najm-auth 4.0.1 → 4.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -0
- package/dist/index.js +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -874,6 +874,13 @@ the successful Next.js render receives. Attempts to override `cookie` or
|
|
|
874
874
|
`authorization` fail closed; only Najm's validated recovery path may replace
|
|
875
875
|
the cookie after it authorizes the recovered session.
|
|
876
876
|
|
|
877
|
+
Speculative/prefetch requests (`next-router-prefetch`, `purpose: prefetch`,
|
|
878
|
+
`sec-purpose` containing `prefetch`, `next-router-state-tree` metadata-only)
|
|
879
|
+
receive the same treatment as direct navigation: a valid signed snapshot or
|
|
880
|
+
non-rotating `/session/recover` validation is still required. Refresh-cookie
|
|
881
|
+
presence is never authorization, so do not bypass `auth.proxy` when a refresh
|
|
882
|
+
cookie is present on a prefetch. Recovery never rotates refresh tokens.
|
|
883
|
+
|
|
877
884
|
```typescript
|
|
878
885
|
// src/app/api/[...route]/route.ts
|
|
879
886
|
import { handle } from 'najm-core';
|
package/dist/index.js
CHANGED
|
@@ -2212,7 +2212,7 @@ var TokenService = class TokenService2 {
|
|
|
2212
2212
|
}
|
|
2213
2213
|
rejectRefreshSession(messageKey = "errors.refreshTokenInvalid") {
|
|
2214
2214
|
this.clearRefreshSessionCookies();
|
|
2215
|
-
Err7(this.t(messageKey), 401);
|
|
2215
|
+
return Err7(this.t(messageKey), 401);
|
|
2216
2216
|
}
|
|
2217
2217
|
async assertRefreshFamilyAllowed(tokenFamily, userId) {
|
|
2218
2218
|
if (await this.invalidation.familyStatus(tokenFamily, userId) === "revoked") {
|