {
    * Compares provided token with hashed version in database
    */
   async refreshTokens() {
-    const refreshToken = this.cookieManager.getRefreshToken();
-    if (!refreshToken) {
-      Err7(this.t("errors.refreshTokenMissing"), 401);
-    }
-    const { userId, tokenFamily } = this.verifyRefreshToken(refreshToken);
+    const { refreshToken, userId, tokenFamily } = this.readRefreshSessionCookie();
     const stored = await this.tokenRepository.getByFamily(tokenFamily);
     if (!stored || stored.userId !== userId) {
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const presentedHash = this.hashToken(refreshToken);
     await this.requireActiveRefreshUser(userId, tokenFamily);
@@ -2166,19 +2178,18 @@ var TokenService = class TokenService2 {
       return this.rotateTokens(userId, tokenFamily, stored.token);
     }
     await this.revokeSuspectRefreshFamily(userId, tokenFamily);
-    Err7(this.t("errors.refreshTokenInvalid"), 401);
+    this.rejectRefreshSession();
   }
   async requireActiveRefreshUser(userId, tokenFamily) {
     const user = await this.tokenRepository.getUser(userId);
     if (!user || user.status !== "active") {
       await this.revokeFamily(tokenFamily);
-      Err7(this.t("errors.refreshTokenInvalid"), 401);
+      this.rejectRefreshSession();
     }
     const requirement = await this.credentialSetupRequirements?.find(userId, PASSWORD_SETUP_PURPOSE);
     if (requirement?.required) {
       await this.revokeFamily(tokenFamily);
-      this.cookieManager.clearRefreshToken();
-      this.cookieManager.clearSessionCookie();
+      this.clearRefreshSessionCookies();
       Err7(this.t("errors.credentialSetupRequired"), 403);
     }
     return user;
@@ -3350,9 +3361,14 @@ var AuthService = class AuthService2 {
     return { recovered: true };
   }
   async logoutUser(userId, authorization) {
-    await this.tokenService.logout(userId, authorization);
-    this.cookieManager.clearRefreshToken();
-    this.cookieManager.clearSessionCookie();
+    try {
+      if (userId) {
+        await this.tokenService.logout(userId, authorization);
+      }
+    } finally {
+      this.cookieManager.clearRefreshToken();
+      this.cookieManager.clearSessionCookie();
+    }
     return { data: null, message: this.t("auth.success.logout") };
   }
   /**
@@ -3846,8 +3862,6 @@ __decorate20([
 ], AuthController.prototype, "recoverSession", null);
 __decorate20([
   Post("/logout"),
-  isAuth(),
-  RateLimit({ limit: 10, window: "15m", key: "user" }),
   __param5(0, User2("id")),
   __param5(1, Headers("authorization")),
   __metadata20("design:type", Function),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -91,13 +91,13 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.5",
-    "najm-database": "^2.0.3",
+    "najm-core": "^2.0.6",
+    "najm-database": "^2.0.4",
     "najm-guard": "^2.0.2",
-    "najm-i18n": "^2.0.3",
-    "najm-cache": "^2.1.0",
+    "najm-i18n": "^2.1.1",
+    "najm-cache": "^2.1.2",
     "najm-email": "^2.0.2",
-    "najm-rate": "^2.1.0",
+    "najm-rate": "^2.1.1",
     "najm-validation": "^2.0.2",
     "jsonwebtoken": "^9.0.3",
     "jose": "^6.1.3",