or3-provider-basic-auth 0.0.8 → 0.0.10

package/README.md

@@ -51,6 +51,7 @@ Optional:
 - `OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD`
 - `OR3_BASIC_AUTH_RATE_LIMIT_BACKEND` (`sqlite` default; `memory` is per-process and intended for single-instance development only)
 - `OR3_BASIC_AUTH_ALLOW_INSECURE_DEV` (`true` in non-production to start with missing secrets instead of failing)
+- `OR3_PLUGIN_DEV_COOKIE_SCOPE` (set by the isolated plugin development launcher to keep browser sessions separate across local hosts)
 
 Registration mode is a core-auth policy, not a provider setting:
 
@@ -72,6 +73,7 @@ Strict-mode behavior:
 - Access JWTs are short-lived and validated by `basicAuthProvider.getSession(event)`.
 - Refresh tokens are rotated and hashed at rest; replay attempts revoke active sessions.
 - The refresh cookie is scoped to `/api` so `/api/auth/session` can transparently rotate expired access tokens during session resolution.
+- Sign-out never refreshes the session: the user is resolved without rotation, and revoking a token also revokes the sessions it was rotated into and clears their rotation grace, so a replayed predecessor cannot recover a successor after logout.
 - The SQLite DB file and directory are hardened to mode `0600`/`0700`; the DB uses WAL journaling.
 
 ## Runtime entrypoints
@@ -90,6 +92,13 @@ Strict-mode behavior:
 | `src/runtime/plugins/auth-status.client.ts` | Client auth-status resolver + silent-refresh recovery |
 | `src/runtime/components/*.client.vue` | Provider-owned auth UI (modals, user menu, sidebar button, lock page) |
 
+New passwords must be at least eight characters and no more than 72 UTF-8 bytes, matching bcrypt's input limit. Existing account hashes remain verifiable, including passwords created before this limit was enforced.
+
+The registered sidebar auth adapter accepts `layout="rail"` (default) and
+`layout="more-sheet"`. In the More sheet it renders Account/Login with the
+host's shared full-width `.more-row` structure, while keeping the existing
+popover and modal behavior.
+
 ## Troubleshooting
 
 - `Authentication provider is not configured`
@@ -129,3 +138,19 @@ bun run type-check
 bun run test
 bun run build
 ```
+
+
+### Testing local changes in OR3 Chat
+
+With this repository beside `or3-chat`, run `bun install` here once, then
+`bun run dev:ssr` from Chat. Chat's dev wrapper rebuilds the local provider and
+prints its selected path; restart it after provider edits. Missing repositories
+or failed builds fall back to installed packages with a warning.
+`OR3_LOCAL_PROVIDERS=false` disables local selection. Production builds use the
+installed package, so local development does not publish these changes.
+
+Basic Auth's database always uses `better-sqlite3`, independently of the sync
+provider's SQLite driver. If the source launcher selects Bun for sync, this
+native binding must also work under the project-pinned Bun version. The launcher
+checks it in that runtime before starting Nuxt and reports incompatible bindings
+or runtime crashes. Managed Cloud uses Node with `better-sqlite3`.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-basic-auth",
   "configKey": "or3-provider-basic-auth",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/components/BasicAuthChangePasswordModal.client.vue

@@ -31,7 +31,7 @@
 
           <USeparator />
 
-          <UFormField label="New Password" name="newPassword">
+          <UFormField label="New Password" name="newPassword" hint="At least 8 characters; at most 72 UTF-8 bytes">
             <UInput
               v-model="state.newPassword"
               type="password"
@@ -83,8 +83,10 @@
 
 <script setup>
 import { computed, reactive, ref } from "vue";
+import { newPasswordFitsBcrypt } from "../password-policy";
 const modalUi = {
-  content: "sm:max-w-[400px]"
+  overlay: "basic-auth-modal-overlay",
+  content: "basic-auth-modal-content sm:max-w-[400px]"
 };
 const props = defineProps({
   modelValue: { type: Boolean, required: true },
@@ -107,6 +109,14 @@ function close() {
   emit("update:modelValue", false);
 }
 async function onSubmit() {
+  if (state.newPassword.length < 8) {
+    errorMessage.value = "New password must be at least 8 characters.";
+    return;
+  }
+  if (!newPasswordFitsBcrypt(state.newPassword)) {
+    errorMessage.value = "New password must be 72 UTF-8 bytes or fewer.";
+    return;
+  }
   if (state.newPassword !== state.confirmNewPassword) {
     errorMessage.value = "Passwords do not match";
     return;

package/dist/runtime/components/BasicAuthRegisterModal.client.vue

@@ -46,7 +46,7 @@
           <UFormField
             label="Password"
             name="password"
-            hint="At least 8 characters"
+            hint="At least 8 characters; at most 72 UTF-8 bytes"
           >
             <UInput
               v-model="state.password"
@@ -112,8 +112,10 @@
 
 <script setup>
 import { computed, reactive, ref } from "vue";
+import { newPasswordFitsBcrypt } from "../password-policy";
 const modalUi = {
-  content: "sm:max-w-[420px]"
+  overlay: "basic-auth-modal-overlay",
+  content: "basic-auth-modal-content sm:max-w-[420px]"
 };
 const props = defineProps({
   modelValue: { type: Boolean, required: true }
@@ -149,6 +151,9 @@ function validateClientSide() {
   if (state.password.length > 512) {
     return "Password is too long.";
   }
+  if (!newPasswordFitsBcrypt(state.password)) {
+    return "Password must be 72 UTF-8 bytes or fewer.";
+  }
   if (state.password !== state.confirmPassword) {
     return "Passwords must match.";
   }
@@ -185,7 +190,7 @@ async function onSubmit() {
     const statusCode = typeof error === "object" && error !== null && "statusCode" in error ? Number(error.statusCode) : null;
     const serverMessage = readFetchErrorMessage(error);
     if (statusCode === 400) {
-      errorMessage.value = serverMessage || "Please check your email and password (min 8 characters).";
+      errorMessage.value = serverMessage || "Please check your email and password (8 characters minimum; 72 UTF-8 bytes maximum).";
     } else if (statusCode === 403) {
       errorMessage.value = serverMessage || "Registration is restricted for this instance.";
     } else if (statusCode === 401) {

package/dist/runtime/components/BasicAuthSignInModal.client.vue

@@ -85,7 +85,8 @@
 <script setup>
 import { computed, reactive, ref } from "vue";
 const modalUi = {
-  content: "sm:max-w-[380px]"
+  overlay: "basic-auth-modal-overlay",
+  content: "basic-auth-modal-content sm:max-w-[380px]"
 };
 const props = defineProps({
   modelValue: { type: Boolean, required: true }

package/dist/runtime/components/BasicAuthUserMenu.client.d.vue.ts

@@ -1,6 +1,9 @@
+import { type AuthUiLayout } from '../lib/auth-ui-layout.js';
 type __VLS_Props = {
     email?: string;
     displayName?: string;
+    /** Explicit host layout — preferred over inject (cross-package inject can miss). */
+    layout?: AuthUiLayout;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "signed-out": () => any;

package/dist/runtime/components/BasicAuthUserMenu.client.vue

@@ -3,9 +3,31 @@
     v-model:open="isOpen"
     portal
     :content="popoverContent"
-    :ui="{ content: 'z-[280] max-w-[240px] p-0 border-none bg-transparent shadow-none' }"
+    :ui="{ content: 'basic-auth-account-popover max-w-[240px] p-0 border-none bg-transparent shadow-none' }"
   >
+    <!-- More sheet: identical anatomy to System .more-row -->
+    <button
+      v-if="isMoreSheetLayout"
+      type="button"
+      class="more-row"
+      aria-label="Account menu"
+    >
+      <span class="more-row-icon more-row-icon--admin" aria-hidden="true">
+        <UIcon name="lucide:user" />
+      </span>
+      <span class="more-row-copy">
+        <span class="more-row-label">Account</span>
+        <span class="more-row-desc">Manage your profile & settings</span>
+      </span>
+      <UIcon
+        name="lucide:chevron-right"
+        class="more-row-chevron"
+        aria-hidden="true"
+      />
+    </button>
+
     <UButton
+      v-else
       v-bind="triggerButtonProps"
       type="button"
       aria-label="Account menu"
@@ -13,7 +35,9 @@
       <template #default>
         <span class="flex flex-col items-center gap-1 w-full">
           <UIcon name="lucide:user" class="h-[18px] w-[18px]" />
-          <span class="sidebar-rail-caption text-[7px] uppercase tracking-wider whitespace-nowrap">
+          <span
+            class="sidebar-rail-caption text-[7px] uppercase tracking-wider whitespace-nowrap"
+          >
             Account
           </span>
         </span>
@@ -24,17 +48,22 @@
       <div
         class="basic-auth-account-menu w-[220px] rounded-[var(--md-border-radius)] border-[length:var(--md-border-width)] border-[color:var(--md-border-color)] bg-[var(--md-surface)] overflow-hidden theme-shadow"
       >
-        <!-- User identity section -->
         <div class="px-4 pt-4 pb-3">
           <div class="flex items-center gap-3">
-            <div class="flex items-center justify-center w-8 h-8 rounded-full bg-[var(--md-success)]/15 text-[var(--md-success)] shrink-0">
+            <div
+              class="flex items-center justify-center w-8 h-8 rounded-full bg-[var(--md-success)]/15 text-[var(--md-success)] shrink-0"
+            >
               <UIcon name="lucide:user" class="w-4 h-4" />
             </div>
             <div class="min-w-0">
-              <p class="text-[10px] uppercase tracking-wider text-[var(--md-on-surface)]/50 mb-0.5">
+              <p
+                class="text-[10px] uppercase tracking-wider text-[var(--md-on-surface)]/50 mb-0.5"
+              >
                 Signed in as
               </p>
-              <p class="text-xs font-medium text-[var(--md-on-surface)] break-all leading-tight">
+              <p
+                class="text-xs font-medium text-[var(--md-on-surface)] break-all leading-tight"
+              >
                 {{ email }}
               </p>
             </div>
@@ -43,14 +72,16 @@
 
         <div class="h-[var(--md-border-width)] bg-[var(--md-border-color)] mx-3" />
 
-        <!-- Actions -->
         <div class="p-2 space-y-1">
           <button
             type="button"
             class="w-full flex items-center gap-2.5 px-3 py-2 text-sm text-[var(--md-on-surface)] rounded-[var(--md-border-radius)] hover:bg-[var(--md-surface-hover)] active:bg-[var(--md-surface-active)] transition-colors text-left"
             @click="onChangePassword"
           >
-            <UIcon name="lucide:key-round" class="w-4 h-4 text-[var(--md-on-surface)]/60 shrink-0" />
+            <UIcon
+              name="lucide:key-round"
+              class="w-4 h-4 text-[var(--md-on-surface)]/60 shrink-0"
+            />
             Change Password
           </button>
 
@@ -74,9 +105,13 @@ import { computed, inject, ref, unref } from "vue";
 import {
   AUTH_UI_POPOVER_CONTENT_KEY
 } from "../lib/auth-ui-popover";
-defineProps({
+import {
+  AUTH_UI_LAYOUT_KEY
+} from "../lib/auth-ui-layout";
+const props = defineProps({
   email: { type: String, required: false },
-  displayName: { type: String, required: false }
+  displayName: { type: String, required: false },
+  layout: { type: String, required: false }
 });
 const emit = defineEmits(["signed-out", "change-password"]);
 const isOpen = ref(false);
@@ -91,6 +126,10 @@ const injectedPopoverContent = inject(
   AUTH_UI_POPOVER_CONTENT_KEY,
   null
 );
+const injectedLayout = inject(AUTH_UI_LAYOUT_KEY, null);
+const isMoreSheetLayout = computed(
+  () => props.layout === "more-sheet" || (injectedLayout ? unref(injectedLayout) : "rail") === "more-sheet"
+);
 const popoverContent = computed(() => ({
   ...DEFAULT_POPOVER_CONTENT,
   ...injectedPopoverContent ? unref(injectedPopoverContent) : null
@@ -121,3 +160,7 @@ async function onSignOut() {
   }
 }
 </script>
+
+<style>
+.basic-auth-account-popover,[data-reka-popper-content-wrapper]:has(.basic-auth-account-menu){z-index:100!important}
+</style>

package/dist/runtime/components/BasicAuthUserMenu.client.vue.d.ts

@@ -1,6 +1,9 @@
+import { type AuthUiLayout } from '../lib/auth-ui-layout.js';
 type __VLS_Props = {
     email?: string;
     displayName?: string;
+    /** Explicit host layout — preferred over inject (cross-package inject can miss). */
+    layout?: AuthUiLayout;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "signed-out": () => any;

package/dist/runtime/components/SidebarAuthButtonBasic.client.d.vue.ts

@@ -1,2 +1,7 @@
-declare const _default: import("vue").DefineComponent<{}, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+import { type AuthUiLayout } from '../lib/auth-ui-layout.js';
+type __VLS_Props = {
+    /** Explicit host layout — preferred over inject (cross-package inject can miss). */
+    layout?: AuthUiLayout;
+};
+declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/components/SidebarAuthButtonBasic.client.vue

@@ -4,10 +4,32 @@
       v-if="isSignedIn"
       :email="sessionUser?.email"
       :display-name="sessionUser?.displayName"
+      :layout="resolvedLayout"
       @signed-out="onSignedOut"
       @change-password="changePasswordModalOpen = true"
     />
 
+    <button
+      v-else-if="isMoreSheetLayout"
+      type="button"
+      class="more-row"
+      aria-label="Login"
+      @click="signInModalOpen = true"
+    >
+      <span class="more-row-icon more-row-icon--admin" aria-hidden="true">
+        <UIcon name="lucide:log-in" />
+      </span>
+      <span class="more-row-copy">
+        <span class="more-row-label">Login</span>
+        <span class="more-row-desc">Manage your profile & settings</span>
+      </span>
+      <UIcon
+        name="lucide:chevron-right"
+        class="more-row-chevron"
+        aria-hidden="true"
+      />
+    </button>
+
     <UButton
       v-else
       v-bind="loginButtonProps"
@@ -18,7 +40,9 @@
       <template #default>
         <span class="flex flex-col items-center gap-1 w-full">
           <UIcon name="lucide:log-in" class="h-[18px] w-[18px]" />
-          <span class="sidebar-rail-caption text-[7px] uppercase tracking-wider whitespace-nowrap">
+          <span
+            class="sidebar-rail-caption text-[7px] uppercase tracking-wider whitespace-nowrap"
+          >
             Login
           </span>
         </span>
@@ -45,14 +69,20 @@
 </template>
 
 <script setup>
-import { computed, nextTick, onMounted, ref } from "vue";
+import { computed, inject, nextTick, onMounted, ref, unref } from "vue";
 import { useRuntimeConfig } from "#imports";
 import { BASIC_AUTH_PROVIDER_ID } from "../lib/constants";
+import {
+  AUTH_UI_LAYOUT_KEY
+} from "../lib/auth-ui-layout";
 import { silentRefreshOnce } from "../lib/silent-refresh.client";
 import BasicAuthSignInModal from "./BasicAuthSignInModal.client.vue";
 import BasicAuthRegisterModal from "./BasicAuthRegisterModal.client.vue";
 import BasicAuthUserMenu from "./BasicAuthUserMenu.client.vue";
 import BasicAuthChangePasswordModal from "./BasicAuthChangePasswordModal.client.vue";
+const props = defineProps({
+  layout: { type: String, required: false }
+});
 const runtimeConfig = useRuntimeConfig();
 const signInModalOpen = ref(false);
 const registerModalOpen = ref(false);
@@ -95,6 +125,16 @@ const isSignedIn = computed(
   () => session.value?.authenticated === true && session.value.provider === BASIC_AUTH_PROVIDER_ID
 );
 const sessionUser = computed(() => session.value?.user);
+const injectedLayout = inject(AUTH_UI_LAYOUT_KEY, null);
+const resolvedLayout = computed(() => {
+  if (props.layout === "more-sheet" || props.layout === "rail") {
+    return props.layout;
+  }
+  return injectedLayout ? unref(injectedLayout) : "rail";
+});
+const isMoreSheetLayout = computed(
+  () => resolvedLayout.value === "more-sheet"
+);
 const loginButtonProps = {
   block: true,
   variant: "ghost",
@@ -135,3 +175,7 @@ onMounted(() => {
   void refreshSession();
 });
 </script>
+
+<style>
+.basic-auth-modal-content,.basic-auth-modal-overlay{z-index:100!important}
+</style>

package/dist/runtime/components/SidebarAuthButtonBasic.client.vue.d.ts

@@ -1,2 +1,7 @@
-declare const _default: import("vue").DefineComponent<{}, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<{}> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+import { type AuthUiLayout } from '../lib/auth-ui-layout.js';
+type __VLS_Props = {
+    /** Explicit host layout — preferred over inject (cross-package inject can miss). */
+    layout?: AuthUiLayout;
+};
+declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/lib/auth-ui-layout.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Host apps can inject a layout mode so auth triggers match the surface
+ * (sidebar rail tiles vs mobile More sheet list rows).
+ */
+export type AuthUiLayout = 'rail' | 'more-sheet';
+/** String key so host app + provider package can share without a linked import. */
+export declare const AUTH_UI_LAYOUT_KEY = "or3:auth-ui-layout";

package/dist/runtime/lib/auth-ui-layout.js

@@ -0,0 +1 @@
+export const AUTH_UI_LAYOUT_KEY = "or3:auth-ui-layout";

package/dist/runtime/password-policy.d.ts

@@ -0,0 +1,2 @@
+export declare const MAX_BCRYPT_PASSWORD_BYTES = 72;
+export declare function newPasswordFitsBcrypt(password: string): boolean;

package/dist/runtime/password-policy.js

@@ -0,0 +1,4 @@
+export const MAX_BCRYPT_PASSWORD_BYTES = 72;
+export function newPasswordFitsBcrypt(password) {
+  return new TextEncoder().encode(password).length <= MAX_BCRYPT_PASSWORD_BYTES;
+}

package/dist/runtime/server/api/basic-auth/_helpers.js

@@ -18,6 +18,9 @@ export async function parseBodyWithSchema(event, schema) {
     const firstIssue = result.error.issues[0];
     const path = firstIssue?.path?.join(".") || "input";
     const detail = firstIssue?.message || "Invalid request";
+    if (detail === "Password must be 72 UTF-8 bytes or fewer.") {
+      throw createError({ statusCode: 400, statusMessage: detail });
+    }
     if (path === "password" || path === "confirmPassword") {
       throw createError({
         statusCode: 400,

package/dist/runtime/server/api/basic-auth/change-password.post.js

@@ -11,11 +11,16 @@ import {
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
 import { basicAuthProvider } from "../../auth/basic-auth-provider.js";
 import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.js";
+import { newPasswordFitsBcrypt } from "../../../password-policy.js";
 const changePasswordSchema = z.object({
   // Existing accounts may have legacy short passwords; only new password is length-enforced.
   currentPassword: z.string().min(1).max(512),
-  newPassword: z.string().min(8).max(512),
-  confirmNewPassword: z.string().min(8).max(512)
+  newPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
+  confirmNewPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  })
 }).refine((input) => input.newPassword === input.confirmNewPassword, {
   message: "Passwords must match"
 });

package/dist/runtime/server/api/basic-auth/register.post.js

@@ -23,11 +23,16 @@ import {
   getSessionMetadataFromEvent
 } from "../../lib/session-store.js";
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
+import { newPasswordFitsBcrypt } from "../../../password-policy.js";
 import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.js";
 const registerSchema = z.object({
   email: z.string().email().max(320),
-  password: z.string().min(8).max(512),
-  confirmPassword: z.string().min(8).max(512),
+  password: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
+  confirmPassword: z.string().min(8).max(512).refine(newPasswordFitsBcrypt, {
+    message: "Password must be 72 UTF-8 bytes or fewer."
+  }),
   displayName: z.string().trim().min(1).max(120).optional(),
   inviteToken: z.string().trim().min(1).max(4096).optional()
 }).refine((value) => value.password === value.confirmPassword, {

package/dist/runtime/server/api/basic-auth/sign-out.post.js

@@ -1,4 +1,5 @@
 import { defineEventHandler } from "h3";
+import { revokeHostActivationsForUser } from "~~/server/utils/plugins/isolation/activation-registry";
 import { clearAuthCookies } from "../../lib/cookies.js";
 import {
   getAccessTokenFromEvent,
@@ -7,26 +8,60 @@ import {
   verifyRefreshToken
 } from "../../lib/jwt.js";
 import { enforceBasicAuthRateLimit } from "../../lib/rate-limit.js";
-import { revokeSessionById } from "../../lib/session-store.js";
+import {
+  findAccountById,
+  findUsableSessionInChain,
+  revokeSessionChain
+} from "../../lib/session-store.js";
 import { enforceMutationOriginPolicy } from "../../lib/request-security.js";
 import { assertBasicAuthReady, noStore } from "./_helpers.js";
+async function resolveSignOutUserId(event) {
+  const accessToken = getAccessTokenFromEvent(event);
+  if (accessToken) {
+    const claims = await verifyAccessToken(accessToken);
+    if (claims && findUsableSessionInChain(claims.sid)) {
+      const account = findAccountById(claims.sub);
+      if (account && account.token_version === claims.ver) {
+        return account.id;
+      }
+    }
+  }
+  const refreshToken = getRefreshTokenFromEvent(event);
+  if (refreshToken) {
+    const claims = await verifyRefreshToken(refreshToken);
+    if (claims && findUsableSessionInChain(claims.sid)) {
+      const account = findAccountById(claims.sub);
+      if (account && account.token_version === claims.ver) {
+        return account.id;
+      }
+    }
+  }
+  return null;
+}
 export async function handleSignOut(event) {
   assertBasicAuthReady(event);
   noStore(event);
   enforceMutationOriginPolicy(event);
   enforceBasicAuthRateLimit(event, "basic-auth:sign-out");
+  try {
+    const userId = await resolveSignOutUserId(event);
+    if (userId) {
+      revokeHostActivationsForUser(userId, "logout");
+    }
+  } catch {
+  }
   const refreshToken = getRefreshTokenFromEvent(event);
   if (refreshToken) {
     const refreshClaims = await verifyRefreshToken(refreshToken);
     if (refreshClaims) {
-      revokeSessionById(refreshClaims.sid);
+      revokeSessionChain(refreshClaims.sid);
     }
   }
   const accessToken = getAccessTokenFromEvent(event);
   if (accessToken) {
     const accessClaims = await verifyAccessToken(accessToken);
     if (accessClaims) {
-      revokeSessionById(accessClaims.sid);
+      revokeSessionChain(accessClaims.sid);
     }
   }
   clearAuthCookies(event);

package/dist/runtime/server/lib/cookies.d.ts

@@ -1,4 +1,6 @@
 import { type H3Event } from 'h3';
+export declare function accessCookieName(): string;
+export declare function refreshCookieName(): string;
 export declare function setAccessCookie(event: H3Event, token: string, maxAgeSeconds: number): void;
 export declare function setRefreshCookie(event: H3Event, token: string, maxAgeSeconds: number): void;
 export declare function clearAuthCookies(event: H3Event): void;

package/dist/runtime/server/lib/cookies.js

@@ -9,6 +9,14 @@ import {
 function isProduction() {
   return process.env.NODE_ENV === "production";
 }
+export function accessCookieName() {
+  const scope = process.env.OR3_PLUGIN_DEV_COOKIE_SCOPE;
+  return scope ? `${ACCESS_COOKIE_NAME}_${scope}` : ACCESS_COOKIE_NAME;
+}
+export function refreshCookieName() {
+  const scope = process.env.OR3_PLUGIN_DEV_COOKIE_SCOPE;
+  return scope ? `${REFRESH_COOKIE_NAME}_${scope}` : REFRESH_COOKIE_NAME;
+}
 function refreshCookieBase() {
   return {
     httpOnly: true,
@@ -17,7 +25,7 @@ function refreshCookieBase() {
   };
 }
 export function setAccessCookie(event, token, maxAgeSeconds) {
-  setCookie(event, ACCESS_COOKIE_NAME, token, {
+  setCookie(event, accessCookieName(), token, {
     httpOnly: true,
     sameSite: "lax",
     secure: isProduction(),
@@ -26,28 +34,28 @@ export function setAccessCookie(event, token, maxAgeSeconds) {
   });
 }
 export function setRefreshCookie(event, token, maxAgeSeconds) {
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: LEGACY_REFRESH_COOKIE_PATH
   });
-  setCookie(event, REFRESH_COOKIE_NAME, token, {
+  setCookie(event, refreshCookieName(), token, {
     ...refreshCookieBase(),
     path: REFRESH_COOKIE_PATH,
     maxAge: maxAgeSeconds
   });
 }
 export function clearAuthCookies(event) {
-  deleteCookie(event, ACCESS_COOKIE_NAME, {
+  deleteCookie(event, accessCookieName(), {
     httpOnly: true,
     sameSite: "lax",
     secure: isProduction(),
     path: ACCESS_COOKIE_PATH
   });
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: REFRESH_COOKIE_PATH
   });
-  deleteCookie(event, REFRESH_COOKIE_NAME, {
+  deleteCookie(event, refreshCookieName(), {
     ...refreshCookieBase(),
     path: LEGACY_REFRESH_COOKIE_PATH
   });

package/dist/runtime/server/lib/jwt.js

@@ -1,7 +1,7 @@
 import { randomUUID, createHash } from "node:crypto";
 import { getCookie } from "h3";
 import jwt from "jsonwebtoken";
-import { ACCESS_COOKIE_NAME, REFRESH_COOKIE_NAME } from "../../lib/constants.js";
+import { accessCookieName, refreshCookieName } from "./cookies.js";
 import { getBasicAuthConfig } from "./config.js";
 export async function signAccessToken(input) {
   const config = getBasicAuthConfig();
@@ -67,10 +67,10 @@ export async function verifyRefreshToken(token) {
   }
 }
 export function getAccessTokenFromEvent(event) {
-  return getCookie(event, ACCESS_COOKIE_NAME) ?? null;
+  return getCookie(event, accessCookieName()) ?? null;
 }
 export function getRefreshTokenFromEvent(event) {
-  return getCookie(event, REFRESH_COOKIE_NAME) ?? null;
+  return getCookie(event, refreshCookieName()) ?? null;
 }
 export function hashRefreshToken(token) {
   return createHash("sha256").update(token).digest("hex");

package/dist/runtime/server/lib/password.js

@@ -1,6 +1,10 @@
 import bcrypt from "bcryptjs";
+import { newPasswordFitsBcrypt } from "../../password-policy.js";
 const PASSWORD_COST = 12;
 export async function hashPassword(password) {
+  if (!newPasswordFitsBcrypt(password)) {
+    throw new RangeError("New passwords must be 72 UTF-8 bytes or fewer.");
+  }
   return await bcrypt.hash(password, PASSWORD_COST);
 }
 export async function verifyPassword(password, hash) {

package/dist/runtime/server/lib/session-store.d.ts

@@ -61,6 +61,14 @@ export declare function ensureBootstrapAccount(input: CreateAccountInput): Basic
 export declare function createAuthSession(input: CreateSessionInput): BasicAuthSession;
 export declare function findSessionById(sessionId: string): BasicAuthSession | null;
 export declare function revokeSessionById(sessionId: string, revokedAtMs?: number): void;
+/**
+ * Revoke a session and every successor it was rotated into, clearing rotation
+ * grace on each. A replayed rotated refresh token therefore cannot recover its
+ * successor after sign-out.
+ */
+export declare function revokeSessionChain(sessionId: string, revokedAtMs?: number): void;
+/** First usable session walking from `sessionId` through rotation successors. */
+export declare function findUsableSessionInChain(sessionId: string): BasicAuthSession | null;
 export declare function revokeAllSessionsForAccount(accountId: string, revokedAtMs?: number): void;
 export declare function rotateSession(input: RotationInput): RotationResult;
 export declare function updatePasswordAndRevokeSessions(accountId: string, newPasswordHash: string): void;

package/dist/runtime/server/lib/session-store.js

@@ -140,6 +140,36 @@ export function revokeSessionById(sessionId, revokedAtMs = Date.now()) {
     "UPDATE basic_auth_sessions SET revoked_at = COALESCE(revoked_at, ?) WHERE id = ?"
   ).run(revokedAtMs, sessionId);
 }
+export function revokeSessionChain(sessionId, revokedAtMs = Date.now()) {
+  const db = getBasicAuthDb();
+  db.transaction(() => {
+    const visited = /* @__PURE__ */ new Set();
+    let currentId = sessionId;
+    while (currentId && !visited.has(currentId)) {
+      visited.add(currentId);
+      const session = findSessionById(currentId);
+      if (!session) break;
+      db.prepare(
+        `UPDATE basic_auth_sessions
+         SET revoked_at = COALESCE(revoked_at, ?),
+             rotation_grace_until = NULL,
+             rotation_grace_refresh_token = NULL
+         WHERE id = ?`
+      ).run(revokedAtMs, currentId);
+      currentId = session.replaced_by_session_id;
+    }
+  })();
+}
+export function findUsableSessionInChain(sessionId) {
+  const visited = /* @__PURE__ */ new Set();
+  let current = findSessionById(sessionId);
+  while (current && !visited.has(current.id)) {
+    if (isSessionUsable(current)) return current;
+    visited.add(current.id);
+    current = current.replaced_by_session_id ? findSessionById(current.replaced_by_session_id) : null;
+  }
+  return null;
+}
 export function revokeAllSessionsForAccount(accountId, revokedAtMs = Date.now()) {
   const db = getBasicAuthDb();
   db.prepare(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "or3-provider-basic-auth",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Saluana/or3-provider-basic-auth.git"